privacy policy
The controller responsible for data processing under the EU General Data Protection Regulation is:
Sebastian Damaschke
Kaiserswerther Strasse 228,
47259 Duisburg, Germany
Email: sebastian@damaschke-business.com
Phone: +49 152 5700 9238
1. Introduction
This privacy policy informs you about the nature, scope, and purpose of the processing of personal data within our online offering and the associated websites, features, and content (collectively referred to as the “online offering” or “website”). This privacy policy applies regardless of the domains, systems, platforms, and devices (e.g. desktop or mobile) on which the online offering is operated.
Due to changes in legal requirements and technical developments, it may be necessary to update this privacy policy from time to time. We therefore ask you to review the content of this privacy policy periodically. If changes require your involvement (e.g. consent) or any other individual notification, we will inform you.
Basic information on data processing and legal basis
We process personal data of users only in compliance with the relevant data protection provisions. This means that user data is processed only where a legal basis exists — in particular where processing is necessary for the performance of our contractual services (e.g. processing orders) or online services, is legally required, users have given consent, or based on our legitimate interests (i.e. our interest in the analysis, optimization, and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR, in particular with regard to reach measurement, the creation of profiles for advertising and marketing purposes, and the collection of access data and the use of third-party services).
2.1 Categories of data processed
- Inventory data (e.g. names, addresses)
- Contact data (e.g. email, phone numbers)
- Content data (e.g. text entries, photographs, videos)
- Usage data (e.g. websites visited, interest in content, access times)
- Meta/communication data (e.g. device information, IP addresses)
2. Purpose of processing
- Provision of the online offering, its features, and content (e.g. appointment request form, appointment booking, newsletter sign-up)
- Responding to contact inquiries and communicating with users
- Security measures
- Reach measurement/marketing
2.3. Terms used
“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
“Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data. A “controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
For further definitions of the terms used, such as “processing” or “controller”, please refer to Art. 4 of the General Data Protection Regulation (GDPR).
2.4. Relevant legal bases
Pursuant to Art. 13 GDPR, we inform you of the legal bases for our data processing. Unless otherwise stated in this privacy policy, the following applies: the legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; the legal basis for processing to perform our services and carry out contractual measures, as well as to respond to inquiries, is Art. 6(1)(b) GDPR; the legal basis for processing to fulfil our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing to safeguard our legitimate interests is Art. 6(1)(f) GDPR. Where the vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.
3. Security measures
We ask you to review the content of this privacy policy periodically. We adapt the privacy policy whenever changes to the data processing we carry out make this necessary. We will inform you whenever the changes require your involvement (e.g. consent) or any other individual notification.
To protect personal data appropriately against loss, misuse, unauthorized access, alteration, and disclosure, and to ensure compliance with data protection laws, we take organizational, contractual, and technical security measures in line with the state of the art. These security measures include firewalls, encrypted transmission of data between your browser and our server, and the use of access controls.
You are, however, responsible for the security and confidentiality of your passwords and registration data. We are not liable for the protection of personal data that we disclose to third parties on the basis of an account link authorized by you.
4. Cooperation with processors and third parties
4.1. Disclosure of data to third parties and third-party providers
Where, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transfer it to them, or otherwise grant them access to the data, this occurs only on the basis of a legal permission (e.g. where the transfer of data to third parties, such as payment service providers, is necessary under Art. 6(1)(b) GDPR for the performance of a contract), where you have consented, where a legal obligation provides for it, or on the basis of our legitimate interests (e.g. when engaging agents, web hosts, etc.). Where we engage third parties to process data on the basis of a so-called “data processing agreement”, this is done on the basis of Art. 28 GDPR.
4.2. Transfers to third countries
Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where this occurs in the context of using third-party services or the disclosure or transfer of data to third parties, this only takes place where necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation, or on the basis of our legitimate interests. Subject to statutory or contractual permissions, we process, or have processed, data in a third country only where the specific requirements of Art. 44 et seq. GDPR are met. This means that processing takes place, for example, on the basis of special safeguards, such as the officially recognized determination of a level of data protection equivalent to that of the EU, or compliance with officially recognized special contractual obligations (so-called “standard contractual clauses”).
