Privacy policy

In the following "iTSM Group" means the group of companies of iTSM Consulting GmbH and all companies, in which iTSM Consulting GmbH has a majority share and is called "iTSM Group" in the following generally and for each single company of the group of companies.

1. Basic information

The iTSM Group is pleased about your visit on our website and your interest in our company. We take the protection of your personal data seriously and want you to feel comfortable when visiting our website. Guarantying data protection and data security is one of the basic principles of the ITSM Group’s policies. Your personal data only will be processed compliant to the General Data Protection Regulation (GDPR).

All employees and cooperating partners are indentured to comply with all statutory provisions concerning data protection.

Please contact our data protection officer in case of date protection related questions, claims and requests. You will find the contact details at the beginning of this statement.

2. Duration of data use

We will store your data for this long,

• as required by legal retention periods,
• as we need them for the assertion, exercise or defense of legal claims
• in case of consent: until the expiry of the agreed processing time or before if you revoke your consent and no reasons prevent deletion.

Within the scope of the deletion of your data, iTSM Group ensures that all affected order processors are immediately informed of your declared revocation of consent. The iTSM Group obliges its contract processors to delete the personal data immediately after knowledge of the revocation - unless there are no legal reasons to the contrary.

3. Processing personal data

The subject of data protection is the protection of personal data. This is all information that can be traced back to an identified or identifiable natural person (so-called data subject). Personal data includes details such as surname, first name, postal address, e-mail addresses and telephone numbers, but also information that necessarily arises during the use of our website, e.g. transmission of your IP address. The use of this website is basically possible without providing personal data. In the following cases, personal data is collected/processed:

3.1 Provision of the website

Every web server automatically registers access to web pages. When you visit our website, our web server temporarily registers the following data for the purposes of system security and control in accordance with Art. 6 Para. 1 letter f) DSGVO, which may allow conclusions to be drawn about your person:

• Computer address (IP address)
• Page from which a file was requested
• Name of the file
• Date and time of the query
• Transferred data volume
• Access status

Without this data it would be technically impossible to deliver and display the contents of the web pages. In this respect the collection of data is absolutely necessary. Furthermore, we use the anonymous information for statistical purposes. They help us to optimize our offer and technology. We reserve the right to subsequently examine the log files if we suspect an illegal use of our offer.

The collected data will be deleted by the system after 7 days.

3.2 Contact form

If you contact us using the contact form or via e-mail, we will process your data to answer your requests. That can only be done after your approval as claimed in Article 6 (1)(a) of the GDPR. You may revoke this approval at any time without stating any reasons. The following personal data will be collected within this processing:

• Salutation (optional)
• Company (optional)
• Last name (optional)
• First name (optional)
• Phone number (optional)
• e-mail address

In order to process your request, we need to add your information to our customer database, for which we use Microsoft Dynamics. Please also refer to the section "Data processing in third countries".

3.3 Booking of trainings

If you book trainings using our booking form we will processes your personal data with the purpose of handling your booking, including contract closing and billing, according to Article 6 (1)(b) of the GDPR. The following personal data will be collected within this processing:

• Company (optional)
• Name
• first name
• Phone number
• Street and house number
• Zip code
• City
• e-mail address
• Country

This data will be logged as well and serve as an evidence for booking a training via our website.

Furthermore, you have to provide the personal data of the training’s participants with the purpose of transmitting important information related to the training and the mailing/ shipping of training materials:

• Salutation
• Name
• first name
• e-mail address

In case of postal mailing the training documents, we transmit your necessary personal data to our service provider Mimeo (www.mimeo.de).

If you are not willing to provide these data, you are not able to book our trainings online. You still have the possibility to book our trainings via phone or by sending an e-mail, though.

If the seminar includes an exam by external institutes, we may need to transmit your personal data in order to register yourself for the exam. The data includes surname, name, e-mail address and will be transmitted to the corresponding institute according to Article 6 (1)(b) of the GDPR. For further information regarding the proceeding of your personal data be aware of the institute’s data protection statements you can find on their websites.

We transmit your data to the following institutes:

• PeopleCert (www.peoplecert.org) with headquarters in Nicosia, Cyprus.
• APMG (https://apmg-international.com/de) with headquarters in High Wycombe, England.

We do not transmit your personal data to the following institutes, but in order to take the exam you will have to register to their services

• Scrum.org (www.scrum.org) with headquarters in Burlington, USA
• ServiceNow (www.servicenow.com) with headquarters in Santa Clara, USA.

