Privacy Policy

Privacy Policy

How to use this: Generate the standard sections with a reputable tool, then insert the tailored sections below, which describe your actual data processing.

2.1 Overview

The following notes give a simple overview of what happens to your personal data when you visit this website or use our Readiness Self-Check. Personal data is any data that can be used to identify you personally.

2.2 Controller

The controller responsible for data processing on this website is Dirk Schmidt (Groundwork Decisions); address and contact details as in the Legal Notice.

2.3 Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, objection, and to withdraw consent at any time, as well as to lodge a complaint with a supervisory authority.

2.4 General information

This site uses SSL/TLS encryption for security. Many processing operations require your explicit consent, which you can withdraw at any time with effect for the future.

2.5 Hosting

Our website is hosted by:

Namecheap, Inc. 4600 East Washington Street, Suite 300 Phoenix, AZ 85034, USA

When you visit the site, the provider processes access data on our behalf (see server log files). The legal basis is our legitimate interest in providing our offering securely and efficiently (Art. 6(1)(f) GDPR). As Namecheap is a US-based provider, personal data (in particular your IP address) may be transferred to the USA; where this occurs, the transfer is based on the EU Commission’s Standard Contractual Clauses (Art. 46 GDPR). A data processing agreement with the provider is to be concluded / confirmed.

Server log files: The provider automatically collects and stores information in server log files transmitted by your browser (browser type/version, operating system, referrer URL, host name, time of request, IP address). This data is not merged with other sources.

2.6 Website technology

This website is based on WordPress and the Elementor page editor. Technically necessary cookies may be set. Any non-essential cookies or services are only used with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

2.7 Readiness Self-Check (online form)

When you submit the Readiness Self-Check, we process your email address (required), optional details (name, organisation, role, type of organisation) and your answers and resulting assessment (scores per dimension, overall score, segment). Purposes: creating and sending your individual assessment and contacting you about our advisory services. Legal bases: your consent (Art. 6(1)(a) GDPR, given via the form checkbox) and pre-contractual measures at your request (Art. 6(1)(b) GDPR). Retention: until you withdraw consent or as long as needed to handle your request and any follow-up.

2.8 Processors and services used

n8n: Processing of the form data (assessment, dispatch, storage) runs via the automation platform n8n (n8n GmbH, Berlin). Processing takes place on servers within the European Union (Microsoft Azure, Frankfurt region, Germany); no transfer to a third country occurs in this processing. Data processing agreement under Art. 28 GDPR.

Google Workspace / Gmail: Assessment and notification emails are sent via Google Workspace / Gmail (Google Ireland Limited, Dublin, Ireland). Data processing agreement under Art. 28 GDPR; any transfer to the USA relies on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

Google Sheets: Requests are documented in Google Sheets (Google Ireland Limited). Same basis as above.

2.9 Booking requests (contact form)

Via our booking form you can request a conversation. We process your name, email address and optional details (organisation, phone number, your message) solely to handle your request and arrange an appointment. Legal bases: your consent (Art. 6(1)(a) GDPR) and pre-contractual measures (Art. 6(1)(b) GDPR). Technical processing and dispatch use the services named in 2.8 (n8n, EU; Google Workspace).

2.10 Aggregated evaluation (“Readiness Index”)

We also evaluate Self-Check results in aggregated, anonymised form to build industry benchmarks. In this form there is no personal reference. Legal basis for the anonymisation/aggregation is our legitimate interest in meaningful benchmarks (Art. 6(1)(f) GDPR).

2.11 Currency of this privacy policy

This privacy policy is current as of June 2026. We may need to amend it as our website develops or due to changed legal or regulatory requirements.