This privacy policy applies to data processing by BRL Risk Consulting GmbH & Co. KG in connection with the "Certinova" service, the use of the website www.Certinova.com and all its subpages, and to all individuals with whom we are in contact.
BRL Risk Consulting GmbH & Co. KG
Caffamacherreihe 16
20355 Hamburg
Germany
+49 40 35006-0
ras@BRL.de
The Data Protection Officer can be reached at the address mentioned above, marked "Attn: Data Protection Officer," or via
Datenschutzbeauftragter@BRL.de.
When you access our website, the browser used on your device automatically sends information to our website's server. This information is temporarily stored in a log file. The following information is collected without any action on your part and stored until it is automatically deleted (access data):
The aforementioned data is processed by us solely to ensure and improve our services, in particular for:
The legal basis for this data processing is Art. 6(1) sentence 1(f) GDPR. Our legitimate interest is derived from the data collection purposes listed above.
During events hosted by us, we will take photographs that may include images of event attendees.
Purposes and use of the photographs:
We take these photographs to document our events visually and to report on them. To this end, we will publish the images on our channels in professional networks, such as LinkedIn and Xing, as well as on our BRL or Certinova media platforms.
The legal basis for this data processing is Art. 6(1)(f) GDPR. Our legitimate interest is derived from the purposes listed above. In accordance with Art. 21(1) GDPR, you have the right to object to the processing, i.e., the creation and publication of images of you.
When you contact us and provide personal data (any information relating to an identified or identifiable natural person), we process this information. This occurs, for example, when you apply for a position with us, hand a business card to a BRL employee or partner, send us an email containing personal data, or provide us with your personal data through other means.
When you contact us, we process the following information (to the extent provided by you):
The aforementioned data is processed by us for the following purposes:
and — if you contact us in connection with our mandate — for the purposes of managing the client relationship, including:
The legal basis for data processing is Article 6(1)(b) of the GDPR insofar as you are in contact with us in connection with our mandate. In this case, the processing serves the fulfillment of a contract or the implementation of pre-contractual measures.
Where necessary and legally permitted, we process your data beyond the stated purposes to fulfill legal obligations (e.g., statutory retention requirements) in accordance with Article 6(1)(c) of the GDPR.
Otherwise, the legal basis for data processing is Article 6(1)(f) of the GDPR. Our legitimate interest arises from the purposes for data collection listed above.
Where special categories of personal data are processed in accordance with Article 9(1) of the GDPR, the legal basis for this is Article 9(2)(f) of the GDPR.
If you have provided us with separate consent, for example for marketing communications via email or for the processing of photographs taken at events, your personal data will be processed on the basis of Article 6(1)(a) and Article 7 of the GDPR.
Consents are logged in order to be able to provide proof of them in accordance with legal requirements. This includes the time of consent along with any prior request from us, the IP address used if applicable, the personal data provided by you such as salutation, title, first name, last name, company, address, email address, telephone number (landline and/or mobile), as well as the text of the privacy notice provided with the request for consent.
You can revoke your consent at any time with effect for the future in accordance with Art. 7(3) GDPR, for example by sending an email with the subject line "Revocation of consent" to the address Datenschutz@BRL.de.
We only store your data for as long as is necessary to fulfill the purpose of processing your data, i.e., for example, for the purpose of contract execution and/or answering your inquiries and for the enforcement and defense of civil law claims arising from the contractual and statutory obligations existing with you until the end of the year following the statute of limitations for all mutual claims, or as long and to the extent that storage is required by law or to comply with any objection to advertising.
Data collected when visiting the website (access data) is generally stored for a period of 3 days.
If we have processed your data as part of an application process, we will delete it six months after the end of the application process, provided that the application did not lead to an employment relationship with us or you have not expressly consented to being included in our applicant database. If we have received your application from a commercial recruitment agency, we will store this data, notwithstanding the above, for the period during which mutual claims can be asserted under the terms of the contractual relationship between the recruitment agency and us (e.g., commission after subsequent hiring). Such data will be deleted no later than 24 months after the referral.
In the event that you have given us your consent to data processing, we will store your data until you revoke your consent. If you do not revoke your consent, we will delete your data in any case 5 years after our last contact.
The above deletion periods do not apply if statutory provisions (e.g., retention periods) prescribe a longer storage period.
Data processed in the course of legal practice must be retained for six years until the end of the calendar year in which the respective proceedings were concluded, for professional legal reasons (Section 50 BRAO). This excludes data that is classified, for example, as business correspondence or as relevant for accounting or professional legal purposes. The respective applicable statutory retention obligations apply here.
Payment data is stored for at least 10 years in accordance with the requirements of the German Fiscal Code (Section 147(4) AO).
Your personal data will not be transmitted to third parties for purposes other than those listed below.
We only share your personal data with third parties if:
To the extent necessary for the aforementioned purposes, we transmit your data, where required, to entities such as tax authorities, tax advisors, auditors or other consultants, logistics service providers, fee collection agencies, or payment service providers.
