Data protection
Privacy policy according to Article 13 and 14 GDPR
Version: October 2026
- 1. Scope
- 2. Responsible Company
- 3. Data Protection Officer Contact Details
- 4. General Information on Data Processing
- 5. Collection and Processing of Personal Data in the Context of Our Services
- 6. Collection and Processing of Business Partner Data
- 7. Data Collection from Interested Parties for Acquisition Purposes
- 8. Doorbell Cameras at Our Locations
- 9. Collection and Processing of Data in the Application Process
- 10. Data Collection When Accessing Websites
- 11. Tracking for Analysis and Optimization
- 12. Rights of Data Subjects
Data processing by Fürstenberg Institut GmbH can essentially be grouped into the following categories:
- In the course of providing our services, we process all data required to perform a contract with Fürstenberg Institut GmbH. Where external service providers are involved in performing the contract, your data will be passed on to them to the extent necessary.
- In the course of our business relationships, we process personal data of employees and representatives of our client companies, of our suppliers and service providers (e.g. building services, fire protection and maintenance companies), and of the companies that lease premises to us, including their property management companies. This serves to initiate and perform the cooperation, to communicate, to schedule appointments, and to handle requests and complaints (for details, see Section 6).
- If you are interested in our services or events on behalf of a company, we process the data you provide in order to handle your enquiry, to prepare quotations and to schedule meetings (for details, see Section 7).
- To protect our office premises, we use video door-entry systems at our locations. These may capture persons who enter the entrance area or use the doorbell, in particular visitors as well as employees of service providers (for details, see Section 8).
- When you access our websites, various items of information are exchanged between your device and our servers. These may also include personal data. Among other things, the information collected is used to optimise our website or – where you have given your consent – to display advertising in the browser on your device.
- Personal data of applicants is processed in order to carry out application procedures.
Fürstenberg Institut GmbH
Gorch-Fock-Wall 3
20354 Hamburg
Telephone: +49 (0)40-380820-0
E-Mail: info@fuerstenberg-institut.de
DS EXTERN GmbH
Dipl.-Kfm. Marc Althaus
Frapanweg 22
22589 Hamburg
E-mail: anfragen@dsextern.de
4.1 No obligation to provide data
There is neither a contractual nor legal obligation to provide personal data. You are not required to provide data.
4.2 Consequences of not providing data
If mandatory data (marked as such when entered) is not provided, the respective service may not be provided at all or not in the same form and quality.
4.3 Transmission to public authorities
We transmit personal data to public authorities (including law enforcement authorities) if this is necessary to fulfil a legal obligation to which we are subject (legal basis: Article 6(1)(c) GDPR) or if it is required to assert, exercise or defend legal claims (legal basis: Article 6(1)(f) GDPR).
5.1 Coaching & counselling
Information/purpose: We collect personal data for the purpose of scheduling appointments, providing counselling, and handling client enquiries or complaints.
Legal basis: Performance of the service agreements (pursuant to Article 6(1)(b) GDPR).
Categories of data:
- Basic personal data: title, salutation/gender, first name, surname, date of birth
- Address data: street, house number, address supplements if applicable, postal code, city, country
- Contact data: telephone number(s), e-mail address(es)
- Organisational data: client company/location/business unit
- Content of the counselling
Internal disclosure: In the context of counselling sessions, counselling notes may be prepared. These are visible to counsellors advising the clients concerned, as well as to supporting and professionally coordinating experts.
Recipient companies: Service providers ensuring the availability of our client service outside core hours and at weekends. Partner companies involved in referring care and childcare offers. We use an external IT service provider to handle e-mail communication with our clients.
Transfers to third countries: The processing of e-mail data takes place in principle within the European Union. In exceptional cases, access to personal data may occur from a third country (e.g. the USA) in the course of maintenance or support services. Such data transfers are based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or on the use of appropriate safeguards such as standard contractual clauses pursuant to Article 46 GDPR.
Retention period: 3 years after completion of the counselling.
5.2 Corporate health
Information/purpose: We collect personal data for the planning, organisation and delivery of events (e.g. workshops) promoting mental health in the workplace.
Legal basis: Performance of the service agreements (pursuant to Article 6(1)(b) GDPR).
