Privacy

This privacy policy explains the nature, scope and purpose of our processing of personal data on our website and in the services connected to it. Personal data is any data relating to you as a person, for example your name, address, email address or your usage behaviour.

This policy applies to the website conceptm.eu and to the landing pages we operate.

Data processed in the course of our research projects, in particular data of participants in studies, interviews and surveys, is covered by a separate notice that we provide before the respective collection.

The controller responsible for processing your data is:

concept m research + consulting GmbH
Thomas Ebenfeld, Dirk Ziems (Managing Directors)
Konrad-Adenauer-Ufer 39
50668 Cologne
Germany

Phone: +49 221 92359010
Email: info@conceptm.eu

You can reach our data protection officer by email at jtb@cortina-consult.de or by post at the address above, marked “to the data protection officer”.

We process your data on one of the following bases:

Consent, Art. 6(1)(a) GDPR. For all services we load only after you agree in the cookie banner, and for the newsletter.

Performance of a contract and pre-contractual requests, Art. 6(1)(b) GDPR. For enquiries, proposals and the delivery of projects.

Legal obligation, Art. 6(1)(c) GDPR. In particular for retention duties under tax and commercial law and for demonstrating the consent you have given.

Legitimate interest, Art. 6(1)(f) GDPR. For the secure and stable operation of the website and for communicating with prospective clients.

Where we store information on your device or access information already stored there, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies in addition. Apart from strictly necessary operations, we obtain your prior consent for this.

If you are a client, business partner or prospective client, the nature, scope and purpose of the processing follow from the contractual or pre-contractual relationship between us. We then process the data required to answer your enquiry, perform the contract, protect our rights and comply with legal obligations. We tell you which data these are before or at the point of collection.

Data: master data (name, address), contact data (email, phone, postal address), contract data (subject matter, term), payment data (bank details, invoices)
Data subjects: prospective clients, clients, business and contractual partners
Purpose: performance of contractual services, communication, handling enquiries, office administration
Legal basis: Art. 6(1)(b), (c) and (f) GDPR

Where we involve third parties in delivering our services, we do so on the basis of a data processing agreement under Art. 28 GDPR or, where those third parties act as controllers in their own right, under their own privacy notices.

Our website runs on Webflow. When you open a page, your browser transmits technically necessary data to the provider’s servers, where it is stored in log files:

IP address
date and time of access, and time zone difference from Greenwich Mean Time
the page requested and the access status (HTTP status)
the volume of data transferred
browser type and version, operating system
the page from which you reached us (referrer)
the internet service provider of the accessing system

This processing is necessary to deliver the website and to keep it stable and secure.

Provider: Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA
Purpose: provision and delivery of the website, operational security, defence against attacks
Legal basis: Art. 6(1)(f) GDPR
Third country: USA, see the section on transfers to third countries
Privacy policy: webflow.com/legal/privacy

For individual campaigns and events we operate landing pages using the Onepage service. These pages are not hosted on conceptm.eu but on the provider’s infrastructure. Opening them generates the same technically necessary access data described for the hosting of our website. If you enter data into a form on such a page, we process it as described in the section on contacting us and forms.

Provider: Onepage GmbH, Hanauer Landstraße 172, 60314 Frankfurt am Main, Germany
Purpose: provision of landing pages for campaigns and events
Legal basis: Art. 6(1)(f) GDPR; for any analytics and marketing services used there, Art. 6(1)(a) GDPR
Privacy policy: onepage.io/documents/Onepage_GmbH_Datenschutzinformationen_Stand_September_2025_DE.pdf

Cookies are small text files stored on your device. Some are necessary for the website to work, others serve analytics or marketing purposes. Alongside cookies, we and the services we use employ comparable technologies such as local storage and tracking pixels.

We distinguish three categories. Necessary cookies are required to operate the website, for example to store your cookie decision or for security purposes, and are always active. Statistics and analytics cookies serve the measurement and evaluation of usage. Marketing cookies serve the delivery of advertising, the measurement of its success and retargeting.

We use the consent management platform CookieFirst to manage this. On your first visit you choose which categories to allow. Services in the statistics and marketing categories are only loaded after you agree. Your decision is recorded together with the time, the scope of consent and a truncated IP address so that we can demonstrate it. You can change or withdraw your choice at any time via the cookie settings link in the website footer.

