Privacy Policy

1) Introduction and Contact Details of the Controller

1.1

We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how your personal data is handled when you use our website. Personal data is any data by which you can be personally identified.

1.2

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is George Salatic, Pernerkreppe 26, 81925 Munich, Germany, Tel.: +49 1516 813 47 80, Email: george@byos.one. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

2.1

When you use our website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to the page server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

- Our visited website

- Date and time at the time of access

- Amount of data sent in bytes

- Source/reference from which you came to the page

- Browser used

- Operating system used

- IP address used (where applicable: in anonymized form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to review the server log files retrospectively if there are concrete indications of unlawful use.

2.2

For security reasons and to protect the transmission of personal data and other confidential content, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string "https://" and the lock symbol in your browser line.

3) Hosting & Content Delivery Network

3.1 Google Firebase

For hosting our website and displaying page content, we use the system of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

All data collected on our website is processed on the provider's servers unless different data recipients are specified below for specific processing operations.

We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

Within the scope of the above-mentioned services, data may also be transferred to servers of Google LLC in the USA as part of further processing on our behalf.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

3.2 Squarespace

For hosting our website and displaying page content, we use the system of the following provider: Squarespace Ireland Ltd., Squarespace House, Ship Street Great, Dublin 8, D08 N12C, Ireland.

All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

Within the scope of the above-mentioned services, data may also be transferred to Squarespace Inc. in the USA as part of further processing on our behalf.

3.3 Google Cloud CDN

We use a content delivery network from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

This service enables us to deliver large media files such as graphics, page content or scripts more quickly via a network of regionally distributed servers. Processing is carried out in order to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR.

Data may also be transferred to: Google LLC, USA.

We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

4) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after the browser is closed ("session cookies"), while others remain on your device for longer and make it possible to save page settings ("persistent cookies"). In the latter case, you can find the storage period in the overview of your web browser's cookie settings.

If personal data is also processed through individual cookies used by us, processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, in accordance with Art. 6(1)(a) GDPR in the event of consent having been given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the site visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually on their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be limited.

5) Contacting Us and Submissions

When you contact us (e.g. via contact form, contribution form, upload form or email), personal data is collected. Which data is collected in the case of a specific form can be seen from the respective form. This data is stored and used exclusively for the purpose of responding to your request, reviewing your submission, contacting you, carrying out the associated technical administration and, where applicable, deciding whether and in what form content submitted by you will be published following editorial review.

If you use our contribution or upload options to submit ideas, texts, files or other content to us, we process the data and files submitted by you exclusively for the purpose of receiving, reviewing, evaluating and, where applicable, publishing the submission. A submission does not result in automatic publication.

The legal basis for processing this data is our legitimate interest in responding to your request, handling submissions and operating our website and editorial processes in accordance with Art. 6(1)(f) GDPR. If your request or submission is aimed at the initiation or performance of a contractual or user relationship, an additional legal basis is Art. 6(1)(b) GDPR.

Your data will be deleted after your request or submission has been finally processed. This is the case if it can be inferred from the circumstances that the relevant matter has been conclusively clarified and provided that there are no statutory retention obligations to the contrary and no further storage is necessary for publication, archive, documentation or other legitimate purposes.

6) Registration, Accounts, Saved Content and Collaboration Areas

You can register on our website by providing personal data. Which personal data is processed for registration is evident from the input form used for registration. We use the so-called double opt-in procedure for registration, i.e. your registration is only completed once you have confirmed your registration via a confirmation email sent to you for this purpose by clicking the link contained therein. If your confirmation is not received within 24 hours, your registration will be automatically deleted from our database. Providing the mandatory data requested during registration is required. Any additional information may be provided voluntarily.

If you use your account, we process and store the data required to provide your account and the associated protected areas and functions, in particular registration data, authentication data, saved society models, collaboration spaces, invitation and participation data, and other content that you create, save, manage or share within your account or collaboration environment.

The processing of account-related data is carried out pursuant to Art. 6(1)(b) GDPR insofar as it is necessary to provide the user account and the requested portal functions, and otherwise pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in maintaining the technical and organizational integrity, continuity and functionality of the portal.