In case the seminars are held by one of our partners, we have to transmit your personal data as well, according to Article 6 (1)(b) of the GDPR. Contracts and agreements with our partners guarantee the proceedings in conformity with the current data protection laws.

3.3.1 Offer creation

We provide you with the opportunity to have an offer for our training courses generated - this can be done anonymously or by using your personal data (e.g. name, address, reachability). Your data will only be used to generate the document and will not be available to us afterwards.

If you wish, you can have us contact you regarding the offer; for this purpose, you only need to provide an e-mail address and/or, if you wish, a telephone number. In this case, the data will be processed according to Article 6 (1)(a) of the GDPR (consent) or Article 6 (1)(b) of the GDPR (pre-contractual measures).

Additionally, you may approve us according to Article 6 (1)(a) of the GDPR, to store your personal data within our customer relationship system with the purpose to contact you within the context of sales activities. You may revoke this approval at any time without stating any reasons.

3.3.2 Requesting demo access for web-based trainings

For various online trainings, you have the option of requesting demo access to our learning platform before booking in order to get a better idea of the content and training methodology. For this purpose, you must at least provide an e-mail address, the information of name and first name are voluntary. The request and provision of demo access is based on Art. 6(1)(b) of the GDPR (pre-contractual measures).

Please also refer to the data protection information regarding our learning platform.

When you request demo access, a voucher will be sent to the email address you provide, which you can use to create an account with the associated demo content. The demo content is available to you for 5 days from the start of the WBT before it is deactivated. Your demo account will also be deactivated afterwards.

As part of providing demo access, we include you in our customer database so that we can send you topic-related notifications. This also applies to the sending of the voucher for the learning platform. You have the right to object to this, please see the section "Objection rights".

We use Microsoft Dynamics for our customer database. Please also refer to section "Data processing in third countries".

3.4 Conducting Webinars

On our website, we offer live webinars on various topics for our customers and interested parties. To conduct the webinars, we use Zoom, a product of Zoom Video Communications Inc. located at 55 Almaden Boulevard, Suite 600, San Jose, CA 95113, USA.

When you register for a webinar, we process the first name, last name, and email address you provide when registering for our webinars; optional information includes your phone number, job position, and company affiliation. Your e-mail address will also be used to provide you with the necessary information about the webinar (registration confirmation e-mail including transmission of the date and dial-in information, reminder e-mail shortly before the webinar takes place, request for webinar evaluation, link to the webinar recording).

The basis for this is your voluntary registration for the webinar (consent pursuant to Art. 6(1)(a) in conjunction with. Art. 49(1)(a) of the GDPR, taking note of the privacy policy and terms of use of Zoom Video Communications Inc:

Privacy Policy - Zoom Video Communications Inc.
Terms of Use - Zoom Video Communications Inc.

For more information about how we process your personal data in the context of organizing, conducting and following up on webinars, please consult the following information:

iTSM Group Webinar Privacy Notice.

3.5 Provision of webinar recordings

The recordings of the webinars already held can be accessed via our website.  The recordings are hosted on Youtube (youtube.com). Youtube is a service provided by Google LLC, so please also note the provider's privacy policy (https://policies.google.com/privacy?hl=de).

In order to access the content, it is necessary to provide your data (name, first name, e-mail address). Optional are the details of your telephone number and your company affiliation. We record your data in our customer database in order to be able to send you thematically related notifications. In doing so, we rely on the legitimate interest according to Art. 6(1)(f) of the GDPR, which includes the identification and acquisition of potential new customers. You have the right to object to this, please see section "Rights to object".

We use Microsoft Dynamics for our customer database. Please also refer to section "Data processing in third countries".

3.6 Provision of Whitepapers

We provide relevant information in the form of whitepapers for various topics via our website.

In order to access the content, it is necessary to provide your data (name, first name, e-mail address). Optional are the details of your telephone number and your company affiliation. We record your data in our customer database in order to be able to send you thematically related notifications. In doing so, we rely on the legitimate interest according to Art. 6(1)(f) of the GDPR, which includes the identification and acquisition of potential new customers. You have the right to object to this, please see section "Rights to object".

We use Microsoft Dynamics for our customer database. Please also refer to section "Data processing in third countries".

3.7 Subscribe to the newsletter

If you sign up for our newsletter, we process your personal data for the purpose of transmitting the newsletter and for the purpose of informing you within the registration process. That can only be done after your approval as claimed in Article 6 (1)(a) of the GDPR. You may revoke this approval at any time without stating any reasons. The following personal data will be collected within this processing:

• e-mail address

Within the newsletter creation and transmitting processes we take advantage of a processor. That means that your personal data you provided for newsletter service need to be transmitted to the processor. To guarantee the protection of your personal data we closed a processor contract according to Article 28 (3) of the GDPR.

