Privacy Notice

1. Controller

Leadership Performance Systems (LPS)
Owner: Prof. Dr. Matthias Müller-Wiegand
Weyerstr. 48–52
50676 Cologne
Germany
info@leadershipperformancesystems.com

2. Hosting and technical delivery

This website, the customer portal, the related database and the business email mailboxes are hosted by ALL-INKL.COM – Neue Medien Münnich, Germany. The hosting provider supplies the technical infrastructure as a processor. According to ALL-INKL, its data centres are located in Germany.

When the website is accessed, technically necessary connection and log data are processed. This may include the IP address, date and time of access, requested URL, referrer, browser/device information, and status or error data. Processing is necessary to provide the website securely, reliably and without errors and to detect misuse and attacks. The legal basis is Art. 6(1)(f) GDPR. Log data are retained only for as long as necessary for operation, troubleshooting and security; longer storage may be required in the event of a security incident or a legal obligation.

3. Contact and project enquiries

The website enquiry form does not automatically transmit the data entered to our web server. It creates an email draft locally which you send yourself using your email application. If you contact us by email, we process the contact details and content you provide in order to handle your enquiry. Where the communication concerns a contract or pre-contractual steps, the legal basis is Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR applies based on our legitimate interest in handling business enquiries. Statutory retention requirements remain unaffected.

4. Checkout and payments through Paddle

LPS software is sold using Paddle as Merchant of Record. Paddle Checkout is not loaded merely because a product page is visited. Paddle.js is loaded from Paddle infrastructure and the checkout is opened only after you actively select a checkout button.

Within checkout, Paddle processes contact, billing, payment, device, browser and transaction data under its own data-protection responsibility for order processing, payments, taxes, fraud prevention and invoicing. Full card or other payment credentials are not stored in the LPS database.

After a completed purchase, Paddle provides LPS with the data required for product fulfilment, licensing and support. Our systems may store in particular the Paddle customer ID, email address, name (if provided), language/locale, transaction ID, currency, transaction status, invoice number (if available), purchased price/product reference, product version, licence plan, entitlement status and information about refunds or chargebacks. The legal bases are Art. 6(1)(b) GDPR for contract performance and product fulfilment, Art. 6(1)(c) GDPR for legal obligations and Art. 6(1)(f) GDPR for fraud prevention, support and the establishment, exercise or defence of legal claims.

Depending on the Paddle entity and subprocessors involved, Paddle may process data outside the EU/EEA. Paddle provides information about controller entities, international transfers, retention and data-subject rights in its privacy notice: Paddle Privacy Notice.

5. LPS customer portal, sign-in and licence management

The LPS customer portal is intended for buyers with an active product entitlement. Passwordless sign-in uses the email address associated with the purchase. A one-time sign-in link is valid only for a short period. The actual sign-in token is stored server-side only as a hash; a cryptographically hashed IP value may also be stored to help secure the sign-in process.

After successful sign-in, a technically necessary session cookie named LPS_PORTAL is used. It is configured as Secure and HttpOnly, uses SameSite=Lax and generally expires with the browser session. This cookie is required for the portal functionality requested by the user.

For contract and licence management, the portal processes in particular product, version, licence plan, licence status, term/update information, permitted device count, device codes and optional device labels entered by you. Processing is necessary to provide, secure and administer the purchased software licence and is based on Art. 6(1)(b) and (f) GDPR.

6. Email from the customer portal

Sign-in links and necessary transaction or support communications are sent using the mail infrastructure hosted by ALL-INKL. In particular, recipient address, subject, message content and technical delivery data are processed. Processing is based on Art. 6(1)(b) GDPR for the user/contractual relationship and Art. 6(1)(f) GDPR for secure operation of the portal.

7. Public demos

The public demos of the LPS Integral Leadership Performance Analyzer, LPS Leadership Impact & ROI Suite and LPS Organizational Viability Analyzer use fictional or simulated demonstration data. Calculations take place in the browser. Public users are not provided with functions for uploading, storing or exporting real personal or company data. Please do not enter real, personal or confidential data into these demos.

8. Cookies, tracking and external content

LPS currently does not use its own analytics, advertising or social-media tracking cookies on the public website pages. Fonts and the Plotly library used for the demos are served locally. Technically necessary session information in the customer portal and technically necessary functions of an actively requested Paddle Checkout remain unaffected. Paddle may use cookies and similar technologies in checkout in accordance with its own privacy and cookie rules.

Some pages contain links to external websites, for example literature or information sources. The privacy rules of the relevant third-party provider apply only when you follow such a link.

9. Recipients and processors

Personal data are disclosed only to parties that need them for the purposes described above. These include in particular ALL-INKL as hosting/email provider and Paddle in connection with checkout, payment, purchase processing and its billing customer portal. Other recipients are involved only where required by law, necessary for contract performance or supported by a separate legal basis.

10. Retention

We retain personal data only for as long as required for the relevant purpose. Customer, transaction, licence and support data may be retained for the duration of the contractual/licence relationship and beyond where statutory retention periods apply or where necessary for the establishment, exercise or defence of legal claims. Short-lived sign-in information is retained only for the technically necessary period. Data are then erased or anonymised unless legal or security reasons require continued retention.

11. Your rights

Subject to the conditions of the GDPR, you have in particular the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, consent may be withdrawn for the future.

To exercise your rights, contact info@leadershipperformancesystems.com.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority. For our establishment in North Rhine-Westphalia, the competent authority is in particular the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW): www.ldi.nrw.de.

13. Automated decision-making

No solely automated decision producing legal or similarly significant effects within the meaning of Art. 22 GDPR is made on the basis of data collected through this website or the LPS customer portal.

14. Version

Version dated 9 August 2026. This privacy notice will be updated if the services used or processing activities materially change.

Language note: The German privacy notice is the authoritative version in the event of differences in interpretation.