1. Controller and contact

The controller within the meaning of Art. 4 no. 7 GDPR is:

No data protection officer has been appointed. The conditions of § 38 Bundesdatenschutzgesetz (BDSG, the German Federal Data Protection Act) are not met, as fewer than 20 people are permanently engaged in the automated processing of personal data. Please address all data protection matters to the address given above.

2. Principles of processing

Personal data is processed exclusively on the basis of the GDPR, the Bundesdatenschutzgesetz (BDSG, the German Federal Data Protection Act) and the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, the German Telecommunications and Digital Services Data Protection Act). Processing takes place only insofar as it is necessary to deliver the respective service or where consent has been given.

The following legal bases may apply:

• Art. 6 (1) lit. a GDPR, consent, for example for non-essential cookies and for the newsletter
• Art. 6 (1) lit. b GDPR, contract or pre-contractual measures, for example for enquiries and the handling of engagements
• Art. 6 (1) lit. c GDPR, legal obligation, for example for retention periods under commercial and tax law
• Art. 6 (1) lit. f GDPR, legitimate interest, for example for technical security and the prevention of misuse

3. Hosting and provision

3.1 Landing pages and website

The landing pages and web pages are provided via the platform of HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland. In doing so, HubSpot processes the technically necessary connection data on my behalf. The basis for this is a data processing agreement pursuant to Art. 28 GDPR.

3.2 Own web space

Supplementary pages, including this privacy policy and the legal notice, are provided on web space operated by united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. Here, too, a data processing agreement pursuant to Art. 28 GDPR is in place. The servers are located in Germany.

united-domains GmbH in turn engages the following sub-processors, all based in Germany: NorthC Deutschland GmbH (data centre in Nuremberg), IONOS SE (web space servers and domain name servers), Open-Xchange GmbH (e-mail services) and Akamai Technologies GmbH (rerouting of requests during denial-of-service attacks).

The legal basis for operation is the legitimate interest in the secure and efficient provision of the offering pursuant to Art. 6 (1) lit. f GDPR.

4. Server log files

Each time a page is accessed, data transmitted by your browser is collected automatically. The following is recorded:

• truncated or full IP address of the requesting device
• date and time of access
• name and URL of the file retrieved
• volume of data transferred and notification of successful retrieval
• browser type used, operating system and the previously visited page

This data serves to establish the connection, to maintain system security and to analyse faults. The legal basis is Art. 6 (1) lit. f GDPR. The data is not merged with other data sources. At the hosting provider, access logs are either stored in truncated form, meaning the IP address is pseudonymised, or deleted after seven days at the latest.

5. Cookies and consent management

No cookies are set and no access is analysed on the pages at web.1.ki. This also applies to the pages with the embedded form and the embedded appointment calendar. A consent banner is therefore not required there.

5.1 Stored display setting

If you select a different display mode at the foot of the page, for example Comfort or High Contrast, this choice is stored in your browser's local storage so that it is retained when you move to another page.

Neither an identifier nor a time stamp nor any other information is stored, so recognition is not possible. Storage takes place solely because you triggered it yourself and is strictly necessary in order to provide the service you have expressly requested within the meaning of § 25 (2) no. 2 TDDDG. Consent is not required for this. If you do not actively select a display mode, nothing is stored. You can delete the entry at any time via your browser settings or by switching back to “Standard”.

Technically necessary cookies are set without consent on the basis of § 25 (2) no. 2 TDDDG. In the client portal this concerns solely the session cookie required for signing in.

On the landing pages delivered via HubSpot at 1mpact.ai, cookies are used for reach measurement. These are only set after your consent. The legal basis is § 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a GDPR. An overview of the cookies used there, with purpose, provider and duration, can be found in the consent banner.

6. HubSpot as CRM and marketing platform

The HubSpot platform of HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland, is used for customer management, communication, forms and reach measurement. The parent company is HubSpot Inc., 2 Canal Park, Cambridge, Massachusetts 02141, USA.

Depending on use, the following is processed: master data such as name, company, address, e-mail address and telephone number; communication data from e-mail, form and appointment contacts; and usage data such as pages viewed, time spent, source of referral, clicks in e-mails and open rates.