If you want to receive our newsletter you must provide a valid e-mail address. To exclude abuse of e-mail addresses we use the “Double-Opt-In” procedure. That means that you will receive a confirmation mail after signing up for the newsletter. You will not get a newsletter unless the confirmation has been transacted. In context of this procedure the order, the transmission of the confirmation email and the and the receipt of the registration confirmation will be logged. Therefore, your IP address, the date and the time of the registration and the date and the time of the confirmation will be recorded. These data serve as an evidence in case of abusing other’s e-mail addresses.

You may revoke your approval for the newsletter at any time without stating any reasons. To do so you may use the link provided in every single newsletter to starts the sign off procedure.

3.8 Application procedure

You have the opportunity to send us your application documents for vacant positions or an unsolicited application by e-mail.

You will find all essential information on the application procedure under the following links:

• application details – German companies of the iTSM Group
• application details – Austria
• application details – Switzerland
• application details – Netherlands
• application details - Italy

3.9 Website analysis and optimization

We use various tracking tools to analyse the use of our website and to implement optimizations based on this information. Insofar as the processing of your personal data is based on your consent in accordance with Article 6(1)(a) of the GDPR, you can grant or revoke this consent through the data protection settings on this website (see section " Consent and revocation regarding the use of cookies"). The following tracking tools are currently in use on our website:

• etracker

3.9.2 etracker

3.10 Retargeting and Conversion Tracking

On our website we use retargeting and conversion tracking. Retargeting means that we "tag" you using a cookie to enable us to target you on other websites with personalised advertising. Our aim is to draw your attention to our products on other websites as well. Conversion tracking enables us to identify how many of our visitors have actually responded to the personalised advertising.

Since these techniques are based on using cookies, the processing and transmission of your data can only be carried out based on your consent in accordance with Article 6(1)(a) of the GDPR.

For information on how you can give your consent and revoke a consent once given at any time for future processing operations, please refer to the section "Consent and revocation regarding the use of cookies".

3.10.1 Google Tag Manager and Google Ad Conversions

Both tools are provided by Google LLC, located in Mountain View, California, USA. Your (user) data will be processed directly by Google (and possibly by its subsidiaries), so that a transmission of your data to the USA cannot be excluded. Therefore, please note in particular the information given in the section “Data transfer to the USA”.

Please also note that Google may also use the data for any other purposes, e.g. to create user profiles, and may link the data to other data (e.g. Google accounts).

For more information about Google's data protection policy and how to opt-out or object to the use of your personal data, please visit https://policies.google.com/privacy?hl=en-US.

3.10.2 LinkedIn Conversion Tracking

We use LinkedIn Conversion Tracking on our website, that is provided by LinkedIn Inc. located in Sunnyvale, California, USA. Using this tool offers the opportunity to understand how our marketing campaigns on LinkedIn perform and how target-oriented they are. In order to be able to gather the necessary information the implementation of LinkedIn Tag Manager on our website is required. The Tag Manager uses cookies and enables the collection of data of our visitors, including

• IP-address
• device and browser information
• visited (sub) page,
• referrer URL
• timestamps

that are transmitted to LinkedIn for further processing. The IP-addresses will be either masked or – if you are a LinkedIn member – hashed. In so far you are a LinkedIn member, the data will be linked with your profile data. By doing this, it is possible to provide detailed demographical data regarding our target- group. This data includes

• geographical location,
• job title,
• job function,
• company,
• company size,
• company sector.

This tells us which target group reacted how intensively to which content. The LinkedIn user IDs will be deleted after 7 days to pseudonymize the data. The pseudonymized data will be deleted after 180 days.

LinkedIn does not share any of this data with us, they only create anonymized, aggregated reports und notifications regarding our target group and the performance of our LinkedIn marketing campaigns.

Since the processing is based on using cookies, the processing and transmission of your data can only be carried out based on your consent in accordance with Article 6(1)(a) of the GDPR.

For information on how you can give your consent and revoke a consent once given at any time for future processing operations, please refer to the section "Consent and revocation regarding the use of cookies".

Please note before giving your consent, that your (user) data will be processed directly by LinkedIn. Since LinkedIn is an US company, please note in particular the information given in the section “Data transfer to the USA”.

