Privacy Notice

The protection of your personal data is of great importance to Inverto. This privacy notice informs you about what personal data we collect, how we use it and what rights you have in respect of your data. It applies to all users of our website and our online services. (Last Update: May 2025)

1. Controller and Contact Details

Controller within the meaning of GDPR is:

Inverto GmbH
Lichtstraße 43i
50825 Cologne
Telephone: +49 221 485 687 0
Fax: + 49 221 485 687 140
E-mail: contact@inverto.com
https://www.inverto.com/

Inverto has appointed an external data protection officer. You can contact them at:

Potsdamer Straße 3
80802 Munich
Germany
Phone: +49 89 919294-900
E-Mail: inverto@activemind.de

2. Collection and Processing of Personal Data

When visiting our website, we process the following personal data about you for the following purposes:

2.1 Automatic Data Collection when Visiting the Website

When accessing our website, we collect your IP address (anonymised where technically possible), date and time of website access, referrer URL, name and URL of the file accessed, browser type and version and operating system.

This data is collected to ensure the proper operation of our website and to analyse errors and optimise our online offering.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the provision and optimisation of our website).

2.2 Data Processing through Cookies

We use cookies for certain offers. These are small text files that are stored on your computer. We use cookies to facilitate the use of our website and to improve our services.

You can find more information about the cookies we use, as well as your option to adjust individual cookie settings, in our Cookie Notice.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent, if required for the use of optional cookies).

2.3 Data from Contact Forms or Direct Enquiries

When you contact us via a form on our website or directly, we store the data you provide (e.g. name, email address, telephone number) to process your enquiry.

Legal basis: Art. 6 para. 1 lit. b GDPR (fulfilment of contract or pre-contractual measures).

2.4 Newsletter / Magazine

If you subscribe to our newsletter or our whitepapers and magazine content, we will use your e-mail address to inform you about news. You may revoke your consent at any time.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent).

3. Disclosure of Personal Data

We only disclose your data if:

you have expressly consented (Art. 6 para. 1 lit. a GDPR);
the disclosure is necessary for the fulfilment of the contract (Art. 6 para. 1 lit. b GDPR);
we are legally obliged to do so (Art. 6 para. 1 lit. c GDPR);
there are legitimate interests on our part or on the part of third parties (Art. 6 para. 1 lit. f GDPR).

Recipients of your personal data may be

External service providers (e.g. IT service providers, hosting providers, analysis tools such as Google Analytics)
Authorities within the scope of legal obligations
Third country recipients: If personal data is processed outside the EEA, an adequate level of data protection is ensured by concluding the EU standard contractual clauses, in the currently valid version, or other suitable guarantees within the meaning of Art. 44 et seq. GDPR.

4. External Service Providers

If external service providers come into contact with your personal data, this generally takes place within the framework of data processing. This is expressly provided for by law (Art. 28 GDPR). Inverto remains responsible for the protection of your personal data even in these cases. The service provider is contractually obliged to process all personal data exclusively in accordance with our instructions, which we ensure through strict contractual regulations, technical and organisational measures and additional controls. If there is no data processing on our behalf, we conclude appropriate contracts with our service providers to ensure that they comply with their obligations under data protection law.

4.1 Hubspot

We work with the external service provider HubSpot to record and analyse the activities on our website. HubSpot also supports us in the administration of our customer relationship management (CRM).

The service uses optional cookies, the use of which you consent to and can revoke at any time. Further information on these cookies can be found in the cookie banner or in our general cookie notice. HubSpot works exclusively in accordance with instructions as a processor within the meaning of Art. 28 GDPR. Further information on data protection at HubSpot can be found at: https://legal.hubspot.com/privacy-policy.

4.2 Surveys, Studies and e-map

We use external service providers at various points on our website to conduct surveys and studies. In the following, we would like to briefly introduce you to the service providers we use and the purposes for which your data is processed:

We use the services of SurveyMonkey (SurveyMonkey Europe UC, 2 Shelbourne Buildings, Second Floor, Shelbourne Rd, Ballsbridge, Dublin 4, D04 Y4A4, Ireland) to embed surveys on our website. The results of these surveys are then published, for example, as a white paper. SurveyMonkey acts as our processor in accordance with our instructions (Art. 28 GDPR). In the event of a third country transfer, the EU standard contractual clauses apply. SurveyMonkey loads Google Fonts via so-called iFrames, over which Inverto has no influence. By participating in a survey, you consent to the use of this service. The types of data processed include your contact information, such as name, e-mail or telephone number. This information is voluntary, and you can also complete the survey anonymously. Subject to your consent, you will be informed about the survey results and other new publications. You may revoke this consent at any time.

