Privacy policy.
IC3 GmbH takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations as well as this privacy policy.
The use of our web pages is usually possible without providing personal data. Insofar as personal data (e.g. name, address, or email address) is collected on our pages, this is always done on a voluntary basis as far as possible.
Information about the collection of personal data and provider identification:
Below, we provide information about the collection of personal data when this website is used. Personal data is all data that can be related to you personally, e.g. name, address, email address.
1. Controller
The controller responsible for processing your personal data within the meaning of Art. 4(7) GDPR is:
IC3 GmbH
Seidlstraße 5
80335 Munich, Germany
Managing Director: Benedikt Pröll
Email: datenschutz@ic-3.com
We are not required to appoint a data protection officer under Section 38 of the German Federal
Data Protection Act (BDSG). Please send any questions about data protection to
2. Legal bases
We only process personal data where there is a legal basis:
• your consent (Art. 6(1)(a) GDPR; for cookies also Section 25(1) of the German TDDDG),
• the performance of a contract or pre-contractual steps, such as booking an appointment
or registering for a webinar (Art. 6(1)(b) GDPR),
• legal obligations, such as retention periods (Art. 6(1)(c) GDPR),
• our legitimate interests (Art. 6(1)(f) GDPR), such as operating our websites securely,
maintaining business contacts and direct marketing to business customers. The sections
below state which interest applies.
3. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction
of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time
with effect for the future. You may also lodge a complaint with a supervisory authority; ours is
the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Right to object (Art. 21 GDPR): Where we process your data for direct marketing, you may
object at any time without giving reasons; we will then no longer process them for this purpose.
You may object to other processing based on our legitimate interests on grounds relating to
your particular situation. An informal message to datenschutz@ic-3.com or to IC3 GmbH,
Seidlstraße 5, 80335 Munich, Germany, is sufficient.
4. Hosting and server log files
Our website ic-3.com is hosted by Squarespace Ireland Limited, Le Pole House, Ship Street Great,
Dublin 8, Ireland. Our offer pages at lp.ic-3.com are hosted by DomainFactory GmbH,
Neuturmstraße 5, 80331 Munich, Germany, on servers in the EU. Both act as processors on our
instructions.
When you open a page, the server automatically stores technical data in log files: IP address,
date and time, page requested, status code, amount of data transferred, referring page, browser,
operating system and language. We need these data to deliver the pages securely and reliably
and to detect misuse (Art. 6(1)(f) GDPR). We do not combine them with other data and delete
them after 7 days unless they are needed to investigate a security incident.
5. Cookies and consent
ic-3.com sets strictly necessary cookies without consent, for example to store your cookie choice
(Section 25(2) TDDDG). All other cookies and services that send data to third parties (Google
Analytics, social media buttons) are only loaded once you agree in the cookie banner (Art. 6(1)
(a) GDPR, Section 25(1) TDDDG). You can change or withdraw your choice at any time via the
“Cookie settings” link at the bottom of the page.
The offer pages at lp.ic-3.com set no cookies and use no web analytics service. To see which campaign pages are used, a small script counts page views anonymously: for each view we store only the date and time, the page, the campaign identifier from the link (for example from a letter’s QR code) and the page language – no IP address, no browser details and nothing else that could identify you. The count is kept on our server at DomainFactory and is not passed on to anyone. The same script keeps the campaign identifier in your browser’s session storage for the duration of your visit (it is deleted when you close the tab) and passes it on to the Calendly booking link. The legal basis is our legitimate interest in measuring the effect of our campaigns (Art. 6(1)(f) GDPR).
6. Google Analytics
With your consent, we use Google Analytics 4 on ic-3.com, provided by Google Ireland Limited,
Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics evaluates how visitors use our
website: pages viewed, time spent, source of the visit, approximate location, device and browser.
It uses cookies for this. Google shortens IP addresses within the EU and does not store them.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can
withdraw at any time via the cookie settings. Data may be transferred to the USA; Google is
certified under the EU-US Data Privacy Framework. Google deletes individual usage events after
2 months and user-level data 14 months after your last visit.
7. Contact form, email and Health Check
If you contact us via the contact form, by email or by submitting the completed Innovation
Health Check PDF, we process your details (name, email address, company, your message or
your ratings) to respond to your enquiry. The legal basis is pre-contractual steps (Art. 6(1)(b)
GDPR) or our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR). The contact form is
provided via Squarespace. We delete enquiries once they have been dealt with and no retention
obligation applies, at the latest after 24 months.
8. Comments
If you leave a comment on our website, we store the time of posting and the name and email
address you provided along with the comment. This serves our security, as we may be held
liable for unlawful content (Art. 6(1)(f) GDPR). Your email address is not published. Comments
remain stored until you request their deletion or the post is removed.
9. Booking appointments via Calendly
You book appointments, for example an L&D Session or an expert call, via Calendly, provided by
Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. We process your name, email
address, the chosen time, any voluntary details in the booking form and campaign identifiers in
the link (such as utm_source) that show us which letter or page you booked from. Calendly
checks the slot against our calendar and sends you a confirmation and reminder.
