Privacy Policy
We are pleased about your visit to our website and your interest in the services of Cybersteps GmbH.
The protection of your personal data is very important to us. We process personal data exclusively in accordance with applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).
This privacy policy informs you about which personal data we collect when you use our website and in connection with our services, for what purposes we process this data, on what legal basis this is done, and what rights you have as a data subject.
This privacy policy applies to our website and all services offered through it, in particular information and advice requests, appointment bookings, newsletter registrations and our educational and consulting services.
1. Responsible person
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Cybersteps GmbH
Schloßstr. 50
12165 Berlin
Telephone:030 585823080
Email:[email protected]
Whenever this privacy policy refers to “we”, “us” or “Cybersteps”, it always refers to Cybersteps GmbH as the data controller.
2. Data Protection Officer
Cybersteps GmbH is not required to appoint a data protection officer under current legal regulations.
If you have any questions about data protection or the processing of your personal data, you can contact us at any time using the contact details provided in the legal notice.
3. General information on data processing
The protection of your personal data is very important to us. We process personal data exclusively in accordance with applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).
Personal data is any information relating to an identified or identifiable natural person. This includes, for example, name, address, email address, telephone number, IP address, or information about professional career.
We process personal data only to the extent that there is a legal basis for doing so. Depending on the type of processing, this is based in particular on:
- Article 6 paragraph 1 letter a GDPR (consent)
- Article 6 paragraph 1 letter b GDPR (contract or pre-contractual measures)
- Article 6 paragraph 1 letter c GDPR (legal obligation)
- Article 6 paragraph 1 letter f GDPR (legitimate interest)
If we obtain your consent, you can withdraw it at any time with effect for the future. Where consent is required for the use of cookies or similar technologies, their storage and the retrieval of information are based on Section 25 of the TDDDG (Telecommunications Digital Services Data Protection Act). The subsequent processing of personal data, if necessary, is based on the General Data Protection Regulation (GDPR), in particular Article 6(1)(a) GDPR.
4. Storage duration
We generally only store personal data for as long as is necessary for the respective processing purposes or as required by law.
Unless statutory retention obligations dictate otherwise, the following retention periods apply in particular:
- Contact requests: up to 12 months after the request has been completed
- Consultation requests: up to 12 months after completion of the consultation, provided no further business relationship is established.
- Leads and prospects: up to 24 months after the last documented contact
- Newsletter data: until consent is withdrawn or the newsletter is unsubscribed.
- Participant data: for the duration of the contractual relationship and beyond, in accordance with statutory retention and documentation obligations.
Personal data will be deleted or anonymized once the respective processing purpose ceases to exist or statutory retention periods expire.
5. Recipients of personal data
As part of our business activities, we use various technical and organizational service providers who may process personal data on our behalf or as independent controllers.
This includes in particular:
- Hosting service provider
- Cloud and collaboration service providers
- CRM systems
- Newsletter service provider
- Providers of analytics and marketing services
- Appointment booking services
- Video conferencing providers
- IT service provider
If service providers process personal data on our behalf, this is done exclusively on the basis of a data processing agreement in accordance with Article 28 GDPR.
6. Data transfer to third countries
Some of the service providers we use also process personal data outside the European Union or the European Economic Area, or may allow access from third countries.
This includes, in particular, services from Google LLC, Salesforce, Calendly, Cloudflare, Zoom, Meta Platforms, LinkedIn, TikTok and other internationally operating providers.
Where personal data is transferred to third countries, this is done exclusively in compliance with the legal requirements of Articles 44 et seq. of the GDPR. The transfer is based in particular on an adequacy decision of the European Commission or suitable safeguards, such as the European Commission’s standard contractual clauses.
7. Hosting
Our website will be used at the SiteGround Hosting Ltd. hosted.
As part of the hosting service, all data necessary for the operation and provision of the website is processed. This includes, in particular, server log files, IP addresses, and technical information that is automatically processed when the website is accessed.
The servers on which our website is operated are located in Germany.
The processing is based on our legitimate interest in a secure, stable and efficient provision of our online service in accordance with Art. 6 para. 1 lit. f GDPR.
Where necessary, we have a data processing agreement with our hosting provider in accordance with Article 28 GDPR.
8. Content Delivery Network (Cloudflare)
To improve the security and loading speed of our website, we use the Content Delivery Network (CDN) of Cloudflare Inc.
Cloudflare processes the following in particular:
- IP Address
- Browser information
- Device information
- technical connection data
- Security information
This processing serves in particular to defend against attacks on our website, to optimize loading times and to ensure the secure delivery of content.
The processing is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.
The processing of personal data outside the European Union cannot be ruled out. Cloudflare uses appropriate safeguards in accordance with Article 46 GDPR.
Further information can be found at:
https://www.cloudflare.com/privacypolicy
9. Server log files
When you visit our website, information is automatically collected by the web server.
This includes in particular:
- IP Address
- Date and time of access
- Browser type and browser version
- Operating system used
- Referrer URL
- pages visited
- Access status
- amount of data transferred
The processing is carried out to ensure the secure and stable operation of the website, for error analysis, and to defend against attacks.
The legal basis for this is Article 6(1)(f) GDPR.
The log files are only stored for as long as necessary for the aforementioned purposes.
10. SSL/TLS encryption
For security reasons, our website uses SSL/TLS encryption.
This encrypts all data transmitted between your browser and our website.
You can recognize an encrypted connection by, among other things, the prefix “https://” in the address bar of your browser and the padlock symbol.
11. CookieYes (Consent Management)
We use the consent management system on our website.CookieYes.
CookieYes enables us to obtain, manage and document the legally required consents for the use of cookies and similar technologies.
In particular, the following data may be processed:
- Consent status
- IP Address
- Browser information
- Device information
- Date and time of consent
- Consent ID
The processing is based on Art. 6 para. 1 lit. c GDPR for the fulfillment of our legal obligations as well as Art. 6 para. 1 lit. f GDPR.
Further information can be found at:
https://www.cookieyes.com/privacy-policy
12. Google Tag Manager
We use the Google Tag Manager from Google Ireland Limited.
The Google Tag Manager is solely for managing and deploying other services and tags. The Tag Manager itself does not process any personal data for its own purposes.
However, using the Tag Manager can allow additional services to be loaded, which in turn process personal data.
Further information can be found at:
https://support.google.com/tagmanager
13. Google Analytics 4
Our website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited.
Google Analytics allows us to analyze the use of our website in order to continuously improve our online services.
The following data, among others, can be processed:
- IP address (truncated)
- Device information
- Browser information
- Usage behavior
- visited pages
- Session duration
- Visitor’s origin
- Interactions on the website
The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.
You can withdraw your consent at any time via our cookie banner.
Further information can be found at:
https://policies.google.com/privacy
14. Google Ads and Conversion Tracking
We use Google Ads and the Google Ads Conversion Tracking service provided by Google Ireland Limited (Google Building Gordon House, Barrow Street, Dublin 4, Ireland).
Conversion tracking allows us to understand whether users perform certain actions on our website after clicking on a Google ad, such as submitting a consultation request or a contact form.
The following data, among others, can be processed:
- IP Address
- Device information
- Browser information
- Date and time of visit
- pages visited
- Conversion data
- Cookie information
The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.
Further information can be found at:
https://policies.google.com/privacy
15. Google Search Console
We use the Google Search Console from Google Ireland Limited for the technical optimization of our website.
The Google Search Console is used exclusively for analyzing the technical discoverability of our website in Google search.
We do not create any personal user profiles.
The processing is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in optimizing our website.
Further information can be found at:
https://policies.google.com/privacy
16. Microsoft Clarity
We use Microsoft Clarity, a web analytics service provided by Microsoft Ireland Operations Limited.
Microsoft Clarity helps us to better understand user behavior on our website and to make our online offering more user-friendly.
In particular, the following information can be processed:
- Mouse movements
- Scrolling behavior
- Clicks
- visited pages
- Device information
- Browser information
- IP address (shortened or pseudonymized)
Microsoft Clarity can record sessions and create so-called heatmaps.
The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.
Further information can be found at:
17. Meta Pixel
We use the Meta Pixel from Meta Platforms Ireland Limited on our website.
The Meta Pixel allows us to analyze the effectiveness of our advertising campaigns on Facebook and Instagram, as well as to create target groups for personalized advertising.
In particular, the following data may be processed:
- IP Address
- Browser information
- Device information
- visited pages
- Conversion events
- Interactions on our website
The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.
Further information can be found at:
https://www.facebook.com/privacy/policy
18. LinkedIn Insight Tag
Our website uses the LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company.
The LinkedIn Insight Tag allows us to analyze the use of our website by LinkedIn members and to measure the success of our advertising campaigns.
In particular, the following data may be processed:
- IP Address
- Browser information
- Device information
- visited pages
- Referrer
- Timestamp
The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.
Further information can be found at:
https://www.linkedin.com/legal/privacy-policy
19. TikTok Pixel
We use the TikTok Pixel from TikTok Technology Limited on our website.
The TikTok pixel is used to analyze the use of our website and to optimize our advertising measures on TikTok.
