Last updated: 31 August 2026
This is a convenience translation of our German privacy policy. In the event of any discrepancy between the German and the English version, the German version shall prevail.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
Executive Profiler GmbH & Co. KG
Baumbergeblick 24
48341 Altenberge
Registered office: Altenberge
Register court: Amtsgericht Steinfurt (Local Court of Steinfurt), HRA 7878
General partner: DELTACON Münster Verwaltungs GmbH
Registered office of the general partner: Münster
Register court: Amtsgericht Münster (Local Court of Münster), HRB 16900
Managing director of the general partner: Dirk Aaron Bohl
Telephone: +49 251 2373420
Mobile: +49 160 93776490
E-mail: kontakt@executive-profiler.com
Where Executive Profiler GmbH & Co. KG does not itself determine the purposes and essential means of the processing in relation to a specific service, but acts on behalf of another controller, the processing is carried out in accordance with that controller’s documented instructions and on the basis of the data protection agreement required for this purpose.
2. Scope, scope of activities and overview
This privacy policy explains how we process personal data in connection with our website and our entrepreneurial, diagnostic and advisory services.
The company’s scope of activities includes in particular the holding of shareholdings, the identification and assessment of business ideas, the introduction of investors and related transactions. This includes in particular management audits as well as the assessment and development of organisational structures. Building on this, we provide, among other things, executive profiling, management and leadership diagnostics, assessments, cultural evaluation, leadership and team matching, feedback discussions, executive coaching and further development services.
Executive Profiler GmbH & Co. KG does not itself carry out any recruitment placement, direct search or executive search of its own. Where it is called in as part of an executive search or selection process for which another company is responsible, its activity is limited to the agreed diagnostic or advisory service.
This privacy policy applies in particular where you
- visit our website,
- contact us via a form, by e-mail, by telephone or by any other means,
- take part in a management audit, executive profiling, assessment or other diagnostic service,
- are involved in a management or organisational project as an executive, employee, shareholder, team member or other data subject,
- take part in a feedback discussion, executive coaching, leadership development or academy offering,
- are in contact with us in connection with a business idea, shareholding, approach to investors or an entrepreneurial project,
- are in contact with us as a client, prospective client, business partner, service provider, cooperation partner or other contact person, or
- receive our newsletter or specialist information.
3. General legal bases
We process personal data only where there is a legal basis for doing so. Depending on the processing, the following in particular may apply:
- Art. 6 (1) (a) GDPR – consent;
- Art. 6 (1) (b) GDPR – performance of a contract or pre-contractual measures at the request of the data subject;
- Art. 6 (1) (c) GDPR – compliance with a legal obligation;
- Art. 6 (1) (f) GDPR – safeguarding our legitimate interests or the legitimate interests of third parties, provided that the interests or fundamental rights and freedoms of the data subject do not override them;
- Art. 9 (2) GDPR – processing of special categories of personal data exclusively under the additional conditions set out therein.
Where we act as a processor, the respective controller determines the legal basis for the processing. In that case we process the data exclusively within the scope of the documented instructions and the agreement pursuant to Art. 28 GDPR.
Where information is stored on your terminal equipment or information already stored is accessed, this is done, in the case of strictly necessary technologies, on the basis of § 25 (2) TDDDG (German Telecommunications Digital Services Data Protection Act). For technologies that are not strictly necessary, we obtain your prior consent pursuant to § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR.
4. Storage period
We store personal data only for as long as this is necessary for the respective purpose or as long as statutory retention obligations exist. If the purpose of the processing ceases to apply, the data are erased or blocked, unless statutory obligations, ongoing contractual relationships, agreed follow-up processes or legitimate grounds for further storage exist.
Depending on the document, retention periods under commercial and tax law may apply. If legal proceedings commence or are threatened, relevant data may be retained until the proceedings have been finally concluded or until the statutory limitation periods have expired.
