Privacy Policy

General information

The following notes provide a simple overview of what happens to your personal data when you visit this website or get in touch with us. Personal data is any data that can be used to identify you personally. Detailed information can be found in the sections below.

Data collection on this website

Who is responsible for data collection?

Data processing on this website is carried out by the website operator. You will find the operator's contact details in the section "Controller".

How do we collect your data?

Some data is collected when you provide it to us, for example via the contact form, a webinar registration, the M&A Value Calculator, the Threat Dashboard or a job application. Other data is collected automatically or with your consent when you visit the website, mainly technical data such as browser, operating system and time of access.

What do we use your data for?

Some data is collected to ensure the website is provided without errors and securely. Other data is used to process your enquiries, run webinars and recruitment processes, deliver requested content, send our newsletter (only with your consent) and measure reach.

What rights do you have?

You have the right at any time to access, rectification, erasure, restriction of processing, data portability and objection. Details can be found in section 07.

Service providers used

We use third-party services for hosting (Vercel), email delivery (Resend), newsletter and contact management (Mailchimp), appointment booking (HubSpot), web analytics (Plausible, Google Analytics), consent management (Cookiebot) and for email, calendar and video conferencing (Google Workspace). Details are provided in the respective sections.

2.1 Hosting (Vercel)

This website is delivered via the infrastructure of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA ("Vercel"). When you access the website, Vercel processes server log data on our behalf as a technical service provider, in particular your IP address, the path requested, date and time of access, the browser used and the HTTP status code. This data is used solely to provide, secure and troubleshoot the website and is not combined with other data sources.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically secure, stable and efficient provision of this website. We have concluded a data processing agreement with Vercel pursuant to Art. 28 GDPR.

As Vercel is a US company, data is transferred to the USA. The company is certified under the EU-US Data Privacy Framework (DPF). The transfer is therefore based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, the European Commission's Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). Certification can be verified at: https://www.dataprivacyframework.gov/list Privacy notice: https://vercel.com/legal/privacy-notice

2.2 Email, calendar, video conferencing and document storage (Google Workspace)

Provider and contractual basis

We use Google Workspace for email, calendar, video conferencing (Google Meet) and document storage. Our contracting party and processor is Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland (VAT ID IE3668997OH). We have concluded a data processing agreement with Google pursuant to Art. 28(3) GDPR (Cloud Data Processing Addendum). Google processes the data solely on our instructions, is bound by confidentiality obligations, has implemented the technical and organisational measures required by Art. 32 GDPR (certified, among others, under ISO/IEC 27001, 27017 and 27018 as well as SOC 2) and deletes the data at the end of the contract.

Data concerned and purposes

When you email us, submit a form on this website, book an appointment with us, exchange documents with us or take part in a video conference or webinar via Google Meet, the content of your communication and of the documents exchanged, together with the associated metadata (name, email address, time, IP address and, for video conferences, your display name and the audio and video signal for the duration of the conference), are processed in Google Workspace. The purpose is to handle our business communication, deliver engagements and events and document our business transactions. We do not record video conferences or webinars.

Legal basis

The legal basis is Art. 6(1)(b) GDPR where processing serves the performance of a contract or pre-contractual measures with you. Otherwise the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure, available and efficient business communication and in complying with commercial and tax retention obligations (Art. 6(1)(c) GDPR in conjunction with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)).

Storage location and third-country transfer

Our Google Workspace account is configured so that covered customer data is stored and processed in data centres within the European Union (data region "Europe" for data at rest and for data processing). Access from third countries is thereby limited to exceptional cases, such as support requests or Google sub-processors outside the EU. As the parent company Google LLC is based in the USA, a transfer to the USA cannot be entirely excluded. In that event: Google LLC is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023, Art. 45 GDPR); in addition, the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) form part of the data processing agreement. Certification can be verified at: https://www.dataprivacyframework.gov/list

Retention period

We retain business correspondence and documents for the duration of the business relationship and beyond that for as long as statutory retention periods apply (generally six years for commercial letters, eight years for accounting records). Enquiries that do not lead to a business relationship are deleted once they have been fully dealt with. Google's privacy notice: https://cloud.google.com/terms/cloud-privacy-notice

2.3 Fonts

The fonts used on this website (Instrument Serif, Satoshi) are served from our own infrastructure. No connection to Google Fonts or other font providers is established when the page loads.

