Privacy Policy

In the following, we would like to inform you about the processing of personal data in line with the usage of our internet pages. According to article 4 of the General Data Protection Regulation (GDPR), “personal data” is all information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”), which can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The legal basis of data protection can be found in the new Federal Data Protection Act (BDSG-neu) and in the GDPR.

Data Controller
The party responsible for this website (“the controller”) is Changepoint Advisory GmbH (Große Elbstraße 42, 22767 Hamburg). Further information about our company and its authorized representatives can be found in the imprint of our website:

Which Data is being processed?
Legal basis of data processing
In order to be able to offer you our website and associated services, we process personal data on the basis of the following legal grounds:

  • consent to the processing of his or her personal data (Article 6 (1) (a) GDPR)
  • for the performance of a contract or steps preparatory to such a contract (Article 6 (1) (b) GDPR)
  • for the purposes of legitimate interests (Article 6 (1) (f) GDPR)
  • for necessary compliance with a legal obligation (Art. 6 (1) (c) GDPR)

We will refer to the respective terminology in connection with the respective processing, so that you can classify the basis on which we process personal data.
If your personal information is processed on the grounds of your consent, you have the right to withdraw your consent to us at any time with future effect.
If we process data on the basis of legitimate interests, you, as the person concerned, have the right to object to the processing of your personal data, taking into account the requirements of Art. 21 DSGVO.

Log files
When you visit our website, personal data is processed in order to be able to display the contents of the website on your device.
To be able to display the pages in your browser, the IP address of the device you are using must be processed. Furthermore, additional general data and information about the browser of your device must be processed. The data is therefore used to detect and correct errors on the internet pages.
In compliance with data protection provisions, we are also obliged to guarantee the confidentiality and integrity of personal data processed using our IT systems.
For that purpose and interest, the following data are logged on the basis of a balance of interests:

  • Anonymized IP- address of the accessing computer (for a maximum of 5 days)
  • Operating system of the accessing computer
  • Browser version used
  • Name of the file retrieved
  • Date and time of access to the internet site
  • Volume of data transferred
  • Referring URL

The anonymized IP address will be deleted after five days from all systems used in connection with the operation of this website.
The data is also used to detect and correct errors on the Internet pages.

We use cookies on our website. Cookies are small text files stored on your device and saved by your browser. Cookies are required to enable certain features of our website.
The cookies we use are so called “session cookies” that are automatically deleted from your browser immediately after your visit.
You have the option to configure your browser and thus prevent the setting of cookies. We point out, however, that the use of our website may be restricted. Cookies do not install or start any programs or other applications on your computer.
The use of cookies is based on a balance of interests. Our interest is a user-friendly visit of our internet pages.

Google Web Font
We use so-called Google Web Fonts on our websites. It downloads fonts from Google servers, which serve to improve the design of the website. The data processing constitutes a justified interest, whereby our interest lies in an attractive design and presentation of our website.
These fonts are downloaded from Google servers, which are usually located in the United States. The adequate level of data protection is guaranteed by Google (list entry “Privacy Shield”).

Online presence in social media
We maintain online presence on social networks and platforms in order to communicate with customers and interested parties that are active on those pages. Furthermore, we inform customers about our services. The terms and conditions and the data processing guidelines are based on the call to the respective providers of the networks.
We only process the users’ data if they communicate with us via social networks. This would be the case if users post on our social network sites or send messages to us.

Use of Doubleclick Ad Exchange
This website uses the online marketing tool DoubleClick. Once Doubleclick Ad Exchange, a web advertising service of Google Inc., USA (“Google”), places advertisements (text ads, banners, etc.) on this website, your browser may save a cookie sent by Google Inc. or a third party. The stored information can be recorded, collected and evaluated by Google Inc. or third parties. In addition, the DoubleClick Ad Exchange also uses so-called “Web bacons” (small invisible graphics) to collect and evaluate simple actions such as visitor traffic on the website. The information generated (through cookies and / or web beacon) about your use of this website is transmitted to and stored by Google on servers in the United States. Google uses the obtained information to evaluate their usage of DoubleClick Ad Exchange ads. In cases third parties process this data on behalf of Google and as far as statutorily required, Google will transfer this information to third parties. If IP addresses are transmitted and stored in this context, this only takes place for combating and filtering spam / fraud (ad impressions spam and click spam). These data are only accessible to anti-abuse teams. Google does not associate the IP address with other data stored by Google. You can prevent the storage of cookies on your hard drive and the display of web beacons. To do this, you have to select “Do not accept cookies” in your browser settings (in Internet Explorer under “Tools / Internet Options / Privacy / Settings”, in Firefox under “Tools / Settings / Privacy / Cookies”).

