Privacy Policy
Last updated: August 10, 2026
MB International Contracting Service LLC ("we", "us", or "our") operates the websites mb-ics.com and berater.mb-ics.com. This page informs you of our policies regarding the collection, use, and disclosure of personal information when you use either website.
1. Information We Collect
We collect information that you voluntarily provide to us when you use our contact form:
- Name
- Email address
- Company name (optional)
- Training interest / message content
This information is used solely to respond to your inquiry about our SAP training services.
For the SAP MM consultant-trainer private beta application form hosted at berater.mb-ics.com, we collect the information that you voluntarily submit:
- Full name and business email address
- Company and role
- SAP MM experience band
- Your company's frequency of SAP training
- The type of legitimate SAP system access owned by you or your company
- Feedback commitment and preferred language
- Motivation (optional)
- Your required acknowledgement of the privacy information for the application
2. Automatic Data Collection
Our website uses the browser's localStorage feature and — subject to your consent — first/third-party cookies set by analytics and advertising services. We store the following essential items locally without analytics or marketing consent:
- Your language preference (German, English, or Spanish)
- Your consent choice (whether you accepted analytics and marketing cookies)
If you consent to analytics and marketing storage, click-attribution identifiers from advertising platforms (gclid, gbraid, wbraid) and campaign parameters (utm_source, utm_medium, utm_campaign) may be stored in localStorage for up to 90 days to associate later inquiries with the campaign that brought you here. No direct personal identifier is stored alongside these values.
localStorage is not a cookie — it is a browser-based storage mechanism that does not expire automatically and is not transmitted with HTTP requests.
3. Consent Mechanism (Google Consent Mode v2)
When you first visit our website, a consent banner is shown. Until you make a choice, our analytics service is loaded in a "consent-denied" mode (no personalized cookies, no identifiers transmitted). You can choose between:
- "Accept all" – Allows analytics (Google Analytics 4) to use cookies and identifiers. Also allows embedded YouTube video playback.
- "Necessary only" – Keeps analytics in consent-denied mode. Google may still receive anonymous cookie-less pings for aggregate modelling; no personal identifiers are sent. YouTube videos remain blocked.
You can change your consent at any time by clicking the "Cookie settings" link in the page footer or by clearing your browser's localStorage for this site (Settings → Site Data), which will cause the consent banner to reappear on your next visit.
4. Third-Party Services
Our website uses the following third-party services:
- Google Analytics 4 (Google Ireland Limited / Google LLC) – With your consent, we use Google Analytics 4 to understand how visitors use our site (pages viewed, traffic sources, approximate location at city level). IP addresses are anonymized (anonymize_ip: true). Without consent, the tag runs in Consent Mode v2 with analytics_storage set to "denied". Data may be transferred to and processed by Google in the United States on the basis of the EU-U.S. Data Privacy Framework. See Google's Privacy Policy.
- Fonts – We use the fonts DM Sans and Playfair Display, which are hosted locally on our own server. No connection to external font services (such as Google Fonts) is established when you visit our website. No data is transmitted to third parties for font loading.
- YouTube (Privacy-Enhanced Mode) – Our video section contains embedded YouTube videos. Videos are embedded using YouTube's privacy-enhanced mode (youtube-nocookie.com), which reduces tracking. Videos are loaded only when you click to play them and only after you have given consent. YouTube/Google may set cookies when you interact with the video player. See Google's Privacy Policy.
- GitHub Pages – The website at
mb-ics.comis hosted on GitHub Pages. GitHub may collect technical log information (IP addresses, browser type) as part of their hosting service. See GitHub's Privacy Statement. - Vercel hosting (Vercel Inc.) – The private-beta website at
berater.mb-ics.comis hosted on Vercel. For hosting, delivery, reliability, and security, Vercel may process request and server-log data such as IP address, requested URL, timestamp, and browser/device information. Vercel Web Analytics is not enabled on the Berater website. To limit automated abuse, the application endpoint stores only a global submission count — no email address or IP address — in its connected KV service for one hour. Vercel is based in the United States and processes data under the service terms applicable to our account; Vercel publishes its processor terms and transfer provisions in its Data Processing Addendum. See Vercel's Privacy Notice and Data Processing Addendum. - Formspree (Formspree Inc., USA) – Form submissions on this website are processed through Formspree. This includes both the contact form on the homepage (name, email, company, message) and the waitlist form on the SAP MM Crash Course landing page at
/sap-mm-crashcourse/(first name, email, country, situation). For the contact form, legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). For the Crash Course waitlist, legal basis is Art. 6(1)(a) GDPR (explicit consent via the opt-in checkbox). Data is transmitted to Formspree's servers in the United States on the basis of standard contractual clauses. See Formspree's Privacy Policy. - Resend (Plus Five Five, Inc.) – Resend acts as our email processor for private-beta applications submitted at
berater.mb-ics.com. It sends both the application notification to MB-ICS and the receipt to the applicant, processing the application message content as well as email and delivery metadata. Resend states that its primary processing takes place in the United States and that its Data Processing Addendum provides for the EU Standard Contractual Clauses and its participation in the EU-U.S. Data Privacy Framework. See Resend's Privacy Policy and Data Processing Addendum.
