Privacy Notice

1. Our First Principle: Privacy Is a Duty of Trust

The person comes before the system. At SNNET DC, privacy is not a formality appended to a service after it has been built. It is a fundamental consideration in how we approach technology, relationships and the responsibilities that arise when information is entrusted to us.

We believe confidence is earned through restraint as much as capability: asking only for information that serves a legitimate purpose; explaining its use in intelligible terms; restricting access to those with an appropriate need; respecting personal choices; and retaining information no longer than the applicable purpose and law justify. We seek to treat each individual with the same consideration and discretion that we would expect when placing our own information in another organisation's hands.

This commitment guides our conduct. The specific processing activities, lawful bases, rights and limitations are set out in the sections that follow. Nothing in this Notice is intended to diminish any right or protection conferred by applicable law.

2. Security, Reliability and Responsible Innovation by Design

Progress in technology is meaningful only when it is matched by responsibility. SNNET DC approaches the design and delivery of products and services with the conviction that privacy, security and reliability must be considered from the outset and revisited as technologies, threats and obligations evolve.

Our approach is risk-based: to limit unnecessary collection, separate public information from restricted operational records, apply appropriate access controls, protect service credentials, assess the services on which we rely, and address foreseeable misuse. We seek dependable operation, clear accountability and proportionate safeguards across the information lifecycle, including when information must be corrected or deleted.

No digital service, email system or security measure can promise absolute protection or uninterrupted availability. Our undertaking is therefore one of responsible design, measured safeguards, ongoing review and an appropriate response to identified risks—not an assertion that risk can be eliminated. Trust deserves clear commitments that can be supported in practice.

3. Identity of the Controller and Privacy Contact

For the processing described in this Notice, the controller is Ngulefac Atabong Charles, operating as SNNET DC. Business location: Bonn, Germany. Street address: To be updated soon. Postal code: To be updated soon. Privacy requests and enquiries may be sent to infodc@snnetconsulting.com or submitted through our Contact page. This is an interim location disclosure and does not represent a complete serviceable postal address. Where an EU representative or data protection officer must be designated under applicable law, the relevant contact details will also be made available.

Questions, objections and requests concerning personal data may be directed to infodc@snnetconsulting.com or submitted through our Contact page. An individual is not required to contact us before exercising the right to approach a supervisory authority.

4. Scope and Application of This Notice

This Notice concerns personal-data processing associated with visits to the SNNET DC website; contact, project and appointment requests; career applications; professional and contractual dealings; and participation in editorial or research-related activities. The categories and purposes that apply depend on the particular interaction. We do not treat the mere use of a public page as consent to unrelated processing.

Services operated independently by third parties, including external websites reached through links, may be governed by their own notices and terms. Where SNNET DC and another organisation determine purposes or means jointly, the required information about that arrangement will be provided as applicable.

5. Principles Governing Our Processing

Personal data must be processed on a lawful basis, for stated and legitimate purposes, with appropriate transparency. We apply the principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability under Article 5 GDPR.

Access and disclosure are restricted to a legitimate purpose and the relevant authorisation. Information provided through a project enquiry or career application is not, merely by reason of that submission, enrolled in an unrelated advertising programme. We do not sell personal information.

6. Categories of Information We May Process

Depending on the services you request, information may include your name, email address, telephone number, organisation, country of residence, business role, correspondence, project requirements, appointment preferences, professional experience, qualifications, role interests, CV and other documents voluntarily supplied.

Limited technical information may also be processed to operate and secure the website, such as request times, IP-related connection data, browser characteristics, security events and error records. Optional website measurement may involve online identifiers and interaction data where consent and applicable law permit. The relevant information depends on the feature used; we do not require every category for every interaction.

7. Sources of Personal Information

We principally receive personal information from the individual concerned, through our website forms, email or direct communications. Technical records arise in the course of delivering and protecting online services.

