We are pleased about your interest in equilane. Protecting your personal data matters to us. Below we inform you, pursuant to the General Data Protection Regulation (GDPR), about which data we process, for what purpose and on what basis – on this website, in the equilane Cockpit, and in our work with clients.
Bright & Brilliance Operations GmbH – registered brand equilane
represented by managing director Sabrina Lode
Ackerstraße 15, 02977 Hoyerswerda, Germany
Email: kontakt@equilaneconsulting.com · Phone: +49 1520 4872339
We have not appointed a data protection officer, as the statutory requirements for doing so are not met.
This website is hosted by Netlify, Inc., 512 2nd Street, San Francisco, CA 94107, USA. When you visit the website, Netlify automatically collects server log files (IP address, date and time, page requested, browser type, referrer). This processing is based on our legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR). We have a data processing agreement with Netlify under Art. 28 GDPR; the transfer to the US is safeguarded by the European Commission's Standard Contractual Clauses. Log files are deleted after 30 days.
The website is delivered over encrypted TLS connections. Fonts are served from our own server; no connection is made to Google Fonts or other font providers.
If you contact us by form, email or phone, we process your details (name, email address, company, phone number, message) solely to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or (f) GDPR (legitimate interest in responding to enquiries). Enquiries that do not lead to a contract are deleted six months after the last communication, unless statutory retention obligations require otherwise.
For booking intro calls and live demos, we use the scheduling feature of Google Calendar (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Booking processes your name, email address, chosen time slot and – if provided – company and enquiry. The legal basis is Art. 6(1)(b) GDPR. Google also processes data in the US; the transfer is safeguarded by Standard Contractual Clauses and Google LLC's certification under the EU-US Data Privacy Framework. We have a data processing agreement with Google (Google Workspace Data Processing Addendum). More information: policies.google.com/privacy.
We use technically necessary cookies based on § 25(2) TDDDG.
Plausible Analytics. For analytics we use Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia). Plausible operates without cookies, creates no profiles and stores no IP addresses. Only aggregated, anonymous usage data is collected (pages viewed, country of origin, referring website, device type). The legal basis is our legitimate interest in statistical analysis of our offering (Art. 6(1)(f) GDPR); no consent under § 25 TDDDG is required. Data is processed within the EU. More information: plausible.io/data-policy.
Google Analytics 4. With your consent via the cookie banner, we additionally use Google Analytics 4, a web analytics service by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse your use of the website (pages viewed, time on page, origin, device, approximate location). IP addresses are truncated by Google Analytics 4 by default and not stored. The resulting information is transmitted to Google's servers, including in the US; the transfer is safeguarded by Standard Contractual Clauses and Google LLC's certification under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We use Google Consent Mode: no analytics cookies are set without your consent. You can withdraw your consent at any time with future effect by reopening the cookie settings and choosing "Decline". Analytics data is retained for 14 months. More information: policies.google.com/privacy and support.google.com/analytics/answer/6004245.
If you reserve a place in a programme (solo lane, solo lane Start) or commission a service via our website, we process the data required for that: name, company, billing address, email address, phone number, details about your business from the reservation form, chosen payment method, and contract and invoicing data. The legal basis is Art. 6(1)(b) GDPR (formation and performance of a contract).
We pass invoicing data to our accounting software (Pisa-Portal) and to our tax office; the legal basis is Art. 6(1)(c) GDPR (tax and commercial law obligations). We retain contract and invoicing records for ten years (§ 147 German Fiscal Code, § 257 German Commercial Code).
If you book as a consumer, we inform you separately about your right of withdrawal during the reservation process.
For collaboration on consulting engagements, we provide our clients with the equilane Wirkungscockpit – our impact cockpit – at equilanecockpit.netlify.app. Together with the client, it captures the engagement's process inventory, scoring, target picture, process cards, assistants, ground rules, notes and measurements.
Access. Clients get access via a login link (magic link) sent by email, without a password. This processes email address, login time and technical session data. equilane consultants log in with email and password.
Data. In the equilane Wirkungscockpit we process users' name and email address, company details (company, industry, size, occasion), operational and process data, notes and follow-up questions, and – only in the form of role labels, never names – information about the client's employees. Employees' names are captured only for attendance confirmations and proof under Art. 4 EU AI Act, where the client requests this.