Provider: CookieFirst by Digital Data Solutions B.V., Plantage Middenlaan 42a, 1018 DH Amsterdam, Netherlands (Chamber of Commerce no. 75762277)
Purpose: obtaining, managing and demonstrating consent, blocking scripts for which no consent was given
Data: consent status and timestamp, consent ID, truncated IP address, browser and device information
Legal basis: Art. 6(1)(c) GDPR (duty to demonstrate consent under Art. 7(1) GDPR) and Art. 6(1)(f) GDPR
Privacy policy: cookiefirst.com/legal/privacy

If you contact us through a form on our website, by email, by phone or via social networks, we process the data you provide in order to handle your enquiry.

Form submissions are first captured by our website system and then passed on automatically to our CRM system, and in certain cases also to our email marketing system. The services involved are described in the sections on hosting, customer relationship management, automation and the newsletter.

Data: master data (name), contact data (email, phone, company, role), the content of your message, time of submission
Purpose: handling and answering your enquiry, preparing possible cooperation
Legal basis: Art. 6(1)(b) GDPR for pre-contractual and contractual enquiries, otherwise Art. 6(1)(f) GDPR
Retention: until your enquiry has been fully handled, thereafter within the statutory retention periods

Providing the data marked as mandatory is necessary for us to handle your enquiry. Any further information is optional.

Enquiries, contact details and the history of our communication are stored in our CRM system. We use it to handle enquiries in a traceable way, prepare proposals and maintain existing business relationships.

Provider: Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia (commercial register of the Republic of Estonia, no. 11958539), together with the group company Pipedrive, Inc. (USA)
Data: master and contact data, company data, communication history, notes, status of the business relationship
Purpose: handling enquiries, sales and project administration, maintaining the business relationship
Legal basis: Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR
Third country: transfer to the USA possible
Privacy policy: pipedrive.com/en/privacy

To connect our systems, for example to pass a form enquiry to the CRM, we use the automation platform Make. The data concerned passes through the provider’s infrastructure and is stored there briefly for the duration of the operation and for logging purposes.

Provider: Make, operated by Celonis, Inc., One World Trade Center, Floor 87, New York, NY 10007, USA
Data: the content, contact and metadata transferred in each case, execution logs
Purpose: transferring data between our systems, avoiding duplicate manual entry
Legal basis: the same basis as the underlying processing, as a rule Art. 6(1)(b) or (f) GDPR
Third country: USA

We send a newsletter with news, publications, studies and event announcements. Your email address is required to subscribe; further details such as your name or company are optional and serve to address you personally.

Subscription uses a double opt-in procedure. After you sign up, you receive an email containing a confirmation link. We only add you to the list once you click that link. To demonstrate consent, we store the date, time and IP address used at sign-up.

Our newsletter contains tracking pixels and individualised links. These allow us to see whether and when an email was opened and which links were clicked. We use this analysis to improve content and send times. This measurement is part of the consent you give when subscribing.

Provider: ActiveCampaign, LLC, 1 North Dearborn Street, 5th Floor, Chicago, IL 60602, USA
Data: email address, optional details such as name and company, time and IP address of sign-up, open and click behaviour, technical data about the email client used
Purpose: sending the newsletter, demonstrating consent, measuring success and improving content
Legal basis: Art. 6(1)(a) GDPR, and for the record of consent additionally Art. 6(1)(c) GDPR
Third country: USA
Privacy policy: activecampaign.com/legal/privacy-policy

You can unsubscribe at any time and thereby withdraw your consent, using the unsubscribe link in every email or by writing to info@conceptm.eu. After you unsubscribe we delete your data from the mailing list. If you never clicked the confirmation link, we delete the sign-up data one month after the confirmation email was sent. We keep the record of a previously given consent for up to three years after withdrawal in order to defend against claims, and restrict processing to that purpose.

We regularly run webinars and online events. To register you, we collect your name, email address and, where provided, your company and role. Events are delivered via Zoom. The provider processes registration and connection data and, during the event, your audio and, if enabled, video data, chat messages and answers given in polls.

If an event is recorded, we say so beforehand. Recording only starts after that notice, and you decide whether to enable your camera and microphone. Attending without contributing audio or video is possible.

Provider: Zoom Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA. Representative in the EU: Workvivo Limited, 4th Floor, City Quarter, Lapps Quay, Cork, Ireland
Data: registration data, connection and metadata (IP address, device and client information, join and leave times), audio and video data, chat, poll answers, recordings where applicable
Purpose: running and organising the event, providing recordings and materials
Legal basis: Art. 6(1)(b) GDPR for delivering the attendance you requested, for recordings Art. 6(1)(a) GDPR
Third country: USA
Privacy policy: explore.zoom.us/en/privacy

We offer online booking of meetings via Calendly. When you book, the provider processes the data you enter together with your time zone and technical connection data.