5. Business-related processing
We process inventory data (e.g. names and addresses as well as contact details of users) and contract data (e.g. services used, names of contact persons, payment information and payment data) for the purpose of fulfilling our contractual obligations and service commitments under Art. 6(1)(b) GDPR, as well as for customer relationship management, marketing, advertising, and market research.
5.1 Contacting us
When you contact us (e.g. via contact form, email, phone, appointment request, or via social media), the user’s details are processed to handle the contact request and its follow-up under Art. 6(1)(b) GDPR. User details may be stored in a Customer Relationship Management system (“CRM system”) or a comparable inquiry organization tool. We delete these inquiries once they are no longer required, subject to statutory retention obligations. The necessity is reviewed regularly, at least every two years.
5.2. Administration, accounting, office organization, contact management
We process data as part of administrative tasks as well as the organization of our business, accounting, and compliance with legal obligations such as archiving. In doing so, we process the same data that we process in the course of providing our contractual services. The legal bases are Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. Customers, prospective customers, business partners, and website visitors are affected by this processing. The purpose of, and our interest in, this processing lies in administration, accounting, office organization, and data archiving — tasks that serve to maintain our business operations, perform our duties, and provide our services. The deletion of data with regard to contractual services and contractual communication follows the details given for those processing activities.
In this context, we disclose or transfer data to tax authorities, advisors such as tax consultants or auditors, as well as other fee agencies and payment service providers.
We further store, on the basis of our business interests, details of suppliers, event organizers, and other business partners, e.g. for the purpose of future contact. We generally store this predominantly company-related data on a permanent basis.
Business analysis and market research
In order to operate our business economically and to be able to identify market trends and customer and user wishes, we analyze the data available to us regarding business transactions, contracts, inquiries, etc. In doing so, we process inventory data, communication data, contract data, payment data, usage data, and metadata on the basis of Art. 6(1)(f) GDPR, with customers, prospective customers, business partners, visitors, and users of the online offering being among the data subjects concerned. These analyses are carried out for the purpose of business evaluations, marketing, and market research. In doing so, we may take into account the profiles of registered users along with details such as their purchasing transactions. The analyses serve us to increase user-friendliness, optimize our offering, and improve business efficiency. The analyses are used solely by us and are not disclosed externally unless they are anonymous analyses with aggregated values.
Where these analyses or profiles are personal in nature, they are deleted or anonymized when users terminate their relationship with us, or otherwise two years after the conclusion of the contract. Beyond that, overall business analyses and general trend assessments are, wherever possible, prepared anonymously.
6. Hosting
The hosting services we use serve to provide the following: infrastructure and platform services, computing capacity, storage space and database services, security services, and technical maintenance services, which we use for the purpose of operating this online offering.
In doing so, we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, and meta and communication data of customers, prospective customers, and visitors to this online offering, on the basis of our legitimate interest in an efficient and secure provision of this online offering under Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement).
7. Collection of access data and log files
We, or our hosting provider, collect data on every access to the server on which this service is located (so-called server log files) on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. Access data includes the name of the website and file accessed, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address, and the requesting provider.
For security reasons (e.g. to investigate misuse or fraud), log file information is stored for a maximum of seven days and then deleted. Data whose further storage is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
8. Newsletter
The following information explains the content of our newsletter as well as the sign-up, sending, and statistical evaluation procedures, along with your rights of objection. By subscribing to our newsletter, you agree to receive it and to the procedures described.
8.1. Newsletter content
We send newsletters, emails, and other electronic notifications containing promotional information (collectively “newsletter”) only with the recipient’s consent or a legal permission. Where the content of the newsletter is specifically described as part of the sign-up process, it is authoritative for the users’ consent. Otherwise, our newsletters contain information about our services, products, offers, promotions, and our company.