Google Re/Marketing Services
ased on our legitimate interests (i.e. interest in the analysis, optimization and economic operation of our online offer) according to Art. 6 (1)( f) GDPR, we use the Marketing and Remarketing Services (“Google Marketing Services”) of Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, (“Google”). Google is certified under the Privacy Shield Agreement, which ensures compliance with European privacy legislation
The Google Marketing Services allow us to more clearly display advertisements for and on our website. Users are presented with ads that potentially correspond to their interests. In the case of remarketing a user sees ads for products he’s been interested in on other websites.
For these purposes, Google will immediately execute a code and so-called (re)-marketing tags (invisible graphics or code, also called “web beacons”) will be incorporated into the website once you call it up or other websites where Google Marketing Services are active.
As a result an individual cookie, i.e. a small file, is stored on the device of the user. Cookies may be set by different domains including,,,, or This file contains what content the user is interested in and what website he has visited. Furthermore, it is noted which offers he has clicked, which referencing websites, technical information about the browser and operating system, visit time and other information on the use of the online offer.

Use of Google Adwords
We also use the Google advertising tool “Google Adwords” to promote our website. As part of this, we use the “Conversion Tracking” analysis tool from Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043 USA, “Google” on our website. If you have reached our website via a Google ad, a cookie will be stored on your computer. Cookies are small text files that your Internet browser stores and saves on your device. These so-called “conversion cookies” lose their validity after 30 days and are not used for your personal identification. If you visit certain pages on our website and the cookie has not expired yet, we and Google may recognize that you, as a user, have clicked on one of our Google-placed ads and have been redirected to our site.
The information obtained through the “Conversion Cookies” is used by Google to create visitor statistics for our website. These statistics tell us the total number of users who have clicked on our ad, and which pages on our site were subsequently accessed by their respective users. However, we or others through “Google Adwords” advertisers do not receive any information that personally identifies users.
You can prevent the installation of the “conversion cookies” by setting your browser accordingly, for example by setting a browser that generally deactivates the automatic setting of cookies or specifically blocks only cookies from the domain “”.
Google’s privacy policy may be retrieved using the following link:

Purposes of processing personal date
We process the aforementioned data for the operation of our website and for the fulfillment of contractual obligations towards our customers or for the safeguarding of our legitimate interests.
For inquiries outside an active customer relationship, we process the data for sales and advertising purposes. You may object to the use of your personal information for promotional purposes at any time.

Optional information
If you voluntarily provide data to us in forms and these are not required for the performance of our contract, we process the data in the legitimate assumption that the processing and use of this data is in your interest.

Recipient/Disclosure of data
Data that you provide to us will only be disclosed after your consent and / or successful participation in bidding procedures, but not to external third parties. In particular, your data will not be disclosed to third parties for their advertising purposes.
However, we may use service providers for the operation of this website or for other products or services. It may occur that a service provider receives knowledge of personal data. We carefully select our service providers – in particular with regard to data protection and data security – and take all necessary data protection measures for permissible data processing.

Data processing outside the European Union
If personal data is processed outside the European Union you will be able to recognize this from previous explanations.

We are using all necessary technical and organizational security measures to protect your personal data from loss and misuse. Your data is saved in a secure operating environment that is inaccessible to the public. Furthermore, data is encrypted during the transfer by so-called Transport Layers Security (TLS). This means that an approved encryption procedure is used for communication between your computer and our servers.

Existence of automated decision-making
As a responsible company we refrain from automatic decision-making or profiling.

Data protection officer
The controller’s data protection officer is Manthana Grabowsky.

Your right as a data subject
You have the right to be informed about your personal data. You can contact us for information at any time.
In the cases of a request for information that is not carried out in written form, we kindly ask you to understand that we need a proof that you are the person who you claim to be.
Furthermore, you have the right to rectification, erasure or restriction of processing to the extent permitted by law.
In addition, you have a right to object to the processing within the scope of the legal requirements. The same applies to a right to data portability.

Deletion of data
n principle, we delete personal data when there is no necessity for further storage. However, it can be necessary to store data in order to fulfill contractual obligations to examine warranty and guarantee claims. In addition, it is indispensable to store data to grant or defend the mentioned claims. In order to comply with the statutory retention period, a deletion shall only be carried out after expiration of the respective retention period.

The right to lodge a complaint with a supervisory authority
You have the right to to lodge a complaint with a supervisory authority regarding the processing of your personal data. The competent supervisory authority depends on the federal state of your residence, your work or the suspected infringement.