Provider: Calendly, Inc., 115 E Main St., Ste A1B, Buford, GA 30518, USA. Representative in the EU: DPO Centre Europe, Friedrichstraße 88, 10117 Berlin, Germany
Data: name, email address, requested time slot, your entries in the booking form, time zone, technical connection data
Purpose: arranging and managing appointments
Legal basis: Art. 6(1)(b) GDPR, as the processing takes place at your request
Third country: USA
Privacy policy: calendly.com/legal/privacy-notice

On our podcast pages we embed the player of our podcast host Podigee. When the player loads, your browser establishes a direct connection to the provider’s servers and transmits your IP address in the process. The provider evaluates requests statistically in order to determine play counts and may store information on your device in this context.

Provider: Podigee GmbH, Revaler Straße 28, 10245 Berlin, Germany
Data: IP address, time of the request, episode and audio file requested, browser and device information, playback progress, volume of data transferred
Purpose: provision of the player and delivery of the audio files, determining play counts
Legal basis: Art. 6(1)(f) GDPR for delivering the content you requested. Where the player stores or accesses information on your device, additionally Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG [to be settled by the data protection officer and reduced to one basis]
Privacy policy: podigee.com/de/about/privacy

We load the following services only after you consent in the statistics category.

Google Analytics 4

We use Google Analytics to evaluate how our website is used. The service records, in pseudonymised form, which pages are opened, how long visits last, which sources bring users to us and which devices are used. For this purpose an identifier assigned to your browser or device is stored. Your IP address is truncated by Google before storage, or not logged at all. We do not ourselves link this data directly to you. Identification nevertheless cannot be ruled out in every case, in particular if you are signed in to a Google account.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Data: pseudonymous usage identifier, pages viewed, time on page, referrer, device, browser and operating system information, approximate location (country and region), truncated IP address
Purpose: audience measurement, analysis of usage behaviour, improvement of content and services
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG
Retention: 14 months from the last event
Third country: transfer to the USA possible
Privacy policy: policies.google.com/privacy

Microsoft Clarity

We use Microsoft Clarity to analyse how our pages are actually used. The service records mouse movements, scroll depth, clicks and page changes, and generates heatmaps and replays of individual sessions from them. Text entered into form fields is masked by the provider by default and is not transmitted in clear text.

Provider: for users in the European Economic Area, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, is the controller together with Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA
Data: usage data (mouse movements, clicks, scrolling, page views, time on page), device, browser and operating system information, truncated IP address, pseudonymous session identifier
Purpose: analysis of usage, identifying usability problems, improving the website
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG
Third country: USA
Privacy policy: privacy.microsoft.com/en-us/privacystatement

We load the following services only after you consent in the marketing category.

We advertise our services and events on external platforms. For this purpose the providers named below set cookies or tracking pixels that measure whether a click on an advert led to an action on our website, for example an enquiry or a newsletter sign-up. On this basis the providers also build audiences in order to show you our adverts again (retargeting) or to address comparable users.

The data collected includes in particular the page you visited, the referring page, the time, device and browser information, and your IP address. If you are signed in to an account with the relevant network, the provider may associate this information with your profile. The reports we receive are aggregated and do not allow conclusions about individual people.

Google Ads

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Purpose: conversion tracking and remarketing for our adverts in the Google advertising network
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG
Privacy policy: policies.google.com/privacy
Ad settings: adssettings.google.com

LinkedIn Insight Tag

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Parent company: LinkedIn Corporation, USA
Purpose: measuring conversions from LinkedIn adverts, building audiences for retargeting
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG
Privacy policy: linkedin.com/legal/privacy-policy
Objection: linkedin.com/psettings/guest-controls/retargeting-opt-out

Meta Pixel

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Parent company: Meta Platforms, Inc., USA
Purpose: measuring conversions from adverts on Facebook and Instagram, building audiences for retargeting
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG
Privacy policy: facebook.com/privacy/policy
Ad settings: facebook.com/settings

For the joint processing involved in the Meta Pixel we have entered into a joint controller arrangement with Meta under Art. 26 GDPR. It provides that Meta is responsible for enabling you to exercise your rights in respect of the data stored at Meta.

We load the following services only after you consent in the marketing category.

We want to know which companies visit our website so that we can target our content and our outreach more precisely. To this end we use services that match your IP address against a database and derive from it which company or network operator it belongs to. In this way we learn the name of the company, general company details such as industry and size, and which pages were opened from that network.

These services are aimed at companies, not at individual people. Because the IP address and the associated page views may nevertheless constitute personal data, and because the services store information on your device, we only load them after you consent.