Data protection

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Controller

The controller responsible for data processing on this website is:

Woodlands Advisory GmbH
Rudolf-Diesel-Str. 11
69115 Heidelberg, Germany

Phone: +49 (0) 151 11405578
Email: management@woodlandsadvisory.com
Privacy enquiries: privacy@woodlandsadvisory.com

For all questions regarding data protection, the exercise of your data subject rights and withdrawals of consent, please contact privacy@woodlandsadvisory.com.

Retention period

Unless a more specific retention period is stated in this privacy policy, your personal data remains with us until the purpose of processing no longer applies. If you assert a justified request for erasure or withdraw consent, your data will be deleted unless there are other legally permissible reasons for retention (e.g. commercial or tax retention periods of six or eight years for business correspondence and accounting records). In that case, deletion takes place once those reasons cease to apply.

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses TLS encryption. You can recognise an encrypted connection by the fact that the browser address line begins with "https://".

No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The evaluations in the M&A Value Calculator and in the Threat Dashboard risk self-check are non-binding initial assessments and have no legal effect on you.

4.1 Contact form

If you send us an enquiry via the contact form, we process the details entered there: name, company, email address, phone number, your request, your role and your message. The details are transmitted to us by email (technical delivery via Resend, see 4.9) and stored in our email mailbox (see 2.2).

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request) or Art. 6(1)(f) GDPR (legitimate interest in handling enquiries). Your data will be deleted once your enquiry has been fully dealt with and no statutory retention obligations apply. Data is not passed on to third parties.

4.2 Job application form

If you apply via our careers form, we process first name, last name, email address, the position applied for and your message. This data is used exclusively for the recruitment process and is transmitted to us by email (see 4.9).

The legal basis is Art. 6(1)(b) GDPR (initiation of an employment relationship) in conjunction with Section 26(1) sentence 1 of the German Federal Data Protection Act (BDSG). If no employment results, we delete your application data no later than six months after the process has ended, unless you have expressly consented to longer storage or we require the data to defend legal claims. Please do not send us special categories of personal data (e.g. health data) unless they are required for the position.

4.3 Webinar registration

To register for a webinar we collect first name, last name, email address, company, role, company type and deal status, and optionally your LinkedIn profile. The details are used to review your registration, send you the access details and run the webinar via Google Meet (see 2.2). The registration is transmitted to us by email (see 4.9).

The legal basis is Art. 6(1)(b) GDPR (delivery of the event you requested). If you additionally tick the unticked box for our updates in the registration form, we will add you to our newsletter after email confirmation (see section 06). Without this consent you will only receive the messages required to run the webinar.

4.4 M&A Value Calculator

The M&A Value Calculator performs all calculations in your browser. Your answers are only transmitted to us when you request the result via the unlock form. We then process your email address, company and role together with your answers and the calculated result (risk band, score, exposure range). These details are transmitted to us by email (see 4.9).

In addition, we create a contact record with your email address and company in our contact management system Mailchimp (see section 06). This record is not used for newsletters or marketing emails unless you have separately consented to the newsletter.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give via the checkbox in the unlock form, and Art. 6(1)(b) GDPR for delivering the result. You may withdraw your consent at any time with effect for the future. After unlocking, we store a proof (email address and timestamp) in your browser's localStorage so that you can access the result for 30 days without unlocking again. The legal basis for this is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The entry never leaves your device and can be deleted at any time via your browser settings.

