Privacy Policy

The following privacy policy is intended to inform you about which of your personal data (hereinafter also referred to simply as ‘data’) we process, for what purposes and to what extent. This policy applies to all processing of personal data carried out by us when you visit our website or contact us.
The terms used are gender-neutral.

Date: 18 June 2026

The controller responsible for the processing of personal data on this website is

Holmberg GmbH & Co. KG
Ohlauer Str. 5–11
10999 Berlin
Germany

Authorised representatives: Lutz-Michael Pöppel, Thorsten Pöppel
Email address: info@holmco.de
Telephone: +49 30 617 80-0

If you have any questions, suggestions or complaints, you can also contact our external Data Protection Officer, Mr. Freyer.
Email address: datenschutz@freyer-berater.de

freyer consultants management systems

Berliner Straße 100
13189 Berlin
Germany

Rights of data subjects under the GDPR (General Data Protection Regulation): As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:

Personal data may be processed by so-called ‘cookies’ or other “third-party services”. Cookies are text files that are stored on your device.

For technical reasons, personal data is logged each time you access our website and each time a page is viewed, in order to enable you to visit and navigate our website.

Session cookies: at the end of your visit to our website.
Persistent cookies (for security functions): after 45 days.
IP addresses and login attempts (to prevent malicious login attempts): after 24 hours.
Language settings: after one year.

We use a consent management solution to obtain users’ consent to the use of cookies. This process is used to obtain, log, manage and withdraw consent, in particular with regard to the use of cookies and similar technologies used to store, read and process information on users’ devices. A pseudonymous user identifier is created, which is stored together with the time of consent, details of the scope of consent (e.g. relevant categories of cookies and/or service providers) and information about the browser, the system and the end device used:

We use the service provider Borlabs GmbH, Hamburger Str. 112, 2083 Hamburg, Germany, for consent management. An individual user ID, language, types of consent and the time at which consent was given are stored on the server and in a cookie on the user’s device.

We use Google LLC, Gordon House, Barrow Street, Dublin 4, Ireland, as a second provider, utilising Google reCAPTCHA to store a website visitor’s status regarding their cookie preferences. The data is processed within the EU and the USA. For the transfer of personal data to the USA, there is an adequacy decision by the European Commission pursuant to Article 45 GDPR in the form of the EU-US Data Privacy Framework (DPF). Google LLC is certified under the Data Privacy Framework, ensuring an adequate level of data protection for data transfers. In addition, Google has entered into so-called Standard Contractual Clauses (SCCs) in accordance with Article 46 GDPR to safeguard data transfers. These oblige the recipient in the USA to comply with European data protection standards. Further information on data processing by Google can be found at:
https://policies.google.com/privacy

You may withdraw all your consents regarding the use of non-essential cookies at any time by deleting the enabled services from your device’s browser, although data processing carried out up to the time of withdrawal remains justified, or by managing them here:

Web analytics (also known as ‘reach measurement’) is used to analyse visitor traffic to our online offering and may include behaviour and interests in pseudonymous form. With the help of reach analysis, we can, for example, identify at what times our online offering, its functions or content are most frequently used, or encourage repeat visits. It also enables us to identify which areas require optimisation.

In addition, users’ IP addresses are stored. However, we use an IP masking procedure (i.e. pseudonymisation by truncating the IP address) to protect users. Generally speaking, no personally identifiable user data (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimisation; instead, pseudonyms are used. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective processes.

On our website, you will find documents that are password-protected and therefore only accessible to registered customers.

You can contact us by email, telephone, post or via the contact form on our website.

In this section, you will find information on how we handle data relating to individuals who submit reports (whistleblowers), as well as data relating to affected and involved parties, as part of our whistleblowing procedure. Our aim is to provide a straightforward and secure way to report potential misconduct by us, our employees or service providers, particularly in relation to actions that breach laws or ethical guidelines. We also ensure that reports are processed and handled appropriately.

Types of data processed:

Use of our online forms: Please note that it is possible to submit reports anonymously. To ensure the security of your data when using our online forms, we recommend accessing them in your browser’s ‘incognito mode’. How to open an incognito window: a) On a Windows PC: Open your browser and press Ctrl+Shift+N; b) On a Mac: Open your browser and press Command+Shift+N; c) On mobile devices: Switch to private mode via the tab menu.

When you visit our website in normal mode, your browser automatically sends certain information to our server, such as your browser type and version, and the date and time of your visit. This also includes your device’s IP address. This data is temporarily stored in a log file and automatically deleted after 30 days at the latest.

The processing of the IP address serves technical and administrative purposes relating to establishing a connection to our website. It ensures the security, stability and functionality of the whistleblower form and is an important part of our measures to ensure confidential submission of reports.

The processing of the logged data is based on Article 6(1)(f) GDPR. Our legitimate interest here lies in the need for security and the necessity to ensure the technical requirements for the smooth and trouble-free submission of reports.

Provision of your name: You have the option to submit reports anonymously. However, unless prohibited by national legislation, we recommend that you provide your name and contact details. This enables us to investigate the report more effectively and, if necessary, to contact you directly.

If you provide your name and contact details, your identity will be treated with strict confidence. Exceptions to this confidentiality only apply where we are legally obliged to disclose your identity. This may be necessary to protect or defend our rights or the rights of our employees, customers, suppliers or business partners. A further exception applies if it is determined that the allegations were made with malicious intent.

Disclosure of data to third parties: We will only disclose data relating to the reports submitted to third parties under certain circumstances. This will occur either a) if you have given us your express consent to do so, or b) if there is a legal obligation to disclose the data. Potential third parties include public authorities, government bodies, regulatory bodies or tax authorities, where disclosure is necessary to fulfil a legal or regulatory obligation. Furthermore, we may engage solicitors and other specialist advisers in accordance with legal provisions. They are authorised to investigate alleged misconduct and to take necessary action following an investigation, such as initiating disciplinary or legal proceedings. Furthermore, service providers carefully selected and monitored by us may receive data for these purposes (for example, operators of a web-based reporting system). However, these service providers are contractually obliged, within the framework of data processing on our behalf, to comply with the applicable data protection regulations.

Technical and organisational measures: We have implemented the necessary contractual, technical and organisational measures to ensure the security of all data we process. This data is processed exclusively for the specified purposes. Incoming reports are handled by authorised personnel who are granted access to the relevant reports and carry out the subsequent investigation of the facts. Our staff are specially trained and instructed to carry out fact-finding investigations properly and are bound to maintain the strictest confidentiality.