We use the services of Microsoft Forms (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA) to operate our e-map tool. The types of data processed include your contact information, such as name, e-mail or telephone number, as well as information about your company. If you subsequently wish to be informed about your benchmarks and other services and news from Inverto, you can voluntarily give your consent to this. You may revoke this consent at any time.

4.3 Online Meetings, Telephone and Video Conferences and Webinars

We use platforms and applications from external providers to conduct video and audio conferences, webinars and other forms of online meetings (hereinafter collectively referred to as “Online Meetings”). In doing so, we ensure that the selection of providers and their services comply with the applicable data protection requirements.

Providers currently used by us:

Zoom (Zoom Video Communications, Inc., 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA)
Microsoft Teams (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA)

The providers act on our behalf on the basis of a data processing agreement in accordance with Art. 28 GDPR. The EU standard contractual clauses have also been agreed to safeguard your personal data.

For more information on data protection at the providers, please visit

Zoom: https://zoom.us/docs/de-de/privacy-and-legal.html
Microsoft Teams: https://privacy.microsoft.com/de-de/privacystatement

Important note: If you access the websites of Zoom or Microsoft Teams, these providers are responsible for data processing. However, access to these websites is only necessary to download the software or use the browser version.

Recording of Online Meetings

In individual cases, Online Meetings may be recorded, for example to make the recording available to participants afterwards or to publish it via our online presences. Recordings will only be made:

After explicitly informing all participants before the start of the meeting;
With the option for participants to control their recognisability on the recording (visually or acoustically) through settings.

A red symbol indicates that a recording is in progress during the meeting. No recording is made by default.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. f GDPR (legitimate interest in documentation and follow-up)

Types of Data Processed

To participate in Online Meetings, you must provide at least your name. You also have the option of participating in our Online Meetings under a pseudonym. You can deactivate and/or customise microphone and camera transmissions at any time.

Personal Data that may be Processed

User data: First name, surname, display name, email address, telephone number, password (if single sign-on is not used), preferred language, optional: profile picture and department
Meeting metadata: Meeting topic and description, meeting ID, date, time, IP addresses, device and hardware information, phone numbers, duration of chat and channel messages, time for audio, video and screen sharing
Telephone dialling: Incoming and outgoing phone number, country name, start and end time
Text, audio and video data: Input via chat, question or survey functions as well as transmissions via microphone and camera. These can be logged during the meeting
Recording data (optional): MP4 files (video, audio, presentation), M4A files (audio), text files of the meeting chat

Beyond this, we do not pass on any data to third parties unless you have expressly consented or this is required by law.

4.4 Use of Google Analytics

Our website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). Google Analytics assigns you a user ID in order to analyse your use of the website. The data collected is generally transmitted to Google servers in the USA in anonymised form and stored there.

Important Features

Anonymisation of the IP address: Your IP address is anonymised before being transferred to the US, within the EU or EEA, so that a direct personal reference is excluded

Google Signals: This function enables cross-device tracking for personalised advertising, provided you are logged into your Google account

User ID: By assigning pseudonymous IDs, we can create cross-device usage profiles

Processed Data

Technical information: Operating system, browser type, IP address (anonymised), referrer URL

Usage behaviour: Duration of visit, pages visited, interactions

Legal basis: Art. 6 para. 1 lit. a GDPR (consent). You may revoke this consent at any time by adjusting your cookie settings.

Profiling and automated decision-making: Usage profiles may be created as part of the use of Google Analytics and Google Signals. These profiles are used to better understand your usage behaviour, to optimise our offer and to provide you with personalised content or advertising.

However, no automated decision-making pursuant to Art. 22 GDPR takes place that would have legal or similar significant effects on you. All measures based on such analyses are either anonymised or pseudonymised so that there is no direct traceability to you personally.

Third Country Transfer

Google also processes data in the United States. To ensure an adequate level of data protection, we have concluded standard contractual clauses with Google. You can find more information here: https://business.safety.google/adscontrollerterms/sccs/.

Retention Period

The data is automatically deleted after 14 months. Aggregated data may be stored for longer.

