Privacy Policy

Controller

The controller responsible for data processing within the meaning of the GDPR is:

LEADBeyond GmbH, Tölzer Str. 1, 82031 Grünwald, Germany. Email: talents@LEADBeyond.de.

If you have any questions about data protection, you can contact us at any time at the address above.

What the platform does

The platform is used to run 360° leadership feedback. Participants assess themselves, nominated feedback providers (raters) submit their assessments, and the results are combined into an individual report. The platform is generally used on behalf of the company (client) that commissions the feedback.

Which data we process

• Account and contact data: name, email address, preferred language, and a password stored in encrypted (hashed) form.
• Assessment data: your questionnaire responses (ratings on a scale of 1 to 6), optional free-text feedback, and your role and assignment within the respective assessment.
• Usage and log data: technical data generated when you sign in and use the platform (e.g. session information as well as error and security logs).

Contact requests via the website

If you send us a request via the contact form on the public pages, we process the details you enter (name, business email address, company, optionally role and message) and the type of your request in order to handle and answer it. We also record which page you opened the form from, the article and call-to-action that led you there and, where different, the first page you visited in that session, and, where available, the category of the referring source (e.g. search engine, AI assistant) and, where identifiable, its hostname (e.g. "chatgpt.com"), and campaign parameters of the address you visited, so we understand which content prospects reach us through. Only plain campaign labels are accepted as campaign parameters; any other value is discarded and not stored. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request) and, for the origin details, Art. 6(1)(f) GDPR (our legitimate interest in the effectiveness of our content). The request is delivered as an email to our mailbox; no automated decision-making or profiling takes place. The data is deleted once your request has been fully handled and no statutory retention obligations apply.

Usage statistics of the public pages

On the public information pages we record, without cookies and without third-party analytics services, which pages are viewed in which language, whether prompts to start a conversation are shown and clicked, whether the contact form was started, submitted or rejected because of an invalid entry, and whether a request resulted from it, and from which category of source (e.g. search engine, AI assistant, direct visit) a visit originates, and, where identifiable, its hostname (e.g. “chatgpt.com”). If you click an onward link to another website (e.g. to book a call), we additionally record that destination’s hostname. For the form steps we count only that the step happened — never what you entered. We also record a coarse device class (mobile, tablet or desktop), which is not a device identifier. Where the address visited carries campaign parameters, those are counted too — as a plain campaign label only; any other value is discarded. These events themselves contain no IP addresses or device or browser identifiers, and they are not linked to any person or session. The connection-level data our hosting provider processes to technically deliver the pages in the first place (such as the IP address that is part of every HTTP request) is unaffected by this and already covered above under “Recipients and processors”. The events are stored in our own database, operated for us in the EU (Frankfurt am Main server region) by our processor Supabase named above. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in improving our content).

Purposes and legal bases

We process this data to provide the feedback platform, to run and evaluate the assessment, and to ensure technical operation and security.

Depending on the context, the legal bases are the performance of a contract or processing on behalf of the client (Art. 6(1)(b) GDPR), your consent (Art. 6(1)(a) GDPR) where such consent is obtained, and our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR). The precise allocation of roles (controller/processor) and the applicable legal bases will be finalised as part of the legal review.

Anonymity and confidentiality

Feedback is shown only in aggregated and anonymised form. The results of a feedback group are displayed only once a minimum number of responses has been submitted (threshold), so that no conclusions can be drawn about individual feedback providers. Individual ratings by individual raters are not disclosed to the participant in an attributable way.

No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. In the current version, free-text feedback is not analysed, clustered or summarised by AI; it is displayed solely in its original, threshold-protected form.

Recipients and processors

To provide the platform we use carefully selected service providers that process data on our behalf and on our instructions (processing under Art. 28 GDPR):

• Supabase – database, authentication and file storage.
• Vercel – hosting and delivery of the application (server region Frankfurt am Main).
• Resend – sending of transactional emails (e.g. invitations and reminders), including the delivery reports (e.g. delivered, rejected).
• Sentry – error and stability monitoring, where enabled.

The platform is designed for data storage within the EU. Where individual providers process data outside the EU/EEA, this is done on the basis of appropriate safeguards (in particular EU standard contractual clauses). The complete list of processors, the respective processing regions and the data processing agreements in place will be finalised as part of the legal review.

Storage period

We store personal data only for as long as necessary for the purposes described or as required by statutory retention obligations. Once an assessment is completed or the purpose no longer applies, data is deleted or anonymised. The specific storage and deletion periods will be finalised before the production launch.

Cookies and local storage

We use only technically necessary cookies: some for your login session, and others for settings you make yourself in the application — for example your selected display language or the view you last opened — which are stored for up to one year. We also use your browser's local storage (localStorage) to remember individual display settings you have chosen. No tracking, analytics or advertising cookies are used. Details can be found in our Cookie Policy. The legal basis for technically necessary cookies — both for your login session and for settings you have chosen yourself — is Section 25(2) no. 2 TDDDG.

Your rights

Under the GDPR you have the following rights:

• access to the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing (Art. 21 GDPR), and
• withdrawal of a given consent with future effect (Art. 7(3) GDPR).

To exercise your rights, an informal message to talents@LEADBeyond.de is sufficient.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany.

Changes to this privacy policy

We will update this privacy policy if our data processing or the legal situation changes. The version published on this page applies.