Stronger into the future

Privacy Policy
Last updated: 26 August 2026

This is a translation for your convenience. The German version of this privacy policy is the binding one.

This policy applies to all websites and brands of ISTARIUM Consulting Group GmbH — in particular istarium.eu, mai-advisory.com and aiee.eu (AI Enabled Executive, AIEE). The controller is the same company in every case; “Mai Advisory”, “MAI Advisory Partners” and “AI Enabled Executive” are brands, not separate companies.

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

ISTARIUM Consulting Group GmbH
Gollierstr. 25, 80339 Munich, Germany
represented by its managing director Michael Mai
Munich Local Court, HRB 234994 · VAT ID DE 314866417

Data protection enquiries: privacy@istarium.com
General contact: see the legal notice on this page.

We have not appointed a data protection officer; the conditions of Sec. 38 BDSG are not met.

Competent supervisory authority: Bavarian Data Protection Authority (BayLDA), Promenade 27, 91522 Ansbach, Germany.

2. Scope

This policy covers

• the use of our websites and landing pages,
• our business communication by email, telephone and in video conferences,
• the maintenance of our business contact directory,
• the delivery of our programmes and engagements,
• application procedures.

It does not cover third-party websites we link to. The respective providers alone are responsible for processing there.

3. Principles

We process personal data only where this is necessary for a specific purpose, and only on one of the legal bases listed in section 4. We do not sell data and do not pass it on to third parties for advertising purposes. Where we use service providers, we do so on the basis of a data processing agreement under Art. 28 GDPR (section 12).

4. Legal bases at a glance

You may withdraw any consent at any time with effect for the future (Art. 7(3) GDPR) — informally to privacy@istarium.com.

5. Use of our websites

5.1 Hosting and server log files

Our websites are operated at ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When a page is called up, data sent by your browser is transmitted automatically and stored in log files:

• IP address of the requesting device,
• date and time of access,
• name and URL of the file retrieved,
• volume of data transferred and notification of successful retrieval,
• browser type and version, operating system, referrer URL.

This processing is necessary to deliver the page, ensure its stability and security and detect attacks. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after 7 days unless they are needed longer to investigate a specific security incident.

We additionally evaluate these log files in aggregated, statistical form (page views, referring pages, device types) in order to improve our offering. The evaluation runs on our own systems. No cookies are set, no tracking pixel is loaded and no third-party analytics service is embedded for this purpose.

5.2 Cloudflare and Cloudflare Turnstile

We use services of Cloudflare, Inc. (EU representative: Cloudflare Germany GmbH, Munich) to deliver our pages securely and to fend off automated access. Your IP address is transmitted to Cloudflare and processed there to detect attacks. The legal basis is Art. 6(1)(f) GDPR (secure provision of our offering).

Cloudflare Turnstile checks whether an input originates from a human. We use it to protect our contact details and forms against automated harvesting and misuse. To do so, Turnstile evaluates technical characteristics of your browser and of your behaviour on the page. No advertising cookies are set and no profiles are created.

5.3 Cookies and similar technologies

We use strictly necessary cookies and storage entries only, so that the site works (session management, security and protection functions). The legal basis is Sec. 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

We do not use consent-requiring cookies, advertising or analytics services — which is why we do not operate a consent banner. Should this change, we will obtain your consent beforehand (Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR).

5.4 Contacting us via form, email or telephone

If you contact us, we process the details you provide — name, contact data and the content of your enquiry — in order to handle it. When you use our contact form, the details are transmitted to our mailbox over an encrypted connection; you receive an automatic acknowledgement of receipt. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns a contract, otherwise Art. 6(1)(f) GDPR (handling enquiries addressed to our company).

Your enquiry and our reply then become part of our business correspondence and, where there is a business context, of our contact directory (section 7).

5.5 Registering for our programmes

If you register for one of our programmes via the order form, we process your details (name, company, billing and contact data, chosen tariff) in order to handle the registration and perform the contract. The legal basis is Art. 6(1)(b) GDPR, and additionally Art. 6(1)(c) GDPR for invoicing and retention.

5.6 Verification of confirmations of participation

For our programmes we issue a confirmation of participation carrying a verification number. Our verification page allows the authenticity of a confirmation to be checked using that number; name, programme and period of participation are displayed. The legal basis is Art. 6(1)(b) GDPR — verifiability is part of the confirmation itself. Access is impossible without the verification number; no directory of participants can be retrieved. On request we will remove your entry from the verification page.

