Privacy & Data Protection

General information

The following notes give a simple overview of what happens to your personal data when you visit this website or book our coaching. Personal data is any data that can be used to identify you personally. Detailed information follows in the sections below.

Who is responsible for data collection?

Data processing on this website and in our coaching is carried out by the operator. Contact details are listed under "Controller" in Section 2.

How do we collect your data?

Some data is collected when you provide it to us, for example in a form, when booking a call, when paying or during coaching. Other data is collected automatically or with your consent by our IT systems when you visit the website. This is mainly technical data such as browser, operating system or time of access.

What do we use your data for?

Part of the data is collected to provide the website without errors. Other data is used to deliver the coaching, process payments, communicate with you and, with your consent, to analyse user behaviour and show advertising.

What rights do you have?

You have the right to receive information about the origin, recipients and purpose of your stored personal data free of charge at any time. You also have the right to request correction or deletion of this data. If you have given consent, you can withdraw it at any time for the future. You may also request restriction of processing under certain circumstances and have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time with these or other questions about data protection.

Data protection

We take the protection of your personal data seriously and treat it confidentially in accordance with statutory data protection regulations and this privacy policy. Please note that data transmission over the internet (e.g. by email) can have security gaps. Complete protection against access by third parties is not possible.

Controller

The controller responsible for data processing is: Leonie Rössle, Neue Straße 23, 89143 Germany, mail@owntheinnergame.info, WhatsApp: +4915563133621. The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

Storage period

Unless a more specific storage period is stated in this policy, your personal data will remain with us until the purpose of processing no longer applies. If you make a justified request for deletion or withdraw consent, your data will be deleted unless we have other legally permissible reasons for storing it, e.g. retention periods under tax or commercial law (generally up to 10 years for invoices and accounting records). In that case, deletion takes place once these reasons no longer apply.

Legal bases

If you have consented, we process your data on the basis of Art. 6(1)(a) GDPR, or Art. 9(2)(a) GDPR where special categories of data under Art. 9(1) GDPR (e.g. health data) are processed. If you have consented to the storage of cookies or access to information on your device, processing is additionally based on Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Consent can be withdrawn at any time. Where data is necessary to perform a contract or take pre-contractual steps, we process it on the basis of Art. 6(1)(b) GDPR. Where data is necessary to comply with a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. Processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR. The relevant legal basis in each case is stated in the sections below.

Transfers to the USA and other third countries

We use tools from companies based in the USA or other third countries. When these tools are active, your personal data may be transferred to and processed in these countries. For US companies certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission of 10 July 2023. Otherwise, transfers are based on the EU Commission's standard contractual clauses. Please note that in third countries without an adequacy decision, a level of data protection comparable to the EU cannot be guaranteed, and authorities may be able to access the data.

Withdrawal of consent

Many processing operations are only possible with your express consent. You can withdraw consent at any time. The lawfulness of processing carried out before withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

IF PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (ART. 21(1) GDPR).

IF YOUR DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO SUCH PROCESSING, INCLUDING PROFILING RELATED TO DIRECT MARKETING. YOUR DATA WILL THEN NO LONGER BE USED FOR DIRECT MARKETING (ART. 21(2) GDPR).

Right to lodge a complaint

In the event of a breach of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged breach. The authority responsible for us is [Berlin Commissioner for Data Protection and Freedom of Information / authority of the state where the business is registered].

Right to data portability

You have the right to receive data that we process automatically on the basis of your consent or to perform a contract, in a common machine-readable format, or to have it transferred to another controller where technically feasible.

SSL/TLS encryption

This website uses SSL/TLS encryption to protect confidential content such as orders or enquiries. You can recognise an encrypted connection by "https://" and the lock symbol in your browser's address bar.

Access, deletion and correction

Within the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin, recipients and the purpose of processing, and, if applicable, a right to correction or deletion.

Right to restriction of processing

You have the right to request restriction of processing in the following cases:

• You dispute the accuracy of your data, for the time we need to verify it.
• Processing is unlawful and you request restriction instead of deletion.
• We no longer need the data, but you need it to establish, exercise or defend legal claims.
• You have objected under Art. 21(1) GDPR, while it is not yet clear whose interests prevail.

If processing is restricted, the data may, apart from storage, only be processed with your consent, for legal claims, to protect the rights of another person, or for reasons of important public interest of the EU or a member state.

Cookies

Our website uses cookies. Cookies are small text files that do not damage your device. They are stored either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically when you leave. Persistent cookies remain on your device until you delete them or your browser deletes them automatically.

