Back to website

Privacy Policy

Data protection in accordance with the EU General Data Protection Regulation (GDPR)

1. Data Controller

Selina Gaertner Consulting
Selina Gaertner
Auwaldstr. 1
79110 Freiburg
Germany

Phone: +49 152 5855 2250
Email: mail@selinagaertner.com

2. Overview of Data Processing

Types of data processed

Categories of data subjects

3. Legal Basis

Personal data is processed on the following legal bases:

4. Hosting

This website is hosted by Netlify, Inc. (44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). When you visit this website, Netlify automatically collects the following information in server log files:

This processing is based on Art. 6(1)(f) GDPR (legitimate interest in the technically error-free presentation of the website). A Data Processing Agreement (DPA) has been concluded with Netlify in accordance with Art. 28 GDPR. Netlify is certified under the EU-U.S. Data Privacy Framework.

Netlify's privacy policy: https://www.netlify.com/privacy/

5. Web Analytics (Plausible)

This website uses Plausible Analytics, a privacy-friendly web analytics service provided by Plausible Insights OÜ (Västriku tn 2, 50403 Tartu, Estonia). Plausible does not use cookies, does not store any information on your device, and does not collect or store personal data. No data is transferred outside the EU.

Plausible records aggregated statistics only, such as page views, referring website, approximate country, browser and device type. Individual visitors are not identified and cannot be tracked across websites or over time. IP addresses are never stored.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a needs-based design and statistical evaluation of our website). Because no information is stored on or read from your device, consent under § 25 TDDDG is not required.

Plausible's data policy: https://plausible.io/data-policy.

5a. Fonts

All fonts used on this website are hosted on our own server. No connection to Google Fonts or any other external font provider is established when you visit this website.

5b. Maria AI Assistant (Voiceflow)

This website offers an AI chat assistant ("Maria"), technically provided by Voiceflow, Inc. (Toronto, Canada). The assistant is not loaded when you open a page. It is loaded only when you actively start the chat via the “Ask Maria” button. As its first message, Maria asks for your consent to the data processing before the conversation begins.

Once started, a connection to Voiceflow's servers is established, your messages are transmitted there and processed to generate a response. Please do not enter any sensitive personal data into the chat.

Legal basis: Art. 6(1)(a) GDPR (consent, given by actively starting the chat). Canada is recognised by the European Commission as providing an adequate level of data protection for commercial organisations.

Voiceflow's privacy policy: https://www.voiceflow.com/privacy.

5c. Speaking AI Avatar in the Academy (LiveAvatar/HeyGen)

Inside the SELVAION AI ACADEMY, logged-in and activated members can have the answers of the learning companion LIA delivered by a speaking AI video avatar. This avatar is technically provided by HeyGen Technology Inc. (USA) under the name LiveAvatar. The feature is not available to visitors who are not logged in.

The avatar is not loaded when you open a page. It only starts once you actively call it up via the dedicated button and have expressly consented to the data processing beforehand. Your consent is recorded on our server together with a timestamp, the language and the version of the consent text, so that we can demonstrate it in accordance with Art. 7(1) GDPR. You can withdraw your consent at any time in the same window with effect for the future, and the withdrawal is recorded as well.

Once started, a video connection via WebRTC is established to HeyGen's servers. Transmitted in the process are your IP address, which is technically required to establish the video connection, and the text the avatar speaks, that is, the answers of the learning companion. Your own input is not transmitted to HeyGen. No microphone is activated, there is no voice chat, and the video is not stored by us. Each session is limited to a maximum of three minutes, and a maximum of five sessions per member per day is possible.

The label “KI-Avatar” (AI avatar) is permanently displayed within the video image. In line with Art. 50 of Regulation (EU) 2024/1689 (AI Act), this indicates that you are seeing and hearing artificially generated content and not a human being.

Legal basis: Art. 6(1)(a) GDPR (consent, given by the express confirmation before the start). The transfer to the USA is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework under Art. 45 GDPR, for which HeyGen Technology Inc. is certified. In addition, Standard Contractual Clauses under Art. 46(2)(c) GDPR and a data processing agreement under Art. 28 GDPR are applied. HeyGen names a data protection officer in Europe.

What we log on our side is limited to your user ID, a session ID, the selected language and the time of use. The purpose of this logging is cost control and protection against misuse. The log data is deleted automatically after 90 days.

HeyGen's privacy policy: https://www.heygen.com/privacy.

5d. AI-assisted evaluation of the scorecard and the funding check

When you complete our AI Readiness Scorecard or the funding check for the NRW.BANK.Impuls KI programme and then request a personal evaluation, we process your first name, your email address and your answers to the self-assessment questions. The sole purpose is to provide you with the evaluation and the results report as a PDF that you requested.

