Privacy policy.

The controller within the meaning of Art. 4 (7) GDPR for the website at stzki.de is:

— referred to below as the “transfer center” —

Further details about the provider are given in the legal notice.

A separate privacy policy applies to the GeniusQ learning platform, because the transfer center acts there in part as a processor for the respective client: geniusq.de.

The transfer center has appointed an external data protection officer:

First, because it explains how short this policy is: the website sets no cookies — not even the contact form, neither when it is displayed nor when it is submitted. There is no audience measurement, no analytics or advertising services, no social networks, no third-party videos or maps. Fonts and program libraries are served from our own server; no content is loaded from external servers to display these pages. There is no profiling and no automated decision-making.

For the same reason there is no consent banner: there is nothing to consent to.

When you open a page, your browser transmits technically necessary data, which the server records in its log:

Purpose: secure and trouble-free operation, detecting and investigating faults and attacks. Legal basis: Art. 6 (1) (f) GDPR. Retention: 14 days, after which the logs are deleted automatically. The data is not combined with other data.

Requests to the Digital Maturity Index questionnaire are deliberately not logged, because a personal access key appears in the path there.

Every page carries a contact form. When you submit it, we process:

Purpose: handling and answering your enquiry. Legal basis: Art. 6 (1) (b) or (f) GDPR.

Recipients: the enquiry is delivered by e-mail to the mailbox of the center's director; we use a service provider for the delivery (section 08). Your details are not used for advertising and not passed on to third parties.

Retention: 12 months after the enquiry is received; after that it is deleted automatically.

You are welcome to write to us directly at info@stzki.de instead.

When you complete the DMI check, we process your e-mail address, your details about the company and your answers to the questions.

Purpose: producing and sending your personal evaluation; your evaluation is reviewed by us before release. Legal basis: Art. 6 (1) (b) GDPR. Recipients: service provider for e-mail delivery (section 08).

Retention: your data remains stored until you delete it. The e-mail with your evaluation contains a deletion link. It removes your submission completely: contact details, all answers, the calculated evaluation and the messages we sent you about it. We ask for confirmation once before deleting; after that it cannot be recovered, and the link to your report no longer works.

The questionnaire offers three consents — all of them optional, and the check works without them. The legal basis in each case is Art. 6 (1) (a) GDPR.

Only your e-mail address and the date of your consent are passed on — the latter as evidence of consent for the recipients. Your answers from the questionnaire and your evaluation are not passed on. The two recipients then process the address as controllers in their own right; their own privacy notices apply to that processing. Without this consent no transmission takes place.

You can withdraw any of these consents at any time without giving reasons, by an informal message to dmi@stzki.de. A withdrawal of the last consent is passed on by us to the two recipients. The lawfulness of processing carried out up to the withdrawal remains unaffected. An individual contribution can no longer be removed from comparative values that have already been calculated.

You can arrange an appointment through the booking pages. In doing so we process your name, your e-mail address, your telephone number if you provide it, your message and the time slot booked.

Purpose: arranging and holding the appointment. Legal basis: Art. 6 (1) (b) GDPR. Recipients: the appointment is entered in the calendar of the person responsible and sent to you as an invitation; we use Microsoft Exchange for this. The calendar credentials are held by us in encrypted form.

Retention: 24 months after the appointment; after that the booking and the notification are deleted automatically.

We do not pass your data to third parties for our own purposes. For operating the site we do use service providers, who process data on our behalf and on our instructions:

Contracts for processing on our behalf pursuant to Art. 28 GDPR are in place with all of the service providers named.

Beyond that there is exactly one case in which data goes to a recipient that processes it for its own purposes: the transmission of your e-mail address to TextilWirtschaft and BTE if you consented in the DMI check to invitations to future surveys (section 06). Without that consent it does not take place.

No personal data is transferred to a country outside the EU or the EEA. The website and the application are operated in Germany, the Exchange server is located in Germany, and e-mail is delivered in the Netherlands. The two recipients named in section 06 are likewise established in Germany.

There is a password-protected area for staff. After signing in we set a technically necessary session cookie, which keeps the sign-in for the duration of the visit and ends when signing out. This area is of no relevance to visitors of the website.

As a data subject you have the following rights:

An informal message to the transfer center (section 01) or to the data protection officer (section 02) is enough for any of these.

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The authority responsible for the transfer center is:

The transfer center reserves the right to adapt this privacy policy, in particular where technical procedures or legal requirements change. The version published here at the time applies.

Last updated: 3 September 2026