For diagnostic, profiling, coaching, shareholding and project documents, the storage principles set out in the respective sections apply in addition. Where a specific period cannot reasonably be determined in advance, the duration is governed by the continued existence of the purpose of the service, the completion of the project, agreed follow-up and feedback services as well as statutory documentation and retention obligations.
5. Recipients and service providers
Within our company, only those persons who need personal data to perform their tasks are given access to it.
A transfer may take place – where necessary and legally permissible – in particular to the following categories of recipients:
- clients and the project managers designated by them, insofar as the disclosure forms part of the agreed service and is permissible under data protection law;
- participants or data subjects themselves, in particular in the course of feedback and evaluation discussions;
- cooperating consultancies or executive search firms, where Executive Profiler is involved exclusively for a clearly delimited diagnostic or advisory service;
- providers of diagnostic, profiling, assessment, survey and video conferencing solutions;
- IT, hosting, e-mail, CRM, cloud, support and document management service providers;
- tax advisers, lawyers, auditors, banks and other professional advisers;
- investors, investment companies, project partners or specialist advisers in connection with entrepreneurial projects, insofar as disclosure is necessary and permissible;
- public authorities, courts and other public bodies where there is a statutory obligation.
Processors are engaged on the basis of a contract pursuant to Art. 28 GDPR. Where joint controllership exists, the controllers involved conclude the required agreement pursuant to Art. 26 GDPR. Where several companies are independent controllers, each company processes the data under its own data protection responsibility.
6. Data transfers to third countries
Some of the service providers we engage are established outside the European Union or the European Economic Area, or process data there. A transfer only takes place where the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of
- an adequacy decision of the European Commission,
- appropriate safeguards such as the European Commission’s standard contractual clauses together with, where applicable, supplementary protective measures, or
- a statutory derogation pursuant to Art. 49 GDPR.
Where a provider is certified under the EU-US Data Privacy Framework, the transfer to that certified provider may be based on the corresponding adequacy decision. We will provide further information on request.
7. Your rights
Subject to the statutory requirements, you have in particular the following rights:
- access to the data processed about you pursuant to Art. 15 GDPR;
- rectification of inaccurate data or completion of incomplete data pursuant to Art. 16 GDPR;
- erasure pursuant to Art. 17 GDPR;
- restriction of processing pursuant to Art. 18 GDPR;
- data portability pursuant to Art. 20 GDPR;
- objection to certain processing operations pursuant to Art. 21 GDPR;
- withdrawal of consent with effect for the future pursuant to Art. 7 (3) GDPR;
- lodging a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR.
To exercise your rights, a message to kontakt@executive-profiler.com is sufficient.
Objection pursuant to Art. 21 GDPR
Where we process your personal data on the basis of Art. 6 (1) (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to such processing. This also applies to profiling based on that provision. Following an objection, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you may object to such processing at any time without giving reasons.
Right to lodge a complaint
You may lodge a complaint with any competent data protection supervisory authority. In principle, the following supervisory authority is competent for our company:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Postfach 20 04 44
40102 Düsseldorf
www.ldi.nrw.de
8. Data security
We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other misuse. Our website uses TLS encryption. You can usually recognise an encrypted connection by the “https://” prefix and the padlock symbol in your browser’s address bar.
Nevertheless, the transmission of data over the internet may involve security risks. Absolutely complete protection cannot be guaranteed.
9. Hosting and server log files
We use an external hosting service provider for the hosting and technical provision of our website. Insofar as that provider processes personal data on our behalf, it is engaged on the basis of a contract pursuant to Art. 28 GDPR.
When the website is accessed, the hosting provider processes in particular the IP address, the date and time of access, the page or file accessed, the referrer URL, the browser type, the browser version, the operating system and the host name of the accessing device in server log files.
The processing takes place for the secure, stable and error-free provision of the website on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure and reliable operation of our online offering. Insofar as the hosting provider is engaged as a processor, a contract pursuant to Art. 28 GDPR is in place.
Server log files are erased as soon as they are no longer required for security and operational purposes, unless a security-related review or a statutory obligation requires longer retention.
10. Cookies and consent management
Our website uses cookies and comparable technologies. Technically necessary technologies are used in order to provide the website and functions that have been expressly requested. Optional technologies, in particular for statistics, marketing, external media or profiling, are only activated after you have given your consent.
To obtain, document and manage your consent we use Real Cookie Banner, software provided by devowl.io GmbH, Tannet 12, 94539 Grafling. In this context, your selection, a pseudonymous identifier, the time of consent, the language and browser and device information in particular may be processed.
The processing serves to comply with statutory documentation obligations on the basis of Art. 6 (1) (c) GDPR. Technically necessary storage of, or access to, information on the terminal equipment takes place on the basis of § 25 (2) TDDDG.
You can change your selection or withdraw a consent at any time via the privacy settings provided on the website. The lawfulness of the processing carried out up to the withdrawal remains unaffected. The providers, purposes, cookie names and storage periods applicable at any given time are additionally displayed in the consent tool.
11. Contacting us and contact form
If you contact us via the contact form, by e-mail or by telephone, we process the data you provide, in particular your name, contact details, company, the content of your message and, where applicable, further information transmitted by you.
The processing takes place
- pursuant to Art. 6 (1) (b) GDPR where the enquiry serves the initiation or performance of a contract;
- pursuant to Art. 6 (1) (f) GDPR in the case of other business or general enquiries; our legitimate interest lies in the proper handling and documentation of the communication;
- pursuant to Art. 6 (1) (a) GDPR insofar as we expressly obtain consent.
The data are erased once the enquiry has been conclusively dealt with and no statutory retention obligations or legitimate grounds for further storage exist. Please avoid transmitting special categories of personal data, such as health data, via a general contact form.
12. Spam and abuse protection with Google reCAPTCHA
Google reCAPTCHA may be used to protect our forms against automated entries and misuse. The provider in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In this context, the IP address, device and browser information, interactions with the website and further data required for risk assessment in particular may be processed and transferred to Google LLC in the USA.
Activation generally only takes place after you have given your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. The consent can be withdrawn at any time via the privacy settings. Without consent, the use of the protected form may be restricted; alternatively, you can contact us by e-mail or by telephone.
Further information: Google’s privacy policy.
13. Management audits, executive profiling, assessments and leadership diagnostics
13.1 Data subjects and categories of data
In the course of diagnostic and advisory projects we process personal data in particular of executives, managing directors, members of management and leadership teams, employees, shareholders, participants in assessments or coaching sessions, as well as – where we are involved in a third party’s selection or executive search process solely for the diagnostic element – of the persons participating in that process.
Depending on the engagement and the method used, the following data in particular may be processed:
- identity and contact details;
- professional function, area of responsibility, organisational integration and – insofar as necessary for the engagement – professional career history;
- information on leadership experience, understanding of the role, decision-making behaviour, communication, motivation, values and work preferences;
- answers given in questionnaires, interviews, self-assessments and external assessments, as well as psychometric raw data and results data;
- evaluations relating to leadership, management competencies, personality, motivation, cultural and team fit as well as other agreed competence or behavioural dimensions;
- interview notes, observations, evaluations, results reports and feedback content;
- in the case of team or organisational projects, information on collaboration, allocation of roles, team dynamics and organisational interfaces.
Special categories of personal data within the meaning of Art. 9 GDPR are generally not the subject of our diagnostics. Where such data exceptionally become necessary or are disclosed by a data subject, we process them only where an additional legal basis pursuant to Art. 9 GDPR exists.
