Privacy Policy

This privacy policy explains how magnolia psychometrics GmbH processes personal data. The general part below applies to all of our websites and services; the section that follows it describes the processing specific to the website you are visiting.

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

magnolia psychometrics GmbH
c/o Basislager Coworking
Peterssteinweg 14
04107 Leipzig
Germany

Represented by the managing director Dr. Björn E. Hommel
Email: hello@magnolia-pm.com
Phone: +49 (0)341 / 98 97 71 07

We are not legally required to appoint a data protection officer. For all data protection questions, please contact us at the address above.

Contacting Us

If you contact us by email, phone, or otherwise, we process the data you provide (e.g., name, email address, organization, the content of your message) to handle your request.

Legal basis: Art. 6 (1) (b) GDPR if your request relates to a contract or to pre-contractual measures; otherwise Art. 6 (1) (f) GDPR, based on our legitimate interest in answering inquiries addressed to us.
Retention: We delete the data once your request has been dealt with conclusively, unless statutory retention obligations apply (see below).

Clients and Business Partners

When we prepare, conclude, and perform contracts, we process the contact and contract data of our clients, business partners, and their contact persons (e.g., name, business contact details, role, correspondence, order and billing data).

Legal basis: Art. 6 (1) (b) GDPR (contract), Art. 6 (1) © GDPR (statutory obligations, e.g., under tax and commercial law), and Art. 6 (1) (f) GDPR for communication with contact persons of companies and institutions.
Retention: For the duration of the business relationship, and thereafter as long as statutory retention obligations under commercial and tax law require (generally up to ten years).

Where we process personal data on behalf of our clients (e.g., data of participants in assessments or studies), our client is the controller for this processing, and we act as a processor under a data processing agreement pursuant to Art. 28 GDPR. Information about that processing is provided by our client.

Recipients

We only disclose personal data where this is necessary for the purposes described here. Recipients are in particular:

service providers who process data on our behalf (e.g., hosting, IT and email services), bound by data processing agreements pursuant to Art. 28 GDPR;
tax advisors, auditors, and authorities, where we are legally required to do so or this is necessary to assert or defend legal claims.

We do not sell personal data.

Transfers to Third Countries

We do not transfer personal data to countries outside the European Economic Area unless this is stated for a specific processing activity in this policy. Where such a transfer takes place, it is based on an adequacy decision of the European Commission (Art. 45 GDPR) or on standard contractual clauses (Art. 46 (2) © GDPR).

Your Rights

You have the right to:

access the personal data we hold about you (Art. 15 GDPR);
rectification of inaccurate data (Art. 16 GDPR);
erasure of your data (Art. 17 GDPR);
restriction of processing (Art. 18 GDPR);
data portability (Art. 20 GDPR);
withdraw any consent you have given, with effect for the future (Art. 7 (3) GDPR).

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves to establish, exercise, or defend legal claims. You may object to the use of your data for direct marketing at any time without giving reasons.

To exercise your rights, an informal message to hello@magnolia-pm.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Sächsische Datenschutz- und Transparenzbeauftragte, Devrientstraße 5, 01067 Dresden, Germany.

Data Security

We protect personal data with appropriate technical and organizational measures. Our websites are delivered exclusively over encrypted connections (TLS).

Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Obligation to Provide Data

You are neither legally nor contractually obliged to provide personal data. Without the data, however, we may not be able to answer your request or to conclude or perform a contract.

Changes to This Policy

We update this privacy policy when our processing or the legal situation changes. The current version is always available on the respective website.

This Website (magnolia-psychometrics.com)

Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers located in Germany. Hetzner processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

Server Log Files

Every time you access this website, your browser automatically transmits information that is processed in server log files: IP address, date and time of the request, requested page or file, HTTP status code, amount of data transferred, referrer URL, and browser and operating system (user agent).

Purpose: delivering the website, ensuring its stability and security, and investigating errors and attacks.
Legal basis: Art. 6 (1) (f) GDPR, based on our legitimate interest in a secure and functioning website.
Retention: Log files are deleted automatically after 7 days at the latest. Data whose further retention is required as evidence of a security incident is exempt from deletion until the incident has been resolved.

To display the website in your language, we store your language preference (the value “en” or “de”) in a cookie named lang and in your browser’s local storage. The value is derived from your browser’s language setting or your choice in the language menu, is kept for one year, and is not used for any other purpose.

Legal basis: Storing this information on your device is strictly necessary to provide the language selection you requested (Section 25 (2) No. 2 German Telecommunications Digital Services Data Protection Act, TDDDG). The associated processing is based on Art. 6 (1) (f) GDPR.
You can delete the cookie and the local storage entry at any time in your browser settings.

We do not use any other cookies.

Contact Form

When you write to us via the contact form, we send your details (name, email address, optionally your organization, and your message) together with the page language by email to our mailbox. The details are not stored on the web server itself. Our mailbox is operated by Google Cloud EMEA Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace), under a data processing agreement pursuant to Art. 28 GDPR. This may involve a transfer to the USA, which is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

To protect against automated messages, we limit the number of messages per IP address. For this purpose, we store a hash of your IP address (a string derived from it that does not directly reveal the address) on our server for at most one hour.

Legal basis and retention of your message: see “Contacting Us”.
Legal basis of the per-IP limit: Art. 6 (1) (f) GDPR, based on our legitimate interest in a contact form protected against abuse.

Audience Measurement with Umami

To understand which content is read, we use the open-source software Umami. It runs on our own servers at Hetzner (see “Hosting”), and no data is passed to third parties. Umami does not set cookies and stores nothing on your device.

For each page view, we record: the page and page title, referrer URL, browser, operating system, device type, screen resolution, language setting, and the country, region, and city derived from the IP address. We also count individual actions in blog articles, such as sharing an article, copying a citation, or reading to the end. The IP address itself is not stored. To group page views into visits, Umami computes an identifier from the IP address, browser details, and a regularly changing random value. The IP address cannot be recovered from this identifier, and visits cannot be linked to the same person over longer periods.

If your browser sends a “Do Not Track” signal, no audience measurement takes place.

Purpose: statistical analysis of usage to improve our content and website.
Legal basis: Art. 6 (1) (f) GDPR, based on our legitimate interest in privacy-friendly audience measurement.
Retention: The statistics data is deleted after 24 months.

No Third-Party Content

We do not use third-party advertising or tracking services. All fonts, scripts, and other resources are delivered from our own servers; no content is loaded from third parties when you visit the website. Links to external platforms (e.g., LinkedIn, GitHub, Hugging Face) are plain links: data is only transmitted to the respective provider if you follow them.

Interactive Examples

Some articles contain interactive examples whose calculations run entirely in your browser. The required program files are loaded from our server. The values you enter are processed locally on your device and are not transmitted to us.