Privacy

The controller responsible for processing your personal data is:

Korsawe Consulting GmbH

Maximilianstraße 2, 80539 Munich, Germany

Managing Director: Lea Marie Korsawe

Email: info@korsaweconsulting.com

Full company details are available in the legal notice (Impressum).

Korsawe Consulting GmbH is not required to appoint a data-protection officer under section 38 of the Federal Data Protection Act (BDSG). Data-protection queries should be addressed directly to the contact details in the legal notice.

We process personal data through the valuation calculator on the following legal bases:

lit. a (consent): sending the complete report after successful double opt-in and, separately and only if actively selected, sending the quarterly newsletter.
lit. b (contract or pre-contractual measures): provision of the requested valuation results and the complete report.
lit. f (legitimate interest): running the application, keeping server logs, defending against abusive use, and ensuring IT security. We also rely on legitimate interests to respond to and assess business inquiries and to identify our advisory services that are relevant to those inquiries. We weigh these interests against the individual’s interests and fundamental rights in each case. You may object at any time to future processing for direct marketing (Art. 21 GDPR).

Processing on the basis of lit. c (legal obligation) or lit. d (vital interests) does not occur in connection with the valuation tool.

The valuation tool processes the following categories of data:

Calculator inputs: revenue, EBITDA, net debt, sector, sub-segment, country, EBITDA trend, owner dependence, and share of recurring revenue. These inputs are first processed only in the browser; they are stored only once the complete report by email has been actively requested.
Contact and request information: email address, name, company, email confirmation status, report request status, newsletter status, the version of the Terms of Use accepted, and the time of each acceptance.
Consent evidence: exact consent text, versions, purposes, language, form source, timestamp, truncated user-agent string, and hashed IP address.
Technical data: IP address, user-agent string, timestamp, referrer; written to the server logs of the hosting platform Vercel. To defend against abusive use, a hashed IP value with a timestamp is also stored briefly in the database when a report request is submitted and is deleted automatically no later than the following day (legal basis: Art. 6 (1) lit. f GDPR).

The categories listed above are processed for the following purposes:

Calculator inputs: calculating the indicative equity value range in the browser and, after a full report is requested, storing only the information needed to record that calculation.
Contact and request information: sending the confirmation email, matching the confirmation to the request, delivering the full report, responding to the inquiry, identifying relevant advisory services, and managing optional newsletter consent.
Consent evidence: proof of consent and Terms acceptance.
Technical data: running the application, security, abuse defense, and error analysis.

The service providers below are engaged to operate the valuation tool. Data-processing agreements under Art. 28 GDPR are in place where personal data is in scope.

6.1 Supabase

Purpose: storing contact and request information, consent records, and saved calculations, as well as temporarily storing hashed IP values to prevent misuse.
Provider: Supabase, Inc. (USA).
Place of processing: Germany (Amazon Web Services, region eu-central-1, Frankfurt am Main).
Third-country transfer: the data is stored in Frankfurt. Where access from the USA is possible for operations or support, it is covered by the data-processing agreement and EU standard contractual clauses.

6.2 Resend

Purpose: sending confirmation emails, report links, and optional newsletters.
Provider: Plus Five Five, Inc. (Resend), San Francisco, USA.
Sending domain: notifications.mittelstandswert.de (dedicated subdomain).
Place of processing: Ireland (region eu-west-1).
Third-country transfer: email delivery is processed in Ireland. Where access from the USA occurs, it is covered by the EU-US Data Privacy Framework, under which Resend is certified, and, in addition, by EU standard contractual clauses.

6.3 Vercel

Purpose: application hosting, edge delivery, server logs.
Provider: Vercel Inc., Covina, California, USA.
Place of processing: Germany (Frankfurt region, fra1). Vercel Inc. is a US company.
Third-country transfer: function execution and delivery take place in Frankfurt. Where access from the USA occurs, it is covered by the EU-US Data Privacy Framework, under which Vercel is certified, and, in addition, by EU standard contractual clauses.

6.4 Sanity

Purpose: managing valuation multiples, editorial content, and legal notices.
Provider: Sanity Inc. (USA).
Place of processing: Belgium (Google Cloud Platform, region europe-west1).
Note: no personal client data is stored here; only public editorial content and reference data.

Processing takes place entirely within the EU: Supabase and Vercel in Frankfurt, Resend in Ireland, Sanity in Belgium. The providers Supabase, Vercel, and Resend are US companies. Where their US parent companies can access data in operations or support, this rests on suitable safeguards, in particular the EU-US Data Privacy Framework and EU standard contractual clauses, together with supplementary technical and organizational measures.

We collect your email address when you request the full report after completing the calculator. Confirmation takes two steps:

1. You enter your email address in the form.
2. You confirm it using the link in our confirmation email.

Only after this second step is the request marked confirmed and the complete report sent. The confirmation link is valid for 72 hours. Data captured before confirmation is deleted automatically no later than 21 days after collection if no confirmation arrives. Optional newsletter consent is separate from the report and can be withdrawn at any time with effect for the future.

Personal data is retained only for as long as necessary for the relevant purpose or as required by statutory retention obligations.

Unconfirmed report requests: until confirmation, and no longer than 21 days from collection; deleted automatically thereafter.
Confirmed report requests: until withdrawal or deletion, and no longer than 24 months from the last contact.
Newsletter status: until withdrawal; a minimal suppression or evidence record may be retained to honor the withdrawal.
Server logs (Vercel): depending on the plan, no longer than 30 days.
Abuse prevention (hashed IP values, Supabase): deleted automatically no later than the following day.
Saved calculations (Supabase): for as long as needed for the requested report, and no longer than the associated confirmed report request.

Subject to the applicable legal requirements, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection. You can exercise these rights by contacting us at the address in the legal notice; no specific form is required.

Withdrawal of consent (Art. 7 (3) GDPR): You may withdraw consent at any time by contacting us at the address in the legal notice; no specific form is required. Withdrawal applies to future processing and does not affect the lawfulness of processing before withdrawal.

Objection to direct marketing (Art. 21(2) GDPR): Where personal data is processed for direct-marketing purposes, you may object at any time without giving reasons. The data will then no longer be processed for those purposes.

Right to lodge a complaint (Art. 77 GDPR): data subjects may lodge a complaint with a supervisory authority. The competent supervisory authority is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

The valuation calculator uses only strictly necessary cookies, such as those for your current session and language preference. No consent under section 25 (1) TDDDG is required for this; the processing rests on section 25 (2) TDDDG. We do not use third-party trackers, marketing cookies, or analytics cookies.

The controller takes technical and organizational measures to ensure a level of security appropriate to the risk. These include TLS transport encryption, access restrictions, role-based permissions, data minimization, separation of production and editorial systems, and periodic review of data-processing agreements.

This privacy notice is updated whenever the processing, the services engaged, or the legal framework changes. The version in force at the time of collection governs.