13.2 Purposes of the processing
We process the data in particular for
- planning, conducting and evaluating management audits, executive profilings, assessments and other diagnostic procedures;
- assessing management, leadership, communication, decision-making and collaboration patterns;
- comparing the person, role, leadership mandate, team, corporate culture and organisational context;
- leadership and team matching as well as the analysis of team and organisational structures;
- preparing profiles, management audit reports, evaluations and recommended courses of action;
- preparing and conducting results and feedback discussions;
- deriving development areas and onboarding, leadership or coaching approaches;
- documenting the provision of services as well as the establishment, exercise or defence of legal claims.
13.3 Direct engagement by an executive or individual
If you engage us yourself for an executive profiling, assessment, feedback or a comparable service, the processing of the data required for this purpose generally takes place for the performance of the contract or pre-contractual measures pursuant to Art. 6 (1) (b) GDPR.
Individual results are disclosed to employers, shareholders, investors, executive search firms or other third parties only where this forms part of the agreed engagement and a sound legal basis exists for it. Where consent is required, it may be withdrawn with effect for the future.
13.4 Corporate engagement, management audit and organisational project
Where a company engages Executive Profiler GmbH & Co. KG for a management audit, leadership or team diagnostic, a cultural evaluation or the assessment or development of organisational structures, the specific role under data protection law is determined before the project begins on the basis of the actual allocation of tasks and decision-making powers.
Insofar as we process personal data exclusively on behalf of and in accordance with the documented instructions of the client, we do so as a processor on the basis of an agreement pursuant to Art. 28 GDPR. Where the client and Executive Profiler jointly determine the purposes and essential means of a processing operation, an agreement pursuant to Art. 26 GDPR is concluded. Insofar as Executive Profiler GmbH & Co. KG determines its own purposes and essential means for particular processing steps, it acts in that respect as a controller in its own right.
Before the diagnostics are carried out, the data subjects receive project-specific information on the purpose, categories of data, recipients, roles under data protection law and – where necessary – the specific legal basis.
13.5 Involvement in an executive search or selection process for which third parties are responsible
Executive Profiler GmbH & Co. KG does not carry out any executive search or recruitment placement of its own. However, it may be involved in a selection process for which an executive search firm, a company or another third party is responsible, for a clearly delimited executive profiling, assessment, management audit or cultural evaluation.
In such cases, Executive Profiler receives only those personal data that are necessary for the agreed diagnostic service. In particular, Executive Profiler does not undertake any identification or direct search of potential candidates, no active sourcing, no compilation of search lists and no placement with potential employers.
Before diagnostic results are transferred to the commissioning third party, it is determined which results are disclosed for which purpose and to which specifically named recipients. The allocation of roles under data protection law is determined and documented for each project according to the actual circumstances.
13.6 Profiling and automated decisions
In the course of executive profiling, structured evaluations, psychometric instruments, surveys and matching procedures may be used. Insofar as a processing operation is to be classified as profiling within the meaning of the GDPR, it serves the structured professional and personal classification as well as the support of human assessments and advisory decisions.
We do not take any decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. Classification, interpretation and recommendation are carried out with the substantial involvement of qualified persons. Art. 22 GDPR remains unaffected.
13.7 Results reports, feedback and disclosure
Results are documented and disclosed only to the extent necessary for the agreed purpose. Which reports or elements of the results a data subject, a client or another project participant receives is determined in advance in the service and data protection concept for the project.
In the case of team and organisational evaluations, individual personal information is minimised, aggregated or anonymised as far as possible where individual attribution is not necessary for the purpose of the project. Raw data from psychometric procedures are not disclosed to third parties without objective grounds.
13.8 External diagnostic and platform providers
Specialised external providers may be engaged for individual profilings, assessments, surveys or video meetings. Insofar as they act as processors, the required contracts pursuant to Art. 28 GDPR are concluded. Insofar as providers process data under their own responsibility, we provide separate information on this where this is necessary for the specific processing operation.
We provide information on the specific provider engaged, the purpose, the categories of data, any third country transfers and the storage period – insofar as this is not already set out in this privacy policy – before or when the respective solution is used.
