Skip to content

Privacy Policy

Last updated: 29 October 2026

1. Who we are

This website (managementkits.com) and the MK Practice are operated by Management Kits AG, Dufourstrasse 49, 8008 Zürich, Switzerland ("Management Kits", "we", "us").

We are responsible for the personal data described here. For any privacy question or request, write to olaf@managementkits.com.

2. What we collect and why

When you subscribe to The Practice Note or another newsletter (on our website or through a LinkedIn Lead Gen Form), we collect your name, email address, job title, company, country, and your consent with its date. We use them to send you the newsletter and, if you agreed, occasional emails about the MK Practice. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through the unsubscribe link in every email.

When you book a call or a demo, we collect your name, email address, the time slot and anything you write in the booking form, to hold and prepare the call. Legal basis: steps before a contract and our legitimate interest in answering your request (Art. 6(1)(b) and (f) GDPR).

When you buy a membership, we collect your name, email address, billing address and payment details. Payments are handled by our payment provider; we do not see full card numbers. We use these data to provide the membership, to invoice and to meet our accounting duties. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c) GDPR).

When you use the MK Practice, we process your account details and what you enter about your organization (diagnostic answers, focus topics, notes) to run the Practice for you, including AI-supported analysis and guidance by our practitioners. Legal basis: contract (Art. 6(1)(b) GDPR).

When you contact us, we process your message and contact details to answer you. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

When you visit our website, we process technical data (IP address, browser, pages viewed, referring site, campaign parameters) through cookies and similar technologies: to run and secure the site, to understand which content and campaigns work and, only with your consent, to measure and target advertising. Legal basis: legitimate interest for strictly necessary cookies; your consent for analytics and advertising cookies.

We do not sell personal data.

3. Cookies, analytics and advertising

We use cookies only as far as you allow in our cookie banner. You can change your choice at any time in the cookie settings of the banner or by deleting the cookies for this site in your browser.

  • Necessary cookies keep the site working and remember your cookie choice.
  • Analytics cookies (HubSpot analytics, Google Analytics and Hotjar) tell us how visitors use the site.
  • Advertising cookies. With your consent, the LinkedIn Insight Tag and the HubSpot ads pixel let us measure whether visits and sign-ups come from our ads, and show our ads to people who visited our site. LinkedIn receives technical data such as your IP address, browser data and the page visited, and may link it to your LinkedIn account. We receive only aggregated reports, never individual profiles. LinkedIn's own privacy policy applies: linkedin.com/legal/privacy-policy.

Videos on our site are embedded from Vimeo; Vimeo may set its own cookies when you play them.

4. LinkedIn Lead Gen Forms

If you sign up through a form inside a LinkedIn ad, LinkedIn pre-fills the form from your profile and passes what you submit to us: name, email address, job title, company and country. We use these data only for the purpose stated on the form and within the consent you ticked. LinkedIn Ireland Unlimited Company and we are each responsible for our own processing.

5. Who processes data for us

We use service providers who process data on our behalf and only for the purposes described here:

  • HubSpot, Inc. (USA): website, forms, CRM, email and the payments interface
  • Stripe: payment processing behind HubSpot Payments
  • Calendly LLC (USA): call booking
  • LinkedIn Ireland Unlimited Company / LinkedIn Corporation (Ireland / USA): advertising, Lead Gen Forms and the Insight Tag
  • Google LLC (USA): Google Analytics
  • Hotjar Ltd. (Malta): website analytics
  • Vimeo (USA): video hosting
  • Providers of the AI models and the cloud hosting that run the MK Practice platform

We may disclose data where the law requires it, or to protect our rights in a legal dispute.

6. Transfers outside Switzerland and the EU/EEA

Some providers are based in the USA. We transfer data there only with appropriate safeguards, such as the EU-U.S. and Swiss-U.S. Data Privacy Frameworks where the provider is certified, or the EU Standard Contractual Clauses with the Swiss amendments.

7. How long we keep data

  • Newsletter data: until you unsubscribe; afterwards only the record of your unsubscribe, so we do not email you again.
  • Contacts who never subscribed or bought: deleted after 24 months without contact.
  • Customer and invoice data: for the statutory retention period (10 years under Swiss law).
  • Data you enter in the MK Practice: for the duration of your membership plus 90 days, then deleted or anonymised. You can ask us for an export before then.
  • Analytics data: according to the retention settings of each tool, at most 26 months.

8. Your rights

You have the right to access the personal data we hold about you; to have it corrected or deleted; to restrict or object to its processing; to receive it in a portable format; and to withdraw any consent at any time (this does not affect processing before the withdrawal).

To exercise any of these rights, write to the address in section 1. We answer within 30 days.

You may also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), in the EU/EEA the authority in your country, and in the UK the Information Commissioner's Office (ico.org.uk).

9. Security

We protect personal data with technical and organisational measures appropriate to the risk, including access controls, encrypted connections and providers with recognised security certifications.

10. Changes

We update this policy when our services or providers change. The date at the top shows the current version. For material changes affecting subscribers or customers, we will tell you by email.