Privacy Policy

1. Data controller

Sebastian Keilich
Leadership Recalibration
Hermannstrasse 43d
64285 Darmstadt
Germany

Phone: +49 172 6504547
Email: sebastian@sebastiankeilich.com

You can use these contact details for questions about data protection and to exercise your rights.

2. Website access and hosting

The website is provided through ChatGPT Sites by OpenAI. The contracting entity for this service in the European Economic Area is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. The website is delivered using Cloudflare infrastructure.

When you access the website, technically necessary connection data is processed. This includes, in particular, your IP address, the date and time of access, the page or file requested, device and browser information transmitted by your browser, and, where applicable, the previously visited page. This processing enables the delivery and availability of the website and the detection and prevention of misuse and attacks.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure, stable operation and provision of this information service. Recipients are the hosting provider and its service providers involved in operation, delivery and security.

Website data processed on my behalf is subject to the ChatGPT Sites Data Processing Addendum. It also lists log, usage and device information as possible categories of website data. Technical data is retained according to the purpose of its processing: for as long as required for delivery, operation and security; in connection with a security incident, potentially until the incident has been investigated and resulting claims have been addressed. Statutory retention obligations remain unaffected.

Processing outside the EU or EEA, particularly in the United States, is possible. For such transfers, the agreement with OpenAI provides for a European Commission adequacy decision or EU Standard Contractual Clauses. The terms and safeguards are available in Section 4 of the linked agreement. Further information: OpenAI’s privacy policy.

3. Cookies, analytics and external content

The website counts views of the German and English landing pages and clicks on the booking link and the two email enquiry links. The purpose is to understand how the offer is used and where interest comes from. The server increments a daily counter by language, action, campaign source and, where available from the hosting infrastructure, country and region. The source is identified from a general label in the link or a recognisable referral from LinkedIn. Country and region are approximate values supplied by the hosting infrastructure.

The measurement uses no analytics cookies, browser storage or visitor identifiers. It stores aggregate daily counts without storing IP addresses or individual browsing histories. The counts are processed through the website hosting described in Section 2 and retained to assess the offer. Where personal data is processed for this measurement, the legal basis is Article 6(1)(f) GDPR. The legitimate interest is understanding the use of this offer while minimising data collection. The measurement respects the Do Not Track and Global Privacy Control browser signals. See Section 7 for information about your right to object.

When you access the website, Cloudflare’s infrastructure may set technically necessary cookies, in particular “__cf_bm” (a lifetime of approximately 30 minutes after the last activity) and “cf_clearance” (whose lifetime depends on the Cloudflare configuration). These cookies help detect bots and prevent misuse and attacks. The page code itself sets no cookies and uses neither Local Storage nor Session Storage. The legal bases are Section 25(2), point 2, of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 6(1)(f) GDPR.

Images and design assets are delivered through the website hosting. The website uses system fonts and loads no advertising scripts, embedded scheduling forms, social media plugins or videos.

4. Contact by email or telephone

When you contact me, the information you provide is processed, including your name, email address or telephone number, company and role where applicable, and the content and time of your enquiry. The enquiry buttons open your email application; the website itself contains no contact form and does not store the content you enter in an enquiry.

The data is processed to respond to your enquiry and, where applicable, to prepare for or carry out an engagement. The legal basis is Article 6(1)(b) GDPR when the enquiry concerns a contract or pre-contractual steps. For other enquiries, the basis is Article 6(1)(f) GDPR; the legitimate interest is handling business communication. Technical service providers are used as required for email and communication services.

Enquiry data is deleted when the enquiry has been dealt with and further retention is no longer necessary. Where communication relates to a business relationship, statutory retention obligations apply, or data is required to establish, exercise or defend legal claims, the necessary data remains stored until the respective periods expire.

5. Booking appointments through Calendly

The booking links take you to Calendly’s external website. No Calendly widget is embedded in this website. The page code does not establish a connection to Calendly merely because you visit this website. Only when you click the link do you leave this website and open Calendly’s booking page.

The provider is Calendly LLC, USA. When an appointment is booked, the data processed includes your name, email address, appointment and time-zone information, and any information you voluntarily provide about your enquiry. Calendly also processes technical connection and device data. Booking data is used to schedule, confirm and conduct the agreed conversation and, where applicable, is transmitted to the calendar and email services connected for this purpose.

The legal basis for scheduling an appointment is Article 6(1)(b) GDPR where it serves to initiate or perform a contract; otherwise it is Article 6(1)(f) GDPR, based on the legitimate interest in efficient scheduling. Booking is voluntary. You can alternatively arrange an appointment by email or telephone.

Booking data processed on my behalf is subject to the Data Processing Addendum incorporated into Calendly’s terms. This involves data processing in the USA; the agreement sets out the bases for international transfers, including the EU Standard Contractual Clauses. For Calendly’s processing as an independent controller, and for cookies and settings on the booking page, please refer to Calendly’s privacy notice and the choices offered there.

The deletion criteria in Section 4 apply to appointment and enquiry data that I process. Calendly’s privacy notice describes its retention criteria for data it processes as an independent controller.

6. LinkedIn and other external links

The LinkedIn link is a standard external link. No LinkedIn plugin is loaded. The linked page opens only when you click the link. The respective provider is responsible for processing data there, and its privacy notice applies.

7. Your rights

Subject to the applicable legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where processing is based on consent, you may withdraw that consent at any time with effect for the future; the lawfulness of processing before withdrawal remains unaffected.

Right to object: You may object to processing based on Article 6(1)(f) GDPR, on grounds relating to your particular situation, in accordance with Article 21 GDPR. You may object at any time to processing for direct marketing.

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), particularly in the member state of your habitual residence, place of work or the alleged infringement. The supervisory authority for the controller’s location in Darmstadt is the Hessian Commissioner for Data Protection and Freedom of Information.

8. Provision of data and automated decisions

Providing contact and booking data is voluntary. Without the information needed to respond or confirm an appointment, it may not be possible to process an enquiry or booking. The connection data described in Section 2 is necessary for technical access to the website. I do not use automated decision-making, including profiling, that produces legal or similarly significant effects in connection with this website.