13.9 Storage period for diagnostic data
Diagnostic and project documents are stored only for as long as they are required for the conduct, evaluation and feedback, for agreed follow-up or development services and for compliance with statutory documentation and retention obligations. Once the purpose ceases to apply, personal raw data and results data are erased or anonymised, unless a statutory obligation, a continuing contractual relationship, pending legal proceedings or another sound legal basis justifies further storage.
In the case of project-related processing on behalf of a controller, the return or erasure of the data is additionally governed by the controller’s instructions and the agreement pursuant to Art. 28 GDPR.
14. Shareholdings, business ideas, investors and entrepreneurial projects
The company’s objects include the holding of shareholdings, the identification and assessment of business ideas, the introduction of investors and related transactions. In this context we process personal data of founders, shareholders, investors, members of corporate bodies, advisers, contact persons at companies and other project participants.
Depending on the project, the following in particular may be processed:
- name, function, company and business contact details;
- communication, appointment and project data;
- information on shareholding structures, roles and responsibilities;
- information from business plans, presentations, investor documents and due diligence documents, insofar as they contain personal information;
- contract, invoicing and transaction data.
Depending on the constellation, the processing takes place for the performance of pre-contractual measures or of a contract pursuant to Art. 6 (1) (b) GDPR, for compliance with legal obligations pursuant to Art. 6 (1) (c) GDPR or on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR. Our legitimate interests lie in particular in the examination and development of entrepreneurial ventures, the establishment and maintenance of business relationships and the preparation and conduct of permissible shareholding and investor processes.
Data are disclosed to potential investors, investment companies, financing partners or other project participants only insofar as this is necessary, expected or agreed for the specific project and permissible under data protection law.
15. Clients, prospective clients and business contacts
From contact persons at clients, prospective clients, cooperation partners and service providers we process in particular names, function, company, business contact details, communication content, contract and project data as well as invoicing information.
The processing takes place for the initiation and performance of contracts pursuant to Art. 6 (1) (b) GDPR, insofar as the data subject is a party to the contract, for compliance with legal obligations pursuant to Art. 6 (1) (c) GDPR and on the basis of Art. 6 (1) (f) GDPR. Our legitimate interests lie in the maintenance of business relationships, the conduct of our diagnostic, advisory and entrepreneurial projects, project communication and internal organisation.
16. Newsletter and specialist information
If you subscribe to our newsletter, we process your e-mail address and, where applicable, your name, company, interests and technical data documenting the registration. Registration takes place using the double opt-in procedure. You will receive an e-mail with which you must confirm your registration.
The legal basis for dispatch and – where used – performance measurement is your consent pursuant to Art. 6 (1) (a) GDPR. The logging of the registration and the storage of a suppression list following unsubscription may be based on Art. 6 (1) (c) or (f) GDPR.
We may engage a specialised dispatch service provider for sending the newsletter. Insofar as that provider processes personal data on our behalf, it is engaged on the basis of a contract pursuant to Art. 28 GDPR. Where processing takes place outside the European Economic Area, we observe the requirements of Art. 44 et seq. GDPR.
You can withdraw your consent at any time via the unsubscribe link in the newsletter or by sending us a message. Following unsubscription, the newsletter data are erased unless they are required to document the consent or to prevent further mailings.
17. Analytics, marketing and reach measurement
The services listed below are only used where they are actually activated on our website and where you have – insofar as required – given your consent via the consent tool. The legal basis is Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Consent can be withdrawn at any time via the privacy settings.
17.1 Google Tag Manager
We may use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in order to manage website tags centrally. The Tag Manager must not activate any optional services without the consent required in each case. In this context, technical data, in particular the IP address, may be processed. Further information: Data protection at Google.
