Skip to content

Privacy Policy

Convenience translation: only the German version of this document is legally binding. In the event of any discrepancy or doubt, the German original shall prevail.

Last updated: 25 October 2026

1. Controller

Kienast Leadership Consulting GmbH, Spargelweg 27, 38179 Schwülper, Email: [email protected].

2. Account and login

When you register, we process your email address and login data in order to provide the user account (Art. 6(1)(b) of the General Data Protection Regulation, GDPR (DSGVO)). The account and database are operated via Supabase in a data centre in the EU.

When you choose a password, we check whether it appears in known data breaches. For this purpose, only a short excerpt of a hash value is transmitted to the Have I Been Pwned service – never the password itself and no information about you as a person (Art. 6(1)(f) GDPR, protection of your account).

3. Order and payment data

For orders of digital products and personal 1:1 sessions, we process the data required to perform the contract (Art. 6(1)(b) GDPR). Payments are processed via the following payment service providers:

  • Stripe – Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (credit card payment)
  • PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

You enter your payment data directly with the respective payment service provider. The provider processes it under its own responsibility and in accordance with its own privacy notices, among other things to fulfil statutory obligations relating to the supervision of payment services and the prevention of money laundering.

In order to assign a purchase to your EvolvU account, the payment service provider transmits to us the email address used for payment (for PayPal, the address of your PayPal account). We do not store this address in plain text, but only as a hash value, and compare it with the hash value of your login address. If the address differs, we send a purchase code to the address used for payment, with which you assign the purchase to your account in the app; if you request a new code, this is likewise sent only to that address. To prevent misuse, we log the time and result of assignment attempts per account (Art. 6(1)(b) and (f) GDPR).

4. Product use, answers and reflections

In the guided walkthrough, we process your input (selections, numerical and free-text entries, as well as options you name) in order to put the next question from our question catalogue to you in each case and to create your Orientation Report (Study Choice Orientation Report or Study Check Orientation Report). In the packages “Study Choice: Decision” and “Study Check: Decision”, we use this to create two Summaries (“Your Drive” and “Your Decision”). If you have previously received an Orientation Report for the same offer, we draw on it as background. In the packages “Study Choice: Action” and “Study Check: Action”, we guide you through several visits and create a Summary after each part of a visit. In doing so, we draw on your own information from earlier visits within the same Action package and, where available, on your own information about your decision from the Decision walkthrough (your decision, the reason that was decisive for you and your drive). The conversion of voice recordings into text and the creation of the Orientation Report and Summaries are AI-assisted; details and recipients can be found in Section 5.

5. Audio recordings, transcription and AI-assisted processing

You can answer by text or audio. We use AI assistance for two purposes:

  • Text recognition: audio recordings are converted into a transcript.
  • Orientation Report and Summaries: your Orientation Report and, in the packages “Study Choice: Decision” and “Study Check: Decision”, your two Summaries are created from your information and automatically checked for quality. For the second Summary, the first one, including your additions, is also processed. In the packages “Study Choice: Action” and “Study Check: Action”, your own information from earlier visits within the same Action package and, where available, from the Decision walkthrough is also processed for each Summary, but not the texts of earlier Summaries.

The questions in the walkthrough are not worded by AI; they come from a reviewed question catalogue.

For this purpose we use OpenAI (USA); the transfer to the USA takes place on the basis of appropriate safeguards (standard contractual clauses/Data Privacy Framework). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

For billing and operational purposes, we additionally store technical usage data on the use of AI (time, model used, volume of text units processed, costs and technical checksums). The content of your answers is not stored there.

There is no decision based solely on automated processing that produces legal or similarly significant effects within the meaning of Art. 22 GDPR.

6. Personal 1:1 sessions: arranging and holding appointments

If you book personal 1:1 sessions, we process your name, your contact details and the information required to arrange appointments. We process any concerns you describe in advance in order to prepare for the conversation (Art. 6(1)(b) GDPR).

The conversations take place as video appointments via Microsoft Teams. In the process, connection and usage data as well as video and audio signals are transmitted in real time. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. We use Microsoft Teams as part of a business Microsoft 365 subscription; under the EU Data Boundary for Microsoft 365, processing generally takes place within the EU or the EFTA states. Access by affiliated companies from third countries cannot be ruled out in every case; see Section 11. You do not need your own Microsoft account to take part.

The conversations are not recorded. A recording is made only if everyone involved has expressly consented beforehand; consent may be withdrawn at any time with effect for the future.

7. Offers for parents and caregivers

For offers aimed at parents or other close caregivers (Bezugspersonen), we process their contact and appointment data as described in Section 6.

In these conversations, information about the young person concerned, who is not present themselves, is regularly discussed. We process this information exclusively insofar as this is necessary for advising the caregiver. We do not create a separate file on the person concerned and do not report the content of conversations to third parties.

