Privacy Notice

1. Controller and Scope

The controller within the meaning of the General Data Protection Regulation (“GDPR”) is:

Maximilian O. Sutter
Harbatshofen 10 ½
88167 Stiefenhofen
Germany
Email: impressum@maxsutter.de

This notice explains how I process personal data when you visit maxsutter.de, make an enquiry, enter into a contract, or take part in executive or leadership coaching, team coaching, interviews, workshops, offsites, facilitation, organisational development, or comparable advisory and development formats. It applies in particular to prospective clients, clients, coachees, participants, client contacts and sponsors.

This notice describes my general practice across client engagements. Where an engagement has a lawful, specifically agreed arrangement that differs from this notice, I explain the applicable processing to affected individuals before it begins and obtain any additional consent required. An agreement with a commissioning organisation does not by itself authorise disclosure of confidential individual coaching content or override data-protection rights.

2. Data Categories, Sources and Data-Protection Roles

Depending on the contact or engagement, I process in particular:

• identity and contact data such as your name, email address and postal address;
• professional and organisational information such as your employer, position, function, team membership and professional context;
• contract, billing, payment and tax data;
• scheduling, communication and participation data;
• content communicated or developed in coaching, interviews, team formats, workshops or offsites, including my session and working notes, agreed actions and approved outputs;
• audio and transcript data only where recording or automated transcription has first been authorised;
• technical and usage data generated when the website or communication, documentation or transcription services are used.

I receive data mainly from the individual concerned. In corporate engagements, names, business contact details, roles, team membership, scheduling information and information about the organisational context may also come from the commissioning organisation, a sponsor, an employer or another project participant. For participant and contact information supplied by a commissioning organisation, the information duties under Article 14 GDPR apply, generally within one month and earlier at the first communication or disclosure. A conversation may also contain incidental information about colleagues or other people. I limit such information to what is needed and avoid names and identifying details where unnecessary. I assess and document individually whether an Article 14 exception applies to a particular third party; coaching confidentiality alone is not a blanket exemption. Where no exception applies, I fulfil the applicable information duties. The commissioning organisation remains responsible for the lawfulness and transparency of its own disclosure.

As a freelance executive coach, I determine the content of individual coaching together with the coachee, independently of the sponsor. I am the controller for this confidential coaching. In corporate engagements, the commissioning organisation and I are generally separate controllers for our respective processing. Roles in a specific project follow the actual allocation of decisions and responsibilities, not a classification in a procurement system. Where I process data solely on the client’s documented instructions in a specific project, an agreement under Article 28 GDPR will be entered into before processing begins. Joint controllership will be regulated separately where required.

3. Purposes and Legal Bases

I process personal data for the following purposes and on the following legal bases:

• enquiries, steps before entering into a contract, contract formation and performance of a contract with the person concerned: Article 6(1)(b) GDPR;
• organisation and professional delivery of corporate engagements for coachees and participants who are not themselves contractual parties, project communication, confidential documentation and continuity of the services: Article 6(1)(f) GDPR;
• creation, organisation and revision of ordinary prepared working notes and preparation and follow-up, excluding the consent-based processing described below: Article 6(1)(b) or (f) GDPR;
• voluntary audio capture, automated transcription, AI-assisted conversation notes in Granola and optional retention of raw transcripts for the agreed coaching purpose: Article 6(1)(a) GDPR;
• compliance with statutory retention, tax and documentation duties: Article 6(1)(c) GDPR;
• establishment, exercise or defence of legal claims: Article 6(1)(f) GDPR.

My legitimate interests are reliable and consistently high-quality service delivery, secure project organisation and IT use, confidential documentation, and the establishment and defence of legal claims. In balancing interests, I take particular account of the individual’s confidentiality expectations, the sensitivity of the format, data minimisation, limited retention periods and human oversight. Special categories of personal data are additionally subject to section 11.

4. Website Hosting, Cookies and Local Browser Storage

This static website is provided through GitHub Pages, a service provided by GitHub. GitHub documents that when a GitHub Pages website is visited, the visitor’s IP address is logged and stored for security purposes, whether or not the visitor is signed in to GitHub.

