Information and purposes
We process contact and company information when you request a resource, make an enquiry or book a call. Purchases require order, payment-reference and participant information so we can deliver and administer the programme. Consultant applications include experience and evidence used to assess a potential collaboration. The applicable legal basis for each activity is set out in our processing summary: performance of a contract for orders, bookings and delivery (GDPR Art. 6(1)(b)); legitimate interests for answering enquiries, business follow-up, security and assessing consultant applications (Art. 6(1)(f)); consent for marketing emails (Art. 6(1)(a)); and legal obligation for accounting records (Art. 6(1)(c)). Promotional emails require an appropriate documented basis and can be unsubscribed from.
Access and suppliers
Access is limited to people with a relevant task. We use Hetzner Online GmbH (hosting, Germany), Cloudflare, Inc. (network security, DNS and email forwarding), SMTP2GO (transactional email) and Stripe (card payments, when online payment is enabled). Processing locations and any transfers outside the EEA: the website and database are hosted in Germany. AIBI is operated by a US company, and Cloudflare, SMTP2GO and Stripe may process data outside the EEA. Such transfers rely on an adequacy decision, the EU-US Data Privacy Framework where the recipient is certified, or the European Commission’s standard contractual clauses. The payment provider handles card details; AIBI does not store full card information.
Client materials
Confidential documents are shared through an agreed secure channel. Access is restricted to the relevant engagement. The portal described here does not send client materials to an AI model.
Retention
Enquiries and resource requests are reviewed after 12 months of inactivity. Consultant applications, including uploaded documents, are deleted or pseudonymised 6 months after a rejection. Engagement files are kept for 12 months and delivered documents for 24 months. Order and accounting records are kept for as long as accounting law requires. Statutory retention duties and documented legal claims may affect deletion. We limit the information retained to what is necessary.
Your rights
Contact us about access, rectification, erasure, restriction, objection and portability where the applicable conditions are met. Consent can be withdrawn without affecting the lawfulness of prior processing. You may complain to the relevant supervisory authority: the data protection authority in the EU/EEA country where you live or work, for example Datatilsynet in Denmark (datatilsynet.dk).
Last updated: 2026-10-10.