Changes to this privacy statement
We will revise this privacy statement in the event of changes concerning this website whenever it may be required. You will always find the current version on this website.

Privacy notice for applicants
We are pleased that you are interested in us and have applied for a project. In the following, we would like to provide you with information on the processing of your personal data in connection with your application.

Which of your data are being processed by us and for what purposes?
We process the data you have sent to us in connection with your application for the purpose of verifying your suitability for the project and to carry out the bidding process.

On what legal basis is it based?
The legal basis for the processing of your personal data in this application process is § 26 BDSG in the version valid from 25.05.2018. Thereafter, the processing of the data required in connection with the decision to establish an employment relationship is permitted. In cases the data may be required for legal prosecution after completion of the application procedure, the data processing can be based on the requirements of Art. 6 (1) (f) GDPR. Our interest then lies in the assertion or defense against claims. Further processing is carried out in accordance with Art. 6 (1) (a) and (b) GDPR.

How long is the data stored?
Data of applicants who have applied for a position in our company and have received a rejection will be stored for a period of six months, provided that a deletion does not conflict with any other legitimate interests of our company. In case you have received a positive response during the application process, the data will be transferred to our personnel information system.
Data of applicants who have applied to project-related jobs will remain in our application tool for the entire duration of the placement, as required by legal retention periods for each task.
Furthermore, your data will be deleted after two years, unless you have given us consent to the further storage.

To which recipients will the data be passed on?
We use a specifically developed software solution for the process. Your application data will be viewed after receiving your application. Suitable applications will be saved in our software tool. Only authorized persons in our company have access to the tool and your data.
We collect, store and process your transmitted personal data to the extent necessary for the processing of inquiries or the execution of projects, if you have given us your consent beforehand. You have the right to revoke your consent with effect for the future at any time.
To give you the best possible support, we share your personal data with our affiliated company Mysupply Expertist Vertriebs GmbH to enable a matching to other projects. In addition, your data will not be disclosed to third parties without consultation. Any transfer of data to third parties beyond your given consent only takes place, if we are obliged to do so due to mandatory statutory provisions or if you decide to do so.

Where is the data processed?
The data is processed exclusively in data centers of the Federal Republic of Germany.

Consent newsletter
With your application, you have the option to subscribe to an email newsletter on our website to inform you about new projects. In addition to the voluntary information in the respective form, we only process your email address.
To be able to analyze the popularity of our newsletter releases and optimize them, we log it when emails are opened and links are clicked. This usage analysis is based on a balance of interests. You can object to this processing by unsubscribing from the newsletter.

Newsletter via CleverReach
We use the CleverReach component to send our newsletters. CleverReach is a service provided by CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, Germany. Your data, which are stored at the time of registration (e-mail address, if necessary name, IP address, date and time of your registration) will be transmitted to a server of CleverReach GmbH & Co. KG in Germany and stored there. The privacy policy of the shipping service provider can be found at the following link: . The legal basis for the establishment of the shipping service provider is based on Art. 6 (1) (f) GDPR for safeguarding our legitimate interests and a processing agreement pursuant to Art. 28 (3) GDPR. The shipping service provider neither uses the data of our newsletter recipients to address them, nor to pass on data to third parties. You can unsubscribe anytime. Alternatively, you will find a link to unsubscribe in each newsletter email.

Which rights do you have?
As an applicant you have, depending on the specific situation, the following data protection rights you can exercise. You can contact us or our data protection officer at any time regarding the exercise of your rights.

Right of access
You have the right to access and receive information about your personal data processed by us and to request a copy of this data. This includes information on the purpose of the use, the category of data used, their recipients and persons authorized to access and, if possible, the planned duration of the data storage. If the planned duration of the data storage cannot be set, it is necessary to specify the criteria for determining that duration.

Correction, erasure or restriction of processing
You have the right to demand immediate correction of inaccurate personal data concerning you. Taking into account the purposes of processing, you have the right to request the completion of incomplete personal data, including an explanatory statement.

If the processing is based on consent, you have the right to revoke your consent at any time. This is possible without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. You can contact us or our data protection officer at any time using the above-mentioned contact details.

Right of deletion
You have the right to ask us to immediately delete your personal data. We are obliged to delete personal data immediately.
This does not apply if the processing is required for:

  • Fulfillment of a legal obligation that requires processing under the law of the Union or of the Member States to which we are subject.
  • Assertion, exercise or defense of legal claims.

Right to lodge a complaint
You have the right to lodge a complaint about the processing of your personal data with a supervisory authority. The competent supervisory authority depends on the federal state of your residence, your work or the suspected infringement.