HubSpot uses cookies for this purpose. These are only activated after your consent. The legal basis is § 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a GDPR. Insofar as data is processed to initiate or perform a contractual relationship, the legal basis is Art. 6 (1) lit. b GDPR.

A data processing agreement pursuant to Art. 28 GDPR is in place with HubSpot. Further information can be found in HubSpot's privacy policy at legal.hubspot.com/de/privacy-policy.

7. Contact, forms and data from other sources

7.1 Forms and direct contact

When you use a form or make contact by e-mail or telephone, the data you provide is processed in order to answer your enquiry. Mandatory fields are marked as such; all further details are voluntary.

The legal basis is Art. 6 (1) lit. b GDPR insofar as the enquiry is directed towards a contract, otherwise the legitimate interest in handling enquiries pursuant to Art. 6 (1) lit. f GDPR.

When protected content or content requiring registration is retrieved, a record is additionally kept of which content was retrieved and when. This serves as evidence of access authorisation and to prevent misuse pursuant to Art. 6 (1) lit. f GDPR.

The message form at web.1.ki/kontakt/nachricht.html is technically provided by HubSpot and embedded into our page. First name, last name, e-mail address, company, telephone number and your message are collected. The form does not ask for consent. None is required in order to answer your enquiry; the bases stated in the preceding paragraph apply. You are not added to any newsletter or advertising distribution list as a result; consent for that is requested separately.

Important note on when data is transmitted: because the form is embedded and not loaded only after a click, your browser establishes a connection to HubSpot as soon as this page is opened. Your IP address is transmitted to HubSpot in the process, even if you do not go on to submit the form. Further details on HubSpot as a processor are set out in sections 6 and 12.

7.2 Data not collected from you directly

In the course of initiating business relationships, professional contact data that does not originate from you directly is also processed. This concerns Art. 14 GDPR. The data processed comprises name, position, company, business e-mail address and telephone number, as well as publicly available information on professional background.

The sources are publicly accessible directories and company websites, professional networks such as LinkedIn and Xing, business cards from personal encounters, and referrals from the network, for example within entrepreneurs' associations.

The purpose is the initiation of business contacts in the field of interim management and consulting. The legal basis is the legitimate interest in direct approach in a professional context pursuant to Art. 6 (1) lit. f GDPR. You may object to this processing at any time in accordance with section 15, after which the data will be deleted.

8. Appointment booking

The HubSpot booking tool (Meetings) is used for arranging appointments. Name, e-mail address, the requested appointment and any voluntary details about your enquiry are processed. The legal basis is Art. 6 (1) lit. b GDPR. The appointment data is synchronised with the controller's calendar.

The appointment calendar is embedded into our page at web.1.ki/kontakt/termin.html so that you can complete the booking without switching to a third-party site. As with the message form, this means your browser connects to HubSpot as soon as the page is opened and transmits your IP address, regardless of whether you subsequently book an appointment. If you wish to avoid this, please use one of the other contact routes at 1mpact.ai/cab.

9. Newsletter and information e-mails

The double opt-in procedure is used for sending information e-mails. After you have registered, you will receive an e-mail asking you to confirm. Only then will you be added to the distribution list. The time of registration, the time of confirmation and the IP address are stored as evidence.

The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR in conjunction with § 7 (2) no. 3 UWG (Gesetz gegen den unlauteren Wettbewerb, the German Act Against Unfair Competition). You can withdraw your consent at any time via the unsubscribe link in every e-mail or by message to c@1.ki.

Dispatch takes place via HubSpot. In the course of this, it is analysed whether and when an e-mail was opened and which links were clicked. This analysis serves to tailor the content to actual needs and is covered by your consent.

10. SMS and voice messages

The platform of seven communications GmbH & Co. KG, Willestraße 4 bis 6, 24103 Kiel, Germany, is used for sending short messages (SMS) and voice messages and for validating telephone numbers.