Where appropriate to a professional, editorial or business relationship, information may also be obtained from an organisation on whose behalf a person acts, an authorised representative, or a lawfully accessible public source. When Article 14 GDPR requires additional notice for information obtained indirectly, we provide it within the applicable period, subject to lawful exceptions.

8. Purposes of Processing and Lawful Bases

Our legal bases depend on the processing activity. Steps taken at your request before entering a contract and the performance of contractual obligations may rely on Article 6(1)(b) GDPR. Compliance with binding legal duties may rely on Article 6(1)(c). Necessary security measures, fraud prevention, ordinary business correspondence and the protection of legal interests may rely on Article 6(1)(f), subject to the legally required assessment of the interests and rights concerned.

Where a service requires consent, including optional analytics technologies, the relevant processing relies on Article 6(1)(a) and, where applicable, the consent requirement for access to or storage on a device under German law. Recruitment processing is assessed against the legal basis appropriate to the particular application or employment context, including applicable German employment-data provisions. Where processing requires a separate notice or consent, it will not be justified merely by inclusion in this general Notice.

9. Necessary Information and Voluntary Submissions

You may browse publicly accessible pages without submitting an application or business enquiry. When you choose to request a service, arrange an appointment or apply for a role, designated information is necessary for us to identify and deal with that request; a failure to supply it may prevent us from proceeding. Optional fields may be left unanswered.

Please provide accurate information relevant to your request and avoid including unnecessary identification documents, financial credentials, medical information or other sensitive material. If special categories of personal data are supplied, their processing will be assessed under the additional requirements of Article 9 GDPR and other applicable law.

10. Website Hosting and Technical Access Records

We use professional website hosting and content-delivery services to provide public pages and related website functions. These services may process connection information, network addresses, request timestamps, requested resources, technical failures and security events where necessary to deliver the website, maintain reliability and protect it against misuse.

Such records are processed for technical operation, diagnosis and reasonable security purposes, not for publication as visitor-level reports. Retention is limited by the relevant operational need, legal obligations and applicable provider configurations.

11. Fraud Prevention, Form Protection and Security Signals

To protect our forms and online services against automated misuse, we use specialised verification, abuse-prevention and access-control services. Depending on the service requested, these providers may process network connection data, limited request metadata and security-verification results for the purpose of assessing abusive activity and maintaining service integrity.

These controls serve service integrity and abuse prevention. They are not intended to assess an applicant's professional suitability or to make an employment decision. Where technical controls affect access to a requested function, we seek to provide a proportionate means of contacting us about a legitimate difficulty.

12. Cookies and Access to End-User Devices

Certain cookies or comparable technologies may be necessary to supply functionality expressly requested by the visitor or to maintain essential security and privacy choices. Optional technologies are treated separately.

Under Section 25 of Germany's Telecommunications Digital Services Data Protection Act (TDDDG), storing information on or accessing information from an end-user device generally requires informed consent unless a statutory exception applies. Where personal data are processed, the GDPR also applies. Non-essential analytics will not be activated without the consent required by these rules.

13. Privacy Preferences and Withdrawal of Consent

Where we request consent, the choice is voluntary. Refusing optional analytics does not prevent access to ordinary public website content. You may review or change applicable selections using the website's Privacy choices control and may withdraw consent at any time with future effect.

Withdrawal does not invalidate processing undertaken lawfully before withdrawal. Processing based on a different applicable legal basis may continue only to the extent that basis genuinely permits. A browser's own storage controls may also affect technologies available to the website.

14. Optional Analytics and Website Measurement

Where enabled and consented to, optional website-measurement services may be used to understand how visitors interact with our public pages and improve accessibility, usability and service quality. Depending on their configuration, analytics providers may process online identifiers, page interactions, browser or device characteristics and other limited usage signals. This processing requires the applicable consent, which can be withdrawn using the website's Privacy choices control.

Internal analysis and management reporting are operational matters, not information intended for public access. This Notice does not publish audience reports, visitor-level records or internal analytical classifications. Information about relevant recipients and international transfers is provided below. You may withdraw analytics consent through Privacy choices.

