Privacy Policy

This English version is provided for convenience. In case of doubt, the German version prevails.

1. Controller

The controller responsible for the processing of personal data on this website is:

OSP Strategy Consultants GmbH
Karlsplatz 3
80335 Munich
Germany

Represented by the Managing Director:
Oktay Süzeroğlu

Phone: +49 89 255 575 806
Email: contact@ospstrategy.com

2. Scope: this website and further online offerings

This privacy policy applies to the website ospstrategy.com as well as to the further online offerings of OSP Strategy Consultants GmbH:

• spieltheorie.info (knowledge portal on applied game theory, including the English edition at spieltheorie.info/en/),
• spieltektonik.info (information offering on the Spieltektonik method),
• negotiation.de (product preview of the negotiation software).

The controller, the contact details and your rights apply equally to all websites named above. Where individual sections concern only certain websites (such as the contact form or the language selection), this is stated in the respective section. spieltektonik.info and negotiation.de are purely informational offerings without forms and without any registration facility.

3. General information on data processing

We process personal data only to the extent necessary to provide and secure these websites, to handle enquiries, to carry out pre-contractual measures or to fulfil contractual and statutory obligations.

Personal data means any information relating to an identified or identifiable natural person. This may include in particular names, contact details, communication content, IP addresses and technical usage data.

The applicable legal bases are stated in the following sections.

4. Hosting and server log files

The websites named in Section 2 are hosted by the following service provider:

IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany

When the websites are accessed, the web server processes technically required information. This may include in particular:

• the IP address of the accessing device,
• date and time of access,
• the page or file accessed,
• the volume of data transferred,
• the referrer URL,
• browser type and version,
• operating system,
• HTTP status code.

This processing takes place in order to provide the websites technically, to ensure their stability and security, to detect attacks and abusive access and to analyse technical errors.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure, stable and functional operation of our websites.

IP addresses are anonymised in the hosting provider’s log files at the point of collection. The log files are stored for up to eight weeks and then deleted. Longer storage may occur in individual cases where there are concrete indications of unlawful use or a security-relevant incident.

A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider. The hosting provider processes the data exclusively within the European Union.

5. Encrypted transmission

Our websites use an encrypted HTTPS connection. This is intended to protect data transmitted between your browser and our server against unauthorised access by third parties.

6. Contacting us

You can contact us via the contact form on ospstrategy.com, by email, by phone or by other means. On negotiation.de, contact (for example regarding the pilot programme) takes place exclusively by email to contact@ospstrategy.com; spieltheorie.info and spieltektonik.info contain no contact forms of their own and refer to these contact channels.

In doing so, we process the data you provide, in particular:

• name,
• company,
• business email address,
• phone number (voluntary),
• selected subject,
• the content of your message,
• further information provided voluntarily.

The processing takes place to handle your enquiry, to communicate with you and, where applicable, to prepare or perform a contractual relationship.

Where your enquiry relates to an existing contract or to pre-contractual measures, the processing is based on Art. 6 (1) (b) GDPR. In other cases, the processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in the proper handling of business and other enquiries and in maintaining existing and potential business relationships.

Protection against misuse: To protect the contact form against automated entries and misuse, we use an invisible form field (honeypot) and a short-term submission limit. For the submission limit, a pseudonymised check value (hash) is derived from the IP address and deleted automatically after a few minutes; the IP address itself is not stored for this purpose. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in protecting our systems against spam and misuse.

The data is deleted as soon as it is no longer required for handling the enquiry and no statutory retention obligations or legitimate interests in further storage exist. If a contractual relationship is established, the data may be processed further within the business relationship and in accordance with the statutory retention periods under commercial and tax law.

7. Cookies and similar technologies

Our websites use cookies and comparable technical storage mechanisms.

Technically necessary cookies and storage access are used insofar as they are required to provide the websites, the language selection, security functions and the privacy settings you have chosen.

Where cookies or comparable technologies are not strictly necessary, they are used only with your prior consent.

The storage of information on your terminal device, or access to information already stored there, is based on Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) for technologies requiring consent. Strictly necessary technical operations are based on Section 25 (2) TDDDG.

Where personal data is processed in the course of using such technologies, this is done for services requiring consent on the basis of Art. 6 (1) (a) GDPR.

Further information about the cookies used, their purposes and their storage periods can be found at: Cookie settings

8. Consent management with Complianz

On all websites named in Section 2, we use the WordPress plugin Complianz to inform you about the use of cookies and comparable technologies and to manage your consent decisions. Your consent applies to the website on which you gave it.

Technically required information is stored in the process, in particular:

• whether you consented or declined,
• which categories you selected,
• the time and version of your consent decision,
• technically required consent cookies.

