This page explains how Pan Consulting processes your personal data when you visit our website and its language versions, contact us, purchase a product or service, or use our compliance self-assessments. It also explains your data protection rights.

Personal data means information relating to an identified or identifiable individual. Business information is covered by this notice insofar as it relates to individuals, including named business contacts and sole traders.

01. Controller and contact

The controller responsible for the processing described in this notice is: Pan Consulting (Weiyue Pan)
Druckerstrasse 36B
22117 Hamburg, Germany
Email: info@pan-consulting.com
Telephone: +49 15251375571

Please use these contact details for questions about this notice or to exercise your rights.

02. Legal bases

We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and, where relevant, the German Telecommunications and Digital Services Data Protection Act (TDDDG). The legal basis depends on the purpose of the processing:

· Article 6(1)(b) GDPR: taking steps at your request before entering into a contract with you, or performing that contract.

· Article 6(1)(c) GDPR: complying with legal obligations, including applicable tax and accounting requirements.

· Article 6(1)(f) GDPR: pursuing legitimate interests, including operating a secure website, responding to business enquiries, administering business customer relationships and protecting legal claims, subject to your rights and interests.

· Article 6(1)(a) GDPR: processing based on your consent, where requested for a particular purpose.

Where you act for a company that is our customer, we process your business contact details to manage that relationship on the basis of Article 6(1)(f) GDPR.

03. Website hosting and technical data

Our website is built and hosted using Squarespace. The provider for our German business is Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08N12C, Ireland.

When you access the website, the hosting infrastructure processes technical information such as your IP address, the date and time of access, requested pages, browser and device information, referral information and technical response data. We use this processing to deliver the website, maintain its reliability, detect misuse and address security incidents. The legal basis for these purposes is Article 6(1)(f) GDPR.

Squarespace processes website hosting and security data on our behalf. Its Data Processing Addendum governs deletion of data held on our behalf in line with Squarespace’s retention policy. The Squarespace Privacy Policy describes Squarespace’s own processing and its retention criteria. See section 10 for international transfers.

04. Cookies and similar technologies

On this website, we use cookies and similar technologies only as needed to provide the functions you request. This may include keeping items in your shopping cart, completing checkout and displaying your selected language. See Squarespace’s cookie documentation for information about its shopping cart and checkout technologies.

Storage or access on your device that is strictly necessary to provide a service you expressly request is covered by section 25(2) no. 2 TDDDG. Sections 5 and 7 explain our processing of any associated personal data.

05. Website translation

We use Weglot, provided by Weglot SAS, 7 cité Paradis, 75010 Paris, France, to make our website available in different languages. Weglot processes website content for translation and technical information needed to serve the translated pages, which may include your IP address, requested page and browser language.

Weglot can direct you to a language version based on your browser language or a previously selected language. Where your selection is saved on your device, it is used to display the language version you requested. We process the technical data needed to deliver translated pages based on our legitimate interest in providing a multilingual website under Article 6(1)(f) GDPR.

See the Weglot Privacy Policy and Weglot’s documentation on cookies and data processing for more information.

06. Enquiries and consultancy services

When you contact us by email, telephone or a website form, we process the details you provide, such as your name, organisation, role, contact details and message. We use them to respond, clarify your request and provide agreed services. Where relevant, business contact information may also be provided by your employer or another representative of the customer organisation.

The basis is Article 6(1)(b) GDPR where your request concerns a contract with you, or Article 6(1)(f) GDPR for other enquiries and business relationship management. Article 6(1)(c) GDPR applies to records we must retain by law.

We use Google Workspace, provided by Google Cloud EMEA Limited in Ireland, to host our business email. Google processes email messages and attachments on our behalf. See section 10 for international transfers and the Google Cloud Data Processing Addendum for further information on Google’s processing.

Please contact us to agree on a secure communication channel before sending particularly sensitive information by email.

Where we process personal data solely on a business customer’s instructions, the customer remains responsible as controller and the relevant processing agreement defines our role. That customer may provide additional privacy information.

07. Purchases and access administration

We process customer and contact details, billing details, the selected product, order number, confirmation code, payment reference and payment status as needed to administer your order. We use these details to verify payment, issue invitations for purchased access, provide purchased materials, handle enquiries and keep required records. Customers complete the self-assessment on Jotform as described in section 8.

We use Squarespace Payments through Squarespace Ireland Limited. Stripe or its relevant affiliates process payments for the service. Payment providers may act as separate controllers for their own purposes, such as fraud prevention and compliance with legal obligations. See the Squarespace Privacy Policy and the Stripe Privacy Policy for more information about their processing.

The legal bases are Article 6(1)(b) GDPR for a contract with you, Article 6(1)(f) GDPR for administering purchases made by a business you represent and protecting against misuse, and Article 6(1)(c) GDPR for statutory records.

08. Compliance self-assessments and reports

We use Jotform to host our compliance risk self-assessments, collect submissions and generate reports. For purchased assessments, we handle the order on our website and send an invitation to the assessment on Jotform. Jotform processes assessment submissions on our behalf. See section 10 and the Jotform Data Processing Addendum for information on transfers and safeguards.

The relevant legal bases are Article 6(1)(b) GDPR where the service is provided under a contract with you, or Article 6(1)(f) GDPR where you use it for a business customer. The latter interest is providing and administering the requested business assessment. Technical security and misuse prevention are based on Article 6(1)(f) GDPR.

