1. Data Controller
Selina Gaertner Consulting
Selina Gaertner
Auwaldstr. 1
79110 Freiburg
Germany
Phone: +49 152 5855 2250
Email: mail@selinagaertner.com
2. Overview of Data Processing
Types of data processed
- Usage data (e.g. pages visited, access times)
- Meta/communication data (e.g. device information, IP addresses)
- Contact data (e.g. email, phone number) when you contact us
Categories of data subjects
- Website visitors
- Communication partners
3. Legal Basis
Personal data is processed on the following legal bases:
- Consent (Art. 6(1)(a) GDPR) – Where you have given us your consent.
- Contract performance (Art. 6(1)(b) GDPR) – Where processing is necessary for the performance of a contract or pre-contractual measures.
- Legitimate interests (Art. 6(1)(f) GDPR) – Where processing is necessary for the purposes of our legitimate interests, e.g. analyzing and optimizing our website.
4. Hosting
This website is hosted by Netlify, Inc. (44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). When you visit this website, Netlify automatically collects the following information in server log files:
- IP address of the requesting device
- Date and time of the request
- URL / name of the requested file
- Amount of data transferred
- Browser type and version
- Operating system
- Referrer URL
This processing is based on Art. 6(1)(f) GDPR (legitimate interest in the technically error-free presentation of the website). A Data Processing Agreement (DPA) has been concluded with Netlify in accordance with Art. 28 GDPR. Netlify is certified under the EU-U.S. Data Privacy Framework.
Netlify's privacy policy: https://www.netlify.com/privacy/
5. Web Analytics (Plausible)
This website uses Plausible Analytics, a privacy-friendly web analytics service provided by Plausible Insights OÜ (Västriku tn 2, 50403 Tartu, Estonia). Plausible does not use cookies, does not store any information on your device, and does not collect or store personal data. No data is transferred outside the EU.
Plausible records aggregated statistics only, such as page views, referring website, approximate country, browser and device type. Individual visitors are not identified and cannot be tracked across websites or over time. IP addresses are never stored.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a needs-based design and statistical evaluation of our website). Because no information is stored on or read from your device, consent under § 25 TDDDG is not required.
Plausible's data policy: https://plausible.io/data-policy.
5a. Fonts
All fonts used on this website are hosted on our own server. No connection to Google Fonts or any other external font provider is established when you visit this website.
5b. Maria AI Assistant (Voiceflow)
This website offers an AI chat assistant ("Maria"), technically provided by Voiceflow, Inc. (Toronto, Canada). The assistant is not loaded when you open a page. It is loaded only when you actively start the chat via the “Ask Maria” button. As its first message, Maria asks for your consent to the data processing before the conversation begins.
Once started, a connection to Voiceflow's servers is established, your messages are transmitted there and processed to generate a response. Please do not enter any sensitive personal data into the chat.
Legal basis: Art. 6(1)(a) GDPR (consent, given by actively starting the chat). Canada is recognised by the European Commission as providing an adequate level of data protection for commercial organisations.
Voiceflow's privacy policy: https://www.voiceflow.com/privacy.
5c. Speaking AI Avatar in the Academy (LiveAvatar/HeyGen)
Inside the SELVAION AI ACADEMY, logged-in and activated members can have the answers of the learning companion LIA delivered by a speaking AI video avatar. This avatar is technically provided by HeyGen Technology Inc. (USA) under the name LiveAvatar. The feature is not available to visitors who are not logged in.
The avatar is not loaded when you open a page. It only starts once you actively call it up via the dedicated button and have expressly consented to the data processing beforehand. Your consent is recorded on our server together with a timestamp, the language and the version of the consent text, so that we can demonstrate it in accordance with Art. 7(1) GDPR. You can withdraw your consent at any time in the same window with effect for the future, and the withdrawal is recorded as well.