Opt-out Options

You may object to the collection of data by installing the browser add-on to deactivate Google Analytics.
Alternatively, you can deactivate the collection of data by Google Analytics by adjusting the cookie settings on our website.

5. Data Control for the Social Media Plugins used

Our website contains buttons from social media networks that you can use to access our company profiles on the social networks in order to follow us there and network with our contacts.

To ensure that you have full data control, the buttons used only establish direct contact between the respective social network and the website visitor when you actively click on the button ( One-Click solution).

By activating the social media plugin, the following data can be transmitted to the social media providers: IP address, browser information, operating system, screen resolution, installed browser plug-ins such as Adobe Flash Player, origin of the visitor if you have followed a link (referrer) URL of the current website.

The next time you visit the website, the social media plugins are provided again in the default inactive mode, so that when you visit the website again, it is ensured that no data is transmitted.

6. Retention Period

We only store your data for as long as is necessary to fulfil the respective purposes or as required by law.

7. Your Rights

As a data subject, you have the following rights under GDPR:

Right of access (Art. 15 GDPR): You can request access to information about whether your personal data is being processed by Inverto.
Right to rectification (Art. 16 GDPR): You can request the correction of incorrect data.
Right to erasure (Art. 17 GDPR): You can request the erasure of your data, provided there are no statutory retention obligations.
Right to restriction of processing (Art. 18 GDPR): You can request the restriction of the processing of your data.
Right to data portability (Art. 20 GDPR): You have the right to receive your data in a commonly used, machine-readable format.
Right to object (Art. 21 GDPR): You may object to the processing of your data on grounds relating to your particular situation. Further information on your right to object can be found in section 8.

You also have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for Inverto is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Dusseldorf
Germany
Phone: +49 211 384 24-0
Fax: +49 211 384 24-10
E-Mail: poststelle@ldi.nrw.de
Website: http://www.ldi.nrw.de

Further information on your rights as a data subject can be obtained from our data protection officer (inverto@activemind.de).

8. Information on your Right to Object pursuant to Article 21 GDPR

Individual Right to Object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 para. 1 lit. f GDPR (data processing on the basis of legitimate interests); this also applies to profiling based on this provision within the meaning of Article 4 no. 4 GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Recipient of the Objection

The objection can be made informally with the subject ‘Objection’ stating your name and should be addressed to:

Inverto GmbH
Lichtstraße 43i
50825 Cologne
Germany
E-Mail: contact@inverto.com
External Data Protection Officer: inverto@activemind.de

9. Changes to this Privacy Notice

Inverto reserves the right to update this privacy notice at any time. You will always find the current version on our website.

Privacy Notice for Clients

Last update: December 2024

The following information is intended to provide you with an overview of how Inverto processes your personal data and your rights as a data subject. Details on which data is processed and how it is used are determined by the services agreed in each case. Therefore, not all statements contained in this notice may apply to you.

Controller and Contact Details

Controller within the meaning of GDPR is:

Inverto GmbH

Lichtstraße 43i

50825 Cologne

Telephone: +49 221 485 687 0

Fax: + 49 221 485 687 140

E-mail: contact@inverto.com

https://www.inverto.com/

In accordance with the respective engagement, one of our affiliated companies (hereinafter referred to as ‘Inverto’) may be the controller within the meaning of GDPR. The individual contact details can be found here.

Inverto has appointed an external data protection officer. You can contact them at:

Potsdamer Straße 3
80802 Munich
Germany
Phone: +49 89 919294-900
E-Mail: inverto@activemind.de

Nature of Personal Data Collected

We may process the following personal data that we receive from you as part of our business relationship:

Company name with legal organisation and address
Title and name
Phone numbers
Fax numbers
E-Mail addresses
Field of work or position

Purposes and Legal Bases of Processing

We process personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and other applicable data protection laws:

For the fulfilment of contractual obligations (Art. 6 para. 1 lit. b GDPR)

Project agreement
Pre-contractual relationship

In addition, the disclosure of personal data may become necessary in the context of official or judicial measures for the purposes of gathering evidence, criminal prosecution or the enforcement of civil law claims.