Categories of data:
- Basic personal data: title, salutation/gender, first name, surname
- Contact data: e-mail address(es)
- Organisational data: client company/location/business unit
- Contributions made in the context of online events
Recipient companies: We work with service providers that support us in organising and delivering online events and e-learning courses. In addition, we use a dedicated service provider for data storage, e-mail communication and the technical delivery of the online events.
Transfers to third countries: The processing of data in the context of data storage, e-mail communication and participation in online events and e-learning courses takes place in principle within the European Union. In exceptional cases, access to personal data may occur from a third country (e.g. the USA) in the course of maintenance or support services. Such data transfers are based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or on the use of appropriate safeguards such as standard contractual clauses pursuant to Article 46 GDPR.
Retention period: We delete the data arising in the course of the organisation and delivery of events once storage is no longer necessary, unless statutory retention obligations apply or limitation periods need to be observed.
5.3 Budget, debt & insolvency counselling
Information/purpose: Provision of budget, debt and insolvency counselling.
Legal basis: Performance of the service agreements (pursuant to Article 6(1)(b) GDPR).
Categories of data:
- Basic personal data: title, salutation/gender, first name, surname, date of birth
- Address data: street, house number, address supplements if applicable, postal code, city, country
- Contact data: telephone number(s), e-mail address(es)
- Organisational data: client company/location/business unit
- Data on the personal and financial situation:
- family, household and housing situation
- maintenance obligations
- income and employment situation
- assets, including account details and contracts
- level of indebtedness and data relating to creditors
Recipient companies:
- Creditors or creditor representatives
- Credit institutions
- Competent courts and/or trustees/insolvency administrators
- In anonymised form, the City of Hamburg and, where applicable, the federal government for statistical purposes
- IT service providers
Transfers to third countries: The processing of data in the context of e-mail communication takes place in principle within the European Union. In exceptional cases, access to personal data may occur from a third country (e.g. the USA) in the course of maintenance or support services. Such data transfers are based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or on the use of appropriate safeguards such as standard contractual clauses pursuant to Article 46 GDPR.
Retention period: 10 years after completion of the counselling.
5.4 Health & safety
Information/purpose: We collect personal data for the planning, organisation and delivery of events (e.g. workshops) on occupational safety and occupational medicine, and for the referral of occupational medicine services. In this context, health data is processed exclusively between the client companies and the occupational medicine providers. Examination results are not disclosed to us; we process solely the participation and master data required for administration and billing.
Legal basis: Performance of the service agreements (pursuant to Article 6(1)(b) GDPR).
Categories of data:
- Basic personal data (name, first name)
- Communication data (e-mail address)
- Organisational data (company name, company address)
- Billing-relevant data (participation in occupational medicine examinations)
- E-learning participation data (quiz results, certificates of participation)
- Technical data (e.g. IP address, device, browser)
Recipient companies: For the technical implementation of communication and internal processes, we work with service providers for data storage, e-mail and video communication. For the delivery of the e-learning courses and the management of participant data in this area, we work with further service providers. This includes reseller partners responsible for processing purchases and payments, as well as e-learning providers that host and deliver the courses. In addition, we work with data synchronisation service providers that ensure the smooth exchange of data between the systems.
Transfers to third countries: The processing of data in the context of data storage, e-mail and video communication takes place in principle within the European Union. In exceptional cases, access to personal data may occur from a third country (e.g. the USA) in the course of maintenance or support services. Such data transfers are based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or on the use of appropriate safeguards such as standard contractual clauses pursuant to Article 46 GDPR. Transfers to third countries outside the EU also occur in the context of using the course-related video services and in ensuring data synchronisation.
Retention period: The data of contact persons at the client companies are stored for as long as the customer relationship exists and are then deleted, unless statutory retention obligations apply or limitation periods need to be observed. Participation data are deleted three years after completion of the event.
5.5 Fürstenberg Campus
Information/purpose: Delivery of courses in the field of mental health.
Legal basis: Performance of the service agreements for registration for and participation in courses (pursuant to Article 6(1)(b) GDPR) and your consent when signing up for the newsletter (pursuant to Article 6(1)(a) GDPR).
