Privacy policy

This website is deliberately built to be data-minimal: no third-party trackers, no fonts from Google, no embedded videos from YouTube or other platforms. If you do not use the contact form, you will not receive any cookies. Below we explain which data is processed when you visit this website, on which legal basis this happens and what rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Dr. Sebastian Rosengrün
Tarnauer Weg 5
14822 Brück
Germany
Phone: +49 1575 6899 440
Email: hello@moral-ai-leader.com

There is no legal obligation to appoint a data protection officer.

2. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content – such as requests you send us via the contact form – this website uses SSL/TLS encryption. You can recognize an encrypted connection by the lock symbol in your browser’s address bar and by “https://” in front of the URL.

3. Hosting

This website is hosted on servers in Germany by:

ALL-INKL.COM – Neue Medien Münnich
Inh. René Münnich
Hauptstraße 68
02742 Friedersdorf
Germany
all-inkl.com/datenschutzinformationen

A data processing agreement (Art. 28 GDPR) has been concluded with the hosting provider. When the website is accessed, the server writes short-lived log files – as is technically necessary – which contain, among other things, connection information. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the website.

4. Own, cookieless audience measurement

To analyze the use of this website, we do not use Google Analytics, Matomo, Plausible or any comparable third-party tool. Instead, we use a self-developed, server-side statistics system that runs entirely on the server in Germany mentioned above. Audience measurement takes place without cookies, without LocalStorage and without comparable storage mechanisms on your device. The following information is processed:

• the page accessed and its title,
• the referring URL (referrer) – domain and path only, without search terms or other query parameters,
• device category, browser family and operating system (derived from the user agent; the full user agent is not stored),
• the primary language of the browser (e.g. “en-US”),
• the size of the browser window (not the screen resolution),
• time spent on the page and clicked elements (e.g. “Play welcome video” or “Buy at De Gruyter”).

To group page views from the same day, a pseudonymous hash that changes daily is generated (SHA-256 of IP address, user agent, a secret key and the current date). The IP address itself is not stored; recognition beyond the change of day, profiling or disclosure to third parties does not take place. If your browser sends the “Do Not Track” signal, no page view is recorded. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a data-minimal analysis of usage in order to improve our offering.

5. Fonts

This website uses the fonts Montserrat and Figtree. Both are delivered locally from our own server. No connection is made to Google Fonts or other external font providers.

6. Welcome video

The welcome video on the home page is delivered from our own server, not via YouTube, Vimeo or any other platform. The video file is only loaded when you click “Play”. This only creates the server log files described in section 3; no data is transmitted to third parties.

7. No external scripts or embedded content

This website does not use external JavaScript libraries, CDNs, advertising or retargeting pixels, or embedded content (e.g. YouTube videos, social media buttons, maps). All scripts, stylesheets, images and videos are delivered from our own server. References to external services – such as De Gruyter, LinkedIn, the German-language site mensch-macht-maschine.com or the authors’ personal websites – are plain links; data is only transmitted to these providers when you click the link. The privacy policy of the respective provider applies there.

8. Contact form and email contact

If you send us a request via the contact form or by email, we process the data you provide (name, email address, company if applicable, selected topic, content of your message) in order to process your request and for any follow-up questions.

If your request is aimed at concluding or preparing a contract – such as a workshop – the legal basis is Art. 6(1)(b) GDPR; otherwise it is our legitimate interest in responding to your request in accordance with Art. 6(1)(f) GDPR.

To protect against misuse (spam, automated requests), we use the following technical measures:

• an invisible honeypot field to detect bots,
• a CSRF token to secure the session,
• a time check (forms submitted very quickly are discarded),
• a limit on the number of requests per IP address; for this purpose your IP address is stored only as a hash combined with a secret key and deleted after 30 days at the latest.

The CSRF token requires a server-side session. As soon as you click into or fill in a field of the contact form, a technically necessary session cookie is set:

This cookie only contains a random session ID and is not used for tracking or advertising. The legal basis is § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(f) GDPR; our legitimate interest lies in protection against abusive form submissions.

Your request is sent to our mailbox via encrypted email and additionally stored in a database on the hosting provider’s server so that no request is lost. We delete your request as soon as it has been dealt with conclusively and no statutory retention obligations prevent deletion, usually after 24 months at the latest.

9. Storage period

Personal data is only stored for as long as is necessary for the respective purposes or as required by statutory retention obligations. In detail:

• server log files of the hosting provider: according to its privacy information (usually a few days),
• statistics data from audience measurement: 90 days at most; the daily pseudonymous hashes can no longer be attributed after the change of day,
• contact requests: until they have been dealt with conclusively, for no longer than 24 months (subject to statutory retention periods, e.g. § 147 AO, § 257 HGB),
• IP hashes for limiting form requests: 30 days at most.

10. Recipients and transfers to third countries

Your data is only passed on to the hosting provider named above, which processes it on our behalf in Germany.

No data is transferred to countries outside the European Economic Area.

11. No automated decision-making

There is no decision based solely on automated processing – including profiling – within the meaning of Art. 22 GDPR.

12. Your rights

You have the following rights with regard to the personal data concerning you at any time:

• right of access (Art. 15 GDPR),
• right to rectification of inaccurate data (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing (Art. 21 GDPR),
• right to withdraw consent with effect for the future (Art. 7(3) GDPR).

To exercise your rights, an informal message to hello@moral-ai-leader.com is sufficient.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). The competent authority is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany
www.lda.brandenburg.de

14. Changes to this privacy policy

We adapt this privacy policy when legal requirements or the technology of this website change. The version published here applies.

Last updated: September 2026