Data Privacy

Last updated: October 15, 2026

1. Controller and contact

This policy explains how we process personal data when you visit customer-institute.org, contact us, or take part in our certification, assessment and community programmes. Personal data is any information that relates to an identified or identifiable person.

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is CCI Customer Institute UG (haftungsbeschränkt), Daniel-Kircher-Str. 5, 40822 Mettmann, Germany, represented by its Managing Director Stefan Osthaus. Phone: +49 2104 640-9370. Email: office@customer-institute.org.

Please use this email address for all questions about data protection and to exercise your rights (section 13).

2. Hosting and server log files

Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, on servers in Germany. ALL-INKL.COM processes data on our behalf under a data processing agreement (Art. 28 GDPR).

Each time you access our website, your browser automatically transmits the following data, which is stored in server log files: IP address (stored only in shortened form, for example 11.22.0.0), date and time of the request, page requested, amount of data transferred, referring URL, browser type and version, and operating system.

We process this data to deliver the website, to keep it stable and secure, and to detect misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in these purposes. Log files are deleted after 190 days. Our host also uses them to create access statistics that only we can view.

All data transmitted between your browser and our website is encrypted using TLS (recognisable by “https://” in the address bar).

3. Cookies and local storage

We do not use cookies for analytics or advertising. Our website stores information on your device, or reads it from there, only in the following cases:

• Technically necessary: our accessibility toolbar stores the display settings you choose in your browser’s local storage (section 8). Logged-in site administrators receive login cookies.
• With your consent: external content such as videos is loaded only after you click on it; its provider may then set cookies (section 7).

Technically necessary storage is based on Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Storage with your consent is based on Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can delete cookies and local storage at any time in your browser settings.

4. Web analytics (Rybbit)

We use Rybbit to understand how visitors use our website and to improve its content and usability. Rybbit is provided by Tomato.gg LLC, 1276 Rothwell Dr, Troy, MI 48084, USA. Analytics data is stored on servers in Germany.

Rybbit works without cookies and stores nothing on your device. It records the pages you visit, the referring website, the time of your visit, your browser and operating system, device information such as device type and screen size, and your approximate location (country or region). Your IP address is used only briefly to determine this location and is not stored. Visits are counted with an anonymous identifier that changes every day, so we cannot recognise you on a later day or identify you personally.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the statistical analysis of how our website is used. We have concluded a data processing agreement with Rybbit (Art. 28 GDPR). Because Rybbit is based in the USA and uses service providers such as Cloudflare, data may be accessed from outside the EU; such transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses (Art. 46 GDPR). Analytics data is retained for as long as we use Rybbit and deleted no later than 30 days after we stop using the service.

You can object to this processing at any time (section 14). More information: rybbit.com/privacy.

5. Contacting us and online forms

You can contact us by email, by phone or through the forms on our website. We process the data you provide: in the contact form your name, email address and message; in other forms, depending on their purpose, also your organisation, job title, country, LinkedIn profile, billing address, VAT number or uploaded files. Mandatory fields are marked with an asterisk; without them we cannot process your request.

Form submissions are stored in our website database and forwarded to us by email. We use this data only to handle your request and, where you apply or register, to provide the service you requested.

The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract with us or to steps prior to entering into one, for example certifications, assessments, programme applications or listings. Otherwise it is Art. 6(1)(f) GDPR; our legitimate interest is responding to your enquiry. We delete the data once your request has been fully dealt with, unless statutory retention periods apply (section 12).

Spam protection (hCaptcha). Some of our forms are protected by hCaptcha, a service of Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA. hCaptcha checks whether a form is being completed by a person or by an automated program. For this purpose, your IP address, information about your browser and device, and your interaction with the page are transmitted to hCaptcha. hCaptcha is loaded only on pages that contain a protected form.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our forms against spam and abuse. hCaptcha processes this data on our behalf (Art. 28 GDPR). Intuition Machines is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are therefore based on the European Commission’s adequacy decision (Art. 45 GDPR). More information: hcaptcha.com/privacy.

6. Certifications, assessments and programmes

If you apply for a certification, commission an assessment, or take part in one of our programmes (for example training certification, mentoring, ambassador or board roles, or listings in the Global CX Community), we process the data needed to provide the service: contact details, information about your organisation and role, the documents you submit, and billing data.

The legal basis is Art. 6(1)(b) GDPR. For invoices and accounting records it is also Art. 6(1)(c) GDPR in conjunction with German commercial and tax law. While a certification is valid, and for its renewal, we keep the data needed to verify it.

Public certificate register. So that third parties can verify certifications, we publish on our website the names of certified individuals, organisations, tools and methods, together with the certificate number, the programme and its validity. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, and we will then remove your entry. To have an entry corrected or removed, please contact us (section 1).