Once started, a video connection via WebRTC is established to HeyGen's servers. Transmitted in the process are your IP address, which is technically required to establish the video connection, and the text the avatar speaks, that is, the answers of the learning companion. Your own input is not transmitted to HeyGen. No microphone is activated, there is no voice chat, and the video is not stored by us. Each session is limited to a maximum of three minutes, and a maximum of five sessions per member per day is possible.
The label “KI-Avatar” (AI avatar) is permanently displayed within the video image. In line with Art. 50 of Regulation (EU) 2024/1689 (AI Act), this indicates that you are seeing and hearing artificially generated content and not a human being.
Legal basis: Art. 6(1)(a) GDPR (consent, given by the express confirmation before the start). The transfer to the USA is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework under Art. 45 GDPR, for which HeyGen Technology Inc. is certified. In addition, Standard Contractual Clauses under Art. 46(2)(c) GDPR and a data processing agreement under Art. 28 GDPR are applied. HeyGen names a data protection officer in Europe.
What we log on our side is limited to your user ID, a session ID, the selected language and the time of use. The purpose of this logging is cost control and protection against misuse. The log data is deleted automatically after 90 days.
HeyGen's privacy policy: https://www.heygen.com/privacy.
6. Calendly
We use Calendly (Calendly LLC, 3423 Piedmont Rd NE, Atlanta, GA 30305, USA) for appointment scheduling. When you book an appointment, the data you enter (name, email address, and any additional information) is processed by Calendly.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(a) GDPR (consent through active booking).
Calendly's privacy policy: https://calendly.com/privacy.
7. LinkedIn
Our website contains links to our LinkedIn profile. When you click on these links, you are redirected to the platform of LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland). No automatic data transfer to LinkedIn occurs simply by visiting our website.
LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.
8. Make (formerly Integromat)
We use Make (Celonis SE, Thomas-Edison-Str. 1, 85716 Unterschleissheim, Germany) to automate workflows, such as processing form submissions from our website. When you submit data through a form on our website, this data may be transmitted to Make for further processing, such as storing it or triggering follow-up actions like sending a confirmation email.
Specifically, when you submit your first name and email address via the AI Readiness Scorecard or the Talk-to-Maria lead magnet (offered in connection with events such as the Global Pharma Tech Summit), this data is sent to Make, which then forwards it to Selina Gaertner Consulting (internal notification) and to the email address you provided (welcome message containing the Pharma AI Sales Playbook, a link to a live demo of the AI assistant "Maria", and a link to book a call). The welcome email is sent from mail@selinagaertner.com. You can opt out and request deletion of your data at any time by emailing mail@selinagaertner.com.
Make processes data on servers within the European Union. As Celonis SE is a company headquartered in Germany, data processing is subject to EU data protection standards.
Legal basis: Art. 6(1)(a) GDPR (your consent, given via the checkbox on the form) and Art. 6(1)(f) GDPR (legitimate interest in efficient business process automation).
Make's privacy policy: https://www.make.com/en/privacy-notice.
9. SSL/TLS Encryption
This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the "https://" in the address bar of your browser and the lock icon.
10. Your Rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15 GDPR) – You may request information about your personal data processed by us.
- Right to rectification (Art. 16 GDPR) – You may request the correction of inaccurate data.
- Right to erasure (Art. 17 GDPR) – You may request the deletion of your data, provided the legal requirements are met.
- Right to restriction of processing (Art. 18 GDPR) – You may request restriction of the processing of your data.
- Right to data portability (Art. 20 GDPR) – You may request that we provide your data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21 GDPR) – You may object to the processing of your data at any time, insofar as the processing is based on Art. 6(1)(f) GDPR.
- Right to withdraw consent (Art. 7(3) GDPR) – You may withdraw any consent given at any time.
- Right to lodge a complaint (Art. 77 GDPR) – You have the right to lodge a complaint with a supervisory authority. The competent authority is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
11. Changes to This Privacy Policy
This privacy policy is current as of May 2026. Due to the further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can always be accessed on our website.