This processing is necessary to store your selection, to avoid asking again on every page view and to be able to demonstrate that consent was given or declined.

The legal bases are Art. 6 (1) (c) GDPR in conjunction with the accountability obligation under data protection law, and Art. 6 (1) (f) GDPR. Our legitimate interest lies in the legally compliant and user-friendly management of your privacy settings.

You can change or withdraw your decision at any time: on ospstrategy.com and spieltheorie.info via the “Cookie settings” page, on spieltektonik.info and negotiation.de via the “Cookie-Einstellungen” link in the footer of the respective page. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

9. Language selection

The websites ospstrategy.com and spieltheorie.info are available in German and English. We use Polylang to manage the language selection.

A technically necessary cookie may be stored that remembers the language you have chosen. This processing serves exclusively to provide the website in the requested language.

The storage takes place as a strictly necessary technical operation on the basis of Section 25 (2) TDDDG; where personal data is processed in the course of this, the legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in providing the expressly requested language function.

10. Locally hosted fonts

The fonts used on our websites are provided locally from our own servers. When the websites are accessed, no connection to Google Fonts servers is therefore established. Your IP address is not transmitted to Google for loading the fonts.

11. Google Analytics 4 (cross-domain measurement)

On the websites named in Section 2, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics is used exclusively if you have previously consented to the “Statistics” category via our consent banner. Before you consent, no connection to Google is established and no data is transmitted to Google.

The legal bases are your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future via the cookie settings.

Cross-domain measurement: Our websites form one connected information offering. We therefore use a shared Google Analytics property with cross-domain measurement. If you move between the websites named in Section 2, your visit is measured as one continuous session; for this purpose, a technical linking parameter (such as “_gl”) is appended to the address of the destination page when you switch. Cross-domain measurement, too, only takes place if you have consented to the “Statistics” category on the respective website.

Google Analytics uses cookies and comparable technologies that enable an analysis of your use of the websites. The data processed includes in particular pseudonymous usage identifiers, device and browser information and information about pages visited and events triggered (for example submitting the contact form or opening an article). IP addresses are not stored by Google Analytics 4; location is determined on the basis of truncated IP data.

We use the analyses to understand the reach, usage and conversions of our websites and to develop our offering further. The data may also be transferred by Google to servers of Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses are in place in addition. The retention period for user-related data in Google Analytics is 14 months.

Further information can be found in Google’s privacy policy at policies.google.com/privacy.

Beyond this, we do not use any further web analytics, tracking or marketing services and do not embed any other content from third-party servers.

12. Recipients of personal data

Within OSP Strategy Consultants GmbH, only those persons who need personal data to perform their tasks are given access to it.

In addition, data may be transferred to external service providers who support us in particular in the following areas:

• hosting and technical provision of the websites,
• maintenance and IT security,
• email communication,
• data backup,
• where applicable, tax, legal or management consulting.

Where service providers process personal data on our behalf, they are contractually bound in accordance with the statutory requirements.

Data is passed on to other third parties only where a legal basis exists, where this is necessary for the performance of a contract or where you have given your prior consent.

13. Transfers to third countries

Personal data is transferred to countries outside the European Union or the European Economic Area only if the statutory requirements of Art. 44 et seq. GDPR are met.

Where, in individual cases, service providers established in a third country or with processing activities in a third country are used, we provide separate information in this privacy policy about the respective service, the legal basis and the safeguards in place.

14. Storage period

We store personal data only for as long as necessary for the respective processing purpose.

Beyond this, data may be stored where statutory retention obligations exist (in particular under commercial and tax law) or where the data is required for the establishment, exercise or defence of legal claims.

Once the processing purpose no longer applies and statutory retention periods have expired, the data is deleted or anonymised.

15. Your rights

Subject to the statutory requirements, you have in particular the following rights:

• the right of access to the data stored about you,
• the right to rectification of inaccurate or incomplete data,
• the right to erasure of your data,
• the right to restriction of processing,
• the right to data portability,
• the right to withdraw consent given, with effect for the future.

Right to object (Art. 21 GDPR): Where processing is based on Art. 6 (1) (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, you can contact:
contact@ospstrategy.com

16. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection law.

For private companies established in Bavaria, the following supervisory authority is competent in particular:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach, Germany
www.lda.bayern.de

You may also contact another competent data protection supervisory authority, in particular the authority of your habitual residence or place of work.

17. No automated decision-making

No exclusively automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place via these websites.

18. Updates to this privacy policy

We amend this privacy policy when the services used, the data processing or the legal requirements change. The version published on this website applies.

Version: July 2026