Listings and testimonials. Where a form provides for publication, for example a job search, freelance, consultancy, training or speaker profile, we publish the information you submit as described in that form (Art. 6(1)(b) GDPR). If you allow us to quote your feedback, we publish your statement with your name and title (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future.

7. Embedded videos and presentations

Some pages contain videos from YouTube and Synthesia and a presentation from Canva. To protect your privacy, this content is not loaded when you open the page. Instead you see a placeholder, and only when you click on it does your browser connect to the provider’s servers. The provider then receives your IP address, information about your browser and device, and the address of the page, and may set cookies or similar technologies. If you are logged in to an account with the provider, it may link this information to your account.

The legal basis is your consent, given by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). If you choose to always display content from a provider, we store this choice in a cookie on your device; you can withdraw it at any time by deleting that cookie.

• YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We embed videos in privacy-enhanced mode (youtube-nocookie.com). Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Privacy policy: policies.google.com/privacy.
• Synthesia: Synthesia Limited, 20 Triton Street, London NW1 3BF, United Kingdom. Transfers to the UK are based on the European Commission’s adequacy decision for the UK (Art. 45 GDPR); Synthesia uses Standard Contractual Clauses for onward transfers, for example to the USA. Privacy policy: synthesia.io/legal/privacy-policy.
• Canva: Canva Pty Ltd, 110 Kippax Street, Surry Hills NSW 2010, Australia; EU representative: European Data Protection Office (EDPO), Dublin, Ireland. There is no adequacy decision for Australia, and data protection there may not be equivalent to that in the EU. By clicking, you also consent to this transfer (Art. 49(1)(a) GDPR). Privacy policy: canva.com/policies/privacy-policy.

8. Fonts and accessibility toolbar

All fonts and icons on our website are hosted on our own server. No connection to Google or any other font provider is made.

Our accessibility toolbar (OneTap) lets you adjust contrast, font size and other display settings. It runs on our own server and stores the settings you choose in your browser’s local storage so that they apply on every page; they are not transmitted to us. The legal basis is Section 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR; our legitimate interest is making our website accessible.

9. Website security (Wordfence)

To protect our website against attacks, we use the security plugin Wordfence by Defiant, Inc., 800 5th Ave, Suite 4100, Seattle, WA 98104, USA. Its firewall checks every request to our website, including your IP address, the page requested, your browser identification and the time. Requests identified as attacks are blocked; these requests and failed login attempts are logged. Information about such attacks, including the IP addresses involved, is shared with Defiant to improve threat detection for all websites that use Wordfence.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security of our website and the data stored on it. Transfers to Defiant in the USA are based on the EU Standard Contractual Clauses (Art. 46 GDPR).

10. Backups

We back up our website every week, including its database, which contains form submissions. The backups are stored with pCloud International AG, Switzerland, on servers in the European Union, and the four most recent backups are kept. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is being able to restore our website and data after a technical failure or an attack.

11. Links to external platforms

Global CX Community. Our Global CX Community at community.customer-institute.org runs on the Mighty Networks platform of Mighty Software, Inc., USA. When you follow the “Membership” link, a new tab opens and you leave our website; the community platform can see that you came from our website. Processing on the community platform is governed by its own privacy policy: mightynetworks.com/privacy-policy.

LinkedIn. Our website contains a simple link to our LinkedIn page. No data is transmitted to LinkedIn unless you click on the link.

12. Storage period

Unless a specific period is stated above, we delete personal data as soon as it is no longer needed for the purpose for which it was collected. Data subject to statutory retention obligations is kept for the period required by law, between 6 and 10 years under German commercial and tax law (Section 257 HGB, Section 147 AO), and then deleted.

13. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Access to the data we hold about you and how we process it (Art. 15 GDPR).
• Rectification of inaccurate or incomplete data (Art. 16 GDPR).
• Erasure of your data, unless we are legally required or entitled to keep it (Art. 17 GDPR).
• Restriction of processing, for example while the accuracy of your data is being checked (Art. 18 GDPR).
• Data portability: receiving the data you provided to us in a structured, commonly used, machine-readable format (Art. 20 GDPR).
• Withdrawal of consent at any time with effect for the future; processing carried out before the withdrawal remains lawful (Art. 7(3) GDPR).
• Objection to processing based on our legitimate interests (Art. 21 GDPR, see section 14).
• Complaint to a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany (ldi.nrw.de).

To exercise your rights, contact us at office@customer-institute.org. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

14. Right to object (Art. 21 GDPR)

15. Changes to this policy

We update this policy when our website or the legal requirements change. The current version is always available on this page.