Privacy Policy

1. Controller and contact

Anding & Company GmbH
Bavariaring 24
80336 Munich, Germany
contact@anding.company

Anding & Company GmbH has not appointed a data protection officer. Please use the contact details above for all privacy matters.

2. Website delivery and security logs

When you visit this website, technical information may be processed automatically, including your IP address, access time, requested page, referrer, browser, device and operating-system information. This is necessary to deliver the website, maintain its stability and protect it from misuse.

Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is secure, stable and technically error-free operation. Security logs are retained only as long as required and then deleted or anonymised, unless longer retention is legally required.

3. Member accounts and authentication

To provide the private member area, we process your email address, encrypted authentication credentials, account identifiers, login events and password-recovery information. If you choose Google sign-in, Google and our authentication provider exchange the information required to authenticate you. Google’s own privacy terms apply to its service.

Legal bases: Art. 6 (1)(b) GDPR for the requested membership service and Art. 6 (1)(f) GDPR for account security. Authentication information stored on your device is technically necessary under § 25 (2) no. 2 TDDDG.

4. Profiles, materials and discussions

Members may provide a display name, university, field of study, graduation year, interests and a biography. We also process discussion posts, questions and ideas, including the author name and posting time. These details support club participation, learning, networking and preparation for potential future opportunities at Anding.

Legal bases: Art. 6 (1)(b) GDPR for the membership service and Art. 6 (1)(f) GDPR for community operation and security. Profile information is visible only to the member unless a feature explicitly states otherwise. Discussion posts are visible to signed-in club members.

Please do not post confidential client information, special-category personal data under Art. 9 GDPR, or personal data about third parties without a lawful basis.

5. Thesis interview contact requests

If you request an introduction, we process the details you provide by email, such as your name, contact details, research topic and requested expertise. We use this information to assess and, where appropriate, arrange an introduction. We share it with a proposed contact only where necessary and after an appropriate basis for the introduction has been established.

Legal bases: Art. 6 (1)(b) GDPR for handling your request and Art. 6 (1)(f) GDPR for facilitating relevant professional and academic exchange.

6. Hosting and service providers

We use specialist providers for hosting, data storage, authentication and technical operation. They process personal data only as needed and subject to contractual data-protection obligations. Data may be processed outside the European Economic Area. Where this occurs, we rely on an adequacy decision, including the EU–US Data Privacy Framework where applicable, or safeguards such as the European Commission’s Standard Contractual Clauses under Art. 46 GDPR.

7. External services and links

The member area links to the Anding Value Canvas at valuecanvas.app and may link to other external resources. When you follow an external link, the destination provider processes data under its own privacy policy. We have no control over external content or data-protection practices. No external service is loaded merely by displaying these links.

8. Cookies and similar technologies

This service uses only storage and similar technologies that are technically necessary for account authentication, security and essential preferences. These do not require consent under § 25 (2) no. 2 TDDDG. We currently do not use optional analytics or advertising trackers. If this changes, optional technologies will not be activated before the required consent has been obtained.

9. Retention and deletion

We retain account, profile and community data while your club account is active. After account closure or a valid deletion request, data is deleted or anonymised unless legal retention duties or legal claims require longer storage. Discussion content may be anonymised where removal would impair an ongoing discussion. Password-reset links expire automatically. Contact-request records are deleted when the request is resolved and no retention obligation remains.

10. Your rights

Subject to the relevant legal requirements, you have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent (Art. 7 (3) GDPR)

You may also complain to a supervisory authority. The authority responsible for our Munich office is the Bavarian State Office for Data Protection Supervision (BayLDA), Postfach 1349, 91504 Ansbach, Germany.

11. No automated decisions; no obligation to provide data

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. There is no legal obligation to provide personal data. However, required account information is necessary to access the private member area.

12. Changes

We may update this policy when legal requirements, processing activities or the service change. The version available here at the time of your visit applies.