Privacy information · IMPACT RADAR

IMPACT PULSE · IMPACT CHECK · IMPACT BOOST

This notice explains how personal data is processed in connection with our IMPACT services, related inquiries and the management of our business contacts. It supplements the information about general website visits at https://www.performthetalk.com/privacy-policy.

1 Controller

The controller is Michelle Euzet, trading as EUZET Advisory Boutique, Bergheimer Straße 147, 69115 Heidelberg, Germany. PERFORM THE TALK is a service name used by the controller, not a separate contracting party. For data protection questions, contact us at impact@performthetalk.com or +49 151 67768353.

2 Data and purposes for PULSE and CHECK

We process the contact and organizational information you enter, your chosen perspective, your answers and the results derived from them to create and provide the evaluation you requested. We also process technical data, such as IP address, browser information, access times and technical error information, insofar as this is necessary for delivery, security and troubleshooting.

The assessment examines organizational conditions based on your own evaluation. It is not a survey of your colleagues and is not intended to assess individual employees’ personal characteristics. Please do not enter colleagues’ names or other identifying details, or information about their health, ethnic origin, religion, sexual orientation or other particularly protected personal circumstances.

Required information is marked in each form. Without it, we may be unable to provide the requested service. Optional fields are not mandatory for use.

3 Legal bases

Where you are personally a party to the contract, we process the data necessary to provide the service you requested under Article 6(1)(b) GDPR. This may also apply to a free service you requested. Where you act as an organization’s contact person, necessary communication and administration are based on Article 6(1)(f) GDPR. Our legitimate interest is to provide the service requested or commissioned for that organization and manage the business relationship.

Technical security measures, troubleshooting and necessary support for inquiries are based on Article 6(1)(f) GDPR insofar as they are not already part of contract performance. Processing required by law, particularly for billing and retention of business records, is based on Article 6(1)(c) GDPR.

4 Report copies and personal support

Michelle receives a copy of your results and report. For this purpose, the report (your IMPACT SNAPSHOT for IMPACT PULSE or your IMPACT ANALYSIS for IMPACT CHECK) is also stored in a protected folder in our Dropbox account; the internal notification sent to us contains only the filename, not a Dropbox sharing link. This copy allows us to handle questions, help provide the report again and prepare for a conversation about your results that you have requested. It does not replace your own backup of the report.

In addition to Michelle, external assistants help organize services and manage business relationships. Anyone with access to the email accounts and CRM data used for these purposes can view the information stored there. Participation in PULSE or purchase of CHECK does not constitute blanket consent to marketing or to sharing your report with other consulting businesses.

If you request joint consulting with further cooperation partners, the purpose and scope of any necessary disclosure will be agreed in advance. A confidentiality agreement alone does not replace a lawful basis under data protection law.

5 Technical delivery and sending

The assessments and access-management functions are hosted through Netlify. The technical data, form entries and status information required for each process are processed for this purpose. Provider information for Netlify, Inc.: https://www.netlify.com/privacy/.

We use Dropbox to store report copies. The report is stored as a PDF file containing your contact details, organizational information and results, with a filename containing the date, organization and name. Files are stored in a folder for each organization. The internal notification contains only the filename, not a Dropbox sharing link. Stored report copies are accessed through our Dropbox account; the folder is not publicly discoverable. The provider is Dropbox International Unlimited Company (Ireland) or Dropbox, Inc. (USA); information: https://www.dropbox.com/privacy. Where data is transferred to the USA, this is based on appropriate safeguards under Article 46 GDPR, such as Standard Contractual Clauses, or on the EU–US Data Privacy Framework.

Only if storage in Dropbox is technically unavailable do we instead receive a reduced-size copy of the report by email through EmailJS. This may involve processing contact details, assessment results, report files and sending information. The provider is EmailJS Pte. Ltd.; information: https://www.emailjs.com/legal/privacy-policy/. The email services involved in sending and receiving also process data.