Third-party cookies may also be stored when you visit our site. These enable us or you to use certain services of the third party, e.g. payment processing.

Technically necessary cookies, which are required for electronic communication, for functions you have requested or to optimise the website, are stored on the basis of Art. 6(1)(f) GDPR. Where consent to cookies and similar technologies has been requested, processing is based exclusively on this consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); consent can be withdrawn at any time. You can manage your consent via [name of consent banner / link to cookie settings].

You can set your browser to inform you about cookies, allow them only in individual cases, exclude them in general or delete them automatically when closing the browser. Deactivating cookies may limit the functionality of this website.

Contact and booking forms

If you send us enquiries via a form (e.g. webinar registration, call booking), your details including contact data are stored to process the enquiry and for follow-up questions. We do not pass this data on without your consent.

Processing is based on Art. 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual measures. In all other cases, it is based on our legitimate interest in handling enquiries effectively (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if requested.

The data remains with us until you request deletion, withdraw consent or the purpose no longer applies. Mandatory statutory retention periods remain unaffected.

Enquiries by email or phone

If you contact us by email or phone, your enquiry including all resulting personal data (name, request) is stored and processed to handle your request. We do not pass this data on without your consent. The legal bases and storage period are the same as for forms above.

What we process

When you book our coaching, we process your contact data (name, email, phone, address), contract and payment data, session dates, notes from sessions, and content you share with us in sessions, messages or questionnaires.

Health-related data

In coaching and breathwork, you may share information about your physical or mental health, for example stress levels, sleep, anxiety, pre-existing conditions or medication. This is a special category of personal data under Art. 9 GDPR. We only process this data on the basis of your explicit consent (Art. 9(2)(a) GDPR), which we obtain before the coaching begins. You can withdraw this consent at any time; we may then no longer be able to provide parts of the coaching safely.

Purpose and confidentiality

We use this data exclusively to deliver and adapt the coaching to you. We treat it confidentially, do not pass it on to third parties and do not use it for advertising. Sessions are only recorded with the consent of all participants.

Legal basis and storage

Processing of contact, contract and session data is based on Art. 6(1)(b) GDPR. Session notes and health-related data are deleted [X months] after the end of the program, unless you ask us to delete them earlier. Contract and invoice data is kept for the statutory retention periods (Art. 6(1)(c) GDPR).

Stripe

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe"). When you pay, Stripe processes your name, email, billing address, payment details (e.g. card number, expiry date), IP address and transaction data. We do not receive your full card details.

Stripe also uses this data for fraud prevention and to meet its own legal obligations, for which it is an independent controller. Data may be transferred to Stripe, Inc. in the USA; the transfer is based on the EU-US Data Privacy Framework and standard contractual clauses.

The legal basis is Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (our legitimate interest in secure payment processing). More information: https://stripe.com/privacy

Klarna

If you choose Klarna as a payment method, your payment data is passed to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may carry out an identity and credit check. Klarna is an independent controller for this. The legal basis is Art. 6(1)(b) GDPR. More information: https://www.klarna.com/international/privacy-policy/

Zoom

We use Zoom for coaching sessions, webinars and sales calls. Provider: Zoom Communications, Inc., 55 Almaden Blvd, San Jose, CA 95113, USA. Zoom processes your name, email, IP address, device data and, where you enable them, audio and video. Meetings are only recorded with the consent of all participants.

The legal basis is Art. 6(1)(b) GDPR where the call serves the contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in efficient online communication). We have concluded a data processing agreement with Zoom. Data may be transferred to the USA; see Section 2.

WhatsApp

We communicate with clients and interested parties via WhatsApp Business. Provider: WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. WhatsApp processes your phone number, profile name and message metadata; messages are end-to-end encrypted. Data may be transferred to Meta Platforms, Inc. in the USA. We use WhatsApp only if you contact us there or have agreed to it. The legal basis is Art. 6(1)(a), (b) or (f) GDPR. If you prefer, you can contact us by email instead.

Telegram

We offer a community group for clients via Telegram. Provider: [Telegram provider name and address]. Participation is voluntary. Telegram processes your phone number, username and the content you post in the group. Other group members can see your profile name and posts. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw by leaving the group.

Leadcosmos / HighLevel CRM

We manage contacts, bookings, emails and client communication in Leadcosmos, which is based on the HighLevel platform (see Section 3 for the providers). This includes data from forms, bookings, purchases and our communication with you. The legal basis is Art. 6(1)(b) GDPR for clients and prospective clients, otherwise Art. 6(1)(f) GDPR. We have concluded a data processing agreement. Data may be transferred to the USA; see Section 2.

