Privacy Statement

Last updated: 19 October 2026

Zuletzt aktualisiert: 19. Oktober 2026

  1. Controller

Rhino Management Consulting GmbH
Louisenstraße 120
61348 Bad Homburg
Germany

Phone: +49 6172 944 6572
Email: info@rhino-mc.de

  1. Data Protection Contact

For any questions regarding data protection, please contact:

Email: dataprotectionofficer@rhino-mc.de

A formal Data Protection Officer has not been appointed.

  1. General Information on Data Processing

3.1 Legal Bases

We process personal data on the basis of:

  • Art. 6(1)(b) GDPR (contract / pre-contractual measures)

  • Art. 6(1)(c) GDPR (legal obligation)

  • Art. 6(1)(f) GDPR (legitimate interests)

  • Art. 6(1)(a) GDPR (consent)

Where cookies or similar technologies are used, Section 25 German TDDDG additionally applies.

3.2 Storage Duration

We retain personal data only as long as necessary for the respective purpose or as required by statutory retention obligations.

3.3 Recipients and Service Providers

We use external service providers (hosting, IT services, analytics tools). These act either as processors pursuant to Art. 28 GDPR or as independent controllers.

  1. Data Processing When Visiting Our Website

4.1 Hosting (IONOS)

Our website is hosted by:

IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany

When accessing our website, the hosting provider automatically processes server log files, including:

  • IP address

  • Date and time of access

  • Accessed page/file

  • Referrer URL

  • Browser type and operating system

  • HTTP status code

Purpose: secure and stable website operation, error analysis, protection against attacks
Legal basis: Art. 6(1)(f) GDPR
Retention period: generally up to 30 days

  1. Cookies and Consent Management

5.1 Use of Cookies

Our website uses:

  • technically necessary cookies

  • optional cookies (e.g. analytics), only based on consent

5.2 Consent Management (CookieYes)

We use CookieYes to manage and document user consent.

Processed data: consent status, timestamp, technical browser information
Legal basis: Art. 6(1)(c) and Art. 6(1)(f) GDPR
Withdrawal: at any time via “Cookie Settings” on our website

  1. Web Analytics (Google Analytics)

Subject to your consent, we use Google Analytics 4.

Provider: Google Ireland Limited, Ireland
Recipient where applicable: Google LLC, USA

Processed data: usage data, device information, pseudonymous identifiers

Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG
Withdrawal: via cookie settings

International transfer: USA – based on EU Standard Contractual Clauses and/or EU-US Data Privacy Framework where applicable

  1. Contact Requests

If you contact us via email, phone, or contact form, we process:

  • name and contact details

  • content of your request

Purpose: responding to inquiries
Legal basis: Art. 6(1)(b) or Art. 6(1)(f) GDPR
Retention: until the inquiry is fully resolved, thereafter in accordance with statutory obligations

  1. Applications

If you apply via our website or email, we process:

  • contact details

  • application documents (CV, certificates, etc.)

  • communication data

Purpose: recruitment process
Legal basis: Section 26 German Federal Data Protection Act (BDSG) in conjunction with Art. 6(1)(b) GDPR
Retention: up to 6 months after completion of the process, longer only with consent

  1. Use of AI Systems (EU AI Act)

We use AI-supported systems to enhance internal processes and improve communication and knowledge workflows.

Depending on context, personal data may be processed, particularly communication content.

We ensure that the use of such systems complies with the GDPR and, where applicable, the EU Artificial Intelligence Act (EU AI Act).

No automated decision-making within the meaning of Art. 22 GDPR takes place.

9.1 Fireflies.ai (Meeting Transcription)

We use Fireflies.ai for meeting transcription and structured summaries, including meetings with clients and business partners.

Provider: Fireflies.ai, Inc., USA
Data processed: audio recordings, transcripts, participant information
Legal basis: Art. 6(1)(b) or Art. 6(1)(f) GDPR
International transfer: EU Standard Contractual Clauses

9.2 Pipedrive AI (CRM Support)

We use Pipedrive AI to support CRM and sales processes.

Provider: Pipedrive OÜ, Estonia
Data processed: contact data, CRM metadata
Legal basis: Art. 6(1)(f) GDPR

9.3 OpenAI Platform / ChatGPT Enterprise

We use OpenAI services (Enterprise/Pro versions with training disabled) to support analytical, text-based and knowledge-related processes.

Provider: OpenAI, L.L.C., USA

Important note: Enterprise configurations are used under which submitted data is not used for model training.

Legal basis: Art. 6(1)(f) GDPR and Art. 6(1)(b) GDPR where used in contractual context
International transfer: EU Standard Contractual Clauses

9.4 Google Gemini

We use Google Gemini to support research and knowledge processes.

Provider: Google Ireland Limited, Ireland
Recipient where applicable: Google LLC, USA

Legal basis: Art. 6(1)(f) GDPR
International transfer: appropriate safeguards under GDPR

9.5 AI-Based Website Chatbot

Our website may include an AI-supported chatbot to provide initial information.

Processed data: user input content, technical metadata
Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR

Please do not enter sensitive personal data or confidential information into the chatbot.

  1. Your Rights

You have the following rights:

  • Right of access (Art. 15 GDPR)

  • Right to rectification (Art. 16 GDPR)

  • Right to erasure (Art. 17 GDPR)

  • Right to restriction (Art. 18 GDPR)

  • Right to data portability (Art. 20 GDPR)

  • Right to object (Art. 21 GDPR)

  • Right to withdraw consent (Art. 7(3) GDPR)

To exercise your rights, contact: dataprotectionofficer@rhino-mc.de

  1. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority.