Recipients of Personal Data

Within Inverto

Employees for the communication with you and the contractual cooperation (including the fulfilment of pre-contractual measures)

Other Third Parties

Data will only be disclosed to recipients outside Inverto in compliance with the applicable data protection regulations. Recipients of personal data may be, for example:

Inverto’s affiliated companies, including Boston Consulting Group, Inc.
Tax advisors or economic and income tax and fiscal auditors (statutory audit mandate)

Transfers to Third Countries or International Organisations

If the data recipient is located in a third country, a transfer to countries outside the European Union and the European Economic Area (EEA) is possible. In this case, Inverto ensures an adequate level of data protection by concluding the standard contractual clauses of the European Commission in the currently valid version.

Retention Period

We process and store your personal data for as long as this is necessary for the fulfilment of our contractual and legal obligations. If the data is no longer required for the fulfilment of contractual or legal obligations, it will be regularly deleted. There may be exceptions,

Where local statutory retention obligations must be fulfilled, e.g. in Germany: German Commercial Code (HGB) and German Fiscal Code (AO). The retention and documentation periods specified there are generally six to ten years;
For the retention of evidence within the framework of the statutory limitation periods. In Germany, these limitation periods can be up to 30 years, whereby the regular limitation period is 3 years;
Other applicable statutory retention obligations.

If the data processing is carried out based on the legitimate interest of Inverto or a third party, the personal data will be deleted as soon as this interest no longer exists. The above mentioned exceptions may apply.

Your Rights as a Data Subject

You have the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR.

The right of access and the right to erasure may be subject to restrictions under applicable local data protection laws.

Competent Supervisory Authority

In addition, you have the right to lodge a complaint with a competent supervisory authority (Article 77 GDPR). The competent supervisory authority for Inverto is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Dusseldorf
Phone: +49 211 384 24-0
Fax: +49 211 384 24-10
E-Mail: poststelle@ldi.nrw.de
Website: http://www.ldi.nrw.de

Are There Any Obligations to Provide Data?

As part of the contractual relationship, you must provide the personal data that is required for the commencement, execution and termination of the contractual relationship and for the fulfilment of the associated contractual obligations or data that we are legally obliged to collect. Without this data, we will generally not be able to conclude or fulfil the contract with you.

Information about Your Right to Object under Article 21 GDPR

Individual Right of Objection

You have the right to object, at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6 para. 1 lit. f GDPR (data processing on the basis of a balancing of interests); this also applies to profiling based on this provision within the meaning of Article 4 no. 4 GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves for the establishment, exercise or defence of legal claims.

Recipient of the Objection

Your objection can be made informally with the subject ‘Objection’, stating your name, and should be addressed to:

Inverto GmbH
Lichtstraße 43i
50825 Cologne
Germany
E-Mail: contact@inverto.com
Phone: +49 221 485 687 0

Privacy Notice for Applicants

Last update: December 2024

This privacy notice informs you about how Inverto processes your personal data when applying for a job posted by us. Among other things, we would like to inform you about your data protection rights, including the right to object to part of the processing carried out by Inverto.  

Controller and Contact Details

Controller within the meaning of GDPR is:

Inverto GmbH

Lichtstraße 43i

50825 Cologne

Telephone: +49 221 485 687 0

Fax: + 49 221 485 687 140

E-mail: contact@inverto.com

https://www.inverto.com/

Inverto has appointed an external data protection officer. You can contact them at:

Potsdamer Straße 3
80802 Munich
Germany
Phone: +49 89 919294-900
E-Mail: inverto@activemind.de

Data Categories and Source

During the application process, we may collect and process the following categories of personal data:

Contact details from the application form (e.g. first and last name, address, country, e-mail address, telephone number).
Further information from the application form (e.g. mandatory information on salary expectations, academic background and motivation).
Application documents (this may include your application photo, CV, cover letter, career development data, qualifications and language skills).
Other data you provide within the application process (e.g. results of personality or performance tests, references).

We may also permissibly obtain the above data about you from other sources, including external business partners, e.g. recruitment agencies or our talent relationship management.

Nature and Purposes of Processing

Your personal data will be processed exclusively for the following purposes:

To initiate and establish the employment relationship.
To contact you for relevant further information.
To contact you in case you are eligible for an alternative position (only if you have expressly consented to this).
Where necessary, to defend any legal claims made against us arising from the application process.
After a successful application for administrative matters (onboarding).

The provision of your personal data as part of the application process is voluntary. However, the provision of certain personal data is necessary for the processing of your application or the conclusion of an employment contract with us.