Newsletter

If you subscribe to our newsletter, we need your email address and information that allows us to verify that you own this address and agree to receive the newsletter (double opt-in). Further data is only collected voluntarily. We use this data exclusively to send the requested information. The newsletter is sent via Leadcosmos.

Processing is based exclusively on your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time, e.g. via the unsubscribe link in each email. The lawfulness of processing already carried out remains unaffected.

Your data is stored until you unsubscribe and then deleted from the distribution list. We reserve the right to delete or block email addresses at our discretion based on our legitimate interest (Art. 6(1)(f) GDPR). Data stored for other purposes remains unaffected.

After unsubscribing, your email address may be stored on a blocklist to prevent future mailings. This data is used only for this purpose and is not combined with other data. This serves both your interest and ours in complying with legal requirements (Art. 6(1)(f) GDPR). Storage on the blocklist is not time-limited. You may object if your interests outweigh our legitimate interest.

Facebook plugins (Like and Share buttons)

This website integrates plugins of the social network Facebook. Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. According to Meta, collected data is also transferred to the USA and other third countries.

When you visit this website, the plugin establishes a direct connection between your browser and Facebook's servers. Facebook thereby learns that you have visited this website with your IP address. If you click the Like button while logged into your Facebook account, Facebook can link your visit to your account. We have no knowledge of the content of the transmitted data or its use by Facebook. More information: https://www.facebook.com/privacy/policy/

If you do not want Facebook to assign your visit to your account, please log out of Facebook. The plugins are used on the basis of your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). Consent can be withdrawn at any time.

Instagram plugin

This website integrates functions of Instagram, also provided by Meta Platforms Ireland Limited. If you are logged into Instagram, you can link content from this website to your profile by clicking the Instagram button, and Instagram can assign your visit to your account. The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). More information: https://privacycenter.instagram.com/policy/

Joint controllership with Meta

Where personal data is collected on our website via these tools and passed to Meta, we and Meta Platforms Ireland Limited are joint controllers for this collection and transfer (Art. 26 GDPR). Processing by Meta after the transfer is not part of the joint responsibility. The agreement is available at https://www.facebook.com/legal/controller_addendum. We are responsible for providing privacy information and for implementing the tools securely; Meta is responsible for the security of its products. You can exercise your rights regarding data processed by Meta directly with Meta. If you contact us, we will forward your request to Meta.

Transfers to the USA are based on the EU-US Data Privacy Framework and standard contractual clauses.

Meta Pixel

We use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure the effectiveness of our Facebook and Instagram ads and to show ads to people who have visited our website. The pixel records page views and actions such as form submissions and purchases, and Meta can link this to your Meta account. The joint controllership described in Section 9 applies. Data may be transferred to the USA.

Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to manage tracking codes on our website. The Tag Manager itself does not create user profiles but may record your IP address and transfer it to Google in the USA.

Google Ads and conversion tracking

We use Google Ads, provided by Google Ireland Limited, to show ads in Google search results and to measure whether visitors take certain actions after clicking an ad (e.g. registration, booking). Google may use cookies for this and link the data to your Google account. Data may be transferred to Google LLC in the USA. More information: https://policies.google.com/privacy

YouTube

This website embeds videos from YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit a page with an embedded video, a connection to YouTube's servers is established and YouTube learns which of our pages you visited. YouTube may store cookies or use similar technologies to recognise you, e.g. for video statistics, usability and fraud prevention. If you are logged into your YouTube account, YouTube can assign your browsing behaviour to your profile; you can prevent this by logging out.

The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG), which can be withdrawn at any time. More information: https://policies.google.com/privacy

Vimeo

This website uses plugins of the video portal Vimeo, provided by Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA. When you visit a page with a Vimeo video, a connection to Vimeo's servers is established and Vimeo receives your IP address, even if you are not logged in. The data is transferred to Vimeo's servers in the USA. If you are logged into Vimeo, Vimeo can assign your browsing behaviour to your profile. Vimeo uses cookies or similar technologies to recognise visitors.

The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG), which can be withdrawn at any time. Transfers to the USA are based on the EU Commission's standard contractual clauses. More information: https://vimeo.com/privacy

Google Fonts

This website uses web fonts provided by Google to display fonts consistently. When you access a page, your browser connects to Google's servers, and Google learns that this website was accessed via your IP address. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a consistent presentation, or your consent where requested. If your browser does not support web fonts, a standard font from your computer is used.

More information: https://developers.google.com/fonts/faq and https://policies.google.com/privacy