17.2 Google Analytics
Google Analytics may be used for the statistical analysis of website usage. In this context, page views, events, approximate location data, device and browser information, referrers, interactions and pseudonymous identifiers in particular may be processed. The provider is Google Ireland Limited. Processing by Google LLC in the USA cannot be excluded. We use the data protection and deletion options offered by Google in accordance with the actual configuration.
17.3 Google Ads and conversion measurement
Google Ads may be used to display advertisements, to measure their success and – where separate consent has been given – to build audiences for interest-based advertising. In this context, cookies or comparable identifiers, the IP address, device and browser information, pages visited and actions triggered may be processed. The provider is Google Ireland Limited. Processing by Google LLC in the USA cannot be excluded.
17.4 LinkedIn Insight Tag
The LinkedIn Insight Tag provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, may be used for conversion measurement, audience building and the statistical evaluation of LinkedIn campaigns. LinkedIn may process, among other things, the URL, referrer, IP address, device and browser characteristics, timestamps and interactions. If you are a LinkedIn member, LinkedIn may associate the data with your account.
17.5 Meta Pixel
We may use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, in order to measure the effectiveness of advertisements on Facebook and Instagram and to build audiences. In this context, the IP address, device information, pages accessed, interactions and pseudonymous identifiers in particular may be processed. If you are logged in to a Meta service, Meta may associate the information with your account.
17.6 HubSpot
Where activated, we may use HubSpot functions for the analysis, contact management and optimisation of our communication. The provider in the European Economic Area is HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland. In this context, contact data, usage data, the IP address, device information and interactions in particular may be processed. Processing by HubSpot companies or service providers outside the EEA cannot be excluded.
18. External media and social networks
18.1 YouTube
We may embed videos from YouTube. The provider is Google Ireland Limited. A connection to YouTube and the transfer of data, in particular the IP address, device information and the page accessed, only takes place after you have given your consent. If you are logged in to YouTube, Google may associate the visit with your account. The legal basis is Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.
18.2 Vimeo
We may embed videos from Vimeo. The provider is Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA. A connection and the transfer in particular of the IP address, device information and the page accessed only take place after you have given your consent. The legal basis is Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.
18.3 Links to and presences on social networks
Our website may link to profiles on LinkedIn, XING, Facebook, Instagram or other platforms. In the case of a mere link, data are generally only processed once you click on the link. The operator of the respective platform is generally responsible for the processing carried out on that platform.
Where we operate profiles on social networks ourselves, we process there in particular messages, comments, reactions, profile and contact data as well as statistics made available by the platform. Depending on the occasion, the processing takes place on the basis of Art. 6 (1) (b), (f) or (a) GDPR. Our legitimate interest lies in communication, public presentation and the maintenance of business contacts.
19. Feedback discussions, executive coaching, leadership development and academy offerings
If you take part in a feedback discussion, executive coaching, leadership development, workshop or academy offering, we process in particular identity and contact details, contract and payment data, interview notes, agreed development objectives, evaluations and the communication required for the provision of the service.
Where there is a direct contractual relationship with you, the processing generally takes place pursuant to Art. 6 (1) (b) GDPR. Where the service is financed or commissioned by a company or another client, it is determined before the start which information the client receives and which content remains confidential between the participant and Executive Profiler.
Content from coaching and feedback discussions is not disclosed to an employer, shareholder, executive search consultant or other third party merely because that party arranged or financed the measure. Disclosure takes place only to the agreed extent and on a sound legal basis.
Where the results of a previous executive profiling are to be used further for coaching or a development measure, this only takes place insofar as the new or continued purpose is covered by the existing legal basis, or the data subject has been informed accordingly and – where necessary – additional consent has been obtained.
Special categories of personal data are processed only where this is necessary for the specific service and permissible pursuant to Art. 9 GDPR.
20. Amendments to this privacy policy
We amend this privacy policy where the legal situation, the website, the services used, the company structure or our processing operations change. The version published on this website at any given time is authoritative.
Last updated: 31 August 2026