The assessment concerns business compliance gaps. Pan Consulting does not use its scores to make solely automated decisions about individuals that produce legal or similarly significant effects within Article 22 GDPR.

Please provide only information needed for the assessment. Avoid entering identifiable information about employees, customers or other third parties, or special categories of personal data such as health information, unless specifically requested through an appropriate process.

To use an invitation, register for or sign in to a Jotform account separately. Jotform explains its processing of registration and sign-in data in the Jotform Privacy Policy. Pan Consulting handles enquiries and privacy requests about the use of your assessment submissions and results.

Completing an assessment or receiving its results does not, by itself, amount to consent to receive separate marketing emails. Any such marketing requires its own applicable legal basis and, where required, separate consent.

09. Recipients and access

Personal data are accessible to authorised persons who need them for the purposes described above. Relevant recipients include our website and form providers, email and IT providers, the payment providers you use, and professional advisers where necessary. Authorities may receive information where disclosure is legally required.

10. Processing outside the EEA

Our service providers and their subprocessors may process or access personal data outside the European Economic Area (EEA). The safeguards below depend on the service, the recipient and the location of the processing.

Squarespace hosting and checkout. For transfers to Squarespace, Inc. in the United States covered by its certification, Squarespace relies on the European Commission’s adequacy decision under the EU–U.S. Data Privacy Framework (DPF). Its Data Processing Addendum provides for the European Commission’s Standard Contractual Clauses (SCCs) where required.

Google Workspace. Transfers of email-related personal data to Google LLC in the United States that are covered by its certification rely on the DPF adequacy decision. For other restricted transfers that require Article 46 safeguards, the Google Cloud Data Processing Addendum provides for applicable SCCs.

Stripe. Stripe states that it relies on the DPF for covered transfers to Stripe, LLC in the United States. Its privacy information describes its other transfer mechanisms, including SCCs where applicable.

Jotform. Jotform’s published data processing terms identify Jotform Ltd in the United Kingdom for EU customers. Transfers to the United Kingdom are covered by the European Commission’s adequacy decision for the United Kingdom. For transfers to Jotform Inc. in the United States, the Jotform Data Processing Addendum describes the DPF for covered transfers and the applicable SCCs for restricted transfers where required.

Weglot. Weglot states that it uses the DPF or SCCs, as applicable, for transfers of personal data to its U.S. subprocessors. See Weglot’s transfer information.

You may contact us for information about the safeguards relevant to your data and how to obtain a copy of the applicable SCCs.

11. Retention and deletion

We retain personal data for the period needed for the purpose for which they were collected, subject to applicable legal retention duties and the need to establish, exercise or defend legal claims. Where continued retention is necessary for a limited purpose, access and use are restricted accordingly.

We normally remove assessment responses, calculated results and PDF reports from active use 90 days after sending the result or report. If we do not deliver a result, the period starts when we close the case. The same 90-day period applies to working copies we hold in our mailbox or other storage. Submissions moved to the Jotform Trash may remain recoverable for up to 30 additional days.

If an outstanding request for re-delivery, a scoring review or a delivery dispute requires further retention, we keep only the records needed to resolve it. We delete them when the matter is resolved or one year after the original starting date, whichever comes first. This limit includes recoverable copies in the Jotform Trash. We retain specific records for longer where required by law or necessary to establish, exercise or defend legal claims.

We keep the order and delivery information needed for customer support for six months after delivery, expiry of an unused invitation or completion of a refund, as applicable. The access period for a purchased assessment invitation is 30 days from issue.

We retain enquiries that do not lead to an engagement for six months after the enquiry and any necessary follow-up have concluded. Where we need a record to handle an ongoing complaint or dispute, or to meet a legal obligation, we retain the relevant record for that purpose for as long as necessary.

We generally retain invoices for eight years from the end of the calendar year in which they were issued under section 14b UStG. Accounting vouchers and other tax records are kept for the applicable statutory periods under section 147 AO.

12. Data security and required information

Our website uses HTTPS. We apply technical and organisational measures appropriate to the risks of the processing, including controls over access to personal data. No transmission or storage system can guarantee absolute security.

Information marked as required in a form or checkout is needed to handle the relevant request or provide the service. If it is not provided, we may be unable to respond or fulfil the order. Optional fields can be left blank. Technical data necessary to deliver the website are processed when it is accessed.

13. Your rights

Subject to the applicable legal conditions, you have the right to access your personal data, have inaccurate data corrected, request erasure or restriction of processing, and receive or transmit data covered by the right to data portability under Articles 15 to 20 GDPR.

Where processing is based on consent, you may withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it.

Your right to object

Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may object at any time to processing for direct marketing, including related profiling, without having to give reasons.

To exercise your rights, contact info@pan-consulting.com. We may request information reasonably necessary to verify your identity. We normally respond within one month; any extension is governed by Article 12 GDPR.

Complaints

You may lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the alleged infringement. For our establishment in Hamburg, the relevant authority is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22
20459 Hamburg
Germany
Contact and complaints

14. Changes to this notice

We update this notice when our processing activities or applicable requirements change. The date below identifies the most recent revision. Where the law requires additional information or consent for a new purpose, we will provide or obtain it separately.

Last revised November 2026