Privacy Policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Data-protection enquiries may be sent to info@gobran.de.

Processing principles

We process personal data only where necessary to operate the website securely, respond to an enquiry, take pre-contractual steps or provide communications requested by you.

Legal bases

• Article 6(1)(b) GDPR for enquiries relating to a contract or pre-contractual steps.
• Article 6(1)(f) GDPR for secure website operation and other business enquiries. Our legitimate interests are the secure provision of this website and reliable communication.
• Article 6(1)(a) GDPR where processing, in particular newsletter delivery, is based on your consent.
• Article 6(1)(c) GDPR where processing is required to meet a legal obligation.

Retention

Unless a specific period is stated below, we retain data only for as long as necessary for the relevant purpose. We then delete or anonymize the data unless statutory retention obligations or legitimate reasons relating to legal claims require continued storage.

This website does not use automated decision-making or profiling within the meaning of Article 22 GDPR.

Hosting, server logs and website security

This website is provided through Cloudflare Workers by Cloudflare, Inc. and protected by Cloudflare services for DNS, delivery and security. Cloudflare processes technical access data generated by operating the website as our processor.

When you visit a page, the data processed may include your IP address, the time and destination of the request, referrer URL, browser and device information, operating system, HTTP status, amount of data transferred, and technical security and usage data. The purposes are delivery, stability, troubleshooting and prevention of abusive access. The legal basis is Article 6(1)(f) GDPR.

Editorial content is maintained in a separate WordPress instance at cms.gobran.de, operated by RAIDBOXES. Visitor requests are not forwarded to the WordPress administration; published content is synchronized through protected technical processes.

Provider-side log data are processed only for as long as required for operation, security, troubleshooting and compliance with legal obligations. We currently conduct no additional audience measurement and maintain no additional personal visitor logs.

Recipients and international transfers

Cloudflare and its sub-processors may also process data outside the European Economic Area. Relevant transfers are based on an adequacy decision by the European Commission or appropriate safeguards, in particular the EU Standard Contractual Clauses under Article 46(2)(c) GDPR.

Cloudflare Data Processing Addendum ↗Cloudflare Privacy Policy ↗

Strictly necessary cookies, Usercentrics and analytics

We use the Usercentrics Consent Management Platform (Usercentrics GmbH) to manage your consent choices. Usercentrics stores your selection, the time of the decision, the selected language and a consent ID. This is necessary to document and apply your choice on the website. The configuration uses Settings ID dkf6ZegF6sUX4y.

We use Google Analytics 4, provided by Google Ireland Limited, only where you have consented in Usercentrics to the “Marketing” category and the “Google Analytics” service. This may process page views, content viewed, technical device and browser data, approximate location data and interactions. Google may transfer data to affiliated companies, in particular Google LLC in the United States. Processing takes place only with consent under Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Google Consent Mode v2 is used with analytics and advertising signals denied by default. Google Analytics is not loaded without consent.

You may change or withdraw consent at any time with future effect through the Usercentrics privacy settings. After withdrawal, no further analytics cookies are set; you can also delete existing cookies through your browser settings.

To protect the site against automated or abusive access, Cloudflare may set the strictly necessary cookie __cf_bm. It contains encrypted information used for bot detection, is not a cross-site user identifier and expires after 30 minutes of inactivity. If a security check is required, additional strictly necessary Cloudflare cookies may be used for the duration of that check.

Access to or storage of information on a device for non-essential services is based on your consent under Section 25(1) TDDDG. Strictly necessary technologies rely on Section 25(2)(2) TDDDG; subsequent processing is based on Article 6(1)(f) GDPR.

Contacting us

If you contact us by email or through the contact form, we process the contact details and content you provide, such as your name, email address, organization, topic and message. We use this information solely to review and respond to your request and to coordinate any next steps.

The legal basis is Article 6(1)(b) GDPR where the request relates to a contract or pre-contractual steps, and Article 6(1)(f) GDPR in other cases. Recipients are the people responsible within GOBRAN and the hosting, CRM and email service providers technically required to handle the communication.

We transmit contact-form data to HubSpot for recording and handling enquiries in our CRM, based on the data-processing agreement agreed with HubSpot.

We use Resend, Inc. (USA) for the technical delivery of contact-form emails. Resend processes the contact details and content entered in the form as well as technical delivery data. Resend may process data in the United States and states that it relies on appropriate safeguards, in particular the EU Standard Contractual Clauses, for relevant transfers. We do not use open or click tracking for contact enquiries.