Categories of data:
- Basic personal data (name, first name)
- Communication data (e-mail address)
- Organisational data (company name, company address)
- Customer history (e.g. products purchased)
- Contract billing and payment data (e.g. payment method, invoices)
- Participation data (quiz results, certificates of participation)
- Technical data (e.g. IP address, device, browser)
- Content data (e.g. videos, images, texts, audio, files)
Recipient companies: For the delivery of the courses and the management of participant data, we work with various service providers. This includes reseller partners responsible for processing purchases and payments, as well as e-learning providers that host and deliver the courses. Video service providers are responsible for delivering the online courses, while newsletter service providers send the newsletters to participants in accordance with our declaration of consent. In addition, we work with data synchronisation service providers that ensure the smooth exchange of data between the systems. For surveys conducted in the course of the events, a corresponding service provider may be used.
Transfers to third countries: The processing of data in the context of data storage and e-mail communication takes place in principle within the European Union. In exceptional cases, access to personal data may occur from a third country (e.g. the USA) in the course of maintenance or support services. Transfers to third countries also occur in the context of using the course-related video services and in ensuring data synchronisation. Such data transfers are based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or on the use of appropriate safeguards such as standard contractual clauses pursuant to Article 46 GDPR.
Retention period: Participation data is deleted three years after course completion; newsletter-related data is retained as long as there is active interaction.
5.6 myFürstenberg (Domain: mein.fuerstenberg-institut.de)
Information/purpose: Provision of client-specific content and information on the services booked with Fürstenberg Institut (e.g. coaching and counselling, media library, events), booking of individual counselling sessions, and provision of a chat function. For the provision of video and audio media, please see Section 5.7 Provision of media.
Legal basis:
- Our legitimate interest in providing the website and in the security of operations (pursuant to Article 6(1)(f) GDPR)
- Your consent for logging in with a personal profile (pursuant to Article 6(1)(a) GDPR)
- For providing the chat to interested clients, a separate consent may be requested where applicable (pursuant to Article 6(1)(a) GDPR)
Categories of data:
- Access to the website (usage data):
- browser type/version
- IP address
- date and time of page access
- operating system used
- URL of the previously visited website
- Registration/log-in on the website
- contact data (name, e-mail address)
- organisational data (client company/location/business unit)
- Use of the chat
- technically necessary cookies
- chat content
Recipient companies: We transmit the data collected for processing to the relevant internal departments and external support service providers in line with the purposes required, e.g. ensuring data integrity. The data are hosted in a data centre in Hamburg.
Our processing of data relies to a large extent on the involvement of support and hosting service providers that make storage and processing capacity available to us in their data centres and that also process personal data on our behalf and in accordance with our instructions. For the provision of the chat functions, we use a service provider that processes the data on systems within the European Economic Area.
Transfers to third countries: No transfers to third countries take place by Fürstenberg Institut.
Retention period: If you register with a personal profile, we generally store your data for the duration of the customer relationship with your company. You may request the deletion of your login data at any time. Booked appointments are retained for the duration of the customer relationship with your company. Website usage data are deleted no later than 72 hours after collection.
5.7 Provision of media
Information/purpose: To support the delivery of our services, we additionally provide media content such as videos and podcasts. This content supports the transfer of knowledge in the context of our events and beyond. For the technical provision, we use platforms of external providers. When you access the respective content, a connection to the servers of these third-party providers may be established. In doing so, personal data – in particular IP addresses and usage data – are processed. The providers may use cookies or similar technologies and may also process data for their own purposes.
Legal basis: Our legitimate interest in providing media content in an appealing and functional manner (pursuant to Article 6(1)(f) GDPR) and your consent, where you have given it via the cookie consent tool (pursuant to Article 6(1)(a) GDPR).
Platforms used:
- Vimeo (provider: Vimeo Inc., 330 West 34th Street, 5th Floor, New York, New York 10001, USA). Vimeo provides the technical infrastructure for the provision of video content. Privacy policy: https://vimeo.com/privacy
- SoundCloud (provider: SoundCloud Global Limited & Co. KG, Rheinsberger Str. 76/77, 10115 Berlin). SoundCloud is used to provide podcasts. Privacy policy: https://soundcloud.com/pages/privacy
Transfers to third countries: When using Vimeo or SoundCloud, personal data may be transferred to so-called third countries (e.g. the USA). These transfers are made by the respective platform providers within their own data protection responsibility. As far as possible, these providers rely on appropriate safeguards, e.g. EU standard contractual clauses or adequacy decisions, e.g. the EU-U.S. Data Privacy Framework. We have no influence on the actual processing carried out by the third-party providers.