5. Legal Basis for Processing (GDPR)
For visitors from the European Union and European Economic Area, we process personal data on the following legal bases:
- Contact form submissions – Art. 6(1)(b) GDPR: Processing is necessary for pre-contractual measures at your request.
- Crash Course notification-signup form – Art. 6(1)(a) GDPR: Based on your explicit consent via the opt-in checkbox.
- Private-beta applications – Art. 6(1)(b) GDPR: Processing is necessary to take steps at your request before and for beta participation, including receiving, assessing, and replying to applications, sending a receipt, selecting participants, and administering the beta. The privacy acknowledgement is required to submit an application; it is not consent to this core processing. No optional marketing processing occurs as part of the private-beta application.
- Vercel hosting, security, and global abuse counter – Art. 6(1)(f) GDPR: Our legitimate interests are securely and reliably delivering
berater.mb-ics.com, preventing abuse, and protecting the application endpoint. The one-hour KV counter is global and contains no applicant email address or IP address. - Google Analytics 4 – Art. 6(1)(a) GDPR: Based on your explicit consent via the cookie banner. Click-attribution identifiers (gclid, gbraid, wbraid) and UTM parameters from incoming ad clicks may be stored in localStorage for up to 90 days on the basis of your consent.
- YouTube video playback – Art. 6(1)(a) GDPR: Based on your explicit consent via our consent banner or the per-video consent prompt.
- Language preference (localStorage) – Art. 6(1)(f) GDPR: Legitimate interest in providing a usable, multilingual website. No personal data is collected or transmitted.
6. How We Use Your Information
We use the information collected through our contact form exclusively to:
- Respond to your training inquiries
- Provide information about our SAP S/4HANA courses
- Schedule training sessions
We use private-beta application data only to receive and assess applications, send and confirm receipt, reply to applicants, select participants, and administer selected participants in the SAP MM consultant-trainer private beta. Submitting an application does not subscribe you to newsletters or unrelated marketing.
We do not sell, trade, or share your personal information with third parties for marketing purposes.
7. Data Retention
We retain contact form submissions only for as long as necessary to fulfill the purpose for which they were collected, typically for the duration of our business communication with you.
MB-ICS deletes its mailbox copy of rejected or non-selected private-beta applications no later than 90 days after cohort selection closes. For selected participants, MB-ICS retains its application copy during the beta and deletes it within 6 months after participation ends, except that specific records may be retained longer where legal obligations require.
Resend separately retains transactional message content, delivery metadata, and operational copies under its service terms and Data Processing Addendum. Its DPA ties general deletion to the customer-account lifecycle and also permits customer deletion instructions; therefore Resend's retention may extend beyond the MB-ICS mailbox periods above. You may ask us at mario@mb-ics.com to send an applicable deletion instruction to Resend.
8. Your Rights (GDPR)
If you are located in the EU/EEA, you have the following rights under the General Data Protection Regulation:
- Right of access (Art. 15) – Request a copy of the personal data we hold about you.
- Right to rectification (Art. 16) – Request correction of inaccurate data.
- Right to erasure (Art. 17) – Request deletion of your personal data.
- Right to restrict processing (Art. 18) – Request limitation of data processing.
- Right to data portability (Art. 20) – Receive your data in a structured, machine-readable format where the statutory requirements apply.
- Right to object (Art. 21) – Object to processing based on legitimate interests where the statutory requirements apply.
- Right to withdraw consent (Art. 7(3)) – Withdraw consent-based processing at any time. This does not affect the lawfulness of processing before withdrawal.
- Right to lodge a complaint (Art. 77) – Lodge a complaint with a competent data-protection supervisory authority in the EU/EEA.