Inclusion in our Talent Pool

Should your application be not successful, we may, with your explicit consent, store your applicant data in our talent pool in order to contact you again and, where applicable, process it further. In this case, we may contact you in the future about suitable vacancies and invite you to other recruiting events that may serve to initiate an employment relationship. In case you do not agree to be included in our talent pool, you will not suffer any disadvantages in future application procedures.

Legal Basis

We process your personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), insofar as this is necessary for the decision on the establishment of an employment relationship with us. The legal basis for this is Art. 88 GDPR in conjunction with Art. 26 BDSG and, alternatively Art. 6 para. 1 p. 1 lit. b GDPR, for application procedures for our non-German entities, for the initiation or execution of contractual relationships.

Furthermore, we may process your personal data if this is necessary for the fulfilment of legal obligations (Art. 6 para. 1 p. 1 lit. c GDPR) or for the defence against legal claims asserted against us. The legal basis for this is Art. 6 para. 1 p.1 lit. f GDPR. The legitimate interest is, e.g., a duty of proof in proceedings under the German General Equal Treatment Act (AGG). Where you grant us explicit consent to process personal data for specific purposes, the lawfulness of this processing is based on your consent in accordance with Art. 6 para. 1 p.1 lit. a GDPR. Such consent may be revoked at any time with effect for the future.

If an employment relationship arises between you and us, we may further process the personal data already received from you for the purposes of the employment relationship in accordance with Art. 88 para. 1 GDPR in conjunction with Art. 26 para. 1, para. 8 p. 2 BDSG, or Art. 6 para. 1 p. 1 lit. b GDPR, insofar as this is necessary for the implementation or termination of the employment relationship or for the exercise or fulfilment of the rights and obligations of the employee lobby resulting from a law or a collective agreement.

Recipients of the Data

Our career website is technically operated by an external service provider (d.vinci HR-Systems GmbH, Nagelsweg 37-39, 20097 Hamburg, hereinafter “Service Provider”). In the context of talent relationship management, we also use the services of Talentry (Talentry GmbH, Nymphenburger Str. 86, 80636 Munich, hereinafter “Service Provider”). We have concluded data processing agreements in accordance with Art. 28 GDPR with the Service Providers we use, which ensure compliance with data protection requirements in the handling of your personal data.

During the application process, your data is generally only accessed by persons who make the specific hiring decision or are significantly involved in it. As a rule, these persons include employees of the HR department and supervisors, and in some cases also specialist managers. All employees entrusted with data processing are obliged to maintain the confidentiality of your data. If, in addition, other persons (e.g. service providers or official bodies) have access to your data, this will always be on the basis of a contractual declaration of confidentiality and/or a data processing agreement or on the basis of legal or official obligations.

Your Rights

Every data subject has the following rights:

15 GDPR: You have the right of access to the personal data stored about you in our company. To do so, please contact the controller named above.
16, 17 GDPR: You can rectify your personal data by sending an email to contact@inverto.com. You can also request the deletion of your data in this way. 
18 GDPR: Under certain circumstances, you can request the restriction of the processing of your data, e.g. if the accuracy of your data is disputed and should be verified by us.  
20 GDPR: Under certain conditions, the data will be provided to you in a structured, commonly used, and machine-readable format.

In addition, you have the right to lodge a complaint with a competent supervisory authority (Article 77 GDPR). The competent supervisory authority for Inverto is:

Duration of Data Storage

Your application documents will be deleted no later than six (6) months after the end of the application process (e.g. by notification or rejection decision), unless longer storage is legally required or permitted. We only store your personal data for a longer period if this is required by law or in a specific case for the assertion, exercise or defence of legal claims for the duration of the legal dispute.

If you have consented to the extended use of your application documents for other positions (inclusion in our talent pool), we will initially store them for twelve (12) months. After this period, you will be asked to consent again to the extended use of your application documents. If you do not renew your consent, we will delete your data from our talent pool.

Right to Object

Insofar as the processing of your personal data is carried out for the protection of legitimate interests pursuant to Art. 6 para. 1 p. 1 lit. f GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing of this data at any time for reasons arising from your particular situation. We will then no longer process this personal data unless we can demonstrate compelling legitimate grounds for the processing.

Recipient of the Objection

Your objection can be made informally with the subject ‘Objection’, stating your name, and should be addressed to:

Inverto GmbH
Lichtstraße 43i
50825 Cologne
Germany
E-Mail: contact@inverto.com
Phone: +49 221 485 687 0