Privacy Policy

Contact details of the controller

True North Consulting Pamax UG (haftungsbeschränkt)
An den Röthen 20, 61381 Friedrichsdorf, Germany
Email: kontakt@truenorth-consulting.de
Website: www.truenorth-consulting.de
Represented by: Patrick Barme – Managing Director, Max de Boer – Managing Director

Data protection officer

In accordance with Art. 37 GDPR in conjunction with § 38 BDSG, we are not obliged to appoint a data protection officer. If you have any questions about data protection or wish to exercise your rights listed below, you can of course contact us at any time using the contact details above.

Types of data processed

The following data may be collected from you, or obtained through your visit:

• Address data: first name, last name
• Content data: text input
• Contact data: phone number, mobile number, email address
• Other data: qualification data, time-tracking data
• Technical data: device information, IP address, log data, protocol files
• Behavioral data: frequency of website access, interest in website content, click behavior, access times, reading times

Purpose of processing

Your data is collected for various reasons. Primarily, the collection enables us to provide our online offering in the form of our website. Certain functions and content can only be provided with the help of your data. Furthermore, the collection enables us to analyze user behavior in order to create a better visitor experience and to analyze and optimize our own web presence. Data is also collected via the contact form so that we can process and answer your inquiries and suggestions. The same applies to comment functions. Finally, the data also allows us to take various security measures to make our website safer.

In summary: analysis of our own web presence, analysis of user behavior, adaptation of security measures, optimization of the web presence, handling of application inquiries, provision of the website and the entire online offering, simplified contact.

Cookies

The websites of True North Consulting Pamax UG (haftungsbeschränkt) use cookies. Cookies are text files that are stored on a computer system via a web browser. Many cookies contain a so-called cookie ID – a unique identifier consisting of a character string by which websites and servers can be assigned to the specific browser in which the cookie was stored. This allows visited websites and servers to distinguish the individual browser of the data subject from other browsers containing other cookies. Through the use of cookies, True North Consulting Pamax UG (haftungsbeschränkt) can provide users of this website with more user-friendly services that would not be possible without them. You can prevent the setting of cookies by our website at any time via a corresponding setting in your browser and thus permanently object to the setting of cookies.

Contact form

When you get in touch (via contact form, email, phone or social media), your details are processed to handle the inquiry in accordance with Art. 6 para. 1 lit. b GDPR (contractual/pre-contractual relationships) and Art. 6 para. 1 lit. f GDPR (other inquiries). This information may be stored in a customer relationship management system (CRM) or comparable inquiry organization. We delete inquiries as soon as they are no longer necessary; necessity is reviewed every two years, and statutory archiving obligations apply.

The technical processing of data submitted via this website's contact form is handled by Netlify Forms (Netlify Inc., San Francisco, USA). For more information, see the Netlify privacy policy.

Booking a call via Google Calendar

To book a call, we use the appointment scheduling of Google Calendar, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The scheduling page only loads once you click "Show available times". Depending on your screen size, it is then embedded on our website or opened in a new browser tab. Your browser connects to Google's servers in the process, so Google receives, among other things, your IP address and the information that you opened the booking page. Loading the scheduling page is based on our legitimate interest in simple online appointment booking under Art. 6 para. 1 lit. f GDPR.

When you book an appointment, we process the details you enter there (first and last name, email address and any further voluntary information) and the selected time in order to arrange and hold the call. You receive a booking confirmation by email with the link to the Google Meet video call. The legal basis is Art. 6 para. 1 lit. b GDPR (pre-contractual measures at your request). The booking data is stored in our calendar and deleted as soon as it is no longer needed to initiate or carry out a business relationship; statutory retention obligations remain unaffected.

A transfer of data to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework. For more information, see the Google privacy policy.

Legal basis under Art. 6 ff. GDPR

In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. Unless stated otherwise in this privacy policy, the following applies: the legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 GDPR; for processing to fulfill our services, carry out contractual measures and answer inquiries, Art. 6 para. 1 lit. b GDPR; for processing to fulfill our legal obligations, Art. 6 para. 1 lit. c GDPR; and for processing to protect our legitimate interests, Art. 6 para. 1 lit. f GDPR. If vital interests of the data subject or another natural person require processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.