15. General Enquiries and Contact Correspondence

When you contact us, we process the details and message you provide for the purpose of understanding and responding to the enquiry, managing necessary follow-up and maintaining a record where justified by the correspondence, a legal duty or the protection of lawful interests.

Submitting an enquiry does not authorise unrelated advertising. We may need to retain some communications where there is an ongoing matter, contractual responsibility or legitimate dispute, subject to the retention rules described below.

16. Project Requests and Business Proposals

A project request may contain business contact details, organisational information, service interests, specifications, background materials and proposed schedules. We use this information to evaluate the request, ask relevant questions, prepare a proposal or take requested pre-contractual steps.

Submission does not itself create a contract. Where an engagement is agreed, information necessary to administer and perform it may subsequently be processed under the relevant contractual and legal bases, with access limited according to responsibility.

17. Appointments, Calls and Scheduling

If you request a meeting or call, we process the contact, purpose, preferred date, time, time-zone information and correspondence required to organise and respond to it. Appointment confirmations and necessary changes are service communications, not marketing subscriptions.

We do not publish appointment details as public website content. An individual may contact us to correct or cancel a proposed appointment, subject to relevant operational constraints.

18. Careers Applications, CVs and Supporting Documents

When you apply through Careers, we process the details you submit, which may include contact information, country of residence, professional background, experience, qualifications, areas of interest and attached CVs or other permitted supporting documents.

Career applications and supporting documents are transmitted through business communication and delivery services to authorised recruitment personnel. These services may handle the applicant's contact information, application content and attachments in order to deliver the submission. Email transmission and storage are subject to inherent technical risks, and applicants should avoid supplying sensitive information unrelated to their application.

19. Recruitment Review and Future Opportunities

We use recruitment information to assess expressions of interest, review relevant qualifications, communicate about possible vacancies and arrange appropriate next steps. A category of professional interest does not, by itself, guarantee that a vacancy is open; nor does submitting an application create an entitlement to an interview or offer of employment.

An application is not retained indefinitely merely because future opportunities could arise. If we propose retention for a distinct future-opportunities or talent-pool purpose, we will explain the basis and relevant period and seek separate consent where required. Individuals may request information about the status and handling of their application.

20. Transactional Emails and Acknowledgements

We may send operational emails to acknowledge submissions or communicate about requested services, appointments and recruitment matters. Contracted email-delivery service providers may process sender and recipient addresses, message content, relevant attachments and limited delivery metadata to transmit and administer those communications.

We take proportionate measures to protect these exchanges; however, ordinary email should not be understood as guaranteed end-to-end encrypted communication. An acknowledgement confirms the sending or receipt status indicated by the relevant process; it is not an agreement to provide a service or an assurance of employment.

21. Client, Supplier and Contract Administration

When a business relationship is established, we process the contact and contractual information reasonably necessary to manage communications, deliver agreed work, maintain accurate business records, arrange payment where relevant and meet accounting, tax or other legal duties.

Access is limited to persons and service providers with an appropriate operational or legal need. Statutory retention obligations may continue after the commercial relationship ends; other information is assessed for deletion when its purpose is complete.

22. Editorial Activities, Contributors and Publications

Our research, publishing and editorial work may involve professional biographies, attribution details, submitted materials, correspondence and publication permissions. Where information is intended for publication, we assess the lawful basis, the scope of agreed attribution and any relevant rights of the individual or third parties.

Requests concerning accuracy, attribution or removal are considered under applicable law and the circumstances of the publication. Information supplied privately for an editorial discussion is not automatically authorised for public release.

23. Internal Administration, Reporting and Restricted Systems

Business operations may involve internal service records, security reviews, performance reports, consent records and editorial or administrative information. Such material belongs within appropriately restricted operational processes and is not made public merely because it relates to website activity.

Our intention is to apply suitable authentication, authorisation and access separation to management functions, including any future command or management console. This Notice does not authorise public access to internal audience intelligence, identifiable visitor records, security logs or operational dashboards. Technical access restrictions must be implemented and tested independently of this written Notice.

