SANDRA NIETHEN consulting
Privacy Policy
Sandra Niethen Consulting takes the protection of your personal data seriously. This Privacy Policy explains what information we collect when you visit our website (sandra-niethen.com), contact us, or use our services, and how we use, store and protect that information.
This policy applies to all processing of personal data by Sandra Niethen Consulting and complies with the General Data Protection Regulation (GDPR) and applicable German data protection law.
1. Controller
The controller responsible for the processing of your personal data is:
Sandra Niethen Consulting
Sonderburgstr. 11
40545 Düsseldorf, Germany
Phone: +49 171 195 6777
Website: sandra-niethen.com
2. Data We Collect
2.1 When You Visit Our Website
When you access our website, our web server automatically records the following data in server log files:
- IP address (anonymised where technically possible)
- Date and time of access
- Pages and files accessed
- Browser type and version
- Operating system
- Referring URL
This data is processed on the basis of Art. 6 (1) (f) GDPR (legitimate interest) to ensure the technical functioning of the website and to detect and prevent misuse. It is deleted after 14 days unless required for longer retention for security purposes.
2.2 When You Contact Us
When you contact us by e-mail, telephone or via a contact form, we collect:
- Your name
- Your e-mail address and/or phone number
- The content of your message
- Date and time of the enquiry
This data is processed on the basis of Art. 6 (1) (b) GDPR (pre-contractual measures or contract performance) or, where applicable, Art. 6 (1) (f) GDPR (our legitimate interest in responding to your enquiry). We retain this data for as long as necessary to respond to your enquiry, and for up to three years thereafter for documentation purposes unless a longer retention period is required by law.
2.3 When You Engage Our Services
In the context of a consulting or coaching engagement, we may process additional personal data including:
- Contact and identification data
- Professional background and organisational context
- Information shared during sessions, assessments or written exchanges
This data is processed on the basis of Art. 6 (1) (b) GDPR and, where it concerns particularly sensitive categories of data (e.g. health-related information), with your explicit consent pursuant to Art. 9 (2) (a) GDPR. It is retained for the duration of the engagement and for up to ten years thereafter in accordance with applicable commercial and tax law retention obligations.
2.4 Coaching Feedback Form
Clients can give feedback on their coaching via the online form on our website (sandra-niethen.com/documents/feedback/). We process:
- your name and, if you provide it, your e-mail address, the session or period covered and the date;
- your ratings and free-text answers;
- if you are willing to provide a testimonial: its text, how your name may appear, and your consent to publication including date and time;
- the date and time of submission.
Purpose and legal basis: We use your feedback solely to evaluate and further develop our coaching work. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in quality assurance and the further development of our services. You may object to this processing at any time (Art. 21 GDPR). Testimonials are published on our website, on LinkedIn and in materials of Sandra Niethen Consulting only on the basis of your separate, voluntary consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future, e.g. by e-mail to sandra@sandraniethen.com. Providing feedback is entirely voluntary; not doing so has no consequences for you.
How the data is handled: The form is transmitted in encrypted form (TLS). Our hosting provider’s server forwards your answers by e-mail directly to Sandra Niethen’s mailbox; they are not stored on the web server. The form uses no cookies, tracking or third-party services, and no copy is sent to the e-mail address entered. Please do not include confidential company information or health details in your free-text answers.
Recipients: Only Sandra Niethen has access to your feedback. Technical service providers (see section 4) are involved as processors. Published testimonials can be viewed by anyone in the form you have approved.
Retention: Feedback is deleted no later than three years after receipt. Testimonials are published until you withdraw your consent; we keep the record of your consent for up to three years after the testimonial is removed in order to demonstrate that it was given (Art. 7 (1) GDPR).
2.5 Requesting the Board Profile
You can request Sandra Niethen’s board profile via the form on our website (sandra-niethen.com/documents/). We process your name, e-mail address, company or organisation, and – if you provide them – your role and the reason for your request, together with the date and time of your request.
Purpose and legal basis: We use this information to decide on your request and, if approved, to send you the profile by e-mail. The legal basis is Art. 6 (1) (b) GDPR (steps taken at your request) and Art. 6 (1) (f) GDPR; our legitimate interest lies in knowing to whom our profile is passed on.
How the data is handled: The form is transmitted in encrypted form (TLS). Your request is forwarded by e-mail to Sandra Niethen and stored in a non-public area of our web server until it has been handled. As soon as the profile has been sent or the request declined, your details are deleted from the web server; unhandled requests are deleted automatically after 30 days. The e-mail notification and any correspondence are kept in Sandra Niethen’s mailbox like other business enquiries (see section 7).
3. Cookies and Analytics
Our website currently does not use tracking cookies or third-party analytics tools. Should this change, this Privacy Policy will be updated accordingly and, where required by law, your prior consent will be obtained.
Technically necessary cookies required solely for the functioning of the website (e.g. session management) may be set without your consent on the basis of Art. 6 (1) (f) GDPR.
4. Disclosure of Data to Third Parties
We do not sell, rent or trade your personal data. We may share your data only in the following circumstances:
- With service providers who assist us in operating our website or delivering our services (e.g. IT hosting, e-mail infrastructure), subject to appropriate data processing agreements pursuant to Art. 28 GDPR;
- Where we are legally obliged to do so (e.g. in response to a court order or request from a supervisory authority);
- In connection with a business transfer, merger or acquisition, subject to appropriate confidentiality and data protection obligations.
We currently use the following service providers as processors:
- Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus – website hosting and sending of the e-mails generated by our contact and feedback forms;
- Microsoft Ireland Operations Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland – e-mail mailbox (Microsoft 365). Data is stored within the EU Data Boundary; where Microsoft Corporation in the USA has access in individual cases, this is based on the EU–US Data Privacy Framework adequacy decision and the EU Standard Contractual Clauses.
We do not transfer personal data to recipients outside the European Economic Area (EEA) unless adequate safeguards are in place in accordance with Chapter V GDPR.
5. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These include encrypted transmission (TLS/SSL), access controls and regular security reviews.
Whilst we take data security seriously, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any data breach in accordance with applicable law.
6. Your Rights
Under the GDPR, you have the following rights in relation to your personal data:
- Right of access (Art. 15 GDPR) — to obtain confirmation of whether and how we process your data, and to receive a copy;
- Right to rectification (Art. 16 GDPR) — to have inaccurate data corrected;
- Right to erasure (Art. 17 GDPR) — to request deletion of your data where there is no lawful basis for continued processing;
- Right to restriction of processing (Art. 18 GDPR) — to request that we limit processing in certain circumstances;
- Right to data portability (Art. 20 GDPR) — to receive your data in a structured, commonly used format;
- Right to object (Art. 21 GDPR) — to object at any time to processing based on legitimate interests;
- Right to withdraw consent (Art. 7 (3) GDPR) — where processing is based on your consent, to withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us using the contact details in section 1. We will respond within the statutory period (generally one month).
You also have the right to lodge a complaint with a supervisory authority. The competent authority for Sandra Niethen Consulting is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2–4, 40213 Düsseldorf
www.ldi.nrw.de
7. Retention Periods
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specific retention periods are set out in the relevant sections above. When data is no longer required, it is securely deleted or anonymised.
8. Links to Third-Party Websites
Our website may contain links to third-party websites. We have no control over the content or privacy practices of those sites and are not responsible for their data processing. We recommend that you review the privacy policies of any third-party sites you visit.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The current version will always be available on our website. Where changes are material, we will notify you by appropriate means.