Legal basis. Art. 6(1)(b) GDPR (performance of the consulting contract). Where we process data on the client's employees, we act as a processor on the client's behalf under a data processing agreement pursuant to Art. 28 GDPR.
Processors and storage locations. The equilane Wirkungscockpit runs on the Supabase platform (Supabase, Inc., 970 Toa Payoh North #07-04, Singapore); our project's data is stored exclusively in EU data centres (Frankfurt am Main). A data processing agreement with Supabase is in place. Notification emails (e.g. when a client completes an entry) are sent via Supabase under the existing data processing agreement. We keep backups of engagement data in our Supabase project's storage (EU) and in our Google Drive account (Google Ireland Limited; Standard Contractual Clauses, Google Workspace Data Processing Addendum).
Local storage. To safeguard your entries, the equilane Wirkungscockpit keeps a copy in your browser's local storage. This is technically necessary and requires no consent (§ 25(2) TDDDG). The copy is removed on logout or when your browser storage is cleared.
Retention. We store engagement data in the equilane Wirkungscockpit for up to twelve months after the engagement ends and then delete it, unless statutory retention obligations require otherwise. On request, we provide a full export of your data at the end of the contract.
To deliver our services we use the following providers as processors, each under a data processing agreement pursuant to Art. 28 GDPR:
Notion (Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, USA) for engagement and task management; transfer to the US via Standard Contractual Clauses and DPF certification.
Google Workspace / Google Drive (Google Ireland Limited) for file storage and email; Standard Contractual Clauses, DPF.
Canva (Canva Pty Ltd, 110 Kippax Street, Surry Hills, NSW 2010, Australia) for creating documents; Standard Contractual Clauses.
Google Meet (Google Ireland Limited) for online sessions and consulting calls. Sessions in our group programmes are recorded so participants can review them; recording only happens with participants' consent (Art. 6(1)(a) GDPR) and is deleted 90 days after the programme ends.
Pisa-Portal for invoicing (see clause 6).
In our work we use AI-based language models to structure text, produce drafts and condense information. We use Claude (Anthropic, PBC, 548 Market Street, San Francisco, CA 94104, USA) and Langdock (Langdock GmbH, Germany) for this.
Principle: we do not process personal data of our clients or their employees, customers or business partners in AI tools. Information is anonymised before processing – roles instead of names, reference numbers instead of clients. Client data is only entered into an AI tool where this has been contractually agreed with the client and a data processing agreement with the provider is in place.
We have a contract with Anthropic based on its Commercial Terms of Service including a Data Processing Addendum; our inputs are not used to train the models. The transfer to the US is safeguarded by Standard Contractual Clauses. Langdock processes data on servers in the EU. All outputs from AI tools are reviewed by us before they are used in client documents; no decision is made in a fully automated way (Art. 22 GDPR).
As part of consulting engagements, we interview our clients' employees, evaluate time logs and run training sessions. In doing so, we process information about role, activity and workflows; we capture names only for attendance confirmations and proof under Art. 4 EU AI Act. The respective client is the controller for this data; we act as a processor under a data processing agreement. We inform the affected employees separately at the start of an engagement pursuant to Art. 13/14 GDPR. We do not evaluate the performance of individual people; statements from interviews are only shared in anonymised form (role instead of name).
Some of the providers named above (Netlify, Google, Notion, Canva, Anthropic) process data outside the EU, particularly in the US. The transfer is based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, the adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR). Copies of the Standard Contractual Clauses are available on request.
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21 GDPR). You may withdraw any consent given at any time with future effect. To exercise your rights, simply send a message to kontakt@equilaneconsulting.com.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden, Germany, www.datenschutz.sachsen.de.
Unless otherwise stated in this notice, we store personal data only for as long as necessary for the respective purposes, or as required by statutory retention periods. In summary: enquiries without a resulting contract – six months · contract and invoicing data – ten years · Cockpit engagement data – twelve months after the engagement ends · session recordings – 90 days after the programme ends · server log files – 30 days · analytics data – 14 months.
We use technical and organisational measures to protect your data against loss, misuse and unauthorised access: encrypted transmission (TLS), access restrictions on engagement data, two-factor authentication for our accounts, regular backups, and anonymisation of client data before any processing in AI tools.
We update this privacy notice whenever our processing or the legal situation changes. The version published on this page at any given time applies.
Last updated: 4 September 2026.