We use Cloudflare Turnstile, provided by Cloudflare, Inc., to protect the form against automated submissions. This involves the processing of technically necessary data such as the IP address, browser and device details, and interaction and security data. The processing serves our legitimate interest in preventing spam and misuse under Article 6(1)(f) GDPR. We additionally store only short-lived, HMAC-pseudonymized counters to limit repeated enquiries. The IP address is not stored in plain text in this rate-limit database, and the counters are deleted after no more than 48 hours.

Providing information is voluntary. Without a means of contacting you and the information required to understand the request, we may be unable to respond. We delete enquiry data once the matter is concluded unless statutory retention obligations or legitimate reasons require further storage.

Please do not send confidential coaching content, health data or other sensitive information through general contact channels.

Resend Privacy Policy ↗Cloudflare Privacy Policy ↗

Requesting CALIBRATE trial access

To process a trial-access request, we use your first name, last name and email address, together with any information you provide voluntarily. The purposes are to process the request, provide information about trial access and coordinate possible next steps. The legal basis is Article 6(1)(b) GDPR.

For the technical transmission of the request by email, we use Resend, Inc. (USA). The contact details provided in the form and technical delivery data are processed for this purpose. Resend may process data in the United States and states that it relies on appropriate safeguards, in particular the EU Standard Contractual Clauses, for relevant transfers.

The data are deleted once the request is concluded unless required for a trial or contractual relationship or subject to statutory retention obligations. Separate privacy information applies to subsequent use of the CALIBRATE platform. This website policy does not describe the processing of personal journals, assessments or AI requests within CALIBRATE.

Resend Privacy Policy ↗

“Leadership Insights” newsletter

Newsletter registration is submitted directly through the form embedded on this website. We use HubSpot as the technical service provider for processing and newsletter delivery. Registration data include your email address, first and last name, consent and confirmation data, and technical registration logs.

Newsletter delivery is based on your consent under Article 6(1)(a) GDPR and Section 7 of the German Unfair Competition Act. You may withdraw your consent at any time with future effect by using the unsubscribe link in any newsletter or emailing info@gobran.de. Processing carried out before withdrawal remains lawful.

We use services provided by HubSpot Germany GmbH and affiliated companies. Data may be processed outside the EEA. HubSpot states that it bases relevant transfers on appropriate safeguards, including the EU Standard Contractual Clauses. Newsletter data are processed until consent is withdrawn or the mailing purpose ceases to apply. Evidence of consent may be retained for as long as necessary to meet legal accountability obligations or defend legal claims.

We use Cloudflare Turnstile to protect the form against automated submissions. Technically necessary browser, device and security data are processed for this purpose. Individualized analysis of page views, opens or clicks, as well as the use of non-essential cookies, will take place only where valid consent has been obtained.

HubSpot Privacy Policy ↗HubSpot sub-processors ↗Cloudflare Privacy Policy ↗

External services and social networks

This website contains ordinary links to external services, in particular the CALIBRATE platform, LinkedIn and individual articles still hosted on gobran.de. No connection to LinkedIn is made before you click; the LinkedIn icon is served locally.

Only when an external link is opened does the relevant provider receive technically necessary access data such as the IP address. The provider is responsible for subsequent processing under its own privacy information. The CALIBRATE login and app involve separate data processing that must be described separately.

Your data protection rights

Subject to the applicable legal requirements, you have in particular the following rights:

• access to your personal data (Article 15 GDPR),
• rectification of inaccurate or incomplete data (Article 16 GDPR),
• erasure (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability (Article 20 GDPR),
• withdrawal of consent with future effect (Article 7(3) GDPR),
• objection to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR).

To exercise these rights, email info@gobran.de. You also have the right to lodge a complaint with a data protection supervisory authority. The authority generally responsible for us is:

Data security and updates

We use appropriate technical and organizational measures to protect personal data against loss, manipulation and unauthorized access. The website is transmitted over encrypted HTTPS connections. Complete protection of data transmitted over the internet cannot, however, be guaranteed.

We update this policy when the website, the services used or legal requirements change. The version published on this page is the applicable version.

Important distinction: This policy applies to the company website described here. Additional privacy information may apply to CALIBRATE, job applications, client projects, Impact Analyses or other independent processing activities.