Legal notice & data protection

General information 

1. Name and contact details of the controller

This privacy policy applies to data processing by:
GPM Deutsche Gesellschaft für Projektmanagement e. V. (hereinafter GPM)
Am Tullnaupark 15
90402 Nuremberg
Tel.: +49 911 433369-0
info@gpm-ipma.de

The GPM's company data protection officer can be contacted at dhpg IT-Services GmbH, Bunsenstr. 10a, 51647 Gummersbach, for the attention of Dr Christian Lenz, or at datenschutz@dhpg.de or 02261-8195-0.

2. Rights of data subjects

You have the right:

• pursuant to Art. 15 GDPR, to request information about your personal data processed by us. If we process your data, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, in particular recipients in third countries, the planned storage period or the criteria for determining it, the existence of a right to rectification, deletion, restriction of processing or objection, the existence of a right of appeal to a supervisory authority, the origin of your data, if it was not collected by us, and the existence of automated decision-making, including profiling and, where applicable, meaningful information about its details;
• to request the immediate rectification of inaccurate or incomplete personal data stored by us in accordance with Art. 16 GDPR;
• to request the erasure of your personal data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary in particular for exercising the right of freedom of expression and information, for fulfilling a legal obligation, for reasons of public interest or for asserting, exercising or defending legal claims;
• pursuant to Art. 18 GDPR, to request the restriction of the processing of your personal data if you dispute the accuracy of the data, the processing is unlawful but you oppose its erasure and we no longer need the data, but you need it for the establishment, exercise or defend legal claims, or you have objected to the processing pursuant to Art. 21 GDPR and it is not yet clear whether our legitimate reasons outweigh your interests;
• pursuant to Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request its transfer to another controller, provided that the processing is based on your consent or a contract and the processing is carried out using automated procedures;
• pursuant to Art. 7(3) GDPR, to withdraw your consent to us at any time. As a result, we will no longer be allowed to continue processing data based on this consent in the future and
• pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose.

3. Right to object

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(e) or (f) GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, provided that there are reasons for this arising from your particular situation or the objection is directed against direct marketing. In the former case, we will no longer process your data unless we can demonstrate compelling reasons that outweigh your interests, freedoms and rights, or our processing serves to assert, exercise or defend legal claims. In the latter case, you have a general right to object, which we will implement without you having to specify a particular situation. If you wish to exercise your right of revocation or objection, simply send an email to info@gpm-ipma.de.

4. Disclosure of data

Your personal data will not be transferred to third parties for purposes other than those listed below. We will only pass on your personal data to third parties if:

• You have given your express consent to this in accordance with Art. 6 (1) (a) GDPR,
• the transfer is necessary in accordance with Art. 6 (1) (f) GDPR for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,
• in the event that there is a legal obligation for the disclosure pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR, and
• this is legally permissible and necessary for the performance of contractual relationships with you pursuant to Art. 6 (1) sentence 1 lit. b GDPR.

In addition, our processors receive your personal data for processing in accordance with our instructions, insofar as this is necessary for the fulfilment of the order. Our processors have no right of use of your data themselves. 

5. Data security

When you visit our website, we use the widely used SSL (Secure Socket Layer) protocol in conjunction with the highest level of encryption supported by your browser. This is usually 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is being transmitted in encrypted form by the closed display of the key or lock symbol or by the use of https in front of the address of our (sub)website. We also use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments. 

6. Third countries

We only transfer data to third countries in accordance with the statutory provisions. The permissibility of data transfers to third countries is governed by Art. 44 ff. GDPR. If we transfer your data to a third country, you will be informed of this in the specific data protection information for the respective processing procedure, stating the relevant legal provision. 

7. Special data protection information for data processing on the website

7.1. When visiting the website 

When you visit our website, the browser used on your device automatically sends information to our website's server. This information is temporarily stored in a log file. The following information is collected without your intervention and stored until it is automatically deleted:

• P address of the requesting computer,
• date and time of access,
• name and URL of the file accessed,
• website from which access is made (referrer URL),
• browser used and, if applicable, the operating system of your computer and the name of your access provider.

We process the aforementioned data for the following purposes:

• Ensuring smooth connection to the website,
• Ensuring convenient use of our website,
• Evaluating system security and stability, and
• For other administrative purposes.

The legal basis for data processing is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the operation of our website and the associated presentation of our company. 

Your data will be deleted as soon as it is no longer required for the specified purposes, at the latest after 6 months. 

7.2. When registering on the PM-ZERT portal

When you select a certification round, a user account is created on the PM-ZERT portal. We require your name and email address for registration. This information serves as the login details for your personal user account. To verify the email address you have provided, we will send you a verification code, which you must enter in the portal to complete the registration process.  

No further identification data (e.g. ID number, place of birth or submission of a document) is collected in the portal. Additional identification is only required if you take part in an online examination; in such cases, proof of identity is provided separately as part of the examination process.  