5.8 Satisfaction surveys
Information/purpose: To evaluate the quality of our services, links to online surveys may be sent after counselling sessions and events. Participation in such surveys is voluntary. The processing of survey responses may take place by means of unique one-time links, which can establish a link to an identifiable person for a short period of time. However, the evaluation and use of the results takes place without any link to an identifiable person in order to preserve anonymity.
Legal basis: Your consent (pursuant to Article 6(1)(a) GDPR).
Recipient companies: To conduct the surveys, we use an external service provider. This service provider processes your data exclusively on our behalf and in accordance with our instructions. No data are passed on to third parties other than those necessary to conduct the survey.
Transfers to third countries: No transfers to third countries take place.
Retention period: The link to an identifiable person is anonymised in each case upon completion of the survey.
6. Collection and processing of business partner data
Information/purpose: We process personal data of business partners as well as employees and representatives of suppliers, service providers and companies that lease premises to us (e.g. building and infrastructure services) for the purpose of making contact, of communication in the context of initiating and performing contracts, and of handling requests, complaints and maintaining contract data. In addition, we use the data to schedule appointments and to send newsletters to existing customers.
Legal basis: Processing is carried out to perform existing or initiated contractual relationships or service agreements (pursuant to Article 6(1)(b) GDPR). Insofar as communication with service providers and client companies and the sending of newsletters to existing customers (in compliance with Section 7(3) UWG [Act Against Unfair Competition]) is concerned, processing is based on our legitimate interest in efficient communication and direct marketing in connection with our services (pursuant to Article 6(1)(f) GDPR).
Source of data: Where we do not collect the contact data directly from you, we receive them from the company with which we have a contractual relationship, or from publicly accessible sources.
Categories of data:
- Basic personal data: first name, surname
- Company address data: street, house number, postal code, city, country
- Contact data: telephone number(s), e-mail address(es)
- Organisational data: client company, supplier or service provider, and function
Recipient companies: For the technical implementation of communication and internal processes, we work with various IT service providers. These are service providers for sending newsletters, for data storage, e-mail, scheduling, surveys and video communication.
Transfers to third countries: The processing of data in the context of data storage, e-mail, scheduling, surveys and video communication takes place in principle within the European Union. In exceptional cases, access to personal data may occur from a third country (e.g. the USA) in the course of maintenance or support services. Such data transfers are based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or on the use of appropriate safeguards such as standard contractual clauses pursuant to Article 46 GDPR.
Retention period: We delete the data arising in the course of communication and cooperation with service providers and client companies once storage is no longer necessary, unless statutory retention obligations apply or limitation periods need to be observed. We generally delete the contact data of contact persons three years after the end of the business relationship, unless they are still required to process outstanding receivables or liabilities, to fulfil statutory retention obligations, or for the establishment, exercise or defence of legal claims.
The following information describes how your personal data are processed when, on behalf of your company, you are interested in our services or events and contact us by e-mail, telephone or via our contact forms (at www.fuerstenberg-institut.de/kontakt and www.campus.fuerstenberg-institut.de/kontakt).
Information/purpose: Prospecting/enquiry handling (preparation of quotations, scheduling of personal sales meetings).
Legal basis: Performance of pre-contractual measures carried out at your request (pursuant to Article 6(1)(b) GDPR).
Categories of data:
- Basic personal data: first name, surname
- Company address data: street, house number, postal code, city, country
- Contact data: telephone number(s), e-mail address(es)
- Organisational data: company/function
Recipient companies: For the technical implementation of communication and internal processes, we work with various IT service providers. These are service providers for data storage and e-mail communication.
Transfers to third countries: The processing of data in the context of data storage and e-mail takes place in principle within the European Union. In exceptional cases, access to personal data may occur from a third country (e.g. the USA) in the course of maintenance or support services. Such data transfers are based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or on the use of appropriate safeguards such as standard contractual clauses pursuant to Article 46 GDPR.
Retention period: We store the data arising in connection with prospecting for as long as an interactive exchange exists and delete it thereafter, unless statutory retention obligations preclude deletion or we still require the data for the establishment or defence of legal claims.