Furthermore, we utilize the support of external service providers, known as data processors, in certain areas to whom we pass on your data. These data processors may only use your data for the purposes specified by us; they are carefully selected and regularly monitored by us to ensure the protection of your data. We have concluded data processing agreements with all service providers in accordance with Art. 28 GDPR, and the service providers process your data exclusively according to our instructions.
The service providers we use include, among others:
Insofar as you have provided us with your consent, we will also share your data with our affiliate, BRL Consulting & Training GmbH, Caffamacherreihe 16, 20355 Hamburg, provided this is covered by your consent. BRL Consulting & Training also processes your data on the basis of Art. 6 (1) (a) and Art. 7 GDPR. Any withdrawal of your consent automatically extends to the aforementioned BRL Consulting & Training GmbH.
With regard to the personal data concerning you, you have the right to access, rectification, erasure, restriction of processing, objection to processing, data portability, and the right to lodge a complaint with a supervisory authority. Provided that the legal requirements are met, you may:
To exercise your rights, please contact us, for example by email at Datenschutz@BRL.de.
We have embedded YouTube videos into our online services. YouTube is a broadcasting service that allows us to post and link video clips for free to showcase our company. The service at de.youtube.com is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
We embed these videos in accordance with Art. 6(1)(f) GDPR, based on our legitimate interest in providing you with this content and functionality.
The videos on our website are hosted on http://www.YouTube.com and can be played directly from our site. The videos are all embedded in "enhanced privacy mode" / "two-click solution." Despite this "enhanced privacy mode," it cannot be ruled out that YouTube and/or Google may, among other things, become aware of your assigned IP address before you click the "Play" button. If you wish to prevent the information collected during this process from being associated with your YouTube member account, you must log out of your YouTube member account before visiting a website with embedded YouTube videos.
The processing of personal data in connection with the embedded YouTube videos is based on Google's privacy policy, where you can also find further information on the purpose and scope of data processing, as well as your rights and settings options for protecting your privacy.
In this process, Google may also share personal data with other third parties within its corporate group, which may result in the transfer of personal data to the USA and other third countries.
Google is certified under the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA designed to ensure compliance with European data protection standards for data processing in the USA. US companies that have certified themselves under the Data Privacy Framework commit to adhering to these data protection requirements. Further information can be obtained from the provider at the following link:
https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active
Our website uses cookies to make our site more user-friendly, effective, and secure. Cookies are small text files that are placed on your device and stored by your browser. Some cookies are technically necessary to provide certain website functions (e.g., login or language settings).
Furthermore, we use cookies for analysis and marketing purposes, particularly in connection with Google Analytics and Google Ads Conversion Tracking. These cookies allow us to evaluate the behavior of website visitors and to optimize our online services and advertising.
Our website uses the web analytics service Google Analytics, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies to enable an analysis of your use of the website. The information generated by the cookie about your use of this website (including your IP address) is generally transmitted to a Google server in the USA and stored there.
We use Google Analytics exclusively with IP anonymization enabled ("anonymizeIP"), which ensures that your IP address is truncated by Google within member states of the European Union or other states party to the Agreement on the European Economic Area.
Processing is based on Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest in analyzing user behavior to optimize our website and advertising).
Our website also uses Google Ads conversion tracking. When you reach our website via a Google ad, a cookie is placed on your device, which allows us to measure the success of our advertisements (e.g., whether a purchase or contact request has been made). These cookies expire after 30 days and are not used for personal identification.
The use of Google Ads may also result in the transfer of personal data to the USA. Google is certified under the EU-U.S. Data Privacy Framework, which ensures an adequate level of data protection.
You can revoke your consent to the use of cookies for analysis and marketing purposes at any time via the cookie settings on our website. You can also generally prevent or restrict the storage of cookies in your browser settings. Please note, however, that this may limit the functionality of the website.
Further information on data processing by Google can be found in Google's privacy policy at:
https://policies.google.com/privacy
On this website, data is collected and stored for marketing, market research, and optimization purposes using the SalesViewer® technology provided by SalesViewer® GmbH, based on the legitimate interests of the website operator (Art. 6(1)(f) GDPR).
For this purpose, a JavaScript-based code is used to collect company-related data and its corresponding usage. The data collected with this technology is encrypted using a non-reversible one-way function (known as hashing). The data is immediately pseudonymized and is not used to personally identify visitors to this website.
Data stored by SalesViewer® will be deleted as soon as it is no longer required for its intended purpose and provided that there are no statutory retention obligations to the contrary.
You may object to the collection and storage of data at any time with future effect by clicking on this link https://www.salesviewer.com/opt-out to prevent future tracking by SalesViewer® on this website. An opt-out cookie for this website will be placed on your device. If you delete your cookies in this browser, you will need to click this link again.
This privacy policy is currently valid and was last updated on November 1, 2026.
It may become necessary to amend this privacy policy due to the further development of our website and services, or as a result of changes in legal or regulatory requirements.