In particular, the following data may be processed:
- IP Address
- Device information
- Browser information
- pages visited
- Interactions on the website
- Conversion data
The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.
Further information can be found at:
https://www.tiktok.com/legal/privacy-policy
When using the TikTok Pixel, personal data may be transferred to third countries. It cannot be ruled out that data may also be processed in countries whose data protection standards do not correspond to those of the European Union. Such transfers will only take place in compliance with the legal requirements of Articles 44 et seq. of the GDPR.
20. Remarketing
We use various remarketing technologies to target visitors to our website with interest-based advertising on other websites or platforms.
Services from Google, Meta and TikTok can be used for this purpose.
Cookies or similar technologies may be used to recognize visitors to our website and to display personalized advertising to them based on their previous usage behavior.
The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.
You can withdraw your consent at any time via our cookie consent tool.
21. Contacting us via our website
On our website you have the option of contacting us via various contact forms.
For this we useFluent Forms.
In the context of contacting us, the following personal data may be processed in particular:
- First and Last Name
- Email Address
- Telephone number
- Information on the professional situation
- Information on previous education
- Information about the desired educational program
- further information voluntarily submitted
The data is processed solely for the purpose of handling your request, contacting you, and preparing for a possible consultation.
The legal basis is Art. 6 para. 1 lit. b GDPR (pre-contractual measures) and, where applicable, Art. 6 para. 1 lit. a GDPR if you provide voluntary information.
The transmitted data will be stored in our CRM system and additionally sent by email to the responsible employees.
Unless there is a legal obligation to retain the data, we will delete it no later than twelve months after processing your request, provided no further business relationship arises.
Providing the data marked as mandatory is required to process your request. Without this information, we may not be able to process your request, or may not be able to process it completely.
22. Consultation requests and educational advice
Cybersteps supports interested parties in selecting suitable further training measures and in examining individual funding opportunities.
As part of a consultation request, we may process the following personal data in particular:
- Name
- Contact details
- Professional background
- Employment situation
- Qualifications
- desired further training goals
- further information required for the consultation
The data is processed exclusively for the purpose of providing the requested consultation and preparing for a possible contractual relationship.
The legal basis for this is Article 6(1)(b) GDPR.
Providing the data required for the consultation is necessary to conduct an individual consultation and to examine funding opportunities. Without this information, the consultation may not be possible.
23. Appointment bookings via Calendly
We use the service to schedule consultation appointments.Calendly.
The following personal data may be processed when booking an appointment:
- Name
- Email Address
- Telephone number
- desired date
- voluntary information in the message field
The data will be used exclusively for the organization and execution of the consultation.
The processing is based on Article 6 paragraph 1 letter b GDPR.
Further information can be found at:
Providing the requested data is necessary for scheduling and conducting a consultation appointment. Without this information, an appointment cannot be booked.
24. Salesforce CRM
We use Salesforce as our Customer Relationship Management (CRM) system to manage our prospects, customers and participants.
In particular, the following personal data may be processed:
- Master data
- Contact details
- Consultation processes
- Communication history
- Documents
- Information on booked training courses
- Status of the consultation
- Funding information
The processing serves the efficient organization of our consulting and support processes.
The legal basis is Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f GDPR.
The necessary data protection agreements are in place with Salesforce.
Further information can be found at:
https://www.salesforce.com/company/privacy
25. Google Workspace
For internal communication and collaboration, we use various services from Google Workspace.
This includes in particular:
- Gmail
- Google Drive
- Google Calendar
- Google Docs
- Google Meet
- other Google Workspace services
- Google Gemini
These services are used in particular for the following purposes:
- Communication
- Appointment management
- Document creation
- File management
- Teamwork
- Conducting video conferences
- Supporting internal work processes through AI functions
Where personal data is processed, this is done exclusively within the framework of legal requirements.
The legal basis is Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f GDPR.
Further information can be found at:
https://workspace.google.com/terms
Insofar as Google processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.
26. Google Drive
We use Google Drive to store and manage documents.
In this context, personal documents may be processed in particular, insofar as this is necessary for the provision of our consulting and training services.
Access to stored data is restricted to authorized employees in accordance with their respective tasks and permissions.
27. Google Gemini
We use Google Gemini to support internal work processes.
Gemini is used in particular to support research, analysis and documentation tasks.
Internal guidelines stipulate that personal data may only be processed to the extent permitted and in compliance with applicable data protection regulations.
The service is used exclusively in accordance with data protection regulations and the contractual agreements concluded with Google. Personal data is only processed to the extent necessary for the respective purpose and permissible under data protection law.
28. Video conferences (Google Meet and Zoom)
We use Google Meet and Zoom for consultations and internal meetings.