Purpose and legal basis: I use this hosting service on the basis of Article 6(1)(f) GDPR. My legitimate interest is the secure, stable and efficient provision of the website and the detection and prevention of misuse.

International processing and retention: GitHub’s general privacy statement describes possible processing in the United States and other countries and the transfer mechanisms used. The GitHub Pages documentation does not specify a fixed retention period for IP logging. The provider’s current information applies in this respect.

I do not use cookies or tracking technologies on this website. The selected language is stored in localStorage until you change the setting or delete your browser data. Dismissal of the language suggestion is stored in sessionStorage until the browser session ends. These values remain in your browser and are not transmitted to me or any third party. Storage and access are permitted under section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), because they are necessary for the language function you expressly request; where personal data is involved, Article 6(1)(f) GDPR additionally applies.

Further information: GitHub Pages – Data collection and the GitHub General Privacy Statement.

5. Contact Form and Formcarry

I use Formcarry, a service provided by Teijal, Inc. d/b/a Formcarry (“Formcarry”), for the contact form. Formcarry processes the submitted information on my behalf, filters spam and forwards the enquiry to me by email.

Data processed: Name, email address, role and organisation, the reason for your enquiry and desired changes, optional information about the referral source and readiness to start, the form’s language and page address, and technically necessary connection data such as the IP address.

Purpose and legal basis: I process the data to answer your enquiry and, where applicable, take steps before entering into a contract under Article 6(1)(b) GDPR. If the person making the enquiry is not the potential contractual party, processing is based on Article 6(1)(f) GDPR; my interest is the efficient handling of business enquiries and protection of the form against misuse.

Recipients and international transfers: Formcarry acts as a processor. According to the provider, form data is stored in Frankfurt; remote access from the United States and US-based subprocessors may be involved and are covered by Standard Contractual Clauses or other safeguards identified by the provider.

Retention: Persistent storage of incoming messages in the Formcarry database is disabled. If no contract is entered into, I generally delete the enquiry received by me no later than twelve months after correspondence ends, unless a statutory duty or specific evidentiary interest requires longer retention.

Please do not submit health information or other particularly sensitive information through the contact form. Further information: Formcarry Data Processing Agreement and Formcarry Privacy Policy.

6. Coaching, Team and Corporate Engagements

To prepare, deliver and follow up on the services, I process the necessary contact, organisational, scheduling and communication data and the content communicated or developed in the relevant format. I may create my own written session and working notes. They support professional continuity, preparation and follow-up, agreed documentation and, to a limited extent, legitimate evidentiary needs.

For individual coaching, the coachee and I determine the content and agenda together. The commissioning organisation receives only scheduling and billing information. I do not report conversation content, individual progress or assessments to managers, HR or the sponsor. Transcripts and individual coaching notes are not part of the sponsor's reporting. For separately agreed team formats, any intended shared outputs and recipients are specified in advance; this does not authorise disclosure of individual coaching content.

Coaching notes are not personnel or performance appraisals and are not created or used by me for decisions about recruitment, promotion, remuneration, performance or termination of employment. Co-facilitators and assistants who are required for an engagement receive data only on a need-to-know basis and are bound to confidentiality.

7. Recording and Transcription with Granola

I use Granola, provided by Granola, Inc. and Granola Labs Ltd., for automated transcription and AI-assisted notes of conversations for which consent has been given. Granola is the only AI service I directly use to process coaching conversations. It may use its own contracted cloud, transcription and AI subprocessors.

Granola captures microphone and system audio. Before capture begins, I inform every participant about transcription, AI-assisted notes, the providers involved, international processing and the retention described below, obtain their explicit agreement and retain evidence of that consent. This notice itself does not constitute consent. Consent is voluntary and may be withdrawn at any time, including during a session. Without consent, or after withdrawal, transcription stops and coaching can continue with manual notes without disadvantage. Consent to transcription does not automatically authorise any additional use or disclosure.

Legal basis: Article 6(1)(a) GDPR and, where special categories of personal data are processed, additionally Article 9(2)(a) GDPR.