8.2. Newsletter sign-up
Newsletter – double opt-in and logging: sign-up to our newsletter takes place using a so-called double opt-in procedure. This means that after signing up you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register using someone else’s email address. Newsletter sign-ups are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the sign-up and confirmation times, as well as the IP address. Changes to your data stored with the dispatch service provider are likewise logged. To sign up for the newsletter, it is sufficient to provide your email address. Optionally, we ask you to provide a name for personal address in the newsletter.
The sending of the newsletter and the associated success measurement is based on the recipients’ consent under Art. 6(1)(a), Art. 7 GDPR in conjunction with Section 7(2) No. 3 of the German Act Against Unfair Competition (UWG), or on the legal permission under Section 7(3) UWG. The logging of the sign-up process is based on our legitimate interests under Art. 6(1)(f) GDPR. Our interest lies in using a user-friendly and secure newsletter system that serves both our business interests and users’ expectations, and that furthermore allows us to prove consent.
8.3. Cancellation/revocation of the newsletter
You may cancel your subscription to our newsletter at any time — i.e. revoke your consent. You will find a link to cancel the newsletter at the end of every newsletter. We may store unsubscribed email addresses for up to three years, on the basis of our legitimate interests, before deleting them, in order to be able to prove previously given consent. Processing of this data is restricted to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that the prior existence of consent is confirmed at the same time.
8.4. Newsletter dispatch service provider
The newsletter is sent using the dispatch service provider CleverReach GmbH & Co. KG, Mühlenstr 43, 26180 Rastede, Germany. You can view the dispatch provider’s privacy policy here: https://www.cleverreach.com/de/datenschutz.
The dispatch service provider is engaged on the basis of our legitimate interests under Art. 6(1)(f) GDPR and a data processing agreement under Art. 28(3) sentence 1 GDPR.
The dispatch service provider may use recipients’ data in pseudonymous form, i.e. without assignment to a specific user, to optimize or improve its own services, e.g. for the technical optimization of dispatch and the presentation of the newsletter, or for statistical purposes. However, the dispatch service provider does not use the data of our newsletter recipients to contact them itself or to pass the data on to third parties.
8.5. Newsletter success measurement
The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from our server, or from the server of our dispatch service provider if we use one, when the newsletter is opened. In the course of this retrieval, technical information is initially collected, such as information about your browser and system, as well as your IP address and the time of retrieval.
This information is used for the technical improvement of the services based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened, and which links are clicked. For technical reasons, this information can be attributed to individual newsletter recipients. However, it is neither our aim, nor — where used — that of the dispatch service provider, to observe individual users. Rather, the evaluations serve to help us recognize our users’ reading habits and adapt our content to them, or to send different content according to the interests of our users.
The use of the dispatch service provider, the performance of statistical surveys and analyses, and the logging of the sign-up procedure are based on our legitimate interests under Art. 6(1)(f) GDPR. Our interest lies in using a user-friendly and secure newsletter system that serves both our business interests and meets users’ expectations.
9. Cookies and right to object to direct marketing
“Cookies” are small files that are stored on users’ computers. Various information can be stored within cookies. A cookie primarily serves to store information about a user (or the device on which the cookie is stored) during or after their visit within an online offering. Cookies that are deleted after a user leaves an online offering and closes their browser are referred to as temporary cookies, “session cookies”, or “transient cookies”. Such a cookie can, for example, store the contents of a shopping cart in an online shop or a login status. Cookies that remain stored even after the browser is closed are referred to as “permanent” or “persistent”. For example, the login status can be saved if users visit again after several days. Likewise, such a cookie can store users’ interests, which are used for reach measurement or marketing purposes. Cookies offered by providers other than the controller operating the online offering are referred to as “third-party cookies” (otherwise, if it is only the controller’s own cookies, they are referred to as “first-party cookies”).
