Privacy Policy

Preamble

With the following Privacy Policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") we process, for what purposes and to what extent. This Privacy Policy applies to all personal data processing carried out by us, both in the context of the provision of our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offering").

The terms used are not gender-specific.

Last updated: 18 May 2026

Table of Contents

Controller

Vincent Müller
Schlüsselweg 58
69221 Dossenheim, Germany

E-mail address: info@next-gen-governance.eu

Overview of Processing Activities

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of Data Processed

Categories of Data Subjects

Purposes of Processing

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases also be applicable in individual cases, we will inform you of these in the Privacy Policy.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. These include in particular the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains in particular special provisions on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated individual decision-making including profiling. Furthermore, data protection laws of the individual federal states may also apply.

Note on applicability of the GDPR and the Swiss FADP: These privacy notices serve both to provide information pursuant to the Swiss Federal Act on Data Protection (FADP) and to comply with the General Data Protection Regulation (GDPR). For this reason, please note that, for reasons of broader geographical applicability and comprehensibility, the terms of the GDPR are used. In particular, instead of the terms "processing" of "personal data", "overriding interest" and "particularly sensitive personal data" used in the Swiss FADP, the terms used in the GDPR, namely "processing" of "personal data" as well as "legitimate interest" and "special categories of data", are used. The legal meaning of these terms, however, continues to be determined in accordance with the Swiss FADP where it applies.

Applicability of data protection requirements in the country of domicile: In the country in which the controller is domiciled, national data protection provisions apply alongside the General Data Protection Regulation (GDPR).

Security Measures

We implement appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk.

The measures include in particular ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input of, disclosure of, ensuring availability of and segregation of the data. Furthermore, we have established procedures to ensure the exercise of data subject rights, the deletion of data and responses to data threats. We also take the protection of personal data into account as early as the development or selection of hardware, software and processes in accordance with the principle of data protection by design and by default.

Securing online connections through TLS/SSL encryption technology (HTTPS): To protect the data of users transmitted via our online services from unauthorised access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user's browser (or between two servers), thereby protecting the data from unauthorised access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions comply with the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is being transmitted securely and in encrypted form.

Transmission of Personal Data

In the course of our processing of personal data, it may happen that the data is transmitted to or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers entrusted with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

International Data Transfers

Data processing in third countries: If we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this takes place in the context of the use of third-party services or the disclosure or transmission of data to other persons, bodies or companies, this always takes place in compliance with the legal requirements.

For data transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of the EU Commission on 10 July 2023. In addition, we have concluded Standard Contractual Clauses with the respective providers that comply with the requirements of the EU Commission and establish contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: the DPF forms the primary protection level, while the Standard Contractual Clauses serve as an additional safeguard. Should changes occur within the DPF framework, the Standard Contractual Clauses serve as a reliable fallback option. This ensures that your data remains adequately protected even in the event of political or legal changes.

For the individual service providers, we will inform you whether they are certified under the DPF and whether Standard Contractual Clauses are in place. For further information on the DPF and a list of certified companies, please visit the website of the US Department of Commerce at https://www.dataprivacyframework.gov/.

For data transfers to other third countries, corresponding security measures apply, in particular Standard Contractual Clauses, explicit consents or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be found in the information offered by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en

General Information on Data Retention and Deletion

We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consents are revoked or no further legal bases for the processing exist. This applies to cases where the original purpose of processing no longer applies or the data is no longer required. Exceptions to this rule exist where statutory obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons or whose storage is necessary for legal prosecution or for the protection of the rights of other natural or legal persons must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that specifically applies to certain processing operations.

If multiple retention periods or deletion deadlines are specified for a piece of data, the longest period shall always be determinative. If a deadline does not expressly begin on a specific date and is at least one year, it automatically starts at the end of the calendar year in which the event triggering the deadline occurred. In the case of ongoing contractual relationships in the context of which data is stored, the event triggering the deadline is the time at which the termination or other end of the legal relationship takes effect.

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject under the GDPR, you have various rights, which arise in particular from Art. 15 to 21 GDPR:

Provision of the Online Offering and Web Hosting

We process users' data in order to be able to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or end device.

Further notes on processing operations, procedures and services:

Use of Cookies

The term "cookies" refers to functions that store and read information on users' end devices. Cookies can also be used for different purposes, for example for the functionality, security and comfort of online offerings as well as the creation of analyses of visitor flows. We use cookies in accordance with the statutory provisions. Where required, we obtain users' prior consent. Where consent is not necessary, we rely on our legitimate interests. This applies where storing and reading information is essential in order to be able to provide expressly requested content and functions. These include, for example, storing settings and ensuring the functionality and security of our online offering. Consent can be withdrawn at any time. We provide clear information about the scope and which cookies are used.

Notes on data protection legal bases: Whether we process personal data using cookies depends on consent. If consent is given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are set out above in this section and in the context of the respective services and procedures.

Retention period: With regard to retention period, the following types of cookies are distinguished:

General notes on withdrawal and objection (opt-out): Users can revoke the consents they have given at any time and also object to the processing in accordance with the legal requirements, including by means of the privacy settings of their browser.

Contact and Enquiry Management

When contacting us (e.g. by post, contact form, e-mail, telephone or via social media) as well as in the context of existing user and business relationships, the information provided by the enquiring persons is processed insofar as this is necessary to respond to the contact enquiries and any requested actions.