Processing and transfers: According to Granola, audio is held temporarily for transcription and deleted afterwards, including by its transcription providers. Transcripts and notes are stored on AWS in the United States. I have accepted Granola's data processing addendum, which provides for Standard Contractual Clauses for relevant international transfers. Granola acts as a processor for customer content and uses subprocessors. It also acts as a separate controller for certain account, system, security and compliance data under its own terms.

Subprocessors: At the revision date, Granola’s official list includes Amazon Web Services for infrastructure, storage and compute; Anthropic, OpenAI, Google Cloud and xAI for AI processing; AssemblyAI and Deepgram for transcription; and Braintrust for evaluating AI performance. The list identifies US hosting for these providers. Their inclusion does not mean that every conversation is sent to every provider. This is Granola’s subprocessing, not my direct use of these AI services. The linked list contains the current providers, purposes and locations.

Model improvement using data from my Granola account is disabled. Granola states that its external AI and transcription providers are prohibited from using the submitted data to train their own models. The deletion of Granola copies and the retention of local text copies are separate steps, as explained in sections 8 and 12.

Further information: Granola Security and Privacy FAQs, Granola Data Processing Addendum, Granola Subprocessors and Granola Privacy Policy.

8. Local Transcripts and Working Documentation

I export raw transcripts as text files to my local computer. Deleting a transcript from Granola does not delete this local copy. Local retention is optional and supports continuity of the active coaching relationship only where access to the relevant original wording or context remains necessary. Before retaining local transcripts, I obtain informed consent covering this purpose and the retention criteria below. Consent can be withdrawn independently of continuing the coaching.

Granola prepares AI-assisted summaries and notes; these can contain errors. I remain responsible for checking them before use. Prepared notes are stored in a Google document shared with the coachee as described in section 9. Raw transcripts are not routinely placed in that shared document.

Legal basis: Optional transcription, AI-assisted conversation processing and local raw-transcript retention rely on Article 6(1)(a) GDPR. Ordinary prepared working notes needed to provide the service rely on Article 6(1)(b) where the individual is a contractual party, or Article 6(1)(f) for the confidential delivery and continuity of employer-funded coaching. Special-category data requires the additional basis described in section 11.

9. Google Workspace and Shared Session Notes

I use a business Google Workspace account, in particular Gmail, Google Calendar, Google Drive and Google Docs, for communication, scheduling, and creating, storing and sharing prepared session notes. Google processes the customer data contained there as a processor under the Google Cloud Data Processing Addendum, which I have accepted. Internal raw and working notes are not shared as such.

Prepared notes are shared with the coachee for our joint work. I limit access to the intended recipient and end access when it is no longer needed. I use restricted, authenticated access for confidential coaching documents, rather than links accessible to anyone who receives them. I ask recipients not to forward documents or grant access to others.

The shared document is a joint working and progress document for the coachee and me. I do not give managers, HR or the commissioning organisation access to individual coaching notes or progress assessments. Separately agreed team outputs are subject to section 6.

Purpose and legal basis: Communication, scheduling, service delivery and access to agreed notes are based on Article 6(1)(b) or (f) GDPR. Google may process customer data worldwide. Its data processing agreement provides in particular for adequacy decisions and the EU Standard Contractual Clauses for transfers outside the EEA. Under the terms for Google Workspace, customer data is not used to train or fine-tune generative AI models without permission.

Further information: the Google Cloud Data Processing Addendum, Google - International Data Transfer Frameworks and Google Workspace Subprocessors.

10. Other Recipients and International Transfers

I disclose personal data only to recipients that need it for the relevant purpose. In addition to the providers identified above, this may include co-facilitators and other assistants bound to confidentiality, lawyers or tax advisers subject to professional confidentiality, insurers, and public authorities or courts where a statutory duty or binding order applies. Clients or sponsors receive data only within the limits described in section 6. Personal data is not sold or disclosed for third-party advertising.

GitHub, Formcarry, Google Workspace, Granola and their relevant subprocessors may process data in the United States or other countries outside the European Economic Area. Depending on the provider and processing, transfers rely on an applicable adequacy decision or Standard Contractual Clauses and any necessary supplementary safeguards. The linked provider information identifies the applicable arrangements. A copy of the relevant safeguards or information on how to obtain it is available on request using my contact details. Countries outside the EEA may provide a different level of data protection.