4.5 Threat Dashboard

To access the protected areas of the Threat Dashboard we collect name, company and email address. We send a one-time code with limited validity to the address provided (technical delivery via Resend, see 4.9). After successful entry we receive a notification of the new access. We create a contact record with your contact details in Mailchimp (see section 06); this record is not used for newsletters or marketing emails unless you have separately consented.

After verification we store a proof (email address and timestamp) in your browser's localStorage to avoid re-verification within 30 days. The legal basis for this is Section 25(2) no. 2 TDDDG. The entry never leaves your device and can be deleted at any time via your browser settings.

If you use the dashboard's risk self-check and request the result, we transmit your email address, your answers and the result to us by email (see 4.9).

The legal basis is Art. 6(1)(b) GDPR (delivery of the content you requested) and Art. 6(1)(f) GDPR (legitimate interest in contacting people who have actively requested specialist content from us). You may object to this processing at any time (see section 07).

4.6 Golf event application

If you apply via the form on the "Golf with the Founder" page, we process name, email address, phone number, company, role, location, handicap and your preferred discussion topic. The details are used to select participants and organise the event and are transmitted to us by email (see 4.9).

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give via the checkbox in the form, and Art. 6(1)(b) GDPR for running the event. The data is deleted after the respective event or after a declined application unless a business relationship results.

4.7 Appointment booking (HubSpot)

To book an introductory call we link to a booking page provided by HubSpot (HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA). If you book an appointment there, the details you enter (name, email address and any further details) are transmitted to HubSpot and stored in our HubSpot account, which is operated in a data centre in the EU. No HubSpot scripts or cookies are loaded on this website itself.

The legal basis is Art. 6(1)(b) GDPR (arranging the appointment you requested). We have concluded a data processing agreement with HubSpot pursuant to Art. 28 GDPR. As HubSpot is a US company, a transfer to the USA cannot be excluded. The company is certified under the EU-US Data Privacy Framework (DPF). The transfer is therefore based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, the European Commission's Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). Certification can be verified at: https://www.dataprivacyframework.gov/list Privacy notice: https://legal.hubspot.com/privacy-policy

4.8 Consent management (Cookiebot)

This website uses Cookiebot as its consent management platform. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot enables the lawful collection, documentation and management of your consent under Art. 7 GDPR in conjunction with Section 25 TDDDG. For this purpose a technically necessary cookie ("CookieConsent") is set which stores your consent decision. Cookiebot also processes your anonymised IP address, the time of consent, your browser URL and a random key to assign the consent.

The legal basis for the cookie is Section 25(2) no. 2 TDDDG (strictly necessary) in conjunction with Art. 6(1)(c) GDPR (obligation to demonstrate consent under Art. 7(1) GDPR). Google services that require consent are only loaded after you agree (Google Consent Mode v2, default "denied"). As Usercentrics A/S is based in the EU, no third-country transfer takes place. Privacy notice: https://www.cookiebot.com/en/privacy-policy/

4.9 Email delivery (Resend)

We use Resend (Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) for the technical delivery of all transactional emails from this website. This covers the notifications from the contact, application, webinar and golf forms, the results of the M&A Value Calculator and the risk self-check, and the one-time codes and access notifications of the Threat Dashboard. Resend uses the data processed solely for delivery.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in reliable and traceable form delivery). We have concluded a data processing agreement with Resend pursuant to Art. 28 GDPR. As Resend is a US company, data is transferred to the USA. The company is certified under the EU-US Data Privacy Framework (DPF). The transfer is therefore based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, the European Commission's Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). Certification can be verified at: https://www.dataprivacyframework.gov/list Privacy notice: https://resend.com/legal/privacy-policy

5.1 Plausible Analytics

This website uses Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia). When a page is accessed, Plausible collects technical data such as the URL accessed, the HTTP referrer, browser and device type and a truncated, non-persistent IP address to determine the approximate location. Plausible sets no cookies, stores no full IP addresses and creates no cross-site user profiles.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly reach measurement). As Plausible operates without accessing information on your device, no consent under Section 25 TDDDG is required. Processing takes place exclusively on servers in the EU. Privacy notice: https://plausible.io/data-policy

5.2 Google Analytics 4

This website uses Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics is only activated after your consent via the consent banner. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Google Analytics sets cookies and collects, among other things, page views, time on site, approximate location, device type and traffic source. Google Analytics 4 does not store IP addresses; they are used only for coarse location determination and then discarded. The data collected is retained for up to 14 months.