For CHECK, the results report is provided in the browser as a PDF download on completion. The personal access link is sent by email through Resend. This involves processing, in particular, the email address, access link and delivery status. In this process, Resend sends access information, not assessment results. The provider is Plus Five Five, Inc.; information: https://resend.com/legal/privacy-policy.

To prevent misuse, such as automated bulk requests, we limit how often a report can be stored each week. For this purpose, we temporarily store a non-reversible hash of your email address and IP address, together with a timestamp, for no longer than seven days. The legal basis is our legitimate interest in the security of the service, Article 6(1)(f) GDPR.

6 Orders, payment and inquiries

For online payments through Stripe, the necessary order, billing and payment data is transmitted to Stripe. We receive information about the order and payment status, not full card details. Depending on its activity, Stripe processes data to handle payments and meet its own legal obligations and security purposes. Further information: https://stripe.com/privacy.

When you request an offer or invoice, we use your contact details, organizational and billing information, and message to handle the request. Squarespace is used for website forms. Provider information: https://www.squarespace.com/privacy. An automated acknowledgment does not constitute either conclusion of a contract or subscription to marketing messages.

7 Contact management and external assistance

We use HubSpot to manage business contacts, correspondence, participation and order information, and agreed next steps. Service information: https://legal.hubspot.com/privacy-policy. We also use LeadDelta to manage LinkedIn contacts and working lists for coordinating contact management.

External assistance is provided through Strandschicht UG (haftungsbeschränkt). This includes CRM maintenance, organizing communication and handling authorized contact-related tasks.

Where contact details do not come directly from you, they may originate from existing business contacts, professional networks such as LinkedIn or publicly available professional sources. Additional information about the specific source and processing purpose is provided in connection with the relevant contact within the statutory deadlines.

8 Professional information and offers

Where you consent to receiving professional information and offers by email, we process the information necessary for that purpose under Article 6(1)(a) GDPR. We document the consent and its scope. You can withdraw it at any time with effect for the future through the unsubscribe option provided or by contacting us.

Participation in PULSE and purchase of CHECK do not depend on marketing consent. The requested service and relevant service information remain separate. Using individual assessment answers for further personalized marketing requires its own lawful basis and corresponding information.

If you object to direct marketing, we will no longer use your data for that marketing. We may retain a necessary suppression record to prevent your contact details from being accidentally added to a mailing list again.

9 Collaboration in IMPACT BOOST

Individual advance assessments are used to prepare and run the workshop. Assessments and working outputs are discussed jointly within the agreed group of participants on the Miro board prepared for your organization. The process is therefore not an anonymous employee survey.

Before entering information, participants are informed about the specific participant group, how contributions are attributed and access to the board. Miro and the conferencing service named in the invitation are used for online collaboration. Miro information: https://miro.com/legal/privacy-policy/. Recording is not part of the regular workshop and requires a separate prior agreement.

10 Storage and deletion

Retention periods depend on the processing purpose. Contact and contract data is needed to administer and manage the business relationship. Report copies in Dropbox and associated answers are retained for the agreed support and any necessary assistance; subsequent retention requires an ongoing lawful purpose. If deletion is requested, we assess whether performance obligations, statutory retention obligations or legitimate grounds for protecting specific legal claims still apply.

Billing and business records are retained to the extent required by law. These obligations do not automatically justify retaining complete assessment answers for the same period. Working copies and exports that are no longer needed must be deleted. Data retained solely for legal reasons must not be reused for marketing without a separate lawful basis.

11 Your rights

Subject to statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing before withdrawal.

You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may object to direct marketing, including associated profiling, at any time without giving reasons.

You may lodge a complaint with a data protection supervisory authority, in particular where you live or work or where the suspected infringement occurred. The State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg can be contacted at https://www.baden-wuerttemberg.datenschutz.de/.

The rule-based assessment evaluation supports reflection. It does not make a decision about you based solely on automated processing that produces legal effects or similarly significantly affects you.