Privacy notice for the Client Workspace

1. Controller

Benjamin Birkelbach, Shruggie Consulting, Savitsstraße 43, 81929 München, Germany. Email: hello@shruggie.consulting.

There is no legal obligation to appoint a data protection officer.

2. Sign-in and your account

Access is by invitation only. We process your email address, the company you belong to, your preferred language and the time of your sign-ins. You sign in with a one-time link or code sent by email; there is no password.

Legal basis: performance of our contract with your company (Art. 6(1)(b) GDPR) and our legitimate interest in providing a secure workspace to the people named by our client (Art. 6(1)(f) GDPR).

The workspace only sets cookies that are strictly necessary for signing in (Section 25(2) no. 2 TDDDG). There are no analytics or tracking cookies.

3. Quarterly reviews and projects

We provide slides, recordings and summaries of our review calls, as well as project descriptions and offers. Calls are only recorded with the consent of all participants. Raw transcripts are used only to prepare summaries; clients cannot see them.

When you open a review, we record who opened it, when it was first and last opened, and how often ("seen by"). This helps us know whether information has reached you. Only Shruggie Consulting sees this. Legal basis: legitimate interest (Art. 6(1)(f) GDPR); you can object at any time.

4. Offers

If you accept, decline or ask to revise an offer in the workspace, we store your answer, any comment, who answered and when, together with a copy of the offer as it was at that moment. This documents the conclusion of the contract. Legal basis: Art. 6(1)(b) and (c) GDPR; accepted offers are kept as business correspondence for 6 years (Section 257 HGB).

5. Invoices and billing details

Invoices and your company's billing details (name, address, VAT ID, invoice email) are managed in our accounting software sevDesk (sevDesk GmbH, Offenburg, Germany). The workspace shows them live from sevDesk; changes you make are written back to sevDesk and we are notified by email. Payment details shown for bank transfers are our own. Legal basis: Art. 6(1)(b) and (c) GDPR; retention under tax law of up to 10 years.

6. AI assistance

To draft review summaries and offers, we use AI models from Anthropic. For this, transcripts, slides, notes or other material are transmitted to Anthropic and processed for that single request. According to its terms, Anthropic does not use this data to train its models. Every draft is checked by us before you see it; material uploaded for offer drafts is not stored by us. Legal basis: legitimate interest in efficient, high-quality preparation (Art. 6(1)(f) GDPR).

7. Service providers

We use processors bound by data processing agreements (Art. 28 GDPR): Supabase (database and sign-in; data stored in Frankfurt, Germany), Cloudflare (hosting, delivery and file storage in the EU; technical logs such as IP addresses for delivery and security), Brevo (Sendinblue SAS, Paris, France; sending sign-in and notification emails), Anthropic (AI, see section 6) and sevDesk (accounting, see section 5).

Supabase, Cloudflare and Anthropic are US companies or have US parent companies. Where data may be transferred to the USA, this is based on the EU–US Data Privacy Framework or the EU standard contractual clauses.

8. Retention

Recordings: 12 months after the call. Transcripts: 30 days after the review is published. Accounts that no longer have access to any company are deleted after 90 days without use. Offers and invoices: per statutory retention periods (6 or 10 years). Everything else: until the end of our collaboration, then deleted unless the law requires us to keep it.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest (Art. 15–21 GDPR). Just email hello@shruggie.consulting.

You can also complain to a supervisory authority, for example the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach).