Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

2. Data Protection Officer

Pursuant to Art. 37 GDPR in conjunction with § 38 BDSG, ISG is currently not required to appoint a data protection officer. For data protection enquiries, please contact us directly at the address given above.

3. Legal Bases for Processing

ISG processes personal data on the following legal bases:

• Art. 6(1)(a) GDPR – consent of the data subject
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR – compliance with a legal obligation
• Art. 6(1)(f) GDPR – protection of the legitimate interests of ISG or third parties

4. Collection and Processing of Personal Data

4.1 Website Visitors (i-sg.eu)

When you visit our website, our web host automatically collects data in so-called server log files. The following information is stored:

• IP address of the requesting device (anonymised after a short period)
• Date and time of access
• Name and URL of the retrieved file
• Volume of data transferred
• Notification of successful retrieval
• Browser type and version
• The user's operating system
• Referrer URL (previously visited page)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and functionality of the website). The data is automatically deleted after 30 days.

4.2 Contact Form and Email Contact

When you contact us via the contact form on our website or by email, we process the following data:

• Name, email address (required fields)
• Company, phone number (optional)
• The content of your message

This data is used exclusively to process your enquiry. Legal basis: Art. 6(1)(b) or (f) GDPR. Retention period: the data is deleted once your request has been fully processed, unless statutory retention obligations apply.

4.3 Contract Processing and Advisory Engagements

In connection with initiating and performing advisory and service contracts, we process the following categories of personal data:

• Contact data (name, address, email, phone)
• Contract data and communication history
• Payment and invoicing data
• Professional qualifications and titles, where applicable

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention obligations, in particular § 257 HGB, § 147 AO). Retention period: 10 years after the end of the contract (commercial and tax law retention obligations).

4.4 Academy Registrations (Seminars, Workshops)

When you register for seminars and workshops, we process:

• First and last name, email address
• Company / organisation
• Billing address
• Payment data

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Retention period: in accordance with statutory retention obligations (up to 10 years).

4.5 Newsletter and Marketing Communication

If you subscribe to our newsletter or specialist publications, we process your email address and optional details (name, company). This is done on the basis of your express consent (Art. 6(1)(a) GDPR, double opt-in procedure). You can withdraw your consent at any time with effect for the future (unsubscribe link in the newsletter or by email to info@i-sg.eu).

5. Cookies and Tracking Technologies

Our website uses cookies. Cookies are small text files stored on your device. We distinguish between:

• Strictly necessary cookies: these are required for the operation of the website (no consent required, Art. 6(1)(f) GDPR).
• Analytics cookies: for the statistical analysis of usage behaviour – only with your consent (Art. 6(1)(a) GDPR).
• Marketing cookies: for personalised advertising – only with your consent.

You can adjust your cookie settings at any time via our cookie consent tool or in your browser settings, or reject all cookies. Further information can be found in our Cookie Policy.

6. Services and Third-Party Providers Used

6.1 Hosting / Web Server

Our website is operated on servers of a German or EU-based web hosting provider. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place.

6.2 Google Analytics (where active)

Where Google Analytics is used, this is only done with your consent. IP addresses are anonymised (IP masking). Processing in the USA takes place on the basis of standard contractual clauses (SCC) pursuant to Art. 46(2)(c) GDPR. You can object to analysis at: tools.google.com/dlpage/gaoptout

6.3 LinkedIn and Social Media

Our website may contain links to LinkedIn. When you access external pages, data may be transmitted to the respective provider. ISG has no influence over the data processing carried out by external platforms. Further information can be found in LinkedIn's privacy policy (linkedin.com/legal/privacy-policy).

6.4 Zoom / Video Conferencing Tools

Video conferencing tools such as Zoom may be used for advisory discussions and online seminars. In doing so, technical connection data and, where applicable, audio and video data are processed. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). We conclude data processing agreements with the providers.

7. Disclosure of Data to Third Parties

ISG only discloses personal data if:

• this is necessary for the performance of a contract (e.g. to subcontractors with a data processing agreement),
• there is a legal obligation (e.g. to tax authorities),
• there is express consent, or
• there is a legitimate interest following careful consideration.

Data is not disclosed to third parties for advertising purposes without consent. Data transfers to third countries outside the EU/EEA only take place on the basis of appropriate safeguards (adequacy decision, SCC, BCR).

8. Your Rights as a Data Subject

You have the following rights vis-à-vis ISG under the GDPR:

• Right of access (Art. 15 GDPR): you can request information about the data stored about you.
• Right to rectification (Art. 16 GDPR): you can request the correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): you can request the deletion of your data, provided no statutory retention obligations prevent this.
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR): you can object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR): with effect for the future
• Right to lodge a complaint with the supervisory authority (Art. 77 GDPR)

To exercise your rights, please contact: info@i-sg.eu

9. Right to Lodge a Complaint with the Supervisory Authority

The competent data protection supervisory authority for ISG is:

10. Data Security

ISG uses technical and organisational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. These include, among others, TLS encryption (HTTPS), access controls and regular security reviews.

11. Validity and Amendment of this Privacy Policy

This privacy policy is dated April 2026. ISG reserves the right to update this policy in the event of changes to the legal situation or to its data processing procedures. The current version is available on the website at i-sg.eu/datenschutz.