Laden...
Laden...
Last updated: 1 August 2026
Mario Lohe
c/o GAM
Pappelallee 64
10437 Berlin
Email: [email protected]
Phone: +49 152 396 008 57
This is a volunteer knowledge project. The appointment of a data protection officer is not required. For privacy questions, please contact the address above.
We only process personal data insofar as it is necessary to provide a functional website and our content and services. Processing is based on Art. 6(1) GDPR. Data is only shared with third parties as described in this policy.
This website is hosted by Netcup GmbH, Daimlerstr. 25, 76185 Karlsruhe, Germany. Servers are located in Germany. When visiting the website, information is automatically stored in server log files (IP address, browser type, access time). This data is required for technical operation and is automatically deleted after 7 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical provision).
You can create a free account to save your tool results across devices.
Data processed: Email address, password (stored encrypted as bcrypt hash), consent timestamp, language preference.
Tool data: Maturity scan results, OKR plans, canvas data, RACI matrices, transformation timelines, learning progress.
Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (contract performance).
Retention: Until account deletion by you. Inactive accounts are deleted after 24 months.
You can delete your account at any time at /konto/daten. Upon deletion, all personal data including tool results and newsletter subscription are irrevocably removed.
With your explicit consent, we send you our newsletter with content on business operations, AI integration, and organizational design.
Data processed: Email address, language preference, signup time, IP address at signup (proof of consent).
Double-Opt-In: After signup, you receive a confirmation email. Your address is only added to the mailing list after clicking the confirmation link.
Delivery: The newsletter is sent via Resend Inc. (USA). See Section 12 (Third-country transfers).
Legal basis: Art. 6(1)(a) GDPR (consent).
Withdrawal: You can unsubscribe at any time via the unsubscribe link in every email or in your account area at /konto.
Retention: Your data is retained for 6 months after unsubscription to document the former consent and then automatically deleted.
When using the contact form, name, email, subject, and message are stored to process your inquiry. Your IP address is also collected for abuse prevention.
To protect against automated submissions we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open the form, a script is loaded from challenges.cloudflare.com; your IP address and browser details are transmitted to Cloudflare for verification. The legal basis is our legitimate interest in preventing spam and abuse (Art. 6(1)(f) GDPR).
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in answering inquiries).
Retention: 12 months after receipt, then automatically deleted. IP addresses are removed after 30 days.
This website uses a self-developed, privacy-friendly analytics system. No cookies are set and no personal data is collected.
Not collected: IP addresses, browser fingerprints, cookies, user IDs, or other personal data.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing website usage).
Retention: 365 days, then automatically deleted.
This website only uses technically necessary cookies required for the operation of the website. A cookie banner is therefore not required (TTDSG § 25(2)).
| Cookie | Purpose | Duration |
|---|---|---|
| next-auth.session-token | Login / Session | 4 hours |
| next-auth.csrf-token | CSRF protection | Session |
| NEXT_LOCALE | Language preference | Session |
| aops-trusted | Trusted device (Admin 2FA) | 30 days |
To protect against abuse, security-relevant events are logged (login attempts, suspicious requests, automated attacks). IP addresses, user agents, and timestamps are collected.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website security).
Retention: 90 days, then automatically deleted. IP addresses are anonymized after 7 days.
For sending emails (newsletter, registration confirmation, password reset, contact notifications), we use Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.
Data processed: Email address, subject, email content. Delivery information (delivered/failed/complaint) is stored anonymously without personal reference.
See Section 12 for third-country transfers and data processing agreements.
The following AI services are used for the interactive AI tools on this website as well as for creating blog content, newsletter editions and header images:
For editorial use (blog, newsletter, images), only editorial content is transmitted. For the interactive tools, the details you enter about your organisation and use case are transmitted to the AI service. Please do not enter personal data or confidential information into the free-text fields.
The AI Transparency page explains which AI systems are used for what purpose and how content is labelled.
Some of the services used are based outside the EU:
A data processing agreement (DPA) is in place with Resend. Transfers to the USA are based on Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or certification under the EU-US Data Privacy Framework.
There is no EU Commission adequacy decision for transfers to DeepSeek in China. Only the details you enter into the tool forms and editorial content are transmitted to this service. Please do not enter personal data there.
You have the following rights regarding your personal data:
To exercise your rights, contact: [email protected]
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Postfach 20 04 44
40102 Düsseldorf
www.ldi.nrw.de
No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place. The assessments offered on this website (e.g., Maturity Scan) are solely for self-assessment and have no legal or similar effects.
| Data | Retention |
|---|---|
| User account | Until deletion / 24 months inactivity |
| Newsletter (active) | Until withdrawal |
| Newsletter (unsubscribed) | 6 months after unsubscription |
| Contact inquiries | 12 months |
| Security logs | 90 days (IPs anonymized after 7 days) |
| Web analytics | 365 days |
| Server-Logfiles | 7 days |
| Password reset tokens | 1 hour |
We reserve the right to update this privacy policy to reflect changes in legal requirements or changes to the website and data processing. The current version can always be found on this page.