Privacy policy

The controller responsible for data processing on both websites is:

Phalanx GmbHHelene-Lange-Str. 2891056 ErlangenGermanyrepresented by its Managing Director, Dr Christian Neusser

Telephone: +49 9131 920 60 75Email: info@phalanx.de

Where Dr Christian Neusser provides services on a freelance basis (for example teaching, lectures, publications) and you contact him about these via christian-neusser.de, he processes your details to handle your enquiry under his own responsibility. The contact details are the same.

[Draft note, to be clarified by counsel: Whether there is an obligation to appoint a data protection officer under Section 38 BDSG depends in particular on how many persons are constantly engaged in the automated processing of personal data. The Managing Director cannot act as data protection officer himself owing to the conflict of interest. The information previously given on the old website must therefore be reviewed.]

If you have any questions about data protection, you can reach us at info@phalanx.de or at the postal address given above.

Our websites do not set cookies, do not embed social media plug-ins and do not load fonts or scripts from third-party providers. Fonts are taken from your device’s operating system, and images are stored on our own server.

For audience measurement we use our own installation of Umami, which works without cookies and does not make you identifiable (section 5).

We process personal data only• when the website is technically accessed (server log files),• when you contact us via the contact form, by email or by telephone,• when you subscribe to our newsletter,• when you arrange a meeting via our appointment booking.

The websites are operated by Railway Corp., 548 Market St PMB 68956, San Francisco, CA 94104, USA. We have selected EU West (Amsterdam, Netherlands) as the server region, so your data are stored and processed within the European Union. A data processing agreement (Art. 28 GDPR) is in place with Railway. As Railway is a US company, access from the USA, for example in the course of maintenance and support, cannot be entirely ruled out. Railway is certified under the EU-US Data Privacy Framework; any transfer to the USA is based on the European Commission's adequacy decision (Art. 45 GDPR) and, in addition, on the EU Standard Contractual Clauses. [Draft note: conclude a DPA with Railway and verify the DPF certification in the official register before publication.]

When the websites are accessed, information transmitted by your browser is processed automatically: IP address, date and time of access, page accessed, referrer URL, browser type and operating system. These data are technically necessary to deliver the website and to ensure its security, for example to fend off attacks. They are not combined with other data sources.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the websites. Server log files are deleted automatically after 30 days.

To understand which content is being read, we run our own installation of the analytics software Umami. The software runs on our own server in the EU West region (Amsterdam, Netherlands). No data is passed on to third parties.

Umami does not set cookies and does not store any identifier on your device. You are not recognised across websites or over longer periods. For each page view we record: the page requested, the referring page, browser and device type, operating system, screen size, language and the country derived from the IP address. Your IP address itself is not stored; it is processed only briefly in order to derive a non-reversible checksum for the daily statistics.

Because no cookies are set and no information is read from your device, no consent under Section 25 TDDDG is required. The legal basis is our legitimate interest in a data-minimising analysis of how our websites are used, Article 6(1)(f) GDPR. The data collected cannot be related to individual persons and is deleted after twelve months.

You can prevent the measurement by enabling the Do Not Track setting in your browser or by using a content blocker. This does not put you at any disadvantage when using our websites.

If you write to us via the contact form, we process your name, your email address, optionally your company and telephone number, the topic selected, your message and the page from which you wrote to us. If you reached our website via a link containing campaign parameters (UTM), we store this information on the origin of the enquiry as well. The enquiry is transmitted in encrypted form to our internal customer management system, PhalanxOS, where it is stored and processed. The form contains an invisible field to fend off automated spam submissions; to prevent misuse, your IP address is briefly processed in memory in order to limit submissions to no more than five enquiries within ten minutes.

The same applies if you contact us by email or telephone.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or to pre-contractual measures, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in responding to your enquiry.

We delete your details once your enquiry has been dealt with in full, provided that no statutory retention obligations prevent this. If a business relationship results from the enquiry, we store the data for the duration of that relationship and thereafter within the retention periods prescribed by commercial and tax law.

