Back to website

Privacy Policy

Data protection in accordance with the EU General Data Protection Regulation (GDPR)

1. Data Controller

Selina Gaertner Consulting
Selina Gaertner
Auwaldstraße 1
79110 Freiburg im Breisgau
Germany

Phone: +49 152 5855 2250
Email: mail@selinagaertner.com

2. Overview of Data Processing

Types of data processed

Categories of data subjects

3. Legal Basis

Personal data is processed on the following legal bases:

4. Hosting

This website runs on our own server, hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in its Nuremberg data centre. When you visit this website, the web server automatically stores the following information in server log files:

This processing is based on Art. 6(1)(f) GDPR (legitimate interest in the secure and technically error-free presentation of the website). The data does not leave Germany.

Hetzner's privacy notice: https://www.hetzner.com/legal/privacy-policy/

5. Web Analytics (Plausible)

This website uses Plausible Analytics, a privacy-friendly web analytics service provided by Plausible Insights OÜ (Västriku tn 2, 50403 Tartu, Estonia). Plausible does not use cookies, does not store any information on your device, and does not collect or store personal data. No data is transferred outside the EU.

Plausible records aggregated statistics only, such as page views, referring website, approximate country, browser and device type. Individual visitors are not identified and cannot be tracked across websites or over time. IP addresses are never stored.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a needs-based design and statistical evaluation of our website). Because no information is stored on or read from your device, consent under § 25 TDDDG is not required.

Plausible's data policy: https://plausible.io/data-policy.

5a. Fonts

All fonts used on this website are hosted on our own server. No connection to Google Fonts or any other external font provider is established when you visit this website.

5b. Maria AI Assistant (Voiceflow)

This website offers an AI chat assistant ("Maria"), technically provided by Voiceflow, Inc. (Toronto, Canada). The assistant is not loaded when you open a page. It is loaded only when you actively start the chat via the “Ask Maria” button. As its first message, Maria asks for your consent to the data processing before the conversation begins.

Once started, a connection to Voiceflow's servers is established, your messages are transmitted there and processed to generate a response. Please do not enter any sensitive personal data into the chat.

Legal basis: Art. 6(1)(a) GDPR (consent, given by actively starting the chat). Canada is recognised by the European Commission as providing an adequate level of data protection for commercial organisations.

Voiceflow's privacy policy: https://www.voiceflow.com/privacy.

5c. Speaking AI Avatar in the Academy (LiveAvatar/HeyGen)

Inside the AI Academy, logged-in and activated members can have the answers of the learning companion LIA delivered by a speaking AI video avatar. This avatar is technically provided by HeyGen Technology Inc. (USA) under the name LiveAvatar. The feature is not available to visitors who are not logged in.

The avatar is not loaded when you open a page. It only starts once you actively call it up via the dedicated button and have expressly consented to the data processing beforehand. Your consent is recorded on our server together with a timestamp, the language and the version of the consent text, so that we can demonstrate it in accordance with Art. 7(1) GDPR. You can withdraw your consent at any time in the same window with effect for the future, and the withdrawal is recorded as well.

Once started, a video connection via WebRTC is established to HeyGen's servers. Transmitted in the process are your IP address, which is technically required to establish the video connection, and the text the avatar speaks, that is, the answers of the learning companion. Your own input is not transmitted to HeyGen. No microphone is activated, there is no voice chat, and the video is not stored by us. Each session is limited to a maximum of three minutes, and a maximum of five sessions per member per day is possible.

The label “KI-Avatar” (AI avatar) is permanently displayed within the video image. In line with Art. 50 of Regulation (EU) 2024/1689 (AI Act), this indicates that you are seeing and hearing artificially generated content and not a human being.

Legal basis: Art. 6(1)(a) GDPR (consent, given by the express confirmation before the start). The transfer to the USA is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework under Art. 45 GDPR, for which HeyGen Technology Inc. is certified. In addition, Standard Contractual Clauses under Art. 46(2)(c) GDPR and a data processing agreement under Art. 28 GDPR are applied. HeyGen names a data protection officer in Europe.

What we log on our side is limited to your user ID, a session ID, the selected language and the time of use. The purpose of this logging is cost control and protection against misuse. The log data is deleted automatically after 90 days.

HeyGen's privacy policy: https://www.heygen.com/privacy.