Further notes on processing operations, procedures and services:

Newsletter and Electronic Notifications

We send newsletters, e-mails and other electronic notifications (hereinafter "newsletter") only with the consent of the recipients or on the basis of a statutory provision. If the contents of the newsletter are specifically described when registering for the newsletter, those contents are determinative for the consent of the users. To sign up for our newsletter, it is normally sufficient to provide your e-mail address. However, in order to provide you with a personalised service, we may ask for your name for personalised address in the newsletter or for further information if this is necessary for the purpose of the newsletter.

Deletion and restriction of processing: We may retain unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before deleting them in order to be able to demonstrate a previously given consent. The processing of this data is limited to the purpose of a potential defence against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently respect objections, we reserve the right to store the e-mail address solely for this purpose in a blocklist (so-called "blocklist").

The logging of the registration process is carried out on the basis of our legitimate interests for the purpose of demonstrating that it was properly conducted. Insofar as we commission a service provider with the sending of e-mails, this is done on the basis of our legitimate interests in an efficient and secure sending system.

Content: Information about us, our services, promotions and offers.

Promotional Communication via E-Mail, Post, Fax or Telephone

We process personal data for the purposes of promotional communication, which may take place via various channels, such as e-mail, telephone, post or fax, in accordance with the statutory provisions.

Recipients have the right to withdraw consents given at any time or to object to promotional communication free of charge at any time via the contact options given above.

After withdrawal or objection, we store the data required to prove the previous authorisation to contact or send for up to three years after the end of the year of the withdrawal or objection on the basis of our legitimate interests. The processing of this data is limited to the purpose of a possible defence against claims. On the basis of the legitimate interest of permanently respecting the withdrawal or objection of users, we also store the data required to avoid renewed contact (e.g. depending on the communication channel, the e-mail address, telephone number, name).

Plug-ins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may include, for example, graphics, videos or maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the users, as they could not send the content to their browser without the IP address. The IP address is therefore required for the display of this content or functions. We endeavour to only use content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to analyse information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the user's device and may include technical information about the browser and operating system, referring websites, the time of visit and other details about the use of our online offering, and may also be linked to such information from other sources.

Notes on legal bases: Where we ask users for their consent to the use of third-party providers, the legal basis for data processing is the permission given. Otherwise, users' data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and user-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this Privacy Policy.

Privacy Information for Whistleblowers

In this section you will find information on how we handle data from persons who submit reports (whistleblowers), as well as from parties affected by and involved in our whistleblowing procedure.

Legal bases (Germany): Insofar as we process data to fulfil our legal obligations pursuant to the Whistleblower Protection Act (HinSchG), the legal basis for the processing is Art. 6(1)(c) GDPR and, in the case of special categories of personal data, Art. 9(2)(g) GDPR, § 22 BDSG, each in conjunction with § 10 HinSchG.

Types of data processed: In the context of receiving and handling reports and the subsequent whistleblower procedure, we may collect various data. These include in particular the data provided by a whistleblower, such as: name, contact details and location of the person making the report, names and data relating to possible witnesses or persons affected by the report, names and data relating to the persons against whom the report is directed, data about the alleged misconduct and other relevant details.

Special categories of personal data: It may occur that we collect special categories of personal data in the course of our activities, in particular when these are communicated by a whistleblower. These include health-related data of a person as well as data on racial or ethnic origin.

Use of our online forms: Please note that it is possible to submit reports anonymously. To ensure the security of your data when using our online forms, we recommend accessing them in the so-called "incognito mode" of your browser. You can open an incognito window as follows: a) On a Windows PC: Open your browser and press Ctrl+Shift+N; b) On a Mac: Open your browser and press Command+Shift+N; c) On mobile devices: Switch to private mode via the tab menu.

Providing a name: You have the option of submitting reports anonymously. Unless prohibited by national legislation, however, we recommend providing your name and contact details. This allows us to follow up on the report more effectively and, if necessary, to contact you directly.

Disclosure of data to third parties: Data related to the reports submitted are only passed on to third parties under certain circumstances. This is either a) if you have given us your express consent to do so, or b) if there is a legal obligation to pass on the data. Possible third parties include public authorities, government, regulatory or tax authorities if the disclosure is necessary to comply with a legal or regulatory obligation. We may also engage lawyers and other professional advisors within the scope of legal provisions. These are authorised to examine alleged misconduct and to take necessary measures following an investigation, such as initiating disciplinary or legal proceedings. In addition, carefully selected and monitored service providers may receive data for these purposes (e.g. operators of a web-based reporting system). These service providers are, however, contractually obliged within the scope of data processing to comply with the applicable data protection provisions.

Data retention and deletion: Personal data is only processed for as long as is necessary to fulfil the processing purposes described above. Once this data is no longer required for the stated purposes, it will be deleted.

Technical and organisational measures: We have implemented the necessary contractual, technical and organisational measures to ensure the security of all data processed by us. This data is processed exclusively for the specified purposes.

Changes and Updates

We ask you to regularly inform yourself about the content of our Privacy Policy. We adapt the Privacy Policy as soon as changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an action on your part (e.g. consent) or any other individual notification.

Where we provide addresses and contact information of companies and organisations in this Privacy Policy, please note that the addresses may change over time and please verify the details before contacting us.

Definitions

In this section, you will find an overview of the terms used in this Privacy Policy. Where terms are legally defined, their legal definitions apply. The following explanations, however, are primarily intended to aid understanding.

Based on the Privacy Policy Generator by Dr. Thomas Schwenke