In the joint Orientation Conversation, several people take part in one appointment. Everyone involved is equally a data subject within the meaning of the GDPR; participation is voluntary.

8. Sending emails

We send account and transaction emails (e.g. confirmation of registration, resetting your password) as well as purchase code emails for assigning a purchase and reminder emails (see below) via Resend (Resend, Inc., USA); the transfer to the USA takes place on the basis of appropriate safeguards; see Section 11. We conduct correspondence for arranging appointments via our business email mailbox at Microsoft 365 (Microsoft Ireland Operations Limited; see Section 6). In this context, your email address and the technical data required for sending are processed (Art. 6(1)(b) GDPR).

Reminder emails: In the packages “Study Choice: Action” and “Study Check: Action”, you choose the day on which you would like to come back or carry on. On that day and, if you have not returned by then, seven days later, we send you a reminder to the email address of your account. If you pause after a review without choosing a day, the third day after that counts as the chosen day. We send no more than two reminders per occasion; once your Action package has been completed, we send no more. The reminders contain no advertising and none of the content of your answers. Each reminder contains a link with which you can unsubscribe from all further reminders for these packages; you will then still see your next visit in the app. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

9. Website hosting and cookies

Hosting, domain and delivery of the website are provided by IONOS SE (Germany). For the use of cookies and Google Tag Manager (only with consent), see our cookie information; the use of Google involves a transfer to the USA on the basis of appropriate safeguards.

The website is additionally delivered via the content delivery network and the security proxy of Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). In the process, Cloudflare processes connection data (in particular IP address, time, page accessed and browser identifier) for secure and fast delivery, to fend off attacks and to protect the email addresses given on the website from automated harvesting (Art. 6(1)(f) GDPR). The transfer to the USA takes place on the basis of appropriate safeguards; see Section 11.

10. Recipients

The following process data on our behalf and in accordance with our instructions:

  • IONOS SE (hosting, domain) – EU
  • Cloudflare, Inc. (content delivery network, security proxy, email protection) – USA
  • Supabase (account, database) – EU
  • Resend, Inc. (sending emails: account, transaction, purchase code and reminder emails) – USA
  • Microsoft Ireland Operations Limited (business email mailbox, appointment correspondence) – EU
  • OpenAI (transcription, creation of the Orientation Report and Summaries) – USA
  • Google (Tag Manager, only with consent) – USA
  • Microsoft Ireland Operations Limited (Microsoft Teams, holding online appointments) – EU

The following process data under their own responsibility:

  • Stripe Payments Europe, Limited (credit card payment) – EU
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (payment) – EU

11. Transfers to third countries

Insofar as data is transferred to third countries (in particular the USA), we base this on appropriate safeguards pursuant to Art. 46 GDPR (standard contractual clauses) or on a valid adequacy decision (Data Privacy Framework).

12. Storage period

We retain invoices and tax-relevant records for ten years in accordance with statutory obligations (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)). Otherwise, we delete data as soon as it is no longer required for the respective purpose and no statutory retention obligations prevent deletion. We store your information from guided walkthroughs and your Summaries for as long as your account exists, so that you can continue to access your Summaries and resume an Action package you have started at any time; you can request erasure at any time (Section 15).

13. Special categories of personal data

Please do not enter any particularly sensitive data (such as information on health, religion or origin) in free-text or audio input, neither about yourself nor about others. Some questions ask about people around you; a first name or a description (for example “my sister”) is sufficient for this. Please do not enter other people’s surnames or contact details. We process such mentions only for your own Orientation Report and your own Summaries; we do not contact the people mentioned. A corresponding obligation is also set out in our General Terms and Conditions.

In personal conversations, you decide for yourself what you raise. We do not specifically collect such information and do not document it. We name topics that suggest the need for medical or psychotherapeutic assessment and refer you to suitable services.

14. Minors

EvolvU is also aimed at young people before they choose what to study. Minors may use EvolvU only with the prior consent of their legal representatives; the purchase of paid services requires the purchaser to be of legal age. The consent of the legal representatives also extends to the AI-assisted processing of input described in Section 5, to the reminder emails under Section 8 and to participation in the personal 1:1 sessions under Sections 6 and 7. Legal representatives may exercise the rights set out in Section 15 on behalf of the person they represent.

15. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent you have given. You can also lodge a complaint with a data protection supervisory authority. Please send requests to [email protected]; we will deal with them without undue delay and at the latest within one month.

16. Security and log files

We take appropriate technical and organisational measures. When the website is accessed, temporary server log data is processed, which serves security and operation.

We use cookies to optimise our website and to give you the best possible online experience. By clicking ‘Allow all’ you agree to this. Click Settings for more information and to allow or deactivate individual cookies.

Settings