We use your contact details to execute the contractual relationship, in particular to organise the certification round, to communicate about examinations and certification steps, and to provide information about necessary recertifications or further certification levels. This serves our legitimate interest in informing you about certification deadlines and offers relevant to you and in helping you to avoid missing certificate expiry dates. Providing a mobile phone number is voluntary; if you provide it, we can also contact you via this number for contract processing. The legal basis for processing is Art. 6 (1) (a), (b) and (f) GDPR. 

We delete your data as a matter of principle when you delete your user account on the portal. Beyond that, we only store it for as long as is necessary to fulfil the contract – in particular for the term of the respective certificates. We then delete the data immediately, provided that there are no legal retention obligations or the data is required to assert or defend civil law claims.  

We use the service provider isolutions AG, Schanzenstrasse 4c, CH-3008 Bern, for the technical provision and processing of portal use. isolutions AG processes personal data exclusively in accordance with our instructions and has no right of use of its own. Personal data is only stored by isolutions AG for the duration necessary for technical provision and implementation.  

7.3. Cookies, analysis tools, plug-ins and other third-party elements

We use cookies, analysis tools, plug-ins and other third-party elements on our website. Cookies are small files that your browser automatically creates and stores on your device (laptop, tablet, smartphone, etc.). Cookies do not cause any damage to your device and do not contain viruses, Trojans or other malware. Information is stored in the cookie that is related to the specific device used. However, this does not mean that we immediately become aware of your identity. Analysis tools evaluate the user behaviour of website visitors and enable the operator to record and evaluate visits to their own website. Plugins and other third-party elements are used to integrate content or other services from these providers into a website.

a) Necessary cookies and similar tools

The use of our necessary cookies and similar tools serves to provide the services of the website and to make the use of our offer more pleasant for you. We process your personal data collected by these cookies and similar tools on the basis of our legitimate interest in presenting our company and the services we offer via the website you have accessed, as well as to promote user-friendliness. The legal basis for processing is Art. 6 (1) (f) GDPR. Most browsers automatically accept these cookies and similar tools. However, you can configure your browser so that no cookies or similar tools are stored on your computer or so that a message always appears before such a cookie or similar tool is created. However, complete deactivation may result in the website not being displayed correctly or you not being able to use all the functions of our website. The respective function descriptions, any recipients of the data, information on possible transfers to a third country and the storage period can be found in the following notes on the individual necessary cookies or similar tools and the associated processing processes. 

Management of consent settings 

We use cookies to obtain and manage website users' consent to data processing. The following data is processed with the help of cookies for this purpose: 

• Your IP address
• Date and time of consent
• URL from which consent was sent

The cookie is stored in the browser for 12 months. This means that your cookie preference is retained for subsequent page requests. 

b) Third-party cookies, analysis tools, plugins and other third-party elements 

The third-party cookies, analysis tools, plugins and other third-party elements listed below and used by us are only used with your express consent and thus on the basis of Art. 6 (1) (a) GDPR. You can revoke your consent at any time with effect for the future. To do so, you can click on the security icon at the bottom left of the website and make the desired changes. 

Failure to give or revocation of consent may result in the website not being displayed correctly or you not being able to use all of the website's functions. We use third-party cookies, analysis tools, plug-ins and other third-party elements to ensure that our website is designed to meet your needs and to continuously optimise it. We also use tracking measures to statistically record the use of our website and to evaluate it for the purpose of optimising our offering for you. The respective function descriptions, any recipients of the data, information on possible transfers to a third country and the storage period can be found in the following notes on the individual processing procedures involving third-party cookies, analysis tools, plugins and other third-party elements. 

(1) Google Analytics (GA4)

For the purpose of designing our pages in line with requirements and continuously optimising them, we use Google Analytics, a web analysis service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; hereinafter ‘Google’). 

Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected by the cookies about your use of this website is usually transferred to a Google server in the USA and stored there. 

With Google Analytics 4, IP address anonymisation is enabled by default. Due to IP anonymisation, your IP address will be truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to Google in the USA and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics is not merged with other data. 

During your visit to the website, your user behaviour is recorded in the form of ‘events’ (e.g. scrolls, page views, clicks, start of session, page views).

The following data is collected:

• Your approximate location (region)
• Your IP address (in truncated form)
• Technical information about your browser and the devices you use (e.g. language settings, screen resolution)
• Your internet service provider
• The referrer URL (the previously visited page) 

The information is used to evaluate the use of the website, to compile reports on website activity and to provide other services related to website activity and internet usage for market research and needs-based design. 

The parent company of Google Ireland, Google LLC, is based in California, USA. The transfer of data to the USA and access by US authorities to data stored by Google cannot be ruled out. Google is certified under the Data Privacy Framework, meaning that transfers to Google in the USA are subject to an adequacy decision by the European Commission in accordance with Art. 45(1) GDPR. 