5d. AI-assisted evaluation of the scorecard

When you complete our AI Readiness Scorecard and then request a personal evaluation, we process your first name, your email address and your answers to the self-assessment questions. The sole purpose is to provide you with the evaluation and the results report as a PDF that you requested.

The evaluation itself is optional. The self-assessment runs entirely without any personal data and shows you your result regardless. Data is only transmitted once you additionally request the personal evaluation and give your explicit consent.

To generate the evaluation, we transmit your first name and your answers to Google Cloud Vertex AI, operated by Google Cloud EMEA Limited, Dublin, Ireland, acting as our processor. Processing takes place with the Google Gemini model in a data centre in Frankfurt am Main, Germany. Google does not use the data to train its models. Logging and caching are switched off; Google reserves the right to log for abuse detection.

The legal basis is Art. 6(1)(b) GDPR, the provision of the evaluation you requested, together with Art. 6(1)(f) GDPR, our legitimate interest in contacting prospective clients. Your data is stored until you object to the processing or request its deletion. You can contact us at any time at the address stated in the legal notice.

5e. AI Act Checklist (email gate and high-risk check)

If you request our “AI Act × MDR/IVDR Integration Checklist” at selinagaertner.com/ai-act-checklist/, we process the details you enter (name, email address and, optionally, company) as well as your answers to the five classification questions and the resulting assessment. The purpose is to provide the checklist you requested and, where you consented, to contact you about related content.

This data is stored on our own server, hosted by Hetzner Online GmbH in Germany, and is transferred into our internal customer relationship management system, which runs locally on our own device. No third-party marketing platform receives this data unless you separately opt in to our email updates (see section 5f). Unlike the assessments described in section 5d, no artificial intelligence is used and no data is transmitted to Anthropic for this checklist.

The legal basis is Art. 6(1)(a) GDPR, your consent, together with Art. 6(1)(f) GDPR, our legitimate interest in contacting prospective clients. You may withdraw your consent at any time with effect for the future; the lawfulness of processing carried out until then remains unaffected. Your data is stored until you object to the processing or request its deletion.

5f. Email updates (Brevo, double opt-in)

If you consent to receiving our email updates, we use Brevo to manage the subscription and to send the emails. The provider is Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, a subsidiary of Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France. We have concluded a data processing agreement with Brevo.

We use the double opt-in procedure: after you subscribe, you receive an email asking you to confirm your subscription. Only after you confirm do we add you to our mailing list. We store your email address, your name where provided, and the confirmation, in order to document your consent as required by law.

Brevo may involve processors in third countries. Such transfers are safeguarded by an adequacy decision of the European Commission or by EU Standard Contractual Clauses. Further information is available in Brevo’s privacy policy at https://www.brevo.com/legal/privacypolicy/.

The legal basis is Art. 6(1)(a) GDPR, your consent. You can unsubscribe at any time, using the link at the end of every email or by writing to the address stated in the legal notice. Your data is stored until you unsubscribe.

5g. Context profile in the AI Academy

In your member area you may voluntarily provide six pieces of information about your company (sub-sector, offering, customer groups, company size, current AI maturity, and one question you want answered within the next twelve months). This helps the AI learning companion LIA tailor examples, the learning path and the 90-day plan to your company.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) as well as your voluntary input. Please do not enter names of third parties or confidential client data here.

Your entries are used exclusively for the stated purpose, never for marketing or automated decision-making, and are included on a per-request basis in requests to our existing AI processor (see the section on the AI assistant LIA). You can change your entries at any time in your profile or remove them with one click on "Delete context"; they are also deleted when your account is deleted.

5h. Usage log in the AI Academy

So that I can support your learning and document which measures to build AI literacy you have used, the academy logs when you sign in, which learning units and materials you open, whether you start a learning video and watch it to the end, and when you complete a learning unit. If you ask the learning companion LIA a question, only the fact that you asked is recorded, never the content of the question. No IP addresses and no device information are stored.

Legal basis: Art. 6(1)(b) GDPR (delivery of the learning programme). For the aggregated analysis of which content is used how often, in order to improve it, Art. 6(1)(f) GDPR (legitimate interest).

Only Selina Gaertner as the operator of the academy can see the entries. They are stored with Supabase in the EU (Ireland). Entries are deleted automatically after 24 months, and immediately when your account is deleted. You can request information about your entries at any time.

5j. Challenge cockpit and assessment by the AI learning companion LIA

Everyone who takes part in the AI agenda challenge receives a personal cockpit, reached through the link in the confirmation email. It stores what you enter on the three worksheets (ratings, notes, the steps of your value chain, your initiative). Only the colour ratings go into the room view, added up and without names.

