Privacy Policy

The controller responsible for processing personal data is:

Please contact us using these details for questions about data protection or to exercise your rights.

Depending on the purpose, we process personal data on the following legal bases:

• Article 6(1)(a) GDPR, where you have given consent.
• Article 6(1)(b) GDPR, where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
• Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation.
• Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests or those of a third party, provided that your interests or fundamental rights and freedoms do not override those interests.

For recruitment, Section 26 of the German Federal Data Protection Act (BDSG) also applies where relevant.

The purposes and legal bases for individual processing activities are explained below.

When you visit our website, technical data are processed to deliver the website and maintain its security and reliability. These data include your IP address, the date and time of access, requested pages and files, browser and operating system information, referring website and technical access or error information.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to provide a functioning, secure website and detect or investigate misuse and technical faults.

Our hosting provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Server logs are retained for the period applied by the hosting provider for the operation and security of the website, unless longer retention is necessary to investigate a specific security incident or establish, exercise or defend legal claims.

Information about any international transfers associated with hosting is provided in Section 8.

Our website does not use analytics or marketing cookies. The only information stored on your device for this website is your choice in our cookie notice. That choice is saved in your browser's local storage, without a fixed expiry, until you clear the stored data for www.maxbridge.de. The provider is Maxbridge Consulting GmbH. The purpose is to remember whether you selected necessary technologies only or accepted all, so that the notice is not shown again on every visit.

Storing information on your device or accessing information already stored on it is subject to Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Consent is not required where the statutory conditions for strictly necessary storage or access are met. Other storage or access requires your prior consent.

Where personal data are processed through strictly necessary technologies, the legal basis is Article 6(1)(f) GDPR, unless another legal basis applies. Our legitimate interest is to provide the requested website functions. We do not use optional analytics or marketing technologies on this website.

The consent notice is provided by us. We do not use an external consent-management provider. You can change or withdraw your choice at any time with effect for the future by clearing the stored site data for www.maxbridge.de in your browser, or by emailing jan@maxbridge.de. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

When you contact us by email, telephone, post or an available website form, we process the information you provide, including your name, business contact details, company, role, message and relevant correspondence.

We use these data to respond to enquiries, arrange meetings and manage business relationships.

Where your enquiry concerns a contract with you or steps requested by you before entering into a contract, processing is based on Article 6(1)(b) GDPR. In other cases, including communications with representatives of corporate clients, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to respond to enquiries and conduct business communications. Article 6(1)(c) GDPR applies where statutory obligations require processing.

We retain enquiries until they have been resolved and further retention is no longer necessary. Business correspondence is retained for applicable statutory periods or where necessary to establish, exercise or defend legal claims.

The service providers used for these activities are the providers that operate our email and IT systems. Any international transfers are described in Section 8.

We process names, professional roles, company names and business postal addresses obtained from North Data (northdata.de), a publicly accessible business information platform, to send relevant postal information about our advisory services to prospective business clients. We also record mailing dates, correspondence and marketing objections.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to acquire business clients through postal marketing relevant to their company activities and professional responsibilities. We balance this interest against the rights and interests of the individuals concerned.

Access is limited to authorised staff and the service providers necessary for storing contact data and preparing or delivering our letters, including IT service providers and postal operators.

We retain prospective contact data while they are used for this postal marketing, starting from the date we obtain them. Further retention for a separate purpose, such as an ongoing business relationship or the establishment, exercise or defence of legal claims, is subject to its own legal basis.

You may object at any time, without giving reasons, to the processing of your personal data for direct marketing. Please email jan@maxbridge.de or write to the address in Section 1. We will then stop processing your data for direct marketing.

Following an objection, we retain only the minimum information necessary in a suppression list to prevent further marketing, for as long as required to respect that objection. This processing serves to comply with Article 21(3) GDPR and is based on Article 6(1)(c) GDPR.

You are not required to provide personal data or respond to our letters. The use of data for postal marketing does not constitute permission to contact you through other marketing channels.

When you apply for a position with us, we process the information contained in your application, including contact details, qualifications, employment history, application documents and correspondence.

We use these data to assess your suitability, conduct the recruitment process and decide whether to establish an employment relationship. Processing is based on Section 26(1) BDSG and, where applicable, Article 6(1)(b) GDPR.

Access is limited to those involved in recruitment and the email provider that receives applications sent to hr@maxbridge.de.

If your application is successful, relevant information is transferred to your personnel record. If no employment relationship is established, we delete your application data two months after notifying you of the decision, unless longer retention is necessary to establish, exercise or defend legal claims. Such retention is based on Article 6(1)(f) GDPR; our legitimate interest is to protect our legal position.

We retain applications for future opportunities only with your separate consent and for the period specified when that consent is obtained. You may withdraw this consent at any time.

Personal data are accessible only to authorised staff and recipients who require them for the purposes described in this policy. Where service providers process data on our behalf, we enter into data processing agreements where required by Article 28 GDPR.

Data may also be disclosed to public authorities or professional advisers where required by law or necessary to establish, exercise or defend legal claims.

Website hosting is carried out by Vercel Inc. in the United States. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework. Where that framework does not cover a transfer, Vercel provides the European Commission's standard contractual clauses. A copy of those safeguards is available at vercel.com/legal/dpa, and you can also request it from jan@maxbridge.de. Vercel's certification can be viewed on the Data Privacy Framework list.

We retain personal data only for as long as necessary for the stated purposes, subject to applicable legal obligations and justified retention for legal claims. Specific retention periods or criteria are set out in the relevant sections above.

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure. These measures are reviewed in light of the nature of the data and the risks of processing.

Subject to the applicable legal conditions, you have the right to:

• Obtain access to your personal data and a copy of them.
• Request correction of inaccurate or completion of incomplete data.
• Request erasure of your data.
• Request restriction of processing.
• Receive data you have provided in a structured, commonly used and machine-readable format, and request their transfer to another controller, where processing is automated and based on consent or a contract.
• Withdraw consent at any time with effect for the future.
• Object to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR on grounds relating to your particular situation.

Where your data are processed for direct marketing, you may object at any time without giving reasons. We will then stop processing your data for that purpose.

To exercise your rights, contact jan@maxbridge.de or write to the address in Section 1.

You may also lodge a complaint with a data protection supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. The supervisory authority responsible for us is:

You are generally not required to provide personal data. However, information may be necessary to respond to an enquiry, assess an application or enter into and perform a contract. If necessary information is not provided, we may be unable to carry out the requested activity. Any applicable statutory or contractual requirements will be explained in the relevant context.

We do not use automated decision-making, including profiling, that produces legal effects or similarly significantly affects you in connection with the activities described in this policy.

We may update this policy to reflect changes to our processing activities or legal requirements. Where required, we will inform affected individuals separately of material changes.