Controller
The controller is Bross Consulting GmbH, Viktualienmarkt 8, 80331 Munich, Germany. Email: info@bross-consulting.com.
Hosting and technical delivery
The website is delivered through Cloudflare. Technical access data such as IP address, time, browser information and requested files may be processed to provide the website securely and reliably. Processing is based on our legitimate interest in secure and reliable website operation under Art. 6(1)(f) GDPR.
No audience analytics or marketing tracking
We do not use web analytics, Google Analytics, Google Ads, a tag manager or marketing pixels on this website. We do not track your visit for audience measurement, profiling or personalized advertising.
Display preference
If you switch between the light and dark appearance, this choice is stored locally in your browser. The information remains on your device and is used only for your chosen display.
Contact
If you contact us by form, email or phone, we process your information to handle the request and follow-up questions. Required information is marked in the form.
The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to entering into or performing a contract. Otherwise we rely on Art. 6 (1) (f) GDPR; our legitimate interest lies in responding to enquiries addressed to our company.
We delete your enquiry once it has been dealt with conclusively, provided no statutory retention periods apply. Correspondence with commercial or tax relevance is retained for the duration of the statutory periods.
Applications
When you apply through the application form, we process your contact details, selected position, message and uploaded CV solely to conduct the application process.
The legal basis is Section 26 (1) BDSG in conjunction with Art. 6 (1) (b) GDPR. Only those persons involved in the selection procedure have access to your documents.
If no employment relationship is established, we delete your application documents no later than six months after the procedure has been concluded. This period accounts for the assertion of potential claims under the German General Equal Treatment Act. Storage beyond this period in our talent pool takes place only with your express consent pursuant to Art. 6 (1) (a) GDPR, which you may withdraw at any time with effect for the future.
Retention periods
We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations.
Technical access and security logs are processed briefly as part of service delivery and deleted automatically. Enquiries submitted via the contact form are deleted once they have been dealt with conclusively. Application documents are deleted no later than six months after the procedure has been concluded. Documents subject to commercial or tax retention obligations are kept for the statutory periods of six or ten years respectively.
Cloudflare Turnstile
We use Cloudflare Turnstile to protect the contact and application forms against automated abuse. The service is activated only when you use a form. Technical browser and interaction data as well as the IP address may be processed for the security check. Processing is based on Art. 6(1)(f) GDPR and our legitimate interest in protecting the forms and our systems. Turnstile is not used for marketing.
Google Maps and YouTube
Google Maps and YouTube content is initially blocked. A connection to Google is established only when you explicitly load the individual item once using its button. Your IP address and device information may then be transmitted to Google. This choice is not stored as general consent and does not enable other external content.
Transfers to third countries
Cloudflare, Inc. is based in the United States. Processing outside the European Union can therefore not be ruled out. The transfer is based on the EU-US Data Privacy Framework and, in addition, on the European Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR.
The same applies to Google Ireland Limited and Google LLC if you expressly load a map or a video. Without this click, no transfer to Google takes place.
Your rights
Subject to the statutory requirements, you have rights including access, correction, deletion, restriction of processing, objection and data portability. You may also lodge a complaint with a data protection supervisory authority. Please send privacy requests to info@bross-consulting.com.
The competent supervisory authority for Bross Consulting GmbH is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
Last updated
Last updated: August 2026.