The evaluation itself is optional. Both self-assessments run entirely without any personal data and show you your result regardless. Data is only transmitted once you additionally request the personal evaluation and give your explicit consent.

To generate the evaluation, we transmit your first name and your answers to Anthropic PBC, San Francisco, USA, acting as our processor. It processes this data solely to generate the evaluation and not to train its models. The transfer to the USA is based on the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(b) GDPR, the provision of the evaluation you requested, together with Art. 6(1)(f) GDPR, our legitimate interest in contacting prospective clients. Your data is stored until you object to the processing or request its deletion. You can contact us at any time at the address stated in the legal notice.

5e. AI Act Checklist (email gate and high-risk check)

If you request our “AI Act × MDR/IVDR Integration Checklist” at selinagaertner.com/ai-act-checklist/, we process the details you enter (name, email address and, optionally, company) as well as your answers to the five classification questions and the resulting assessment. The purpose is to provide the checklist you requested and, where you consented, to contact you about related content.

This data is stored on our own server, hosted by Hetzner Online GmbH in Germany, and is transferred into our internal customer relationship management system, which runs locally on our own device. No third-party marketing platform receives this data unless you separately opt in to our email updates (see section 5f). Unlike the assessments described in section 5d, no artificial intelligence is used and no data is transmitted to Anthropic for this checklist.

The legal basis is Art. 6(1)(a) GDPR, your consent, together with Art. 6(1)(f) GDPR, our legitimate interest in contacting prospective clients. You may withdraw your consent at any time with effect for the future; the lawfulness of processing carried out until then remains unaffected. Your data is stored until you object to the processing or request its deletion.

5f. Email updates (Brevo, double opt-in)

If you consent to receiving our email updates, we use Brevo to manage the subscription and to send the emails. The provider is Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, a subsidiary of Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France. We have concluded a data processing agreement with Brevo.

We use the double opt-in procedure: after you subscribe, you receive an email asking you to confirm your subscription. Only after you confirm do we add you to our mailing list. We store your email address, your name where provided, and the confirmation, in order to document your consent as required by law.

Brevo may involve processors in third countries. Such transfers are safeguarded by an adequacy decision of the European Commission or by EU Standard Contractual Clauses. Further information is available in Brevo’s privacy policy at https://www.brevo.com/legal/privacypolicy/.

The legal basis is Art. 6(1)(a) GDPR, your consent. You can unsubscribe at any time, using the link at the end of every email or by writing to the address stated in the legal notice. Your data is stored until you unsubscribe.

6. Calendly

We use Calendly (Calendly LLC, 3423 Piedmont Rd NE, Atlanta, GA 30305, USA) for appointment scheduling. When you book an appointment, the data you enter (name, email address, and any additional information) is processed by Calendly.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(a) GDPR (consent through active booking).

Calendly's privacy policy: https://calendly.com/privacy.

7. LinkedIn

Our website contains links to our LinkedIn profile. When you click on these links, you are redirected to the platform of LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland). No automatic data transfer to LinkedIn occurs simply by visiting our website.

LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.

8. Make (formerly Integromat)

We use Make (Celonis SE, Thomas-Edison-Str. 1, 85716 Unterschleissheim, Germany) to automate workflows, such as processing form submissions from our website. When you submit data through a form on our website, this data may be transmitted to Make for further processing, such as storing it or triggering follow-up actions like sending a confirmation email.

Specifically, when you submit your first name and email address via the AI Readiness Scorecard or the Talk-to-Maria lead magnet (offered in connection with events such as the Global Pharma Tech Summit), this data is sent to Make, which then forwards it to Selina Gaertner Consulting (internal notification) and to the email address you provided (welcome message containing the Pharma AI Sales Playbook, a link to a live demo of the AI assistant "Maria", and a link to book a call). The welcome email is sent from mail@selinagaertner.com. You can opt out and request deletion of your data at any time by emailing mail@selinagaertner.com.

Make processes data on servers within the European Union. As Celonis SE is a company headquartered in Germany, data processing is subject to EU data protection standards.

Legal basis: Art. 6(1)(a) GDPR (your consent, given via the checkbox on the form) and Art. 6(1)(f) GDPR (legitimate interest in efficient business process automation).

Make's privacy policy: https://www.make.com/en/privacy-notice.

9. SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the "https://" in the address bar of your browser and the lock icon.

10. Your Rights

Under the GDPR, you have the following rights:

11. Changes to This Privacy Policy

This privacy policy is current as of May 2026. Due to the further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can always be accessed on our website.

Home Imprint Privacy Policy

© 2026 Selina Gaertner Consulting. All rights reserved.