5.7 AI Project Self-Check and email series

On our page aiee.eu/en/selfcheck/ (German: aiee.eu/selbstcheck/) you can assess an AI initiative for yourself along ten questions. We process your answers and the description of your initiative solely within the running page request in order to display your result. They are neither stored nor passed to third parties; the processing ends when you close the page. You can print the result yourself or save it as a PDF.

If you would also like to receive the blank sheet as a PDF and the scoring keys by email, you enter your email address. What is then stored is exclusively your email address, the score reached and — where present — the three-character campaign code from the address you called up. The individual answers are expressly not part of it. The legal basis is Art. 6(1)(b) GDPR, as you have ordered this delivery.

In addition you may subscribe to the email series “Where does the number come from?” via a separate checkbox that is empty by default. That is a decision of its own and is not required in order to receive the sheet. The legal basis for it is your consent under Art. 6(1)(a) GDPR in conjunction with Sec. 7(2) no. 2 UWG.

Confirmation procedure (double opt-in): after submitting you receive an email with a confirmation link. Only your click on it creates the contact; it also shows that the address is yours and covers both of the operations named above. The time of sign-up, the time of confirmation and the IP address used are logged as proof of consent (Art. 7(1) GDPR). Where confirmation does not follow, we send one reminder and then erase the address.

Withdrawal: every email in the series carries an unsubscribe link; one click is enough and takes effect for the future. You may equally write to us at privacy@istarium.com. Withdrawal does not affect the lawfulness of processing carried out up to that point.

For dispatch and administration of the mailing lists we use Brevo as a processor (sections 6 and 12); the processing takes place within the European Union. Neither a script nor a tracking pixel from Brevo is embedded in our pages — the form sits on our own server, and only our server passes the details named above to Brevo. Simply visiting the self-check page transmits no data to Brevo.

6. External services and platforms

No content or buttons of these networks are embedded in our websites — simply visiting our pages transmits no data to LinkedIn, Xing, Microsoft or Zoom.

On our presence in professional networks: if you visit our company pages on LinkedIn or Xing, the operators process your data under their own responsibility and produce aggregated statistics which they make available to us. We have no influence over that processing and receive no individual-level data. Insofar as we and the operator are joint controllers within the meaning of Art. 26 GDPR, the operator’s respective arrangements apply. For processing within your user account the operator alone is responsible.

Video conferences: when you take part, your name, access data and connection data are processed, and during the conversation also image and sound. Recordings are made only if we inform you beforehand and you agree.

7. Business contacts and correspondence (AI-assisted)

This section does not concern the use of our websites but the ongoing processing within our business relationships.

7.1 What data we process

• Contact and organisational data: name, company, function, business email address, business telephone number, address and profile information from professional networks.
• Communication data: business emails, conversation and call notes, appointment details as well as the occasion and outcome of a contact.
• Our own notes and dictations: records we make for ourselves about a conversation, an appointment or a matter which may contain information about you (for example: who was spoken to, what it was about, what was agreed). We convert voice notes into text for this purpose.

7.2 When we write to you for the first time — where your data comes from

If you receive a message from us for the first time without having given us your data yourself, the following applies (information pursuant to Art. 14 GDPR):

Your business contact data originates from previous contact with you (email, telephone, appointment, business card), from professional networks in which you have published your professional details, from referrals and recommendations by third parties, or from publicly accessible sources such as company websites and legal notices (Art. 14(2)(f) GDPR).

We keep it in our business contact directory and process our correspondence with you with AI assistance in order to assign and retrieve matters — without assessing you as a person and without automated decisions (7.4). The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
You may object and request erasure at any time: privacy@istarium.com.

7.3 Purposes and legal bases

The purpose is the organisation, maintenance and retrievability of our business contacts and correspondence, as well as initiating, performing and following up business relationships.

• Art. 6(1)(f) GDPR for maintaining the contact directory and handling correspondence. Our legitimate interest is to organise business relationships properly, to retrieve matters and to assign contacts correctly. This corresponds to the customary use of a contact and customer management system.
• Art. 6(1)(b) GDPR insofar as the processing serves to initiate or perform a contract with you or your company.
• Art. 6(1)(c) GDPR in conjunction with Sec. 257 HGB and Sec. 147 AO for correspondence subject to statutory retention duties.

7.4 Use of artificial intelligence

To process the data listed in 7.1 we use an AI-assisted system — comparable to the AI functions of common contact and customer management systems. Specifically, we use it to

• capture and structure incoming messages, notes and voice recordings and assign them to the right contact or matter,
• detect duplicates and keep contact details up to date,
• derive tasks and appointments from correspondence and notes,
• make the records searchable, including by subject-matter context and not only by exact search terms,
• produce aggregated evaluations of our own records (for example: how many contacts are assigned to an industry, when contact last occurred).