11. Special Categories of Personal Data and Consent

Information concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used for unique identification, health, or a person’s sex life or sexual orientation is not actively requested. Such information may nevertheless be disclosed voluntarily in a confidential coaching conversation.

I include special-category data in lasting notes or process it further only if necessary for the agreed purpose and covered by an exception under Article 9(2) GDPR. For ordinary coaching purposes, I obtain the individual's explicit consent under Article 9(2)(a); merely volunteering information does not itself establish that consent. Where data is required solely for the establishment, exercise or defence of legal claims, Article 9(2)(f) GDPR may apply. Sensitive detail that is not needed is not documented or is removed as early as possible.

If sensitive information is to be captured or processed through Granola, I obtain explicit consent covering that processing before the information is transmitted. Deleting sensitive text afterwards does not undo its earlier transmission. Where the necessary basis is absent, I pause transcription or omit that information. A participant's consent does not cover personal data of other individuals mentioned in a conversation. I avoid unnecessary third-party details. If sensitive information is unexpectedly captured, I stop or pause transcription as soon as I recognise the issue, promptly review the affected content and delete it from active copies unless a valid basis permits the necessary processing. This remedial deletion does not retrospectively authorise the original capture. A participant cannot consent on behalf of an identifiable colleague or other third party merely by mentioning them. Consent does not remove the requirements of necessity, data minimisation or any other applicable legal conditions. This notice is information, not a substitute for the required consent.

Consent may be withdrawn at any time with future effect. This does not affect the lawfulness of processing before withdrawal. Data processed solely on the basis of the withdrawn consent is generally deleted without undue delay unless another legal basis permits or requires continued processing. I do not subject anyone to adverse consequences for declining or withdrawing consent to recording, transcription or cloud AI processing of personal data; an alternative without the relevant processing will be used where required.

12. Retention and Deletion

Retention depends on a defined purpose and continuing necessity, not on using the longest conceivable period. There is no general statutory retention period for raw executive-coaching transcripts. The following rules apply to the copies under my control:

Lawful engagement-specific agreements may provide for shorter retention or additional deletion obligations, which I follow subject to applicable legal duties. Any longer retention requires a separately lawful, necessary purpose and transparent information; a contract alone does not justify it. Return or deletion arrangements do not authorise disclosure of confidential individual coaching records to a sponsor.

• Audio: Granola states that temporary audio is deleted after transcription; it does not retain an audio archive.
• Granola copies: Raw transcripts are deleted from Granola once the local export has been checked and they are no longer needed there for preparing the agreed notes. Granola notes and temporary AI drafts are deleted when they are no longer needed for preparation or follow-up. Granola is not used as a permanent archive; provider copies still needed during coaching are deleted no later than the end of the active relationship, subject only to the narrow exceptions below.
• Local raw transcripts: With informed consent covering local retention, I may keep necessary text transcripts during the active coaching relationship to revisit relevant wording, context and agreed topics across sessions. This is not automatic retention of every complete transcript for the whole relationship. I review necessity when preparing later sessions and at least every three months; if final notes suffice, the raw transcript or unnecessary parts are deleted earlier. Remaining raw transcripts are deleted without undue delay when the active coaching relationship ends. A merely possible future return is not a reason to retain them.

An active coaching relationship ends when it is terminated or completed, or when further sessions or follow-up are no longer concretely planned or needed. At the three-month review, a pause is not treated as an indefinite extension: retention continues only if there is a specific agreed continuation and a documented need for the retained information.

