Last updated: 7 August 2026
This notice explains how personal data is processed when you visit maxgrillo.com, send a workshop enquiry or submit a review.
1. Controller
The person responsible for deciding why and how personal data is used on this website is:
Maxmilian Grillo
Munich, Germany
Email: max.grillo@gmail.com
A separate serviceable business address is not currently available. My private home address is not published. For all privacy requests, please use the email address above.
No data protection officer has been appointed because there is currently no legal requirement to do so.
2. Website hosting and technical data
This website is hosted through ChatGPT Sites. OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, processes hosted data on my behalf as a data processor.
When the site is accessed, technical information may be processed to deliver and protect it. This can include IP address, date and time, requested page, browser and device information, log data, usage data and technically necessary cookies or similar technologies.
The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the secure, stable and efficient operation of the website. I have not added advertising, behavioural tracking, marketing cookies or third-party analytics.
ChatGPT Sites does not currently provide data residency. Hosted data may therefore be processed outside the European Economic Area. Under the applicable ChatGPT Sites Data Processing Addendum, transfers are protected by an adequacy decision or agreements incorporating the European Commission’s Standard Contractual Clauses, as applicable. OpenAI may use authorised subprocessors to operate the service.
3. Workshop enquiries
If you use the enquiry form, the site processes the information you enter: name, email address, organisation, type of workshop or event, participant estimate, timeframe, location, desired outcomes and any additional information.
The information is used only to understand your request, respond to you and, if relevant, take steps towards arranging a workshop. The legal basis is Article 6(1)(b) GDPR for steps requested before a possible agreement. For messages that are not pre-contractual, the legal basis is Article 6(1)(f) GDPR and the legitimate interest in responding to genuine professional enquiries.
Name, email address, enquiry type and desired outcomes are required to send the form. Without them, I cannot meaningfully respond. Other fields are optional. Please do not include health data, payment-card details or other sensitive personal information.
Enquiry records are normally deleted from the website database within 12 months of submission if no working relationship develops. Information may be kept longer where needed for a contract, to establish or defend legal claims, or to meet statutory record-keeping duties.
4. Reviews
If you submit a review, the site processes your name, verification email, session category, workshop or event, rating, review text and any optional organisation, role or attendance date.
Your email and submission are used to verify and moderate genuine feedback on the basis of Article 6(1)(f) GDPR. The legitimate interests are preventing fabricated or abusive reviews and maintaining the credibility of published feedback.
A review is published only if you actively consent. Your name, role and organisation are displayed only if you separately consent to displaying your identity; otherwise an approved review is shown anonymously. The legal basis for publication is Article 6(1)(a) GDPR. You may withdraw either consent at any time by emailing me. Withdrawal does not affect processing that was lawful before it was withdrawn.
Submissions that are not approved are normally deleted within six months. Published reviews and the associated consent record are retained while the review remains published, and are removed when consent is withdrawn or the review is no longer needed.
5. Recipients
Personal data is accessible only where needed to operate the site and respond to submissions. Recipients may include me, OpenAI Ireland Limited and its authorised subprocessors, and the email provider used when I reply. Personal data is not sold and is not used for marketing.
6. External links
The website links to LinkedIn and may include links to other external sites. No information is intentionally sent to those services by this website until you choose to follow a link. Once you leave this site, the privacy terms of the external provider apply.
7. Your rights
Subject to the conditions in the GDPR, you may have the right to:
- request access to your personal data;
- correct inaccurate or incomplete data;
- request deletion or restriction of processing;
- receive data you provided in a portable format;
- object to processing based on legitimate interests; and
- withdraw consent at any time where processing relies on consent.
To exercise a right or ask a privacy question, email max.grillo@gmail.com. There is no automated decision-making or profiling on this site.
You also have the right to lodge a complaint with a data protection supervisory authority. For a private operator based in Bavaria, the relevant authority is the Bavarian State Office for Data Protection Supervision (BayLDA). You may also contact another competent EU supervisory authority.
8. Changes to this notice
This notice will be reviewed when the website, its forms, service providers or legal requirements change. The date at the top shows the latest revision.