Privacy

1. General information

The protection of your personal data is very important to us. This privacy policy explains which personal data is processed when you visit our website and use the functions offered there.

Personal data is any information relating to an identified or identifiable natural person. The relevant definitions are set out in Art. 4 of the General Data Protection Regulation (GDPR).

This privacy policy applies to the website ca-strategy.de and to any domains of CA Strategy Consultants GmbH that redirect to it or are technically connected to it.

2. Controller

CA Strategy Consultants GmbH, Schleißheimer Straße 2, 80333 Munich, Germany

Represented by the Managing Director: Dipl.-Kfm. Markus Knarr

Phone: +49 89 5151-4812 · Email: info@ca-strategy.de

3. Provision and hosting of the website

When you visit our website, the following data in particular is processed for technical reasons:

• IP address of the accessing device
• date and time of access
• pages and files accessed
• amount of data transferred
• access status or HTTP status code
• browser type and version
• operating system
• device information
• language settings
• referrer URL, if transmitted by the browser
• internet service provider and
• technical log and security data.

Processing takes place to provide our website, ensure its stability and security and detect and prevent misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure, stable and functional operation of our website.

Where required, a data processing agreement pursuant to Art. 28 GDPR has been concluded with our hosting provider. Technical data is deleted or anonymised as soon as it is no longer needed for these purposes; longer storage may occur where required to investigate a specific security incident or to fulfil legal obligations.

4. Domain management by IONOS

Our domain is registered and managed by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany.

Where IONOS provides technical domain or DNS services for our website, technical connection data, in particular the IP address of the requesting system and the date and time of the request, may be processed. This serves the reliable, secure and stable availability of our website. The legal basis is Art. 6(1)(f) GDPR.

Further information: https://www.ionos.de/terms-gtc/datenschutzerklaerung/

5. Cookies and similar technologies

Cookies are small files or pieces of information stored on or read from your device. Technically necessary technologies are used on the basis of Section 25(2) TDDDG where they are strictly necessary to provide a digital service you have expressly requested. Where personal data is processed, this is based on Art. 6(1)(f) GDPR.

Optional cookies and similar technologies, in particular for analytics, statistics, personalisation or marketing, are only activated with your prior consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future.

6. Contact by email, phone or contact form

If you contact us by email, phone or via the contact form, we process the information you provide, in particular your name, contact details, company and the content of your enquiry, in order to handle your request. The contact form opens your email programme with a prepared message; transmission takes place by email.

If your enquiry relates to a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in handling enquiries properly and efficiently.

The data is deleted once your enquiry has been fully processed, unless statutory retention obligations or legitimate interests prevent deletion. Providing your details is voluntary; without the necessary contact information we may not be able to process your enquiry.

7. Applications

If you apply to us, we process the application data you submit. This may include in particular:

• name and contact details
• cover letter
• CV
• certificates and proof of qualifications
• information on education and career
• desired start date
• salary expectations
• application photo, if provided voluntarily, and
• other information you provide.

Processing serves the decision on establishing an employment relationship. The legal bases are Section 26(1) BDSG and, where applicable, Art. 6(1)(b) GDPR. Please only submit special categories of personal data, such as health data or information on a severe disability, where necessary for the application process; such data is processed where applicable on the basis of Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG.

Only persons involved in the application process have access. If your application is successful, the necessary data is transferred to your personnel file. If it is rejected, your data is generally deleted no later than six months after the end of the process (Art. 6(1)(f) GDPR, to assert, exercise or defend possible legal claims). Inclusion in a talent pool for longer only takes place with your express consent, which you may withdraw at any time.

8. Recipients of personal data

Within our company, only those persons and departments that need personal data to perform their tasks have access to it. In addition, service providers we use may receive personal data, in particular in the following areas:

• website hosting and operation
• domain management
• email communication
• application management
• IT maintenance and IT security and
• website maintenance.

Where required, these providers process personal data on the basis of a data processing agreement pursuant to Art. 28 GDPR. Data is only passed on to other recipients if you have expressly consented, if it is necessary to perform a contract or pre-contractual measures, if we are legally obliged to do so, or if it is necessary to protect legitimate interests and your overriding interests do not prevail.

9. Data security

In accordance with Art. 32 GDPR, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. Our website uses TLS encryption, recognisable by “https://” in your browser's address bar.

Please note that communication by ordinary email cannot always be fully protected against access by third parties.

10. Storage period

Unless a specific storage period is stated in this privacy policy, we store personal data only for as long as necessary for the respective purpose. It is then deleted unless statutory retention periods or legitimate interests, in particular to assert, exercise or defend legal claims, prevent deletion.

11. Your rights

Subject to the statutory requirements, you have in particular the following rights:

• right of access under Art. 15 GDPR
• right to rectification under Art. 16 GDPR
• right to erasure under Art. 17 GDPR
• right to restriction of processing under Art. 18 GDPR
• right to data portability under Art. 20 GDPR
• right to object under Art. 21 GDPR and
• right to withdraw consent under Art. 7(3) GDPR.

Withdrawal of consent applies to the future; the lawfulness of processing carried out before withdrawal remains unaffected. To exercise your rights, please contact info@ca-strategy.de.

12. Right to object

Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you may object to the processing under Art. 21 GDPR on grounds relating to your particular situation. Where personal data is processed for direct marketing, you may object at any time without giving reasons; this also applies to profiling related to direct marketing.

13. Right to lodge a complaint

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany (https://www.lda.bayern.de).

You may also contact another competent authority, in particular the one at your habitual residence or place of work.

14. External links and social networks

Our website contains links to external services, in particular kununu and XING. These are ordinary links, not embedded social media plugins. A connection to the provider is only established when you click such a link; your IP address, technical browser information and the previously visited page may be transmitted. The operator of the external service is responsible for any subsequent processing.

• kununu: https://www.kununu.com/de/info/datenschutz
• XING: https://privacy.xing.com/de/datenschutzerklaerung

15. Automated decision-making

No exclusively automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

16. Changes to this privacy policy

We update this privacy policy when our data processing, the services used or legal requirements change. The version published on our website applies. Last updated: 5 August 2026