In addition, we may store and display content published by you or approved for publication by us in order to operate the website, preserve public discussions, provide archive and comparison functions, document already created societies and enable future search, research and further development based on previously published content. The legal basis for this is Art. 6(1)(f) GDPR.

If you delete your account, the account itself will no longer be publicly retrievable. However, public comments, published contributions, archived or publication-approved content may remain visible where and to the extent this is necessary to preserve the integrity, documentation, functionality and archive value of the website. All other account data that is no longer required will be deleted, subject to statutory retention obligations, technical backups and overriding legitimate grounds.

7) Comment Function

As part of the comment function on this website, in addition to your comment, information about the time the comment was created and the commentator name chosen by you will be stored and published on this website. Furthermore, your IP address will be logged and stored. This storage of the IP address takes place for security reasons and in the event that the person concerned violates the rights of third parties or posts unlawful content through a submitted comment. We require your email address in order to contact you if a third party should object to your published content as unlawful.

The legal basis for storing your data is Art. 6(1)(b) and (f) GDPR. We reserve the right to delete comments if they are objected to by third parties as unlawful.

8) Web Analytics Services

8.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables analysis of your use of our website.

By default, cookies are set by Google Analytics 4 when you visit the website. These are small text elements stored on your device and collect certain information. This information also includes your IP address, which is shortened by Google by the last digits in order to exclude a direct personal reference.

The information is transferred to Google servers and further processed there. Transfers to Google LLC based in the USA are also possible.

Google uses the collected information on our behalf to evaluate your use of the website, to compile reports on website activity for us, and to provide other services related to website and internet use. The shortened IP address transmitted by your browser within the framework of Google Analytics is not merged with other Google data. The data collected within the framework of the use of Google Analytics 4 is stored for a period of two months and then deleted.

All processing described above, in particular the setting of cookies on the device used, only takes place if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. Without your consent, Google Analytics 4 will not be used during your visit to the website. You can revoke your consent at any time with effect for the future. To exercise your right of revocation, please deactivate this service via the cookie consent tool provided on the website.

We have concluded a data processing agreement with Google that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

Further legal information on Google Analytics 4 can be found at:

- https://business.safety.google/intl/de/privacy/

- https://policies.google.com/privacy?hl=de&gl=de

- https://policies.google.com/technologies/partner-sites

Demographic characteristics

Google Analytics 4 uses the special function "demographic characteristics" and can generate statistics that make statements about the age, gender and interests of site visitors. This is done by analyzing advertising and information from third-party providers. This allows target groups to be identified for marketing activities. However, the collected data cannot be assigned to any specific person and is deleted after being stored for a period of two months.

Google Signals

As an extension of Google Analytics 4, Google Signals may be used on this website to generate cross-device reports. If you have activated personalized ads and linked your devices to your Google account, Google can, subject to your consent to the use of Google Analytics pursuant to Art. 6(1)(a) GDPR, analyze your usage behavior across devices and create database models, including for cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop cross-device analysis, you can deactivate the "Personalized Advertising" function in your Google account settings. Follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=de. Further information on Google Signals can be found here: https://support.google.com/analytics/answer/7532985?hl=de

User IDs

As an extension of Google Analytics 4, the "User IDs" function may be used on this website. If you have consented to the use of Google Analytics 4 pursuant to Art. 6(1)(a) GDPR, created an account on this website and log in to this account on different devices, your activities, including conversions, may be analyzed across devices.

8.2 Google Tag Manager

This website uses the Google Tag Manager, a service of the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager provides a technical basis for bundling various web applications, including tracking and analytics services, and for calibrating, controlling and linking them to conditions via a uniform user interface. Google Tag Manager itself does not store any information on user devices or read such information. Nor does the service perform any independent data analysis. However, when a page is accessed, your IP address is transmitted to Google by Google Tag Manager and may be stored there. A transmission to servers of Google LLC in the USA is also possible.