For more information about LinkedIn's data protection policy please visit https://privacy.linkedin.com

3.11 Further processing (third party providers)

Our website is not rigid, which means that the layout and content will be adjusted from time to time. You may be provided with content that requires the involvement of third parties. In this case, our server usually sends requests to the third party providers (usually at least by sending your IP address), whereupon the corresponding content is displayed. You can either give your consent in accordance with Article 6(1)(s) of the GDPR automatically retrieve the content, or when using the website you decide individually for each content that your personal data will be used to provide the content - this is usually a click on the content in question, whereby you give your one-time consent.

You can configure this in the cookie settings of our website, see section "Consent and revocation regarding the use of cookies".

The following third-party providers are potentially used (list will be updated as necessary).

Websites and services of other providers linked on our website have been and will be designed by third parties. We therefore have no influence on the design, content and function of these third-party services and expressly distance ourselves from all content of all linked third-party offers. Therefore, please note that the third-party services linked from our website may install their own cookies on your end device and thereby collect personal data.

We have no knowledge of which data are transmitted to the providers in addition to the IP address, and in what way they are processed. Please inform yourself directly with the third-party providers, as we have no influence on this. Further information can be found in the data protection statements of the respective providers. As a rule, the transmitted data should not be personally identifiable to you, unless you are registered with an account with the relevant third-party provider at the time of the data transmission. In this case, the data may be assigned to your profile and may support so-called profiling.

4. Facebook-Fanpage

The iTSM Group operates a fan page on the social media platform Facebook. Within the scope of using or visiting our Facebook fan page, your personal data will be processed by Facebook for statistical evaluations regarding our fan page - regardless of whether you have a Facebook account yourself. If you have an account and are logged in to it when you visit our fan page, Facebook may process more of your personal data.

If you have concerns regarding the processing of your personal data by Facebook, you should read the privacy policy before using our fan page and, if necessary, refrain from using our fan page:

Facebook Privacy Policy

Privacy policy of the Facebook fan page of iTSM Group

5. Use of cookies

This website uses cookies to deliver and display the website correctly (technical cookies) and to make the use of our website more pleasant for you (functional cookies). Furthermore, cookies are used in order to be able to use services that allow us to analyze user behaviour on the website and to derive optimisation options based on this (see section "Website analysis and optimization") and to place personalized advertising (see section "Retargeting and conversion tracking").

A detailed description of the individual cookies in the respective categories can be found in the cookie settings under "Show details".

In addition to the cookie settings on our website, you can configure the handling of cookies individually through browser settings. How you can carry out this configuration depends on the browser you are using. In the following, you will find help (up-to-date at the time of the creation of this data protection notice) for the most common browsers. If one of the links is outdated, please contact the respective browser manufacturer for information on the subject of cookies.

Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen

Internet Explorer: https://support.microsoft.com/de-de/help/17442

Google Chrome: https://support.google.com/chrome/answer/95647

Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac

Opera: http://help.opera.com/Linux/9.01/de/cookies.html

To deactivate the usage of third-parties’ advertising cookies  you may use the website of NAI, Network Advertising Initiative, http://www.networkadvertising.org/managing/opt_out.asp

5.1 Strictly necessary cookies

Strictly necessary cookies help to ensure that you can navigate the website by providing basic features such as navigating the pages and accessing secure areas. Without these cookies, the website would not function properly. Your consent is not required for the use of such cookies; the data processing based on technically relevant cookies is carried out on the basis of our legitimate interest in accordance with Article 6(1)(f) of the GDPR, which results from the outlined purposes of use of the respective cookie.

5.2 Functional cookies

Functional cookies allow information to be stored that can change the way how the website looks or acts. This could be your preferred language or region. This is to enable you to use the website more comfortably.

Functional cookies may only be used if you give your consent in accordance with Article 6(1)(a) of the GDPR. For more information on how to give your consent and how to revoke your consent at any time for future processing operations, please see the section "Consent and revocation regarding the use of cookies".

5.3 Statistical cookies

Statistical cookies help us understand how visitors interact with the website by collecting information and reporting information. This is carried out using appropriate analytic tools - see section "Website analysis and optimisation" for more information.

Statistical cookies may only be used if you give your consent in accordance with Article 6(1)(a) of the GDPR. For more information on how to give your consent and how to revoke your consent at any time for future processing operations, please see the section "Consent and revocation regarding the use of cookies".

