Privacy statement

This statement explains which personal data is processed when you visit bpm360podcast.com, use the chat assistant, send a guest request or contact us, and which rights you have. We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG).

Controller

bpExperts GmbH
represented by Dr. Jochen König, Markus Wolf, Dr. Russell Gomersall
Frankfurter Straße 39 / Stadthof 16 A, 63065 Offenbach am Main, Germany
Tel: +49 151 222 344 96 · info@bpexperts.de

Data Protection Officer

HSDK GmbH, Dirk Schell
Eschersheimer Landstr. 42, 60322 Frankfurt am Main, Germany
www.hsdk-privacy.com · data-privacy@bpexperts.de

Hosting and server log files

This website runs on Railway (Railway Corporation, USA) in an EU region. When you visit a page, your browser automatically transmits data that is stored in server log files: IP address, date and time, requested page, referrer, browser type and operating system. We process this data to deliver the website and to keep it stable and secure (Art. 6(1)(f) GDPR). Log data is not merged with other data sources. Episode thumbnails and images are delivered through our own server, so viewing the episode list does not connect your browser to YouTube or other third parties. Fonts are hosted on our own server as well.

Web analytics (Umami)

We use Umami, an open-source analytics tool that we host ourselves (on Railway, EU region), to understand which episodes and pages are used. Umami sets no cookies, does not store IP addresses and does not track you across websites; visits are counted anonymously. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR). You can block the analytics script with any content blocker without losing functionality.

YouTube videos

Episode pages offer the episode as a YouTube video (YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The player is not loaded until you click it; before that, no data is sent to YouTube. When you click play, the video is loaded in YouTube’s privacy-enhanced mode (youtube-nocookie.com). Your IP address and device information are then transmitted to Google, which may store information on your device and may transfer data to the USA (Google LLC is certified under the EU-U.S. Data Privacy Framework). The legal basis is your consent by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time by leaving or reloading the page. Details: Google privacy policy.

AI chat assistant

The chat assistant (bottom right) helps you find episodes. It is provided by us and runs on Railway (EU region). When you send a message, the conversation is transmitted to our chat service and to Anthropic (Claude API, USA), which generates the answer as our processor under a data processing agreement; under that agreement Anthropic does not use the content to train its models. Transfers to the USA are safeguarded by the EU Standard Contractual Clauses.

We log the questions and answers together with an anonymous session ID and technical metrics (response time, token counts) to operate the assistant, detect misuse and improve its answers. The logs are stored with Railway and with our log service Better Stack (Better Stack, Inc.). IP addresses are used only briefly in memory for rate limiting and are not logged. Logs are kept only as long as needed for these purposes and are then deleted. Legal basis: our legitimate interest in offering an interactive way to find content and in improving it (Art. 6(1)(f) GDPR). Using the assistant is voluntary. Please do not enter personal or confidential information into the chat. The assistant sets no cookies and stores nothing on your device; the conversation is discarded when you reload the page. AI-generated answers can be wrong — please check the linked episodes.

Contact by e-mail

If you write to us (e.g. to questions@bpm360podcast.com or info@bpexperts.de), we process your e-mail address, name and the content of your message to answer your enquiry, e.g. about a guest appearance (Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR where it concerns a contract). We delete the data once the enquiry is resolved and no statutory retention obligation applies.

Guest requests and recording dates

On the page “Be a guest” you can offer to appear on the podcast and reserve a recording date. We process the details you enter (name, e-mail address, link to your LinkedIn profile, proposed topic, your reasons, the date you chose, the time zone in which you viewed the dates — your browser’s, unless you chose another — and the time of your consent) to review your request, to answer you and to organise the recording. The hosts look at your public LinkedIn profile for this purpose. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by e-mail, and steps prior to entering into an agreement on your appearance (Art. 6(1)(b) GDPR).

The request is stored in the calendar of our podcast mailbox, and the e-mails to you and to the hosts are sent from that mailbox; both run on Microsoft 365 (Microsoft Ireland Operations Limited, processor). To help the hosts read requests quickly, the proposed topic and your reasons — without your name or contact details — are sent to Anthropic (Claude API, USA, processor as described under “AI chat assistant”), which writes a short note on how the topic relates to earlier episodes. The hosts alone decide on every request.

If none of the offered dates suits you, you can send the request without a date and, optionally, tell us when you would be available. No date is reserved and nothing is stored on the website: your details travel only in the encrypted confirmation link sent to you (valid for two days) and then in the e-mail to the hosts and the hosts’ encrypted links (valid for 90 days). If the hosts would like to record with you, they agree a date with you by e-mail and enter it; from then on your details are stored in the calendar appointment as for any other confirmed recording. If they decline, nothing about the request remains on the website.

If you do not confirm your e-mail address, the reservation lapses and your details are deleted from the calendar. If we decline a request, your details are removed from the calendar with the decision. For confirmed recordings we keep the details as long as needed to prepare and carry out the recording. E-mails are deleted as described under “Contact by e-mail”. Requests are rate limited by IP address, which is held in memory only briefly and not logged.

Podcast guests

For guests of the podcast we publish name, role and company, a short profile, a photo and links (e.g. LinkedIn) on the guest and episode pages, together with the recorded conversation. We do this on the basis of the guest’s agreement to appear on the podcast (Art. 6(1)(a)/(b) GDPR) and our legitimate interest in presenting the podcast (Art. 6(1)(f) GDPR). Guests can ask us at any time to correct or remove their profile.

To keep the episode and guest pages up to date, the titles and show notes of our published episodes (taken from our YouTube channel) — which can contain the names, roles and companies of guests — are sent to Anthropic (Claude API, USA, processor under a data processing agreement as described under “AI chat assistant”). Anthropic assigns topics to each episode and suggests which guests appear in it. When a new episode is published, a guest who is named in the episode title and identified with high confidence is added to the guest pages automatically, with name and role/company as stated in the episode; all other suggestions are checked by the hosts before anything is published. Legal basis: our legitimate interest in presenting the podcast and its guests accurately (Art. 6(1)(f) GDPR). This information is already public on the episode itself. Guests can ask us at any time to correct or remove their profile.

Links to other websites

Links to YouTube, LinkedIn, audio platforms and guests’ websites are ordinary links: no data is transmitted to these services until you click them. Their own privacy policies then apply.

Cookies and local storage

This website sets no cookies and does not use local storage. A consent banner is therefore not needed. The YouTube player may store information on your device only after you have clicked to load it (see above).

Recipients and international transfers

We use the service providers named above (Railway, Anthropic, Better Stack; Microsoft 365 for guest requests and e-mail; YouTube only after you load a video) as processors or, for YouTube, as an independent controller. Where data is processed outside the EU/EEA, the transfer is safeguarded by an adequacy decision (EU-U.S. Data Privacy Framework) and/or EU Standard Contractual Clauses. We do not sell personal data. Details are available from our Data Protection Officer.

Retention

We store personal data only as long as necessary for the purposes described above or as required by statutory retention periods, and then delete it.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on your consent, you can withdraw it at any time with effect for the future.

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop processing unless there are compelling legitimate grounds.

To exercise your rights, contact us at info@bpexperts.de or our Data Protection Officer at data-privacy@bpexperts.de.

Right to lodge a complaint

You can lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.

Automated decision-making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. The chat assistant only answers your questions; it makes no decisions about you. Guest requests are decided by the hosts personally; the AI-written topic note is an aid for reading, not a decision. Adding a guest profile from an episode title (see “Podcast guests”) only reproduces what the episode already states and has no legal or similarly significant effect.

Last updated: 12 November 2026.