PhalanxOS is our own internal system for customer management, projects, appointment booking and newsletters. It is likewise operated by Railway Corp. and in the same server region, EU West (Amsterdam, Netherlands), as the websites. Access is restricted to authorised employees of Phalanx GmbH, and only to the extent that they need the data for their tasks.

You can subscribe to our newsletter, "Phalanx Perspectives". For this we need your email address and your last name; providing your first name is optional. We use names solely to address you personally in the salutation. [Draft note, for legal review: the last name is currently a mandatory field. In view of data minimisation under Art. 5(1)(c) GDPR, it should be examined whether this field can be justified as mandatory or should be made optional.]

We use the double opt-in procedure: after subscribing, you will receive an email containing a confirmation link. We add you to the mailing list only once you have confirmed. In order to be able to prove your subscription, we store the time of subscription and of confirmation, the page on which you subscribed, the wording of the consent and your IP address in truncated or hashed form. Unconfirmed subscriptions are deleted after 30 days.

The newsletter is sent via our own system, PhalanxOS, which is operated in the EU West (Amsterdam, Netherlands) server region. [Draft note: name the email service used for dispatch once it has been determined, and state whether open and click rates are measured. If such measurement takes place, it must be described here and expressly included in the consent text.]

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 7(2) no. 2 UWG; the logging is based on Art. 6(1)(c) and (f) GDPR (proof of consent).

You can unsubscribe from the newsletter at any time, via the link in each issue or by email to info@phalanx.de. After you unsubscribe, we will no longer use your email address for the newsletter.

The "Book an appointment" button takes you to our appointment booking in PhalanxOS. There we process the details you provide for the booking (in particular name, email address and, where applicable, company, telephone number and preferred date and time) in order to arrange the appointment, send you a confirmation and prepare for the meeting.

Meetings are usually held as a video conference via Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When you take part in an appointment, Microsoft processes connection and usage data, such as your IP address, the name displayed and audio and, where applicable, video data during the meeting. We do not record meetings unless we have asked for your express consent beforehand. You receive the invitation link with the appointment confirmation; you do not need a Microsoft account to take part. [Draft note, for legal review: verify the data processing agreement with Microsoft (Data Protection Addendum) and the basis for third-country transfers, and link to Microsoft's privacy information.]

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request). The data are deleted once they are no longer required for this purpose and no retention obligations apply.

Our websites contain links to external services, such as LinkedIn, CapitalMatch, the Phalanx Expert Network, Google Scholar or ORCID. These are simple links; only when you click on a link are you redirected to the website concerned, whose privacy provisions then apply. No data are transmitted to these providers when you access our pages.

We process applications that you send us by email or post in order to decide on establishing an employment or cooperation relationship. The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG. If no collaboration results, we delete the documents no later than six months after the conclusion of the procedure, unless you have consented to longer storage.

We pass on your data only where this is necessary for the purposes stated, for example to our hosting provider as a processor or to the video conferencing provider for a scheduled appointment, or where we are legally obliged to do so. The websites and PhalanxOS are operated in the EU West (Amsterdam, Netherlands) server region, so your data are stored within the European Union. Where a transfer to a country outside the EU or the EEA nevertheless takes place, for example because a service provider is based in the USA, it occurs only on the basis of an adequacy decision of the European Commission or appropriate safeguards such as the EU Standard Contractual Clauses.

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You may object to processing for direct marketing purposes at any time without giving reasons (Art. 21(2) GDPR).

An informal message to info@phalanx.de is sufficient to exercise your rights.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

The websites are delivered exclusively over an encrypted connection (TLS). You can recognise this by “https://” and the padlock symbol in your browser’s address bar. We take technical and organisational measures to protect your data against loss and unauthorised access.

We amend this privacy policy when our websites or the legal requirements change. The version published here at any given time applies.