In particular, the following data may be processed:
- Name
- Email Address
- Audio and video data
- Chat Messages
- Conference metadata
- technical connection data
The system is used exclusively for conducting consultation and meeting appointments.
The legal basis is Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f GDPR.
29. Newsletter (Brevo)
We use the service to send our newsletter.Brevo.
As part of the newsletter registration process, we process in particular the following data:
- Email Address
- Time of registration
- Confirmation of registration (double opt-in)
The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.
You can withdraw your consent at any time via the unsubscribe link in the newsletter.
Further information can be found at:
https://www.brevo.com/legal/privacypolicy
30. Notion
We use Notion for the internal organization of our company.
Notion primarily processes internal company information.
Furthermore, in individual cases personal data may be processed, for example feedback from participants or project-related information.
Access to this information is restricted to authorized employees and is based on the need-to-know principle.
The processing is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in an efficient internal organization.
31. Processing of participant data
As part of our consulting and training services, we process personal data of interested parties and participants to the extent necessary for the provision of our services.
This may include, in particular, the following data:
- First and Last Name
- Address
- Telephone number
- Email Address
- Professional background
- Qualifications
- Employment situation
- Information about the desired further training
- Consultation process
- Documents related to participation in educational programs
The processing is carried out exclusively for the purpose of providing our consulting and support services, as well as for preparing and implementing contractual measures.
The legal basis for this is Article 6(1)(b) GDPR.
32. Processing of education vouchers
Insofar as education vouchers are processed as part of our services, this is done exclusively for the processing of the respective funding measure.
Education vouchers are submitted to us digitally by the individuals concerned, processed internally and then returned to the responsible office.
Further processing will only take place if this is necessary for the implementation of the respective funding measure or is required by law.
The legal basis is Article 6(1)(b) GDPR.
Providing the necessary personal data is required for processing the education voucher and implementing the funding measure. Processing cannot take place without this information.
33. Disclosure of personal data in the context of job placement
If interested parties or participants wish to receive support in their job search, personal data will only be transmitted to potential employers or partner companies after the prior express consent of the person concerned.
In particular, the following data may be transmitted:
- Name
- Contact details
- CV
- Qualifications
- Professional background
- further information released by the data subject
The processing is carried out exclusively on the basis of consent in accordance with Art. 6 para. 1 lit. a GDPR.
Consent can be withdrawn at any time with effect for the future.
34. Social media presences
We maintain company profiles on various social networks to communicate with interested parties, participants and business partners and to inform them about our services.
We currently operate company profiles on:
- TikTok
- YouTube
When you visit our social media pages, personal data is processed both by us and by the respective platform operator.
We have only limited influence over the data processing carried out by the respective platform operators. Information on the processing of personal data can be found in the privacy policies of the respective providers.
Insofar as we process personal data via our social media channels, this is done on the basis of our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in modern corporate communication or on the basis of your consent, if required.
Our privacy policy is available on our website. We also ensure that it can be accessed within a few clicks via our social media channels.
Insofar as we decide jointly with the operators of the respective platforms on the purposes and means of certain data processing, joint controllership may exist in accordance with Art. 26 GDPR.
35. Automated decision-making
Decision-making based solely on automated processing, including profiling as defined in Article 22 GDPR, does not take place.
The systems we use, in particular Salesforce, Google Workspace, and Google Gemini, serve solely to support internal workflows. Decisions with legal effect or similarly significant consequences are not made exclusively automatically.
36. Your rights as a data subject
Under the legal provisions, you have the following rights in particular:
- Right to information pursuant to Article 15 GDPR
- Right to rectification pursuant to Article 16 GDPR
- Right to erasure pursuant to Article 17 GDPR
- Right to restriction of processing pursuant to Article 18 GDPR
- Right to data portability pursuant to Article 20 GDPR
- Right to object to processing pursuant to Article 21 GDPR
- Right to revoke consent given with effect for the future
To exercise your rights, you can contact us at any time using the contact details provided in the legal notice.
37. Right of appeal
You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data.
The responsible supervisory authority for Cybersteps GmbH is:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Website: https://www.datenschutz-berlin.de
The exercise of this right of appeal does not affect other administrative or judicial remedies.
38. Data security
We take appropriate technical and organizational measures to protect your personal data from loss, manipulation, unauthorized access and other unauthorized processing.
Our security measures are regularly reviewed and adapted as needed in line with technological developments.
Access to personal data is restricted to authorized employees in accordance with their respective tasks and responsibilities.
39. Changes to this Privacy Policy
We reserve the right to amend this privacy policy if this becomes necessary due to changes in legal requirements, technical developments or changes to our services.
The version published on our website at the time of your visit applies.