The legal basis is Art. 6(1)(f) GDPR. The AI does not replace a decision about you; it performs the sorting and assignment work that would otherwise be done by hand.

What we expressly do not do:

• We do not create assessments, scores or rankings regarding your person, your behaviour or your commercial attractiveness.
• We do not enrich your data with information from external data sources in order to build a more comprehensive profile.
• There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Decisions about making contact or entering a business relationship are taken exclusively by humans.
• Your data is not used to train AI models. This is contractually agreed with the providers we use.
• We honour confidentiality obligations. Content covered by a contractual confidentiality obligation (e.g. under a non-disclosure agreement) is detected automatically and redacted or excluded before any AI-assisted processing; it is not transmitted to an AI provider and is not processed there.

Language models used: we use models from Anthropic PBC as well as models made available to us via STACKIT (data centres in Germany) and Amazon Web Services (EU region). Which model is used depends on the task at hand; the requirements of this section apply to all of them alike.

The contact directory is stored permanently on systems operated by ourselves in Germany (Hetzner Online, STACKIT).

8. Applications

If you apply to us, we process the documents and details you submit exclusively in order to conduct the application procedure. The legal basis is Sec. 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR.

If no employment results, we delete the documents six months after the procedure ends; this period serves to defend against possible claims under the German General Equal Treatment Act (AGG). If you would like us to keep your documents for future positions, we will obtain your separate consent.

9. Recipients of your data

Within our company, only those persons have access who need it to fulfil the purposes stated. Beyond that we pass data on to:

• processors under Art. 28 GDPR (sections 6 and 12),
• professional advisers and public authorities, insofar as we are legally obliged to do so (for example tax advisers, tax authorities).

Data is neither disclosed for advertising purposes nor sold.

10. Transfers to third countries

Some of the services used process data outside the EU/EEA, in particular in the United States:

Hetzner Online and STACKIT operate data centres exclusively in Germany; no transfer to third countries takes place there. Brevo processes the data of our mailing lists within the European Union; no transfer to third countries takes place there either.

Anthropic is not certified under the EU-US Data Privacy Framework; the transfer relies exclusively on the Standard Contractual Clauses. You can obtain a copy of the agreed safeguards at privacy@istarium.com.

Despite these safeguards it cannot be ruled out that authorities in the recipient country access the data. We therefore transfer only what is necessary for the respective purpose.

11. Retention periods

12. Processing on our behalf

With all the service providers listed in section 6 that process personal data on our behalf we have concluded agreements under Art. 28 GDPR. These oblige them to process the data exclusively on our instructions and within the agreed scope, and to take appropriate technical and organisational measures.

13. Data security

We take technical and organisational measures to protect your data against loss, alteration and unauthorised access — in particular transport encryption (TLS) on our websites, access restrictions on a need-to-know basis, encrypted backup copies and continuous updating of the systems in use. Our measures are continuously adapted to the state of the art.

14. Your rights

You have the right to

• access to the data processed about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• withdrawal of consent with effect for the future (Art. 7(3)),
• lodging a complaint with a supervisory authority (Art. 77). The authority competent for us is the Bavarian Data Protection Authority (BayLDA), Promenade 27, 91522 Ansbach, Germany.

An informal message to privacy@istarium.com is sufficient. We reply within one month; where a request is complex, we may extend the period by up to two months and will inform you accordingly.

14.1 Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Art. 6(1)(f) GDPR (Art. 21(1) GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

You may object to being approached for advertising purposes at any time and without giving reasons (Art. 21(2) GDPR); such an objection applies without exception.

14.2 Erasure, restriction and suppression list

If you request erasure of your data, we remove it from our active systems without undue delay, at the latest within 30 days — unless a statutory retention duty or compelling legitimate grounds on our part stand in the way. Where such an exception applies, we do not erase but restrict processing (Art. 18 GDPR): your data is then merely stored and no longer actively used. We inform you of this within the same period and give reasons.

So that an objection remains permanently effective, we store a non-reversible identifier of your email address or telephone number. It prevents your data from being recreated by a later automatic import from email, telephone system or address book, and serves this purpose alone.

Where we have passed your data on to a service we use (for example Microsoft 365), we arrange for erasure there as well.

15. No automated decision-making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place. This also applies to the use of artificial intelligence described in section 7.

16. Obligation to provide data

Providing your data is neither required by law nor by contract. Without the details necessary for a contract, however, we cannot conclude or perform a contract with you.

17. Changes to this policy

We adapt this policy when our processing or the legal situation changes. The version published on this page at the relevant time applies.