The following data is processed:

• sender and recipient telephone numbers
• name, telephone number and optionally e-mail address from the address book, where maintained there
• content of the messages sent
• traffic and status data such as time stamps, delivery status, the mobile network operator involved and costs

The purpose is the delivery of the message, the traceability of delivery and billing. The legal basis is Art. 6 (1) lit. b GDPR insofar as the message serves to initiate or perform a contractual relationship, for example for appointment confirmations or follow-up questions. For messages with advertising content, the sole basis is your prior express consent pursuant to Art. 6 (1) lit. a GDPR in conjunction with § 7 (2) no. 2 UWG (Gesetz gegen den unlauteren Wettbewerb, the German Act Against Unfair Competition). Without this consent you will not receive any advertising by SMS.

Processing takes place within the European Union. Traffic and status data is deleted after 90 days by default; address book data is retained until deleted by me or until the end of the contract. A data processing agreement pursuant to Art. 28 GDPR, version 2.1, was concluded with seven on 04.08.2026.

seven in turn engages sub-processors. The current list, including registered office and place of processing, is available at seven.io/de/subunternehmer. Should a transfer to a third country be necessary for a sub-processor, seven bases this on an adequacy decision of the European Commission or on the standard contractual clauses.

The mobile network operators involved, which merely forward a message, are not regarded as processors according to the prevailing view. Passing the telephone number to the responsible operator is technically indispensable; without it, a message cannot be delivered.

11. Further integrated services

Apart from HubSpot, the own web space and the message dispatch described under number 10, no third-party services are integrated into the web pages. In particular, no analysis or advertising services such as Google Analytics, Google Tag Manager, LinkedIn Insight Tag or Meta Pixel are used, no video platforms are embedded and no chat or bot services are loaded.

Fonts are delivered locally from the server. No connection to third-party servers is established in order to load fonts.

Should a further service be added in future, this policy will be updated before it is activated.

12. Recipients and processors

Your data is only passed on where this is necessary to perform a contract, where a legal obligation exists or where you have given your consent. Service providers engaged process data exclusively on instruction, on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Tax advisers, legal advisers and banks receive data only to the extent provided for by law, as controllers in their own right.

13. Transfer of data to third countries

In the course of using HubSpot, personal data may be transferred to the USA. The European Commission has adopted an adequacy decision pursuant to Art. 45 GDPR for companies certified under the EU-U.S. Data Privacy Framework. The certification of HubSpot Inc. can be viewed at dataprivacyframework.gov. In addition, the standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR apply. A copy of the safeguards agreed is available on request to c@1.ki.

Despite these safeguards, it cannot be entirely ruled out that US authorities may access data on the basis of the legislation applicable there. Legal protection fully equivalent to the European level cannot be guaranteed in this respect.

14. Retention periods

Personal data is deleted as soon as the purpose of processing ceases to apply and no statutory retention obligation stands in the way. A retention period of six years applies to business letters, and of ten years to accounting records and invoices, pursuant to § 147 Abgabenordnung (AO, the German Fiscal Code) and § 257 Handelsgesetzbuch (HGB, the German Commercial Code).

Traffic and status data from message dispatch is deleted after 90 days, see number 10.

Records of consent are retained for the duration of the consent and for three years thereafter, in order to be able to demonstrate lawfulness.

15. Your rights as a data subject

Beyond this, you have the right at any time to:

• access to the data processed about you pursuant to Art. 15 GDPR
• rectification of inaccurate data pursuant to Art. 16 GDPR
• erasure pursuant to Art. 17 GDPR
• restriction of processing pursuant to Art. 18 GDPR
• data portability pursuant to Art. 20 GDPR
• withdrawal of consent given, with effect for the future, pursuant to Art. 7 (3) GDPR

A message to c@1.ki is sufficient to exercise these rights. The withdrawal of consent does not affect the lawfulness of processing carried out up to the point of withdrawal.

Automated decision-making, including profiling, with legal effect or similarly significant impact pursuant to Art. 22 GDPR does not take place.

Irrespective of this, you have the right to lodge a complaint with a supervisory authority, Art. 77 GDPR. The authority responsible for the controller is:

16. Amendments to this policy

This privacy policy will be adapted as soon as the legal situation, the services used or the purposes of processing change. The version available at the time applies to each new visit.

Last updated: 7 August 2026, most recently amended in respect of cookies and the contact form