Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR/DSGVO) is:

Dr. rer. medic. Franz Hütter, M.A.

BRAIN-HR

Am Schlagbaum 1

58285 Gevelsberg

Deutschland

E-Mail: fh@brain-hr.com

Telefon: +49 171 99 79 519

2. General information

We take the protection of your personal data seriously and process it exclusively on the basis of the statutory provisions (DSGVO, BDSG, TDDDG). This privacy policy informs you about the nature, scope and purpose of the processing of personal data on this website, as well as about your rights.

3. Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. Hetzner processes on our behalf on the basis of a data-processing agreement under Art. 28 DSGVO. The legal basis is our legitimate interest in a secure and efficient provision of the website (Art. 6(1)(f) DSGVO).

4. Access data / server log files

When the website is accessed, technical access data is recorded automatically (IP address, date and time, page accessed, amount of data transferred, browser type, operating system, referrer URL). This data serves the delivery of the page, stability and security. In our access logs, IP addresses are truncated (anonymized) and sensitive information (e.g. cookies, authentication data) is removed, so that no personal reference remains. The legal basis is Art. 6(1)(f) DSGVO.

5. SSL/TLS encryption

For security reasons, this website uses TLS encryption. You can recognize an encrypted connection by the „https://" in the address bar and by the padlock symbol in your browser.

6. Cookies and consent (consent banner)

On your first visit to our website, you receive a cookie notice (consent banner) through which you decide for yourself which processing operations you allow.

Technically necessary cookies are required for the operation of the website (e.g. session management, shopping cart, storing your cookie choice). They are set without consent. The legal basis is § 25(2) TDDDG in conjunction with Art. 6(1)(f) DSGVO.

Optional cookies and services (in particular web analytics with Google Analytics, see section 8) are only set after you have actively consented in the consent banner. Until you consent, these services are not loaded. The legal basis is your consent under § 25(1) TDDDG in conjunction with Art. 6(1)(a) DSGVO.

You can withdraw your consent at any time with effect for the future by opening the cookie settings again or deleting the cookies in your browser.

7. Reach measurement with Rybbit (cookieless)

For the statistical analysis of website use, we use Rybbit, a privacy-friendly, cookieless web analytics service. The provider is Rybbit (contact: hello@rybbit.com, https://rybbit.com). Rybbit uses no cookies, stores no personal identifiers and creates no cross-device user profiles. Processing takes place on servers in the European Union. IP addresses are used only briefly to determine the approximate region of origin and are not stored permanently. Aggregated information is collected, such as pages accessed, approximate origin, device type used and referrer; this aggregated statistical data is retained for twelve months by default. Since no cookies are set and no device information beyond what is technically necessary is read, this measurement takes place without consent on the basis of our legitimate interest in data-minimizing reach measurement (Art. 6(1)(f) DSGVO).

A data-processing agreement under Art. 28 DSGVO is part of the usage agreement with the provider and is available at https://rybbit.com/dpa .

8. Web analytics with Google Analytics 4 (GA4)

If you have consented in the consent banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google"). Google Analytics uses cookies and similar technologies that enable an analysis of your use of the website. The information collected (including truncated IP address, pages accessed, time spent, approximate origin, device and browser information) is generally transferred to Google servers and stored there.

Property/measurement ID of this website: G-FB1CVXB46G.

Google Analytics 4 anonymizes IP addresses by default; full IP addresses are not stored. Nevertheless, a transfer of data to Google LLC in the USA cannot be ruled out. Google is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses are in place. Despite these safeguards, access to the data by US authorities cannot be entirely ruled out.

Legal basis is exclusively your consent under § 25(1) TDDDG in conjunction with Art. 6(1)(a) DSGVO. The service is only loaded after your consent in the consent banner. You can withdraw your consent at any time with effect for the future (open the cookie settings again or delete cookies). You can additionally object to the processing via the browser add-on to deactivate Google Analytics (https://tools.google.com/dlpage/gaoptout).

You can find further information on how Google handles user data in Google's privacy policy: https://policies.google.com/privacy.

9. Fonts

The fonts used on this website are delivered locally from our own server. When the fonts are loaded, no data is transferred to third parties (in particular not to Google).

10. Contacting us

If you contact us via the contact form or by email, we process the data you provide (e.g. name, email address, message) to handle your enquiry. The legal basis is Art. 6(1)(b) DSGVO (pre-contractual measures/contract) or Art. 6(1)(f) DSGVO (answering general enquiries). The data is deleted as soon as it is no longer required and no statutory retention obligations conflict with this.

11. Newsletter

For sending our newsletter we use the double-opt-in procedure: after signing up you receive a confirmation email with which you confirm the subscription. We process the sign-up data (email address, name if provided) as well as the sign-up time and IP address as proof of consent. Sending is carried out via our own, self-hosted system (Odoo) and the technical email dispatch of our provider. The legal basis is your consent (Art. 6(1)(a) DSGVO). You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by message to us.

12. Appointment booking (Calendly)

For arranging appointments we use Calendly (Calendly LLC, USA). When booking, the data you provide (e.g. name, email address, preferred date) is transmitted to Calendly. This involves a transfer to the USA, which is safeguarded on the basis of standard contractual clauses or the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) DSGVO (appointment arrangement) or Art. 6(1)(f) DSGVO.

13. Embedded video content

YouTube: We embed videos from YouTube (Google Ireland Limited) in extended privacy mode. In this mode, data is only transferred to Google when a video is started; a transfer to the USA is possible. Vimeo: Occasionally we embed videos from Vimeo (Vimeo Inc., USA). When played, data is transferred to Vimeo. The legal basis in each case is Art. 6(1)(f) DSGVO (appealing presentation of our content).

14. Orders and payment processing

When booking seminars, products or licenses, we process the data required to perform the contract (name, billing address, email address, service booked). The legal basis is Art. 6(1)(b) DSGVO. Payment is made by invoice or via PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg); when using PayPal, their data protection provisions additionally apply. Invoice and contract data is stored in accordance with the commercial and tax retention periods (6 and 10 years respectively).

15. Customer management (CRM)

To handle and maintain customer and prospect relationships, we store contact and contract data in our self-hosted system (Odoo) on the server named above. The legal basis is Art. 6(1)(b) DSGVO (contract performance) or Art. 6(1)(f) DSGVO (customer care).

16. Online events (Zoom)

For webinars and online events we sometimes use Zoom (Zoom Video Communications, Inc., USA). During registration and participation, data (e.g. name, email address, participation data) is processed; this involves a transfer to the USA, safeguarded via standard contractual clauses or the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) or (f) DSGVO.

17. Your rights

You have the right to access (Art. 15 DSGVO), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) as well as a right to object to processing based on Art. 6(1)(f) DSGVO (Art. 21). You can withdraw a consent you have given at any time with effect for the future (Art. 7(3) DSGVO). To do so, please use the contact details given above.

18. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)

Kavalleriestraße 2-4, 40213 Düsseldorf

19. Currency and changes

This privacy policy is as of June 2026. Further development of the website or changed legal requirements may make an adjustment necessary.