We may use temporary and permanent cookies and provide information about this within this privacy policy. If users do not want cookies to be stored on their computer, they are asked to disable the relevant option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings. Excluding cookies may lead to functional limitations of this online offering.
A general objection to the use of cookies used for online marketing purposes can be declared, for a large number of services, particularly in the case of tracking, via the US site www.aboutads.info/choices or the EU site www.youronlinechoices.com. Furthermore, the storage of cookies can be prevented by disabling them in your browser settings. Please note that in this case not all functions of this online offering may be usable.
10. Google Analytics
On the basis of our legitimate interests (i.e. our interest in the analysis, optimization, and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), we use Google Analytics, a web analytics service provided by Google LLC (“Google”). Google uses cookies. The information generated by the cookie about the use of the online offering by users is generally transferred to a Google server in the USA and stored there.
Google will use this information on our behalf to evaluate the use of our online offering by users, to compile reports on activities within this online offering, and to provide us with further services related to the use of this online offering and internet usage. In doing so, pseudonymous user profiles may be created from the processed data.
We use Google Analytics only with IP anonymization enabled. This means that users’ IP addresses are shortened by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.
The IP address transmitted by the user’s browser is not merged with other data from Google. Users can prevent the storage of cookies by setting their browser software accordingly; users can furthermore prevent the collection of data generated by the cookie and related to their use of the online offering by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout.
Further information on data use by Google, as well as settings and objection options, can be found in Google’s privacy policy and in Google’s ad settings. Users’ personal data is deleted or anonymized after 14 months.
11. Google Maps
On our website, we use Google Maps to display our location and to create directions. This is a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter referred to only as “Google”.
In order to enable the display of certain fonts on our website, a connection to Google’s server in the USA is established when our website is accessed.
If you access the Google Maps component embedded in our website, Google stores a cookie on your device via your browser. In order to display our location and create directions, your user settings and data are processed. In this context, we cannot rule out the possibility that Google uses servers located in the USA.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in optimizing the functionality of our website.
Through the connection to Google established in this way, Google can determine from which website your request was sent and to which IP address the directions are to be transmitted.
If you do not agree with this processing, you have the option of preventing the installation of cookies through the appropriate settings in your browser. Details on this can be found above under the heading “Cookies”.
Furthermore, the use of Google Maps and the information obtained through Google Maps is subject to Google’s Terms of Service and the Google Maps Terms and Conditions.
Google also provides further information at its ad settings and its privacy policy.
12. Google reCAPTCHA
On our website, we use Google reCAPTCHA to check and prevent automated interactions with our website, e.g. by so-called bots. This is a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter referred to only as “Google”.
Through this service, Google can determine from which website a request is sent, as well as from which IP address the so-called reCAPTCHA input box is used. In addition to your IP address, Google may also collect further information necessary for the provision and guarantee of this service.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the security of our website and in defending against unwanted, automated access such as spam.
Google provides further information on the general handling of your user data in its privacy policy.
13. Google Fonts
On our website, we use Google Fonts to display external fonts. This is a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter referred to only as “Google”.
In order to enable the display of certain fonts on our website, a connection to Google’s server in the USA is established when our website is accessed.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the optimization and economic operation of our website.
Through the connection to Google established when our website is accessed, Google can determine from which website your request was sent and to which IP address the display of the font is to be transmitted.
Google provides further information, in particular on options for preventing the use of data, at its ad settings and its privacy policy.
14. Integration of third-party services and content
14.1. Explanation
Within our online offering, on the basis of our legitimate interests (i.e. our interest in the analysis, optimization, and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), we use content or service offerings from third-party providers in order to integrate their content and services, such as videos or fonts (collectively referred to as “content”). This always requires that the third-party providers of this content perceive the users’ IP address, since without the IP address they would not be able to send the content to the user’s browser. The IP address is therefore necessary for the display of this content. We endeavor to use only content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. Through these “pixel tags”, information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, visit time, and other details about the use of our online offering, and may also be combined with such information from other sources.