This processing only takes place if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. Without this consent, Google Tag Manager will not be used during your visit to the website. You can revoke your consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the cookie consent tool provided on the website.

We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

Further legal information on Google Tag Manager can be found at: https://policies.google.com/privacy?hl=de&gl=de

8.3 Squarespace Analytics

This website uses the web analytics service of the following provider: Squarespace, Le Pole House, Ship Street Great, Dublin 8, Ireland.

Data may also be transferred to Squarespace Inc. in the USA as part of further processing on our behalf.

Using cookies and/or comparable technologies (tracking pixels, web beacons, algorithms for reading device and browser information), the service collects and stores pseudonymized visitor data, including information on the device used such as the IP address and browser information, in order to analyze user behavior on our website statistically and create pseudonymized user profiles. Among other things, this allows the evaluation of movement patterns (so-called heatmaps), which show the duration of page visits as well as interactions with page content (e.g. text entries, scrolling, clicks and mouse-overs). Pseudonymization generally excludes direct personal reference. No merging with other clear personal data collected in other ways takes place.

All processing described above, in particular the reading or storage of information on the device used, is only carried out if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the cookie consent tool provided on the website.

We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

9) Site Functionalities

9.1 YouTube

This website uses plugins for displaying and playing videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Data may also be transferred to: Google LLC, USA.

When you access a page on our website that contains such a plugin, your browser establishes a direct connection to the provider's servers in order to load the plugin. Certain information, including your IP address, is transmitted to the provider in the process.

If playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behavior, create playback statistics and prevent abusive behavior.

If you are logged into a user account with the provider during your visit to the website, your data will be directly assigned to your account when you click on a video. If you do not want your data to be assigned to your account, you must log out before clicking the play button.

All of the above-mentioned processing, in particular the setting of cookies to read information on the device used, only takes place if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You can revoke the consent you have given at any time with effect for the future by disabling this service via the cookie consent tool provided on the website.

9.2 Firebase Authentication

On our website, we use the following provider's service to verify registration and login attempts for protected areas of the website: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Exclusively on the basis of our legitimate interest in maintaining the structural and data security of our website, your login data, in particular your email address and password, is transferred to the provider for authentication pursuant to Art. 6(1)(f) GDPR in order to decide whether the login attempt should be approved.

In addition to a transfer of data to the provider location mentioned above, data may also be transferred to: Google LLC, USA.

We have concluded a data processing agreement with the provider that protects the data of our site visitors and prohibits disclosure to third parties.

9.3 AI-Supported Analysis and Transformation Features

On our website, we provide AI-supported features for generating society analyses, future outlooks and transformation roadmaps. If you use these features, the inputs you provide, in particular selected modules, vision statements, free-text entries, custom elements, country selections and, where applicable, content contained in saved, shared or collaboration-based society models, may be processed for the purpose of generating the requested output.

For this purpose, data may be processed using AI services of Google. Provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Data may also be transferred to Google LLC, USA.

Processing is carried out pursuant to Art. 6(1)(b) GDPR insofar as it is necessary to provide the user-requested functionality and otherwise pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing AI-supported website features and improving the usability of our services.

Please do not enter any special categories of personal data or confidential third-party information into free-text fields unless this is absolutely necessary and you are entitled to do so.

Where outputs are stored, shared, published or further processed by you through the website, the corresponding input and output data may also be processed in order to provide account, collaboration, archive, save, print and share functions.

For data transfers to the USA, Google LLC relies on the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

9.4 Adobe Fonts (Typekit)

This website uses so-called web fonts from the following provider for the uniform display of fonts: Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA.

When a page is accessed, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly and establishes a direct connection to the provider's servers. Certain browser information, including your IP address, is transmitted to the provider in the process.

Personal data is only processed in the course of establishing the connection with the font provider if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by disabling this service via the cookie consent tool provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.

9.5 Google Web Fonts

This website uses so-called web fonts from the following provider for the uniform display of fonts: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Data may also be transferred to: Google LLC, USA.