24. Processors, Service Providers and Other Recipients

Access to personal data is limited to authorised personnel and the categories of external recipients necessary for the relevant activity. These may include website hosting and content-delivery providers (technical connection data); website security and abuse-prevention providers (network and verification data); business communications and email-delivery providers (contact details, messages and relevant attachments); operational storage or support providers (information necessary for the service requested); and optional audience-measurement providers (usage information, only where applicable consent has been obtained).

The recipients involved depend on the particular service and information supplied. Providers acting as processors are subject to appropriate legal and contractual safeguards. Recipients may be located within or outside the EU/EEA; the applicable transfer principles are set out in Section 25. You may request further information about the recipients of your personal data and applicable safeguards through our privacy contact. Disclosure may also occur where binding law requires it or to establish, exercise or defend legal claims. We do not sell personal data.

25. International Processing and Transfers

Some services may involve access to or processing of personal data outside the European Union or European Economic Area. Where Chapter V GDPR applies, transfers must rely on an appropriate legal mechanism, which may include a relevant adequacy decision or European Commission Standard Contractual Clauses, together with any additional safeguards legally required in the circumstances.

The mechanism depends on the provider, destination and processing arrangement; no single safeguard should be assumed to apply identically to every transfer. You may request information about the applicable safeguards and how to obtain access to them through our privacy contact.

26. Confidentiality, Technical Safeguards and Personal-Data Incidents

We seek to apply technical and organisational measures proportionate to the nature of the information and the risks involved. Measures may include encrypted transport, controlled service credentials, access restrictions, segregation of public and administrative functions, abuse prevention and review of security events.

These measures reduce risks; they do not make electronic communication or storage infallible. Where a personal-data breach occurs, we assess it and notify the competent supervisory authority and, where required, affected individuals in accordance with Articles 33 and 34 GDPR. We do not waive responsibilities imposed by applicable law through this Notice.

27. Retention, Erasure and Backup Records

Personal data are retained only for the period necessary for the purpose for which they were collected, or for another lawful period required by legislation or justified by the establishment, exercise or defence of legal claims. The relevant criteria include whether an enquiry is open, an appointment has concluded, a service contract remains active, a recruitment process is pending, a security issue requires investigation, or a statutory recordkeeping obligation applies.

Recruitment files and CV attachments received by email must be reviewed for deletion from active recruitment mailboxes when the relevant recruitment and justified claims-defence purposes end, unless another lawful basis applies. Business and accounting records may be subject to longer mandatory periods. Technical logs and consent records follow the period appropriate to their function. Protected backups may persist temporarily until their scheduled replacement or expiry, subject to access restrictions. You may request information about the period or criteria applicable to a particular record.

28. Rights of Individuals and Automated Decision-Making

Subject to applicable statutory conditions and exceptions, you may exercise the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection (Article 21). You may withdraw consent where consent is the legal basis, and you may raise concerns about automated decisions with legal or similarly significant effects under Article 22.

We do not use the public Careers submission form to make solely automated hiring decisions producing such effects. Requests may be sent to our privacy contact. We respond without undue delay and ordinarily within one month, subject to any extension or verification procedure permitted by law. Where a request is refused or limited, the applicable grounds and available remedies will be explained as required.

29. Supervisory Authorities, Updates and How to Reach Us

You have the right to lodge a complaint with a competent data protection supervisory authority under Article 77 GDPR, without first notifying SNNET DC. Where the competent German supervisory authority is the North Rhine-Westphalia authority, further information is available from the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) at www.ldi.nrw.de.

We may revise this Notice to reflect changes in technology, operations, providers or applicable law. The published version will identify its revision date, and material changes will be communicated where the law requires. Privacy enquiries and rights requests may be directed to infodc@snnetconsulting.com or through our Contact page.

---

Privacy contact: infodc@snnetconsulting.com Contact: snnetconsulting.com/en/contact