Privacy policy

1. Joint controllers

Christoph Petry and Christian Farin are joint controllers within the meaning of Article 26 GDPR for the processing of your personal data in connection with this website. They are also joint service providers within the meaning of Section 5 DDG.

Christoph Petry, Feldbergstraße 19, 65187 Wiesbaden, christoph.petry@p-tnt.eu, +49 611 1478000.

Christian Farin, Dieselstraße 2, 63165 Mühlheim am Main, christian.farin@wp-farin.de, +49 6108 9958235.

They have entered into an arrangement concerning their respective responsibilities under Article 26 GDPR. Under this arrangement, Christoph Petry handles the technical administration of the website and the regular deletion of form submissions, while Christian Farin checks for possible exceptions before deletion. Under Article 26(3) GDPR, you may exercise your rights as a data subject against either controller. Their contact details are provided above.

2. General information on data processing

We process personal data only where this is necessary to provide a functional website and our content and services, or where you have consented to the processing. Depending on the processing activity, the legal basis is Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (a pre-contractual request or contract discussions) or Article 6(1)(f) GDPR (our legitimate interest in operating a secure and functional website).

3. Hosting

This website is hosted by Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA (“Netlify”). Netlify processes technical connection data (see Section 4) and, when you use the contact or Quicktest forms, the information you enter there. Netlify acts as a processor within the meaning of Article 28 GDPR.

The processing is governed by Netlify’s Data Processing Agreement (DPA). According to Netlify, the DPA forms part of its terms of service and applies automatically to all customers, regardless of their selected plan. No separate signed agreement is therefore required. The DPA is publicly available at: https://www.netlify.com/pdf/netlify-dpa.pdf.

Netlify and the subprocessors it engages may process personal data outside the European Economic Area, particularly in the USA. According to Netlify, such transfers primarily rely on the EU–U.S. Data Privacy Framework. Where that framework does not apply, Netlify relies on the European Commission’s Standard Contractual Clauses. Further information is available at https://www.netlify.com/gdpr-ccpa/ and in Netlify’s privacy policy at https://www.netlify.com/privacy/.

The legal basis for using Netlify is Article 6(1)(f) GDPR, based on our legitimate interest in operating a secure and functional website.

4. Server log files

When you access this website, Netlify automatically collects technical access data in server log files. This may include your IP address, the date and time of access, the page requested, the browser used and the operating system used. This data is processed to ensure reliable operation, detect and prevent misuse, and maintain IT security.

The retention period for technical logs depends on the type of log and Netlify’s security and deletion procedures. Further information is available in Netlify’s privacy policy and Data Processing Agreement: https://www.netlify.com/privacy/ and https://www.netlify.com/pdf/netlify-dpa.pdf.

5. Cookies and local storage

To provide the Quicktest, we store your answers, company profile, progress and a randomly generated test identifier in your browser’s session storage. This data is deleted in the current tab when you restart the Quicktest or successfully submit a request for a conversation. If an error occurs, the data remains available so that you can try again. Depending on your browser, it may remain available if the browser session is restored. Contact details are generally held only in working memory. If the page needs to reload to apply a changed consent choice, form entries are temporarily saved in session storage and removed after they have been restored. Entries older than five minutes are discarded.

These essential storage operations provide the functions you have requested. Section 25(2) no. 2 TDDDG applies to storage operations that are strictly necessary. Personal data is processed to provide the Quicktest and handle your request under Article 6(1)(b) GDPR or on the basis of our legitimate interest in providing a functional service under Article 6(1)(f) GDPR.

Google Analytics, Google Ads and the LinkedIn Insight Tag are currently not active. Optional storage of campaign information is also disabled. No consent banner is displayed while no optional service is configured. Any later activation will require updated privacy information and the necessary prior consent. The option to provide test results voluntarily under Section 7 is offered separately on the results page.

6. Contact form

When you submit the general contact form, we process your name, email address, message and confirmation of the privacy notice to handle your request and any follow-up questions. The information is transmitted and stored through Netlify Forms. Christoph Petry and Christian Farin receive the request jointly; the email notifications configured for this purpose contain the form data. This form does not include a Quicktest PDF.

The legal basis is Article 6(1)(b) GDPR where your request concerns steps prior to entering into a contract, and Article 6(1)(f) GDPR for other communications. The processing is carried out jointly by the controllers named in Section 1.

7. Quicktest

The Quicktest and the results PDF are initially generated locally in your browser. You do not need to provide contact details to complete the Quicktest, view the results or download the PDF. No answers or results are sent to Netlify Forms for these purposes. Loading the website files generates the technical connection data described in Section 4. Local processing provides the self-assessment you requested; the legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR for providing this service.

If you explicitly request a results review, we send your first name, last name, company and email address to Netlify Forms, together with your telephone number and message where provided. If available in the current test, we also send the company profile, selected topic areas, individual answers, results, test ID, test version and timestamps, together with an internal preparation PDF. This data is used to handle your request and prepare for the conversation. Christian Farin and Christoph Petry receive the request, the form data and the internal PDF or a file link supplied by Netlify. The legal basis is Article 6(1)(b) GDPR for pre-contractual requests and otherwise Article 6(1)(f) GDPR for handling the request you expressly submitted.