9.6 Google reCAPTCHA

We use the CAPTCHA service of the following provider on this website: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Data may also be transferred to: Google LLC, USA. For the visual design of the CAPTCHA window, Google uses fonts loaded from the internet. No additional information beyond that already transmitted to Google via the functionality of reCAPTCHA is processed for this purpose.

The service checks whether an input is made by a natural person or abusively by machine and automated processing, and blocks spam, DDoS attacks and similar automated malicious access. In order to ensure that an action is taken by a human and not by an automated bot, the provider collects the IP address of the device used, recognition data of the browser and operating system used, as well as the date and duration of the visit, and transmits these to the provider's servers for evaluation. Cookies may be used in this context, i.e. small text files stored in the browser of the device used.

If the processing described above is carried out on the basis of cookies, these are only set if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by disabling this service in the cookie consent tool provided on the website.

If the processing described above is carried out without the use of cookies, the legal basis is our legitimate interest in establishing individual responsibility on the internet and preventing misuse and spam pursuant to Art. 6(1)(f) GDPR.

We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

10) Tools and Miscellaneous

Cookie Consent Tool

This website uses a so-called cookie consent tool to obtain valid user consent for cookies and cookie-based applications that require consent. The cookie consent tool is displayed to you when the page is accessed in the form of an interactive user interface, on which you can grant consent for certain cookies and/or cookie-based applications by ticking boxes. Through the use of the tool, all cookies/services requiring consent are only loaded if you give the relevant consent by ticking the appropriate boxes. This ensures that such cookies are only set on your device if consent has been granted.

The tool sets technically necessary cookies in order to store your cookie preferences. Personal user data is generally not processed in this context.

If, in individual cases, personal data is nevertheless processed for the purpose of storing, assigning or logging cookie settings, such as the IP address, this is done in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website.

A further legal basis for processing is Art. 6(1)(c) GDPR. As the controller, we are under the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent.

Where required, we have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

Further information on the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

11) Rights of the Data Subject

11.1

Applicable data protection law grants you the following data subject rights vis-a-vis us as the controller with regard to the processing of your personal data, whereby reference is made to the legal basis stated for the respective conditions of exercise:

- Right of access pursuant to Art. 15 GDPR

- Right to rectification pursuant to Art. 16 GDPR

- Right to erasure pursuant to Art. 17 GDPR

- Right to restriction of processing pursuant to Art. 18 GDPR

- Right to notification pursuant to Art. 19 GDPR

- Right to data portability pursuant to Art. 20 GDPR

- Right to withdraw consent granted pursuant to Art. 7(3) GDPR

- Right to lodge a complaint pursuant to Art. 77 GDPR

11.2 Right to Object

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTERESTS AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. FURTHER PROCESSING REMAINS RESERVED, HOWEVER, IF WE CAN PROVE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

12) Duration of Storage of Personal Data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and, where relevant, additionally by the respective statutory retention period.

When personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you revoke your consent.

If statutory retention periods exist for data processed within the framework of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after expiry of the retention periods, provided it is no longer required for contract fulfillment or contract initiation and provided that we no longer have a legitimate interest in further storage.

When personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can prove compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

When personal data is processed for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

Unless otherwise stated in the other information in this declaration on specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Account data, saved society models, collaboration spaces and related protected-area content are generally stored for the duration of the user relationship or for as long as the respective account or collaboration space exists, unless earlier deletion is requested and no overriding legitimate grounds, statutory obligations or technically necessary backups prevent deletion.

Data and files submitted via contribution or upload forms are generally stored for as long as this is necessary to process, review, communicate about and, where applicable, publish or reject the respective submission. If submitted content is published or approved for publication, corresponding content and associated metadata may be stored for longer as part of the website, its editorial documentation, archive or related functions.

Public comments, published contributions and content intentionally made public or approved for publication may remain visible and may continue to be stored for documentation, archive, search, comparison and further development purposes, unless deletion is legally required or overriding legitimate interests of the data subject prevail.

Copyright notice: This privacy policy is based on a text originally generated by IT-Recht Kanzlei and subsequently translated and adapted for the English-language website version. The original German legal text should be retained as an internal reference version.