The data we send and link to cookies is automatically deleted after 14 months. Data that has reached its retention period is automatically deleted once a month. For more information on Google Analytics' terms of use and Google's privacy policy, please visit  https://marketingplatform.google.com/about/analytics/terms/de/ as well as https://policies.google.com/?hl=de.

(2) Google Tag Manager

We use Google Tag Manager (hereinafter: Tag Manager) from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; hereinafter: Google). Tag Manager is a tool that can be used to organise website tags globally. Tags are small pieces of code generated by analysis tools (e.g. Google Analytics).  
Tag Manager does not set any cookies itself. It merely serves as an administration tool for data generated by other services. For information on the data provided by these tools, please refer to the relevant information in this privacy policy. 
The transfer of data to Google cannot be ruled out. The transfer of data to companies based in the United States cannot be ruled out either. Similarly, access by US authorities to data stored by Google cannot be ruled out, even if it remains on servers within the EU. 

The parent company of Google Ireland, Google LLC, is based in California, USA. The transfer of data to the USA and access by US authorities to data stored by Google cannot be ruled out. Google is certified under the Data Privacy Framework, meaning that transfers to Google in the USA are subject to an adequacy decision by the European Commission in accordance with Art. 45 (1) GDPR. 
For information on how long the data processed by Tag Manager is stored, please refer to the information on the respective analysis tools in this privacy policy. 

Further information on data protection can be found in Google's privacy policy at https://safety.google/intl/de_de/security-privacy/.

(3) YouTube

We use social plugins from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; hereinafter ‘YouTube’) on our website to embed videos that complement its content. YouTube cookies are only used with your express consent and thus on the basis of Art. 6 (1) (a) GDPR. You can revoke your consent at any time with effect for the future. To do so, you can change your settings using the corresponding button below each video. Failure to give or revocation of consent may result in the videos not being displayed to you.  

We integrate these plugins using the so-called two-click method in order to protect visitors to our website as best as possible. This means that your personal data (in particular your IP address) is not transmitted to YouTube when you visit the website. Instead, you must first activate the integrated ‘buttons’ and videos by clicking on them. By clicking, you give your consent for a connection to be established with the YouTube servers and for data to be transmitted.  

We also use the extended data protection mode with ‘youtube-nocookie’ to transmit as little data as possible. Google also uses the collected data for its own purposes. If you are logged in to Google at the same time, this information will be linked to your member account. 

You can prevent this by logging out of your member account before visiting our website. 

Information is also transmitted to the parent company Google Inc. in the USA and to other Google companies and Google partners outside the EU. Google is certified under the Data Privacy Framework, so transfers to Google in the USA are subject to an adequacy decision by the European Commission in accordance with Art. 45 (1) GDPR. The privacy policy and terms of use for YouTube can be found at https://policies.google.com/privacy?hl=en

(4) LinkedIn Insight Tag

We use the LinkedIn Insight Tag, a service provided by LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland (hereinafter: ‘LinkedIn’), for this website. LinkedIn acts as a processor in accordance with Art. 28 GDPR. 

The LinkedIn Insight Tag creates a unique LinkedIn browser cookie in your browser and enables the collection of the following data for this cookie: metadata such as IP address, timestamp and page events (e.g. page views). 

This technology enables us to generate reports on the performance of our advertisements and information on website interaction. To this end, the LinkedIn Insight tag is integrated into this website, establishing a connection to the LinkedIn server. It enables detailed advertising campaign reports and provides valuable information about visitors to our website. The LinkedIn Insight Tag allows us to track the success of the advertisements we place, retarget our website visitors, and gain aggregated insights into the LinkedIn member categories that respond to our advertisements. 

When using the LinkedIn Insight Tag, data may be transferred to LinkedIn Ireland's parent company, LinkedIn Corporation, in the United States. LinkedIn Corporation is certified under the EU-US Data Privacy Framework, meaning it is considered a secure data recipient. 

For more information about data protection at LinkedIn, please visit www.linkedin.com/legal/privacy-policy/ and https://www.linkedin.com/help/linkedin/answer/a1444756/linkedin-marketing-solutions-und-die-datenschutz-grundverordnung-dsgvo-?lang=de.

8. Current status and changes to the privacy policy

This privacy policy is currently valid and was last updated in November 2024. Due to the further development of our website and offers on it, or due to changes in legal or regulatory requirements, it may be necessary to amend this privacy policy. You can access and print out the current privacy policy at any time on the website. 

Language of the Documents / German Version Prevails
These legal notice & data protection info  are provided in German and English. In case of discrepancies between the German and English versions, the German version shall prevail and is binding.
The English version is provided for information and clarity purposes only.

Governing Law
German law shall apply, excluding the UN Convention on Contracts for the International Sale of Goods (CISG) and the rules of private international law.