Privacy Policy

The controller responsible for data processing on this website within the meaning of Art. 4 (7) GDPR is:

No data protection officer has been appointed. As a sole proprietorship, the thresholds in Art. 37 GDPR and § 38 BDSG are not met. For any data protection question you can reach me directly at the address above.

You have the following rights regarding your personal data. An informal message to the email address above is enough to exercise any of them.

• •Access (Art. 15 GDPR): what data about you is being processed.
• •Rectification (Art. 16 GDPR): correction of inaccurate data.
• •Erasure (Art. 17 GDPR): the "right to be forgotten".
• •Restriction of processing (Art. 18 GDPR).
• •Data portability (Art. 20 GDPR): your data in a common, machine-readable format.
• •Objection (Art. 21 GDPR): against processing based on legitimate interests.
• •Withdrawal of consent (Art. 7 (3) GDPR): with effect for the future. The lawfulness of processing carried out before withdrawal is unaffected.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes data on my behalf under a data processing agreement pursuant to Art. 28 GDPR. The site is served from EU server locations (Frankfurt).

Each time a page is requested, the server automatically records the following technical data, which your browser necessarily transmits:

• •truncated IP address
• •date and time of the request
• •page requested and volume of data transferred
• •browser type, browser version and operating system
• •referring page (referrer)

This data is used solely to deliver the website, ensure system security and diagnose faults. It is not merged with any other data source.

Legal basis: Art. 6 (1) (f) GDPR, legitimate interest in the secure and reliable operation of the website.

Retention: log files are deleted after 30 days at the latest.

This website uses the Nunito and Playfair Display typefaces. They are served locally from this website's own server and are not fetched from an external provider. No connection to Google servers is established and your IP address is not transmitted to any third party.

This website sets no strictly necessary cookies in the narrow sense. Your cookie decision itself is stored locally in your browser (localStorage) so that the consent banner does not reappear on every visit. This information never leaves your browser.

The keys stored are "cookie-consent" (your choice), "cookie-consent-date" (when you made it) and "basin-body-lang" (your language preference).

You can change your decision at any time: the cookie button at the bottom right of every page reopens the settings, letting you withdraw consent with effect for the future. Withdrawing is therefore just as easy as giving consent.

Legal basis: § 25 (2) no. 2 TDDDG. Storage is necessary to provide the service you expressly requested, namely honouring your consent decision.

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is activated only after you have given explicit consent in the cookie banner.

Until you consent, the Google Analytics script is not loaded at all. No connection to Google servers is made, no cookies are set and no data is transmitted to Google. The script is fetched only once you have consented. Advertising-related processing (ad_storage, ad_user_data, ad_personalization) remains permanently disabled.

IP anonymisation is enabled, so your IP address is truncated by Google within the EU before any further processing.

Once you have consented, the following is processed: pages viewed, time on page, approximate location at country/city level, device type and browser, and interactions such as starting the self-assessment or submitting a form.

Transfer to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR.

Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, your consent, revocable at any time with effect for the future.

Retention: 14 months from your last visit.

This website offers a contact form, booking for a free introductory call, and a non-binding pre-registration for courses. Only the details you enter into the relevant form are processed:

• •Contact form: name, email address and your message.
• •Introductory call: name, email address, preferred date and preferred time.
• •Pre-registration: first name, last name, email address, the topics you select, and optionally how you heard about Basin Body.

Form data is transmitted via a webhook to my automation platform n8n (n8n GmbH, Borsigstraße 27, 10115 Berlin, Germany), operated on servers within the European Union. From there a confirmation email is sent to you and a notification to me via Google Workspace (Gmail). A data processing agreement pursuant to Art. 28 GDPR is in place with both providers.

Legal basis: Art. 6 (1) (b) GDPR for enquiries aimed at a contract or pre-contractual steps, otherwise Art. 6 (1) (f) GDPR, legitimate interest in responding to your enquiry.

Retention: your enquiry is deleted once it has been dealt with conclusively and no statutory retention periods apply, as a rule after twelve months at the latest. Documents arising from a contractual relationship are subject to the commercial and tax retention periods of six and ten years respectively.

The self-assessment runs entirely in your browser. Your answers and your result are transmitted neither to my server nor to any third party, and are not stored anywhere. They are gone as soon as you close or reload the page.

The self-assessment therefore processes no health data within the meaning of Art. 9 GDPR. If you have consented to analytics, only the anonymous event that an assessment was started or completed is recorded, never your answers.

If you contact me directly by email, your email address and the content of your message are processed in order to answer your enquiry. Email is handled via Google Workspace. The same legal bases and deletion periods apply as for the forms.

Hosting and automation take place on servers within the European Union. With Google Analytics and Google Workspace, processing by Google LLC in the USA may occur. Google LLC is certified under the EU-U.S. Data Privacy Framework; by decision of 10 July 2023 the European Commission determined an adequate level of data protection for its participants. Standard contractual clauses pursuant to Art. 46 (2) (c) GDPR have additionally been agreed.

This website is served exclusively over a TLS-encrypted connection (HTTPS), indicated by the padlock in your address bar. Data you submit through the forms is therefore protected against interception in transit. Access to incoming enquiries is limited to me personally and secured with two-factor authentication.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The recommendations in the self-assessment are general, editorially prepared suggestions, not an automated individual decision about you.

Providing personal data is neither legally nor contractually required. Without the fields marked as mandatory, however, I cannot answer your enquiry. You can browse this website without providing any personal data at all.

I update this privacy policy whenever the data processing on this website or the legal requirements change. The version published here, bearing the date shown above, is the one that applies.