Security measures

Taking into account Art. 32 GDPR and the state of the art, we implement appropriate technical and organizational measures to minimize the risk of unlawful handling of your personal data — including safeguarding the confidentiality, integrity and availability of your data through physical access controls to buildings and data carriers, separation of data categories, control of access and disclosure rights, and more.

Storage period of personal data

We may only retain and store your personal data on the basis of statutory periods. After expiry of such a period, we are obliged to delete your personal data unless it is still required for the performance of a contract or the initiation of a new contract, in which case our lawful claim under Art. 6 GDPR applies. We must also comply with certain statutory periods that prescribe longer retention.

Consent via the cookie banner

We only use Google Analytics, Google Ads, HubSpot and the LinkedIn and Meta ad pixels if you click “Accept” in the cookie banner when visiting our website. As long as you have not consented, none of these services is loaded, none of these providers sets cookies and no data is sent to them. The legal basis for accessing your device is Section 25 (1) TDDDG (German Telecommunications Digital Services Data Protection Act); the legal basis for the subsequent processing is your consent under Art. 6 para. 1 lit. a GDPR.

We store your choice (“Accept” or “Decline”) in your browser’s local storage so that the banner does not reappear on every page view. This storage is strictly necessary for the website to work (Section 25 (2) no. 2 TDDDG); no data is sent to us or to third parties.

You can withdraw your consent at any time with effect for the future by clicking “Cookie settings” in the footer of our website and choosing “Decline”. The cookies these services have set on our website are then deleted. The lawfulness of processing carried out before the withdrawal remains unaffected.

Google Analytics

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics sets cookies (in particular “_ga” and “_ga_*”, stored for up to 2 years) that allow your browser to be recognised on later visits. Among other things, it records the pages you view, how long you stay, where the visit came from (e.g. an ad or a search engine), information about your browser, operating system and device, your approximate location, and interactions such as submitting our contact form or clicking through to book a call. Google Analytics 4 does not store IP addresses; your IP address is only used briefly to determine your approximate location and is then discarded.

We use this information to evaluate how our website is used and to improve it. The data is deleted automatically after 14 months. The legal basis is your consent under Art. 6 para. 1 lit. a GDPR and Section 25 (1) TDDDG. We have concluded a data processing agreement with Google under Art. 28 GDPR.

A transfer of data to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework. For more information, see Google’s privacy policy.

Google Ads (conversion tracking and remarketing)

With your consent, we also use Google Ads, an advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We run ads on Google and use conversion tracking to measure whether visitors who reached our website through one of our ads then send an enquiry via our contact form. For this, Google sets cookies (e.g. “_gcl_au”, stored for 90 days, and cookies on Google domains such as doubleclick.net, stored for up to 13 months). We only receive statistical reports from Google, such as the number of enquiries after an ad click, and cannot identify you personally from them.

Google Ads remarketing lets us show Varis ads to visitors of our website later on other websites and in Google Search. For this, Google records that your browser has visited our website. If you are signed in to your Google account and have personalised ads turned on, Google may link this information to your account. You can also turn off personalised ads in Google’s ad settings.

The legal basis is your consent under Art. 6 para. 1 lit. a GDPR and Section 25 (1) TDDDG. Google also processes the data partly for its own purposes, for example to improve its advertising services. A transfer of data to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework. For more information, see Google’s overview of how it uses data in advertising.

HubSpot

With your consent, we use HubSpot, marketing and customer relationship management (CRM) software provided by HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland (“HubSpot”). The HubSpot tracking code sets cookies (in particular “__hstc” and “hubspotutk”, stored for 6 months, “__hssc”, stored for 30 minutes, and “__hssrc”, stored for the browser session) that allow your browser to be recognised on later visits. Among other things, it records the pages you view, how long you stay, where the visit came from, information about your browser and device, your IP address and your approximate location.

If you submit one of our contact forms after giving your consent, your details (e.g. name, company, email address, phone number and your request) are also sent to HubSpot and stored there as a contact in our CRM. HubSpot links this contact to your browser’s earlier visits to our website. We use this information to handle your enquiry, to improve our website and our offering, and to understand which content matters to prospective customers. The storage period for the contact details is as described under “Contact form”.