The legal basis is arranging the appointment (Art. 6(1)(b) GDPR); evaluating campaign
identifiers is based on our legitimate interest in measuring the effect of our mailings (Art. 6(1)
(f) GDPR). Calendly is certified under the EU-US Data Privacy Framework; a data processing
agreement is in place. We delete booking data 24 months after the appointment unless a
business relationship develops.
10. Webinars with Microsoft Teams
When you register for one of our webinars, we process your name, your email address and,
voluntarily, your company and job title. During the webinar, technical connection data and
content you contribute yourself, such as questions in the Q&A, are added. We use these data to
run the webinar, to send you the access link, a reminder and the recording, and to see who
attended.
The legal basis is your registration (Art. 6(1)(b) GDPR). Evaluating attendance and asking
whether you would like to explore the topic further are based on our legitimate interest in
maintaining business contacts (Art. 6(1)(f) GDPR). We only send you promotional emails with
your consent. We use Microsoft Teams, provided by Microsoft Ireland Operations Ltd., One
Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor.
Data are stored in the EU; access from the USA cannot be ruled out, and Microsoft is certified
under the EU-US Data Privacy Framework. We delete registration data no later than 24 months
after the webinar unless a business relationship develops.
11. Recording and publication of webinars
Our webinars are recorded and automatically transcribed. The recording shows only the
speaker and the presentation; participants’ cameras and microphones are switched off, and we
read out questions from the Q&A without names. We then make the recording publicly
available so that people who could not attend can watch it (Art. 6(1)(f) GDPR). We use the
transcript only internally and delete it after 12 months. If you are nevertheless identifiable in
the recording, we will remove the passage on request to datenschutz@ic-3.com.
12. Innovation Academy (Thinkific)
We run our learning platform innovation-academy.ic-3.com on Thinkific, provided by Thinkific
Labs Inc., 369 Terminal Ave, Vancouver, British Columbia, V6A 4C4, Canada. There we provide
participants in our trainings and client projects with learning content, templates and
recordings.
When you create an account or we give you access, we process your name, email address,
password (encrypted), the courses you have access to, your learning progress and technical
usage data. Thinkific sends you system messages on our behalf, for example about your login or
new content. The legal basis is the performance of the training or project contract (Art. 6(1)(b)
GDPR); for client projects commissioned by your employer, our legitimate interest in fulfilling
the contract (Art. 6(1)(f) GDPR).
Thinkific acts as a processor under a data processing agreement. The European Commission has
issued an adequacy decision for Canada; where data are processed by sub-processors outside
the EU, the EU Standard Contractual Clauses apply. We delete your account and learning
progress 24 months after the end of the training or project, or earlier at your request.
13. Direct marketing by post and LinkedIn
We contact professionals and managers whose role relates to our services, for example those
responsible for Learning & Development. You receive this information under Art. 14 GDPR
because we did not collect your data from you directly.
Which data: name, salutation, job title, company, business address and the address of
your public LinkedIn profile.
Source: publicly available professional sources, in particular LinkedIn, your company’s
website and press releases, and commercial and company directories.
Purpose: to send you information and working material on our services by post and to
contact you via LinkedIn (connection request, message, reactions to your posts). We
record whether you responded, registered for a webinar or booked an appointment so
that you do not receive unsuitable further mailings.
Legal basis: our legitimate interest in direct marketing to business customers (Art. 6(1)
(f) GDPR in conjunction with Recital 47). We do not send promotional emails without
your consent.
Recipients: our print and mailing service provider and LinkedIn Ireland Unlimited
Company, Wilton Place, Dublin 2, Ireland, for contact via the platform.
Retention: until the end of the campaign and for no more than 24 months thereafter
unless a business contact develops. If you object, we delete your data except for a
suppression note that prevents us from contacting you again.
You can object to this processing at any time (see section 3).
14. Social media buttons
Our website links to our profiles on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton
Place, Dublin 2, Ireland) and XING (New Work SE, Am Strandkai 1, 20457 Hamburg, Germany).
The buttons are simple links or are only loaded after your consent. Data only reach the provider
when you click the button; processing there is governed by the respective provider’s privacy
policy.
15. External links
Our pages contain links to other websites. We are not responsible for their content or data
processing; the privacy policies of the respective providers apply.
16. Recipients and transfers to third countries
We only pass on personal data where necessary for the purposes stated: to the service providers
named in this policy, who act as processors on our instructions, and to print and mailing
service providers. We do not sell data. Where data may be transferred to the USA (Google,
Calendly, Microsoft), the providers are certified under the EU-US Data Privacy Framework;
where agreed, the EU Standard Contractual Clauses also apply.
17. Retention
We only store personal data for as long as the respective purpose requires; the periods are
stated in the individual sections. Statutory retention obligations, for example under commercial
and tax law for business letters and invoices (six and ten years), remain unaffected.
18. Data security
We protect your data with technical and organisational measures that reflect the state of the
art. Our websites are transmitted encrypted via HTTPS. Complete protection against access by
third parties cannot be guaranteed for communication by email.
19. Changes
We update this privacy policy when our services or the legal situation change. The version
published here applies.
Last updated: October 2026