Regardless of whether you download the PDF or request a conversation, you may separately consent on the results page to submitting data voluntarily for statistical analysis. Submission occurs only if you select the checkbox, which is not selected by default, to help improve the Quicktest. There is no separate submit button. Only your individual answers with question IDs, selected topic areas, overall and area scores, test version, and the consent decision, timestamp, text version and purpose identifier are transmitted. Names, company details, email address, telephone number, company profile, free text, test identifier, marketing and campaign data, and PDFs are not transmitted. The result data is stored in a separate Netlify form. No email notifications are configured for this form. The legal basis is your voluntary consent under Article 6(1)(a) GDPR. Participation is not required to view your results, download the PDF or request a conversation. Downloading the PDF or requesting a conversation does not trigger this statistical data submission.

When Netlify receives the data, it may process technical connection data such as the IP address, time of receipt and its own submission identifier. The separate result records are therefore not treated as guaranteed anonymous when received. We use them to identify general challenges faced by growing companies and to improve the service. Technical metadata is excluded from aggregated analyses, and each displayed group contains at least five data sets. We also check whether rare combinations could allow conclusions about individual cases and combine them further or omit them where necessary. Individual statistical records are deleted no later than twelve months after receipt. Aggregated data that has been effectively anonymized may be retained.

You may withdraw your consent to statistical processing for the future using the contact details in Section 1. Because we deliberately do not store contact details or our own user identifier with the statistical data, it may be difficult to identify a specific record. We will attempt to identify it using the information you provide. Once the data has been effectively anonymized, it can no longer be linked to an individual.

If you later open the conversation form using the link in the downloaded results PDF, the fragment part of the link—the part after the # character—contains an encoded local copy of the Quicktest answers, results, company profile, test ID and related timestamps. This fragment is not technically transmitted to Netlify or any other server when the link is opened. It is processed only in the browser and then removed from the visible browser address. The information is sent to Netlify Forms, together with the internal preparation PDF, only when you submit the conversation form as described above. The link contains no contact details. Anyone with access to the results PDF can use the link and therefore access the encoded Quicktest data.

8. Recipients and data transfers

We do not disclose your data to third parties other than the processors named in this policy, particularly Netlify, unless we are legally required to do so or you have expressly consented.

The controllers use email services to deliver and process emails. Christoph Petry uses IONOS for his domain and booked email service and Google Workspace for email. Google Workspace may process data outside the European Economic Area, particularly in the USA. Further information is available at https://workspace.google.com/terms/dpa_terms.html and https://policies.google.com/privacy. Christian Farin uses a Microsoft email service for his business email address. Microsoft may also process data outside the European Economic Area, particularly in the USA. Microsoft Ireland Operations Limited is generally responsible for the European Economic Area. Further information is available at https://www.microsoft.com/privacy/privacystatement and https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.

9. Retention periods

We generally retain personal data from form submissions for twelve months after a request has been completed, unless a statutory retention obligation or another documented reason requires a longer period. Further details are set out in the arrangement between the controllers under Article 26 GDPR.

Christoph Petry manages the Netlify account and organizes deletion; Christian Farin checks for possible retention exceptions beforehand. The deletion review covers form submissions, uploaded PDFs, notification emails and other stored copies. The website code does not perform automatic deletion. The period stated in Section 7 applies to separate statistical records; Section 14 applies to email marketing.

10. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and the right to object to processing based on legitimate interests (Article 21 GDPR). Where you have consented to processing, you may withdraw your consent at any time for the future (Article 7(3) GDPR). You may exercise these rights against either of the joint controllers named in Section 1.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority concerning our processing of your personal data. The competent authority is:

The Hessian Commissioner for Data Protection and Freedom of Information, PO Box 3163, 65021 Wiesbaden.

12. Data security

This website uses a TLS-encrypted connection to protect personal data during transmission. You can identify this by the HTTPS address and the security information displayed by your browser.

13. Updates and changes to this privacy policy

This privacy policy is current as of 21 September 2026. It may need to be amended as the website develops or legal requirements change. Any changes will be agreed jointly in accordance with Section 2 of the arrangement under Article 26 GDPR.

14. Voluntary information by email

When requesting a conversation, you may separately and voluntarily consent to receiving future emails about the Scale-up-Navigator Toolbox and relevant offers and events from Christian Farin and Christoph Petry. The checkbox is not selected by default. Both may send you information on the basis of this consent. Emails are sent manually from their business email accounts; no newsletter system or automated mailing system is used.

For documentation purposes, your request transmits the Yes/No decision, timestamp, text version, purpose identifier and complete consent wording to Netlify. The legal basis for using your information for marketing is Article 6(1)(a) GDPR. You may withdraw your consent at any time for the future by emailing christoph.petry@p-tnt.eu. Christoph Petry coordinates the withdrawal with Christian Farin so that both stop sending mailings. Your request for a conversation does not depend on this consent.

We use your email address for these communications until you withdraw your consent or the service ends. Any necessary record of consent or suppression record will then be retained only for as long as required to comply with the withdrawal or protect legitimate interests in demonstrating compliance. This limited further processing is based on Article 6(1)(f) GDPR.