If you trigger the attack simulation, the draft of your initiative, the sparring or the assessment in the cockpit, we transmit your entries for this purpose to Anthropic PBC, San Francisco, USA, acting as our processor. Your name and email address are not transmitted. Anthropic processes the data solely to generate the answer and not to train its models. The transfer to the USA is based on the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

The assessment is a recommendation on which next step fits your initiative: the 90-day programme "The first move", the academy membership, or a conversation with Selina Gaertner. It is created only when you click and appears only in your cockpit. No automated decision with legal effect takes place.

Legal basis: Art. 6(1)(b) GDPR (running the challenge you registered for). Data is stored with Supabase in the EU. We delete your entries at any time on request, a message to the address named above is enough.

5l. AI Challenger Check

With the AI Challenger Check you assess how exposed your company, or a department in it, is to an AI-native competitor. To do so, you paste public information about your company (for example website texts), answer a few questions and choose a starting point, industry, role and company size. Please only enter public information: no customer names, no internal figures, no third-party data.

Your input is sent to my server at Hetzner Online GmbH in Nuremberg (see section 4) and passed from there to an AI model in the European Union. This is normally Claude by Anthropic, which I run via Amazon Bedrock from Amazon Web Services EMEA SARL, Luxembourg. The request starts in Frankfurt and, depending on load, may also be processed in Stockholm, Milan, Spain, Ireland or Paris. Anthropic has no access to your input. If this route is disrupted, I use the model Gemini via Google Cloud Vertex AI from Google Cloud EMEA Limited in the European Union instead. The model uses it to produce follow-up questions and the assessment. I do not store your text, your answers or the assessment, and they are not used to train AI models. I have not set up logging of requests and responses. The providers may automatically check input for abuse. The result appears in your open browser window and is also emailed to your address. Brevo GmbH handles the sending (see section 5f) and holds the email for delivery and proof of delivery. My server only logs that a request took place, not its content.

Before the assessment appears, you enter your email address and, optionally, your first name. I then process: email address, first name, the time of your consent, an origin note from the page link (parameter “src”), the key figures of your result (score today, score after the suggested moves, weakest dimension) and your details on starting point, industry, company size, role and page language. They are stored on my server in Nuremberg and in my contact management (see section 7a). I am notified of new entries via Telegram; the message only contains a shortened email address. The assessment is an estimate; no automated decision with legal effect is made.

Legal basis: Art. 6(1)(b) GDPR for providing the tool and the assessment you request, Art. 6(1)(f) GDPR for storing the key figures with your contact details (legitimate interest in preparing a possible follow-up conversation; only a few key figures are stored, no texts). Retention: as in section 7a, earlier on request at any time. You only receive the newsletter and the follow-up impulses if you tick the second box and click the link in the confirmation email (see section 5f). The follow-up impulses are three emails in the two weeks that follow, the first refers to your weakest dimension. You can unsubscribe in every email.

5n. Solve a specific problem

On this page you describe a specific problem from your company or department so that I can prepare our conversation. Please do not enter names of customers or employees or confidential figures.

Your answers are sent to my server at Hetzner Online GmbH in Nuremberg (see section 4) and passed from there to the AI model Gemini, which I run via Google Cloud Vertex AI from Google Cloud EMEA Limited in the European Union (region “eu”, data processing agreement with Google). The model uses them to produce follow-up questions and to sum up your problem in one sentence. Your input is not used to train AI models. Processing at Google works as described in section 5l.

When you submit your description, I process: email address, optionally your first name, company, role, company size, page language, an origin note from the page link (parameter “src”), the time of your consent, and your answers, follow-up answers and the summarising sentence. On the server the texts are deleted after 30 days at the latest. In my contact management (see section 7a) they remain until the purpose has ended or you request deletion. The server log contains no content. I am notified of new entries via Telegram; the message only contains a shortened email address.

You receive a confirmation by email, which I send via Brevo GmbH (see section 5f).

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). You only receive the newsletter if you tick the second box and click the link in the confirmation email (see section 5f).

6. Appointment booking (meet.selinagaertner.com)

You book appointments through our own booking page meet.selinagaertner.com. It runs on our own server, hosted by Hetzner Online GmbH in Germany (Nuremberg data centre). When you book, we process your name, your email address and the topic you enter, plus the chosen time. The calendar invitation to you and to us is sent via the SMTP service of Brevo GmbH (Köpenicker Str. 126, 10179 Berlin, Germany), see also section 5f. The booking page reads free times from our calendar; only busy and free times are transferred, no content.