Leadinfo

Provider: Leadinfo // Team.blue GmbH, Bunsenstr. 19, 40215 Düsseldorf, Germany (commercial register HRB 100147)
Data: IP address and the company information derived from it, pages viewed, time and duration of visits, device and browser information
Purpose: identifying visiting companies, evaluating interest in our content
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG
Privacy policy: leadinfo.com/en/legal/privacy-policy

Pipedrive Web Visitors

The Web Visitors feature of our CRM system works on the same principle. It is delivered technically by a further service provider.

Provider: Pipedrive OÜ (see the section on customer relationship management), technical service provider: Dealfront Finland Oy, Finland, which is a joint controller for this purpose together with Dealfront Group GmbH, Durlacher Allee 73, 76131 Karlsruhe, Germany
Data: IP address and the company information derived from it, pages viewed, visit times, cookie identifiers (including _lfa and _lfa_expiry)
Purpose: identifying visiting companies, matching website visits to existing CRM contacts
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG
Privacy policy: pipedrive.com/en/privacy and marketing.dealfront.com/privacy-information-for-data-subjects-de.pdf

Some of the services we use are operated by companies based in the United States or process data there. In those cases we rely on one of the following safeguards:

the European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, where the provider concerned is certified under it, Art. 45 GDPR
the European Commission’s standard contractual clauses together with supplementary protective measures, Art. 46(2)(c) GDPR

We point out that in third countries access to data by government authorities cannot be excluded to the same extent as in the European Union, and that enforcing your rights there may be more difficult. Where we transfer data to a third country on the basis of your consent, we additionally rely on Art. 49(1)(a) GDPR.

We delete your data as soon as the purpose of the processing no longer applies and no legal basis remains, as well as when you withdraw a consent you have given or effectively object to processing based on our legitimate interest.

Where we must retain data beyond that point, we delete it only after the relevant period has expired and restrict processing to that purpose in the meantime. This concerns in particular:

retention duties under commercial and tax law, as a rule six years for business correspondence and ten years for accounting records and invoices
the assertion, exercise or defence of legal claims until the relevant limitation periods expire
the record of consent given

For individual services we state the retention period in the relevant section.

You have the following rights in relation to us, which you can exercise at any time using the contact details above:

Access, Art. 15 GDPR. You can find out whether and which data we process about you.
Rectification, Art. 16 GDPR. You can have inaccurate data corrected and incomplete data completed.
Erasure, Art. 17 GDPR. You can request the deletion of your data.
Restriction of processing, Art. 18 GDPR. You can require us to process your data only in a restricted way in certain cases.
Data portability, Art. 20 GDPR. You can receive the data you provided to us in a structured, commonly used and machine-readable format, or have it transmitted to another controller.
Withdrawal of consent, Art. 7(3) GDPR. You can withdraw a consent you have given at any time. The lawfulness of processing carried out up to that point is not affected.
Objection, Art. 21 GDPR. See the following section.
Complaint to a supervisory authority, Art. 77 GDPR.

The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2 to 4
40213 Düsseldorf, Germany
ldi.nrw.de

You may also contact the supervisory authority where you habitually reside or where you work.

You have the right to object at any time to processing of your data that we base on Art. 6(1)(f) GDPR. If you exercise that right, we ask you to briefly set out your reasons. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests and rights.

Irrespective of the above, you have the right to object at any time to the processing of your data for direct marketing purposes. Following such an objection we will no longer process your data for those purposes. Please address your objection to the contact details above.

Automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place. The analyses described in the sections on analytics, online advertising and company identification serve audience measurement and the targeting of our advertising. They do not result in any decision that produces legal effects concerning you or similarly significantly affects you.

You are under no obligation to provide us with personal data. Without the information marked as mandatory in our forms, however, we cannot handle your enquiry, send you a newsletter, or conclude and perform a contract with you. Consenting to non-necessary cookies is voluntary. If you do not consent, the website remains fully usable.

We operate company profiles on social networks, in particular on LinkedIn. If you open such a profile, the relevant provider processes your data under its own terms and as controller in its own right. We receive aggregated statistics from the provider about the use of our profile, from which we cannot identify individual people. Where we are joint controllers with the provider for those statistics, the relevant arrangement under Art. 26 GDPR applies.

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Legal basis: Art. 6(1)(f) GDPR
Privacy policy: linkedin.com/legal/privacy-policy

We take technical and organisational measures in line with the state of the art to protect your data against accidental or deliberate manipulation, loss, destruction and unauthorised access by third parties. Transmission via our website is encrypted using TLS.

This privacy policy is dated [insert publication date]. We update it when the services we use, our processing activities or the legal requirements change. The current version is always available on this page.