• Prepared notes and shared Google documents: These are kept during the engagement as needed for the agreed joint work. Afterwards, only necessary documentation is retained for a specific continuing purpose, including proportionate evidence of service delivery or defence of claims. The ordinary outer limit is 31 December of the third calendar year following the end of the engagement; unnecessary content is deleted earlier and sharing ends when no longer needed. This is my chosen retention limit with a necessity review, not a statutory duty to preserve intimate coaching notes. Raw transcripts are subject to the shorter rule above.
• Enquiries that do not result in a contract are generally deleted no later than twelve months after correspondence ends.
• Business and commercial correspondence is retained for six years where legally required, accounting records and invoices for eight years, and books, financial statements and comparable tax records for ten years. These periods apply only to the records covered by the relevant legal duty, not to coaching conversations or transcripts.
• Specific legal exception: Only information demonstrably necessary for a concrete legal dispute, specifically anticipated claim or applicable legal duty may be retained beyond the ordinary rule, on a separately valid legal basis. Sensitive data additionally requires an Article 9 exception, such as Article 9(2)(f) where applicable. Retention is limited to relevant extracts where sufficient, restricted to that purpose and reviewed until the reason ends; it does not justify keeping every full transcript.

Withdrawal of consent ends the processing that depends on it. The affected raw transcripts and consent-only copies are deleted without undue delay unless a separately applicable legal obligation or concrete claims-related basis requires limited retention. I do not automatically switch to legitimate interests to retain previously consent-based raw transcripts. Withdrawal does not affect earlier lawful processing. Provider-side final erasure follows the applicable contractual deletion and backup cycles; deletion from an account and final erasure from all provider backups are not necessarily simultaneous. Google's DPA provides for deletion within 180 days after customer data becomes non-recoverable in the service. At the end of the contract with Google, an additional recovery period of up to 30 days may precede that period, subject to legal storage duties and the DPA’s exception for data also covered by another continuing agreement.

The rules apply to active local files and provider copies under my control. Any residual backup copies remain protected until their ordinary overwrite cycle and are not reused for coaching; deletion instructions also apply if a backup is restored. Copies independently made by a recipient are outside my control, and that recipient is responsible for their own subsequent use.

13. Required Data and No Automated Decisions

Data required for enquiries, scheduling, performance or billing must be provided; otherwise I may be unable to handle the enquiry or provide the service. Audio capture, automated transcription and cloud AI processing of personal data are not requirements for participation.

I do not make decisions based solely on automated processing within the meaning of Article 22 GDPR and do not carry out profiling. AI systems support only the creation and organisation of working material. I review AI output before using it in any substantive assessment or project output and remain responsible for those results. AI output, coaching notes and transcripts are not used for automated personnel, performance or employment decisions.

14. Your Data Protection Rights

Subject to the statutory conditions, you have the right of access under Article 15 GDPR, rectification under Article 16 GDPR, erasure under Article 17 GDPR, restriction of processing under Article 18 GDPR and data portability under Article 20 GDPR.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. I will then no longer process the relevant data unless I demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

You may withdraw consent at any time with future effect. Requests are generally answered within one month. Where a request is particularly complex or numerous requests are received, this period may be extended by up to two further months where the statutory conditions are met.

You also have the right to lodge a complaint with a data-protection supervisory authority. The supervisory authority generally responsible for supervising my processing is the Bavarian Data Protection Authority for the Private Sector (BayLDA), Promenade 18, 91522 Ansbach, Germany. You may also contact another competent supervisory authority.

15. Data Security

I use technical and organisational measures appropriate to the risk, including access restrictions, secured accounts, encrypted transmission channels and data minimisation.

Local transcripts are kept on my computer, separately from the prepared notes shared through Google Docs. Access to raw transcripts is limited to the confidential coaching purpose. I protect local files and backups with encryption, secure provider accounts with multi-factor authentication, and restrict and review access permissions for shared documents. These controls cover storage, transmission and recovery from backups.

Cloud processing is also protected by the providers’ contractual and technical safeguards. Despite appropriate measures, absolute protection cannot be guaranteed for electronic transmission or storage.

16. Changes and Contact

I update this notice when processing arrangements, services or legal requirements change. This version describes the current coaching workflow and retention rules. For material changes, I also inform people already affected directly; publication on this website alone does not replace that information. Before a different use begins, I provide the necessary information and obtain any additional consent required. This notice does not replace the actual consent and deletion processes or data processing agreements and is not a legal compliance certificate.

For questions or to exercise your rights, contact impressum@maxsutter.de or use the postal address in section 1.