The competent authority for us is typically:

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Germany

  1. Online Surveys

12.1 Access Code

If you request an access code, we process your name, business e-mail address and company to issue the code and organise the survey. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is providing the survey to you and your organisation. Without these data we cannot issue a code. Recipients: our e-mail and CRM service providers as processors. The data are deleted 12 months after our last contact with you.

12.2 Survey

We process your answers, optional information on your role and optional comments. We use them to evaluate the survey, to provide the participating organisation with results and for our internal analysis. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is assessing and improving IT organisations and developing our survey and consulting methods. Participation is voluntary; not taking part has no consequences.

12.3 Operation and Security

To run the survey securely, we process your IP address (to limit failed access attempts) and server logs. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the secure operation of the survey. If you sign in with your organisation account, we only check the organisation and whether multi-factor authentication was used; we do not store these sign-in data. Your browser stores one cookie for the survey round, your unsent answers and your language setting; these are strictly necessary for the service (Section 25(2) No. 2 TDDDG).

12.4 Recipients

A cloud hosting provider as our processor; the data are processed exclusively in the European Union. The participating organisation receives results in aggregated form and comments without names and without any link to other answers, and only once at least 5 people have taken part. Within Rhino MC, only the staff working on the survey have access.

12.5 Retention

Unsent answers are deleted when you close the browser tab, or after 3 hours without input. Submitted answers are deleted in the survey system no later than 3 months after the survey round closes. Answers exported for evaluation are deleted no later than 12 months after the round closes. Server logs are deleted after 30 days.

12.6 Your Rights

You can object at any time to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). Your other rights and your right to lodge a complaint are set out in Sections 10 and 11. Contact: dataprotectionofficer@rhino-mc.de.

  1. Online-Umfragen

12.1 Zugangscode

Wenn Sie einen Zugangscode anfordern, verarbeiten wir Ihren Namen, Ihre geschäftliche E-Mail-Adresse und Ihr Unternehmen, um den Code auszustellen und die Umfrage zu organisieren. Rechtsgrundlage: Art. 6 Abs. 1 lit. f DSGVO; unser berechtigtes Interesse ist die Bereitstellung der Umfrage für Sie und Ihre Organisation. Ohne diese Angaben können wir keinen Code ausstellen. Empfänger: unsere E-Mail- und CRM-Dienstleister als Auftragsverarbeiter. Die Daten werden 12 Monate nach unserem letzten Kontakt mit Ihnen gelöscht.

12.2 Umfrage

Wir verarbeiten Ihre Antworten, freiwillige Angaben zu Ihrer Rolle und freiwillige Kommentare. Wir nutzen sie, um die Umfrage auszuwerten, der teilnehmenden Organisation Ergebnisse bereitzustellen und für unsere interne Auswertung. Rechtsgrundlage: Art. 6 Abs. 1 lit. f DSGVO; unser berechtigtes Interesse ist die Bewertung und Verbesserung von IT-Organisationen sowie die Weiterentwicklung unserer Umfrage- und Beratungsmethoden. Die Teilnahme ist freiwillig; eine Nichtteilnahme hat keine Folgen.

12.3 Betrieb und Sicherheit

Für den sicheren Betrieb der Umfrage verarbeiten wir Ihre IP-Adresse (zur Begrenzung fehlgeschlagener Zugriffsversuche) und Server-Logs. Rechtsgrundlage: Art. 6 Abs. 1 lit. f DSGVO; unser berechtigtes Interesse ist der sichere Betrieb der Umfrage. Wenn Sie sich mit dem Konto Ihrer Organisation anmelden, prüfen wir nur die Organisation und ob Multi-Faktor-Authentifizierung verwendet wurde; diese Anmeldedaten speichern wir nicht. Ihr Browser speichert ein Cookie für die Umfragerunde, Ihre noch nicht abgesendeten Antworten und Ihre Spracheinstellung; diese sind für den Dienst unbedingt erforderlich (§ 25 Abs. 2 Nr. 2 TDDDG).

12.4 Empfänger

Ein Cloud-Hosting-Anbieter als unser Auftragsverarbeiter; die Daten werden ausschließlich in der Europäischen Union verarbeitet. Die teilnehmende Organisation erhält Ergebnisse in aggregierter Form sowie Kommentare ohne Namen und ohne Bezug zu anderen Antworten, und nur, sobald mindestens 5 Personen teilgenommen haben. Innerhalb von Rhino MC haben nur die mit der Umfrage befassten Mitarbeitenden Zugriff.

12.5 Speicherdauer

Nicht abgesendete Antworten werden gelöscht, wenn Sie den Browser-Tab schließen, oder nach 3 Stunden ohne Eingabe. Abgesendete Antworten werden im Umfragesystem spätestens 3 Monate nach Ende der Umfragerunde gelöscht. Für die Auswertung exportierte Antworten werden spätestens 12 Monate nach Ende der Runde gelöscht. Server-Logs werden nach 30 Tagen gelöscht.

12.6 Ihre Rechte

Sie können einer Verarbeitung auf Grundlage von Art. 6 Abs. 1 lit. f DSGVO jederzeit widersprechen (Art. 21 DSGVO). Ihre übrigen Rechte und Ihr Beschwerderecht sind in den Abschnitten 10 und 11 beschrieben. Kontakt: dataprotectionofficer@rhino-mc.de.

  1. Amendments

We reserve the right to amend this Privacy Policy if our data processing activities, website, or legal requirements change.

Scroll to Top