If an appointment is paid in advance (for example the AI Value Sprint), the booking page checks with Stripe whether the payment is complete and takes your name and email address from the payment into the booking form.

We add your name, email address, topic and appointment to our customer records, which run locally on a computer of the owner and are not reachable from the internet, to prepare the meeting and to look after you as a customer. They stay there as long as the business relationship exists and statutory retention duties require; you can ask for access or deletion at any time. On the booking page itself, booking data is deleted automatically 30 days after the appointment. The meeting itself takes place on Zoom (Zoom Communications, Inc., USA); Zoom's privacy statement applies: https://explore.zoom.us/en/privacy/.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures and holding the appointment); for the customer records also Art. 6(1)(f) GDPR (legitimate interest in looking after our customers).

6a. Calendly (older booking links)

We use Calendly (Calendly LLC, 3423 Piedmont Rd NE, Atlanta, GA 30305, USA) for appointment scheduling. When you book an appointment, the data you enter (name, email address, and any additional information) is processed by Calendly.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(a) GDPR (consent through active booking).

Calendly's privacy policy: https://calendly.com/privacy.

6b. Payment processing (Stripe)

Some offers, for example the AI Value Sprint, can be paid for directly online. The payment page and the payment are handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). Stripe processes your name, email address, billing address, company name and VAT ID where given, and your payment details. We do not receive card details. Stripe calculates VAT and issues the invoice.

After payment, our booking page checks with Stripe whether the payment is complete and takes your name and email address into the booking form (see section 6). We keep payment and invoice data for as long as tax and commercial retention duties require.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (statutory retention duties). Stripe may also transfer data to the USA, based on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

Stripe's privacy policy: https://stripe.com/privacy.

7. LinkedIn

Our website contains links to our LinkedIn profile. When you click on these links, you are redirected to the platform of LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland). No automatic data transfer to LinkedIn occurs simply by visiting our website.

LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.

7a. Contacting business contacts and lead management

As part of our business development we contact professionals and executives at life sciences companies, for example via professional networks such as LinkedIn. In doing so we process professional information you have made publicly available yourself (name, position, company, public professional posts) as well as the history of our communication, in our own contact management system.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in initiating business relationships in a professional context. We address you exclusively in your professional role, do not process private data, and stop reaching out if you do not respond. To prepare a personal approach, public professional information may be summarised by an AI service (Google Gemini); to our knowledge no storage beyond the individual request takes place there.

Retention: Contacts who do not respond are deleted, or reduced to basic contact data, no later than twelve months after the last attempt to contact them. Objection: You may object to this processing at any time, informally, via the address given in the imprint. We record the objection and will not contact you again.

8. Make (formerly Integromat)

We use Make (Celonis SE, Thomas-Edison-Str. 1, 85716 Unterschleissheim, Germany) to automate workflows, such as processing form submissions from our website. When you submit data through a form on our website, this data may be transmitted to Make for further processing, such as storing it or triggering follow-up actions like sending a confirmation email.

Specifically, when you submit your first name and email address via the AI Readiness Scorecard or the Talk-to-Maria lead magnet (offered in connection with events such as the Global Pharma Tech Summit), this data is sent to Make, which then forwards it to Selina Gaertner Consulting (internal notification) and to the email address you provided (welcome message containing the Pharma AI Sales Playbook, a link to a live demo of the AI assistant "Maria", and a link to book a call). The welcome email is sent from mail@selinagaertner.com. You can opt out and request deletion of your data at any time by emailing mail@selinagaertner.com.

Make processes data on servers within the European Union. As Celonis SE is a company headquartered in Germany, data processing is subject to EU data protection standards.

Legal basis: Art. 6(1)(a) GDPR (your consent, given via the checkbox on the form) and Art. 6(1)(f) GDPR (legitimate interest in efficient business process automation).

Make's privacy policy: https://www.make.com/en/privacy-notice.

9. SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the "https://" in the address bar of your browser and the lock icon.

10. Your Rights

Under the GDPR, you have the following rights:

11. Changes to This Privacy Policy

This privacy policy is current as of October 2026. Due to the further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can always be accessed on our website.

Home Imprint Privacy Policy

© 2026 Selina Gaertner Consulting. All rights reserved.