Privacy Policy

Last updated: March 2026

Your Rights

You have the right to:

Request a copy of the personal data we hold about you (Art. 15 DSGVO)
Correct any inaccurate data (Art. 16 DSGVO)
Request deletion of your data (Art. 17 DSGVO)
Restrict processing of your data (Art. 18 DSGVO)
Receive your data in a portable format (Art. 20 DSGVO)
Object to processing of your data (Art. 21 DSGVO)

To exercise any of these rights, email us at info@soyermusic.com. We will respond within 30 days.

What We Collect

We collect personal data only when you actively provide it:

Contact form: your name, phone number, email address, and message
WhatsApp: your phone number and message content when you contact us
Payments: payment details processed by Stripe when you book lessons
Technical: your IP address is temporarily used for rate limiting (not stored)

Why We Collect It

Each type of data has a specific legal basis under DSGVO Art. 6:

Contact form & WhatsApp: your consent (Art. 6(1)(a)) — you choose to reach out
Payment data: contract performance (Art. 6(1)(b)) — processing your lesson booking
Rate limiting (IP address): legitimate interest (Art. 6(1)(f)) — protecting the site from abuse

Contact Form

When you submit our contact form, your data is sent to Ceren via email (through Resend) and stored in our lesson management system (Coda) so we can respond to your inquiry and manage lesson bookings.

When you message us on WhatsApp, your messages are processed through the WhatsApp Business API (Meta) and stored in our lesson management system (Coda) for student communication and lesson coordination.

Payments

Lesson payments are processed by Stripe. We do not store your payment card details on our servers. Stripe handles all payment data according to PCI DSS standards. Payment records are retained for 10 years as required by German tax law (§147 AO).

Who Processes Your Data

We use the following services to operate this website:

Vercel — website hosting and serverless functions (USA, EU edge network)
Resend — sending email notifications (USA)
Coda — lesson management and student records (USA)
Stripe — payment processing (USA/EU)
Meta / WhatsApp — messaging (USA/EU)

International Transfers

Some of our service providers are based in the United States. Data transfers are protected by the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs) as required by DSGVO.

How Long We Keep It

We don't keep data longer than necessary:

Contact form submissions: until the student relationship ends, plus 6 months
Email notifications: automatically deleted after 30 days (Resend)
WhatsApp messages: until the student relationship ends, plus 6 months
Payment records: 10 years (German tax law, §147 AO)
Theme preference: stored in your browser until you clear it

Cookies & Local Storage

This website does not use tracking cookies. We use Umami for anonymous page analytics (no cookies, no personal data). We store only:

Your dark/light mode preference (localStorage — stays in your browser)
Whether you dismissed the cookie notice (localStorage)

We do not use Google Analytics, Facebook Pixel, or any cookie-based tracking tools. Umami analytics is cookieless and collects no personal data.

Data Controller

Ceren Ece Soyer
Deichstraße 32, 20459 Hamburg
Email: info@soyermusic.com

Right to Complain

If you believe your data has been processed unlawfully, you have the right to file a complaint with the supervisory authority:Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 20459 Hamburg

Changes to This Policy

We may update this privacy policy from time to time. The date at the top of this page shows when it was last revised.