14.2. Overview of third-party providers
The following overview provides a list of third-party providers and their content, together with links to their privacy policies, which contain further information on the processing of data and, in part already mentioned here, options for objection (so-called opt-out):
- External code from the JavaScript framework “jQuery”, provided by the third-party provider jQuery Foundation, jquery.org
- Google Fonts – see section 13
- Google Maps – see section 11
- Seal from Ausgezeichnet.org
Nitropack CDN (page speed)
On our website, we use the Content Delivery Network (“CDN”) of NitroPack LLC, 801 Garden Street 3 А, Prof. Georgi Bradistilov Str. 1700 Sofia, Bulgaria.
Nitropack uses variation cookies to display our website correctly and in an optimized manner. With regard to cookies, we only store information about the cookies specified in the variation cookie settings in Nitropack.
When you visit our website, Nitropack collects information about the browser you use, your IP address, the country of retrieval, device identifiers, your language preference, the date and time of access, as well as operating system and network information. We have therefore entered into a data processing agreement with Nitropack, as well as the EU Standard Contractual Clauses. Our legitimate interest within the meaning of Art. 6(1) sentence 1 (f) GDPR lies in optimizing loading and retrieval times, as well as improving the protection of our website against third-party attacks.
Further information on security and data protection at Nitropack can be found here: nitropack.io/page/privacy. You can reach Nitropack’s data protection officer at: dataofficer@nitropack.io.
15. Rights of data subjects
You have the right to request confirmation as to whether the data concerning you is being processed, and to obtain information about this data as well as further information and a copy of the data, in accordance with Art. 15 GDPR.
Pursuant to Art. 16 GDPR, you have the right to request the completion of data concerning you or the correction of inaccurate data concerning you.
Pursuant to Art. 17 GDPR, you have the right to request that the data concerning you be deleted without delay, or alternatively, pursuant to Art. 18 GDPR, to request a restriction on the processing of the data.
You have the right to receive the data concerning you that you have provided to us, in accordance with Art. 20 GDPR, and to request its transfer to other controllers.
Furthermore, pursuant to Art. 77 GDPR, you have the right to lodge a complaint with the competent supervisory authority:
16. Right of withdrawal
You have the right to withdraw any consent given, with effect for the future, pursuant to Art. 7(3) GDPR.
17. Right to object
You may object at any time to the future processing of data concerning you, in accordance with Art. 21 GDPR. In particular, you may object to processing for the purposes of direct marketing.
18. Deletion of data
The data we process is deleted, or its processing restricted, in accordance with Art. 17 and Art. 18 GDPR. Unless expressly stated within this privacy policy, the data stored with us is deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing deletion. Where data is not deleted because it is required for other legally permissible purposes, its processing is restricted instead. This means the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.
Under German statutory requirements, retention is required in particular for 6 years pursuant to Section 257(1) of the German Commercial Code (HGB) (commercial books, inventories, opening balance sheets, annual financial statements, commercial letters, accounting documents, etc.) and for 10 years pursuant to Section 147(1) of the German Fiscal Code (AO) (books, records, management reports, accounting documents, commercial and business letters, documents relevant for taxation, etc.).
19. Online presence on social media
We maintain an online presence within social networks and platforms in order to communicate with customers, prospective customers, and users active there, and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and data processing policies of their respective operators apply.
Unless otherwise stated within this privacy policy, we process users’ data where they communicate with us within social networks and platforms, e.g. by writing posts on our online presences or sending us messages.
20. Information
This privacy policy was prepared on 17 May 2018 in compliance with the requirements of the GDPR.
If you have any questions or suggestions regarding the content of this privacy policy or the processing of your personal data on sebastian-damaschke.com, please send them to:
Intercultural & Executive Coaching
Sebastian Damaschke
Kaiserswerther Strasse 228,
47259 Duisburg, Germany
Email: sebastian@damaschke-business.com
Phone: +49 152 5700 9238
