Privacy Policy (Datenschutzerklärung)

§1 Scope & Applicability

§2 Definitions

• "Personal data" means any information relating to an identified or identifiable natural person (Art. 4 No. 1 DSGVO). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• "Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction (Art. 4 No. 2 DSGVO).
• "Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (Art. 4 No. 7 DSGVO).
• "Processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller (Art. 4 No. 8 DSGVO).
• "Data subject" means any identified or identifiable natural person whose personal data is being processed by the controller.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her (Art. 4 No. 11 DSGVO).

§3 Data Controller (Verantwortlicher)

§4 Rights of the Data Subject

• Right of access (Art. 15 DSGVO): You have the right to obtain confirmation as to whether personal data concerning you is being processed, and, where that is the case, access to the personal data and information including the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients, the envisaged retention period, and the existence of the right to request rectification, erasure, or restriction of processing.
• Right to rectification (Art. 16 DSGVO): You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
• Right to erasure (Art. 17 DSGVO): You have the right to obtain the erasure of personal data concerning you without undue delay where one of the grounds set out in Art. 17(1) DSGVO applies, for instance where the data is no longer necessary in relation to the purposes for which it was collected, or where you have withdrawn your consent on which the processing is based.
• Right to restriction of processing (Art. 18 DSGVO): You have the right to obtain restriction of processing where you contest the accuracy of the personal data, the processing is unlawful and you oppose the erasure, we no longer need the data but you require it for the establishment, exercise, or defence of legal claims, or you have objected to processing pending the verification of legitimate grounds.
• Right to data portability (Art. 20 DSGVO): You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and have the right to transmit those data to another controller without hindrance, where the processing is based on consent or a contract and is carried out by automated means.
• Right to object (Art. 21 DSGVO): You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) DSGVO, including profiling based on those provisions. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms.
• Right to withdraw consent (Art. 7(3) DSGVO): Where processing is based on your consent, you have the right to withdraw that consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

§5 Categories of Personal Data Collected

§6 Legal Basis for Processing

• Art. 6(1)(a) DSGVO — Consent of the data subjectProcessing of data submitted through the contact form and WhatsApp messaging is based on your freely given, informed consent. You provide this consent by voluntarily initiating contact and, in the case of the contact form, by affirmatively checking the consent checkbox before submission. You may withdraw your consent at any time with effect for the future (see §4).
• Art. 6(1)(b) DSGVO — Performance of a contractProcessing of payment data is necessary for the performance of a contract to which you are party, specifically the booking and delivery of music lessons. This includes processing your payment through Stripe and maintaining booking records.
• Art. 6(1)(f) DSGVO — Legitimate interests of the controllerThe transient processing of IP addresses for rate limiting and abuse prevention constitutes a legitimate interest within the meaning of Art. 6(1)(f) DSGVO. Our legitimate interest lies in ensuring the availability, integrity, and security of the website. A balancing test has been conducted confirming that this interest is not overridden by the fundamental rights and freedoms of data subjects, given that IP addresses are processed only transiently and are not stored.
• Art. 6(1)(c) DSGVO — Compliance with a legal obligationThe retention of invoices, payment records, and booking confirmations for a period of ten (10) years is required pursuant to §147 of the German Fiscal Code (Abgabenordnung, "AO") and §257 of the German Commercial Code (Handelsgesetzbuch, "HGB").