The legal basis is your consent under Art. 6 para. 1 lit. a GDPR and Section 25 (1) TDDDG. We have a data processing agreement with HubSpot under Art. 28 GDPR. The data is stored in a HubSpot data centre in Germany. A transfer of data to HubSpot, Inc. in the USA, for example for analytics and support purposes, still cannot be ruled out; HubSpot, Inc. is certified under the EU-US Data Privacy Framework. For more information, see HubSpot’s privacy policy.

LinkedIn and Meta ad pixels (via HubSpot)

For our ads on LinkedIn and on Facebook and Instagram, we use the ad pixels of these networks with your consent: the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”), and the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). The pixels are added through HubSpot by connecting our ad accounts to HubSpot, and they only load if you have accepted the cookie banner. If we also connect our Google Ads account to HubSpot, the “Google Ads” section applies to it.

The pixels record that your browser has visited our website, which pages you view and whether you send an enquiry. For this, they set cookies (for the LinkedIn Insight Tag e.g. “li_fat_id”, stored for 30 days, and “li_giant”, stored for 7 days; for the Meta Pixel “_fbp”, stored for 90 days; plus cookies on LinkedIn and Meta domains). This lets us measure whether our ads lead to enquiries and show Varis ads to visitors of our website later on LinkedIn, Facebook and Instagram (remarketing). If you are signed in there, the network may link your visit to your account. From the networks we only receive statistical reports and audiences that do not let us identify you personally. If you have sent us your details through a contact form, HubSpot also records which ad brought you to our website.

The legal basis is your consent under Art. 6 para. 1 lit. a GDPR and Section 25 (1) TDDDG. We and the respective network are joint controllers (Art. 26 GDPR) for collecting the data on our website and transmitting it to LinkedIn or Meta; the network alone is responsible for any further processing. The division of duties is set out in LinkedIn’s advertising terms and in Meta’s Controller Addendum. A transfer of data to LinkedIn Corporation or Meta Platforms, Inc. in the USA cannot be ruled out; both are certified under the EU-US Data Privacy Framework. For more information, see LinkedIn’s privacy policy and Meta’s privacy policy.

Google Fonts

We embed fonts ("Google Fonts") from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When you open a page, your browser loads the required web fonts into its cache to display texts and fonts correctly. For this purpose, your browser must connect to Google's servers, giving Google knowledge that our website was accessed via your IP address. The use of Google Web Fonts is based on our legitimate interest in a uniform and appealing presentation of our online offering under Art. 6 para. 1 lit. f GDPR. If your browser does not support web fonts, a standard font from your computer is used.

YouTube

We embed videos from the "YouTube" platform of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We use YouTube in enhanced privacy mode. According to YouTube, no information about visitors is stored on this website before they watch the video. As soon as you start a YouTube video on our website, a connection to YouTube's servers is established, telling the YouTube server which of our pages you have visited. This processor is used on the basis of our legitimate interests under Art. 6 para. 1 lit. f GDPR.

LinkedIn

Functions and content of the "LinkedIn" service, offered by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, may be integrated within our online offering — including images, videos, texts or buttons with which users can share content of this online offering on LinkedIn. The privacy policy can be found at https://www.linkedin.com/legal/privacy-policy. This processor is used on the basis of our legitimate interests under Art. 6 para. 1 lit. f GDPR.

Outbound links

Where we use external links offered within our websites, this privacy policy does not extend to those links. When we offer links, we endeavor to ensure that they also comply with our data protection and security standards. However, we have no influence on other providers' compliance with data protection and security regulations. Please therefore also inform yourself about the privacy policies provided on the websites of other providers.

Your rights as a data subject

You have the following rights:

• Access (Art. 15 GDPR): you can request information about the personal data we process about you.
• Rectification (Art. 16 GDPR): you can request the correction of inaccurate data.
• Erasure (Art. 17 GDPR): you can request the deletion of your data, provided no statutory retention obligations apply.
• Restriction of processing (Art. 18 GDPR): you can request the restriction of the processing of your data.
• Data portability (Art. 20 GDPR): you can request to receive your data in a structured, common format.
• Objection (Art. 21 GDPR): you can object to the processing of your data.
• Withdrawal of consent (Art. 7 para. 3 GDPR): you can withdraw given consent at any time.

You also have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR.

Closing remarks

If you have any further questions, or if you notice incomplete information, please feel free to contact us at any time.