Privacy Policy

Controller

The controller responsible for data processing within the meaning of the GDPR is:

LEADBeyond GmbH, Tölzer Str. 1, 82031 Grünwald, Germany. Email: talents@LEADBeyond.de.

If you have any questions about data protection, you can contact us at any time at the address above.

What the platform does

The platform is used to run 360° leadership feedback. Participants assess themselves, nominated feedback providers (raters) submit their assessments, and the results are combined into an individual report. The platform is generally used on behalf of the company (client) that commissions the feedback.

Which data we process

• Account and contact data: name, email address, preferred language, and a password stored in encrypted (hashed) form.
• Assessment data: your questionnaire responses (ratings on a scale of 1 to 6), optional free-text feedback, and your role and assignment within the respective assessment.
• Usage and log data: technical data generated when you sign in and use the platform (e.g. session information as well as error and security logs).

Purposes and legal bases

We process this data to provide the feedback platform, to run and evaluate the assessment, and to ensure technical operation and security.

Depending on the context, the legal bases are the performance of a contract or processing on behalf of the client (Art. 6(1)(b) GDPR), your consent (Art. 6(1)(a) GDPR) where such consent is obtained, and our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR). The precise allocation of roles (controller/processor) and the applicable legal bases will be finalised as part of the legal review.

Anonymity and confidentiality

Feedback is shown only in aggregated and anonymised form. The results of a feedback group are displayed only once a minimum number of responses has been submitted (threshold), so that no conclusions can be drawn about individual feedback providers. Individual ratings by individual raters are not disclosed to the participant in an attributable way.

No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. In the current version, free-text feedback is not analysed, clustered or summarised by AI; it is displayed solely in its original, threshold-protected form.

Recipients and processors

To provide the platform we use carefully selected service providers that process data on our behalf and on our instructions (processing under Art. 28 GDPR):

• Supabase – database, authentication and file storage.
• Vercel – hosting and delivery of the application (server region Frankfurt am Main).
• Resend – sending of transactional emails (e.g. invitations and reminders).
• Sentry – error and stability monitoring, where enabled.

The platform is designed for data storage within the EU. Where individual providers process data outside the EU/EEA, this is done on the basis of appropriate safeguards (in particular EU standard contractual clauses). The complete list of processors, the respective processing regions and the data processing agreements in place will be finalised as part of the legal review.

Storage period

We store personal data only for as long as necessary for the purposes described or as required by statutory retention obligations. Once an assessment is completed or the purpose no longer applies, data is deleted or anonymised. The specific storage and deletion periods will be finalised before the production launch.

Cookies and local storage

We use only technically necessary cookies: some for your login session, and others for settings you make yourself in the application — for example your selected display language or the view you last opened — which are stored for up to one year. We also use your browser's local storage (localStorage) to remember individual display settings you have chosen. No tracking, analytics or advertising cookies are used. Details can be found in our Cookie Policy. The legal basis for technically necessary cookies — both for your login session and for settings you have chosen yourself — is Section 25(2) no. 2 TDDDG.

Your rights

Under the GDPR you have the following rights:

• access to the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing (Art. 21 GDPR), and
• withdrawal of a given consent with future effect (Art. 7(3) GDPR).

To exercise your rights, an informal message to talents@LEADBeyond.de is sufficient.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany.

Changes to this privacy policy

We will update this privacy policy if our data processing or the legal situation changes. The version published on this page applies.