§7 Processing via Contact Form

§8 Processing via WhatsApp Communication

§9 Payment Processing & Financial Data

§10 Sub-Processors & Third-Party Service Providers

• Resend Inc.Transactional email delivery for contact form notifications. Headquarters: San Francisco, CA, USA. Email content is automatically purged after 30 days. Legal basis for transfer: Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) DSGVO.
• Coda (Coda Project Inc.)Lesson management, student records, and communication log storage. Headquarters: San Francisco, CA, USA. Legal basis for transfer: Standard Contractual Clauses (SCCs).
• Stripe Inc. / Stripe Payments Europe Ltd.Payment processing, invoicing, and financial compliance. Stripe, Inc. (USA) and Stripe Payments Europe Ltd. (Dublin, Ireland). PCI DSS Level 1 certified. EEA payment data is processed within the EU by default. Legal basis for transfer: EU-US Data Privacy Framework (DPF) certification.
• Meta Platforms Ireland Ltd.WhatsApp Business API for inbound messaging. Meta Platforms Ireland Ltd. (Dublin, Ireland). Messages may be processed in both EU and US data centers. Legal basis for transfer: EU-US Data Privacy Framework (DPF) certification.
• Google Ireland Ltd.Google Analytics 4 (GA4) for website analytics and Google Ads conversion tracking (consent-gated). Google Ireland Ltd. (Dublin, Ireland). Legal basis for transfer: EU-US Data Privacy Framework (DPF) certification.
• Umami Software, Inc.Privacy-first website analytics. Umami Software, Inc. Headquarters: San Francisco, CA, USA. No cookies set; collects anonymised page-view and event data only. Legal basis for transfer: Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) DSGVO.

§11 International Data Transfers

• EU-US Data Privacy Framework (DPF): Where a sub-processor is certified under the DPF (adequacy decision of the European Commission of 10 July 2023, C(2023) 4745), this certification serves as the basis for the transfer pursuant to Art. 45 DSGVO.
• Standard Contractual Clauses (SCCs): Where DPF certification is not available, we rely on the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) DSGVO (Commission Implementing Decision (EU) 2021/914 of 4 June 2021).
• Adequacy decisions: For transfers to countries that have been the subject of an adequacy decision by the European Commission (Art. 45 DSGVO), no additional safeguards are required.

§12 Data Retention Periods

• Contact form submissions: retained for the duration of the student relationship plus six (6) months following its termination, to allow for follow-up inquiries and account reconciliation
• Email notifications (via Resend): automatically and irrecoverably purged from Resend's infrastructure after thirty (30) days
• WhatsApp message records: retained for the duration of the student relationship plus six (6) months, unless longer retention is required for the resolution of an ongoing dispute or legal proceeding
• Payment records, invoices, and booking confirmations: ten (10) years from the end of the calendar year of the transaction, in compliance with §147 AO and §257 HGB
• Google Analytics data: anonymized analytics data is retained for fourteen (14) months (Google's default retention setting for GA4 properties)
• Theme preference and cookie consent choice: stored in your browser's local storage (localStorage) with no server-side persistence; retained until manually cleared by the user or upon browser data deletion

§13 Cookies, Local Storage & Tracking Technologies

§14 Google Analytics 4 & Google Ads Conversion Tracking

• Data processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
• Legal basis: Art. 6(1)(a) DSGVO — your explicit, informed, freely given consent via the cookie banner
• Data collected upon consent: IP address (anonymized via IP masking before storage), pages visited and interaction events, session duration and engagement metrics, device type, operating system, browser type and version, screen resolution, referral source (direct, organic search, paid ad, social media), and geographic region (derived from anonymized IP, city-level precision)
• Cookies set: _ga (client ID, 2 years), _ga_[Measurement-ID] (session state, 2 years), _gid (session ID, 24 hours). See §13.2 for detailed descriptions.
• International data transfer: Google Ireland Ltd. may transfer data to Google LLC (USA). This transfer is protected by Google's participation in the EU-US Data Privacy Framework (DPF), certified by the U.S. Department of Commerce.
• IP anonymization: GA4 does not log full IP addresses by default. IP addresses are used for geographic derivation and then discarded. No full IP addresses are stored in our GA4 property.

§15 Technical & Organizational Security Measures

• Transport Layer Security (TLS): All data transmitted between your browser and our servers is encrypted using TLS 1.3. Our website enforces HTTPS via HTTP Strict Transport Security (HSTS) headers with a minimum max-age of one year.
• Access controls: Administrative access to sub-processor accounts (Vercel, Coda, Stripe, Resend) is restricted to authorized personnel and protected by multi-factor authentication (MFA). Access credentials are stored in an encrypted password manager.
• Data minimization by design: Our systems are designed to collect only the minimum data necessary for each processing purpose. Contact form fields are limited to essential information, and payment card details never touch our infrastructure.
• Regular review: We periodically review our security measures, sub-processor agreements, and data processing activities to ensure continued compliance with DSGVO requirements and to address emerging threats.

§16 Automated Decision-Making & Profiling

§17 Supervisory Authority & Right to Lodge a Complaint

§18 Amendments & Version History