Cookie and localStorage consent choices can be changed through the "Cookie settings" link or by clearing localStorage, as described in Section 3. Clearing localStorage does not withdraw a private-beta application.
To exercise any of these rights, including requesting deletion or ending consideration of a private-beta application, contact us at mario@mb-ics.com. A withdrawal or deletion request may end application consideration or participation where the requested data is necessary for those purposes.
Participant reviews — publication consent versions 2026-10-09 (review) and 2026-10-31 (optional course context)
Review notice updated October 31, 2026. The controller is MB International Contracting Service LLC, identified above. Review submission and publication are voluntary, based on your separate consent (Art. 6(1)(a) GDPR). Your rating, chosen display name (or anonymity), original comment, course area, optional course month, language and publication date can become public only after email confirmation and manual approval. Your email, confirmation and withdrawal tokens, consent record and abuse-control keys are not public or used for marketing. Your training period and training areas are never published. Your optional certifications achieved and course books used are published together with your review when you select them in the form — your selection is your consent (version 2026-10-31) to that publication, and they appear as your own indication, not as a verified credential. If you select none, none of them is published. All optional course selections are used to classify and moderate your review, are kept under the same retention and withdrawal rules as your review, and are erased together with it. Email confirmation proves control of an address, not attendance. Please do not include sensitive information or other people's personal data.
Our review API and database are hosted by netcup GmbH in Nuremberg, Germany, separately from the GitHub Pages frontend described above. The service encrypts private email addresses and queued email payloads at rest; review text is accessible to the authorized moderator before publication. Participants need no account. ZITADEL provides the owner's moderator login and MFA, not participant registration; see its data processing agreement.
Cloudflare Turnstile protects the review form against automated abuse. It processes technical signals including IP address, browser information and the site origin. Cloudflare acts as processor for protecting this website and as controller for improving bot detection; see the Turnstile Privacy Addendum. Our basis for abuse prevention, technical delivery, moderation security and restricted audit/recovery records is Art. 6(1)(f) GDPR: reliable operation and protection against abuse. Provider infrastructure may process technical data internationally.
Resend (Plus Five Five, Inc.) sends confirmation and withdrawal links to your email address; it does not receive your review comment from this service. The sending domain is configured for Ireland, but this is not a promise of EU-only processing: Resend's DPA describes primary US processing and Standard Contractual Clauses. Provider message content, delivery metadata and operational copies follow Resend's own retention terms and may outlast our application copies; see its DPA and Section 7 above. Contact us for an applicable deletion instruction.
Confirmation links expire after 24 hours and require an explicit confirmation action. Unconfirmed submissions are deleted after 14 days and rejected submissions after 30 days. Pseudonymous application abuse counters expire within one day. Published reviews remain while their purpose and your consent continue. Restricted audit and recovery records retain identifiers, actions, timestamps and consent/withdrawal evidence, not erased email or review text; they are not published. Hosting and mail providers may retain separate technical records under their policies.
Private backups are encrypted before upload to Backblaze B2's EU region; the decryption identity is held separately by the owner, not on the server. Backups rotate on a maximum 30-day schedule; privacy changes are reapplied before a restoration can serve data. Backblaze's DPA and transfer clauses apply; an EU storage region does not exclude international service or support processing.
The separate private withdrawal link removes a review from public results and statistics and erases its associated private email, comment and display name in the active service. You can also contact mario@mb-ics.com for withdrawal, erasure, access or correction and the other rights in Section 8. Withdrawing consent does not affect earlier lawful processing. Clearing browser storage does not withdraw a review, and erasure in the active service does not instantly delete rotating backups or provider-held records.
The optional LinkedIn handoff copies only your own original comment on your explicit request, or offers manual copying. Opening LinkedIn is separate voluntary external navigation under LinkedIn's terms. We do not post, log in, track that handoff, transfer stars or store your email/comment in browser localStorage. The offer is available for every rating and is not a condition of verification or publication. See methodology and EN/DE/ES explanations.
9. International Users
Our website is accessible worldwide and our training services are offered internationally. If you are accessing our website from the European Union, European Economic Area, or any other region with specific data protection laws, please be aware that your information may be transferred to and processed in the United States, where our company is based.
10. Children's Privacy
Our website and services are intended for business professionals and are not directed at individuals under the age of 18.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.
Contact
MB International Contracting Service LLC
Fort Lauderdale, FL, United States
Email: mario@mb-ics.com