The data is transferred to servers of Google LLC in the USA. The company is certified under the EU-US Data Privacy Framework (DPF). The transfer is therefore based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, the European Commission's Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). Certification can be verified at: https://www.dataprivacyframework.gov/list You can withdraw your consent at any time via the consent banner. Privacy notice: https://policies.google.com/privacy

Newsletter

We send updates on IT security, regulation and corporate governance. Registration takes place solely on the basis of your express consent: via the newsletter form with a checkbox you must actively tick, or via the unticked box in the webinar registration form. After registering you will receive an email with a confirmation link (double opt-in). You are only added to the recipient list after confirmation. We log the time of registration and confirmation in order to be able to demonstrate consent.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 7(2) no. 2 of the German Act Against Unfair Competition (UWG). You may withdraw your consent at any time with effect for the future, via the unsubscribe link in every newsletter email or by informal notice to privacy@woodlandsadvisory.com. The lawfulness of processing carried out before withdrawal remains unaffected. After unsubscribing, your email address is removed from the recipient list.

Our newsletters contain a tracking pixel through which Mailchimp evaluates whether and when an email was opened and which links were clicked. This evaluation serves to improve our content and is covered by your consent. If you do not wish to be evaluated, please unsubscribe from the newsletter.

Contact management without newsletter

We store contact details from the M&A Value Calculator (see 4.4) and the Threat Dashboard (see 4.5) in Mailchimp as contact records without newsletter status. These contacts do not receive newsletters or marketing emails unless separate consent has been given. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in orderly contact management); you may object at any time (see section 07).

Third-country transfer

We have concluded a data processing agreement with Mailchimp pursuant to Art. 28 GDPR. As Mailchimp and Intuit are US companies, data is transferred to the USA. The company is certified under the EU-US Data Privacy Framework (DPF). The transfer is therefore based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, the European Commission's Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). Certification can be verified at: https://www.dataprivacyframework.gov/list Privacy notice: https://www.intuit.com/privacy/statement/

Right of access (Art. 15 GDPR)

You have the right to obtain, free of charge and at any time, information about the personal data stored about you. This includes in particular the purposes of processing, the categories of data, the recipients or categories of recipients, the planned retention period, the origin of the data and the existence of automated decision-making.

Right to rectification (Art. 16 GDPR)

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you or the completion of incomplete personal data.

Right to erasure (Art. 17 GDPR)

You may request the erasure of your personal data if the data is no longer necessary for the purpose of processing, consent has been withdrawn, the processing was unlawful or a statutory obligation to erase exists. The right to erasure does not apply where processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of processing of your personal data if you contest the accuracy of the data, the processing is unlawful and you oppose erasure, we no longer need the data but you require it to establish legal claims, or you have objected pursuant to Art. 21 GDPR.

Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller, provided the processing is based on consent or a contract and is carried out by automated means.

Right to object (Art. 21 GDPR)

Withdrawal of consent (Art. 7(3) GDPR)

Where processing is based on consent (e.g. newsletter, Google Analytics, M&A Value Calculator, golf event), you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected. You can withdraw by email to privacy@woodlandsadvisory.com, for the newsletter via the unsubscribe link in every email, and for Google Analytics via the consent banner.

Right to lodge a complaint (Art. 77 GDPR)

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
(State Commissioner for Data Protection and Freedom of Information Baden-Württemberg)
Lautenschlagerstraße 20
70173 Stuttgart, Germany
https://www.baden-wuerttemberg.datenschutz.de/