5.4 Marketing cookies

Marketing cookies are used to identify visitors across different websites. The aim and purpose is to show individual web users advertising that is relevant and interesting to them, and therefore more valuable to publishers and third-party advertisers. We also make use of various tools for this purpose; details can be found in the section "Retargeting and Conversion Tracking".

Marketing cookies may only be used if you give your consent in accordance with Article 6(1)(a) of the GDPR.  For more information on how to give your consent and how to revoke your consent at any time for future processing operations, please see the section "Consent and revocation regarding the use of cookies".

5.5 Consent and revocation regarding the use of cookies

You can give your consent or revoke your consent to the use of cookies and the associated processing activities via the cookie settings. These will be displayed the first time you visit our website. You will be prompted to give the relevant consent and save the settings. You can either accept the use of all types of cookies, accept only the technically necessary cookies or make individual settings.

Click on the button "Accept all" to give your consent for the use of all types of cookies used by us.

Click on the button "Decline all" to only allow the use of technically relevant cookies. This could mean that some functions of the website cannot be used.

You can also decide individually for each type of cookie used whether you wish to give your consent for its use. You can set this via the respective slider. Then click on the "Save settings" button.

Please note that these settings can only be saved for further visits if you allow at least the setting of technically relevant cookies by browser setting. Otherwise, you must confirm the cookie settings each time you visit our website.

You can change the cookie settings at any time, and thus revoke consent already granted or grant further consent. To do so, click on the cookie symbol, which you will always find at the bottom left.

6. Rights of the data subject

As soon as your personal data is being processed according to the GDPR you are a data subject and therefore have the right to:

• revoke your approval at any time according to Article 7(3) of the GDPR. As a consequence, we are not allowed to process your data in the context of the purpose your approval was given to anymore.
• obtain information about your personal data being processes by us according to Article 15 of the GDPR. You may obtain information especially about the processing purposes, the category of personal data, the category of recipients to whom the personal data have been or will be disclosed, the envisaged period for which the personal data will be stored, the existence of the rights to rectification, erasure, restriction of processing, objection, complaint-lodging,  as well as information about the sources of the personal data when not collected by us and information about the existence of automated decision-making (including profiling).
• claim the rectification of inaccurate data and the completion of incomplete data stored by us, without undue delay according to Article 16 of the GDPR.
• claim the erasure of your personal data stored by us according to Article 17 of the GDPR unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims,
• claim the restriction of processing your personal data according to Article 18 of the GDPR, as far as the accuracy of the data is contested by you, the processing is unlawful and you oppose the erasure of the personal data, we do not need your personal data anymore, but the data are still required for the establishment, exercise or defence of legal claims or you objected to processings pursuant to Article 21(1) of the GDPR.
• to receive your personal data being processed by us in a structured, commonly used and machine-readable format and to have those data transmitted to another controller according to Article 20 of the GDPR.
• to lodge a complaint with a supervisory authority according to Article 77 of the GDPR. You can find the supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement. 

You can claim all rights (except the right to lodge a complaint) by contacting our data protection officer using the given contact information at the beginning of this statement.

6.1 Rights to object

In cases of processing your personal data based on legitimate interests according to Article 6 (1)(f) of the GDPR, you have the right to object this processing according to Article 21 of the GDPR. This right includes profiling based on certain processings.

If you exercise your right to object, iTSM Group will cease processing the personal data relating to you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims, in accordance with the law.

If the personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

If you wish to exercise your right to object, simply send an e-mail to datenschutz@itsmgroup.com.

7. Data security

This website uses the common TLS encryption protocol (Transport Layer Security) in association with the highest encryption level being supported by your browser. This encryption is used to securely transmit confidential content to the iTSM Group. A (green) lock symbol in the status bar of your browser labels a website to be secure.

8. Data processing in third countries

If data is transferred to bodies whose registered office or place of data processing is not located in a member state of the European Union or in another state party to the Agreement on the European Economic Area, we will ensure prior to the transfer that, outside of exceptional cases permitted by law, either an adequate level of data protection exists at the recipient (e.g. through an adequacy decision by the European Commission or through appropriate safeguards such as the agreement of so-called EU standard contractual clauses of the European Union with the recipient) or you give your consent to the data transfer.

9. Changes to our privacy policy

This data protection statement corresponds to the data protection requirements being stated in the GDPR. To ensure our data protection statement to be up to date and correspond to actual legal regulation, we reserve the right to make modifications at any time. That also covers the cases that the date protection statement needs to be updated due to new or update services. An updated data protection statement is valid at your next visit to our website.

Last update: 19^th of September, 2023