Information/purpose: To protect our office premises, video door-entry systems (doorbell cameras) are in place at our locations. These are activated when the doorbell is pressed. No recording takes place; the image is only briefly displayed to our staff at reception.
Legal basis: Our legitimate interest in protecting our property (pursuant to Article 6(1)(f) GDPR).
Recipient companies: No transmission to third parties takes place.
Transfers to third countries: No transfers to third countries take place.
Retention period: No recording takes place.
Information/purpose: Identification, making contact, communication for the initiation of contracts, selection of applicants, applicant pool.
Legal basis: Your consent (pursuant to Article 6(1)(a) GDPR in conjunction with Section 26 BDSG (Federal Data Protection Act) and Article 88 GDPR).
Categories of data:
- Basic personal data
- Address data
- Contact data
- Application data
Recipient companies: For the technical implementation of communication and internal processes, we work with various IT service providers. These are service providers for data storage and e-mail communication.
Transfers to third countries: The processing of data in the context of data storage and e-mail takes place in principle within the European Union. In exceptional cases, access to personal data may occur from a third country (e.g. the USA) in the course of maintenance or support services. Such data transfers are based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or on the use of appropriate safeguards such as standard contractual clauses pursuant to Article 46 GDPR.
Retention period: 6 months. If you have given us your consent to store your data in our applicant pool, we store your data for up to 2 years or until you withdraw your consent.
The Fürstenberg Institut records a set of general data and information with each access to its websites. This general data is stored in the server log files.
Information/purpose: The data collected serves to establish the connection, to correctly display the content of the website, to detect attacks on our site based on unusual activity, and for general error diagnosis.
Legal basis: Our legitimate interest in the proper functioning of the services, the security of data and business processes, the prevention of misuse, and the prevention of damage caused by interference with information systems (pursuant to Article 6(1)(f) GDPR).
Categories of data: Access data: date and time of the visit to our service; the page from which the accessing system reached our site; the pages called up during use; session identification data (session ID); and the following information of the accessing computer system: internet protocol address used (IP address), browser type and version, device type, operating system, and similar technical information.
Recipient companies: To detect and prevent attacks exploiting security gaps or vulnerabilities, we work with specialised IT security service providers. In the event of a cyberattack, data may be passed on to the competent law enforcement authorities.
Transfers to third countries: No transfers to third countries take place.
Retention period: 7 days.
Information/purpose: Analysing user behaviour by means of tracking helps us to review the effectiveness of our services, to optimise them and adapt them to users’ needs, and to troubleshoot errors. Tracking used to measure the success of advertising campaigns serves to optimise our advertisements for the future.
Legal basis: Your consent (pursuant to Article 6(1)(a) GDPR).
Information on the tracking methods used can be found in the data protection settings (consent management tool).
12.1 Right to object
If we process your personal data for direct marketing purposes, you have the right to object at any time with future effect to the processing of personal data concerning yourself for such marketing, insofar as it is related to such direct marketing.
You also have the right to object, on grounds relating to your particular situation, at any time with future effect to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR.
You can exercise your right to object free of charge. You can contact us using the contact details above.
12.2 Right of access
You have the right to know whether personal data concerning you is processed by us, what personal data this may be, and further information in accordance with Article 15 GDPR.
12.3 Right to rectification
You have the right to demand that we correct incorrect personal data affecting you (Article 16 of the GDPR). Taking the purpose of processing into account, you have the right to demand that incomplete personal data be completed – even in the form of a supplementary explanation.
12.4 Right to erasure (“Right to be forgotten”)
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the grounds specified in Article 17(1) GDPR applies and the processing is not necessary for one of the purposes specified in Article 17(3) GDPR.
12.5 Right to restriction of processing
You are entitled to request a restriction on the processing of your personal data if one of the conditions set out in Article 18(1)(a) to (d) GDPR is met.
12.6 Right to data portability
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us or to have it transmitted directly by us, where technically feasible. This applies wherever the basis for the processing is consent or a contract and the data is processed automatically. This therefore does not apply to data held only in paper form.
12.7 Right to withdraw consent
If the processing is based on your consent, you have the right to withdraw your consent at any time. This does not affect the lawfulness of the processing carried out on the basis of the consent until revocation. You can contact us using the contact details above.
12.8 Right to complain
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for Fürstenberg Institut is The Hamburg Commissioner for Data Protection and Freedom of Information.