1. Controller
The controller responsible for data processing on this website is:
We have not appointed a Data Protection Officer, as we are not required to do so under Art. 37 GDPR.
2. Scope, and which law applies
This website is operated from Germany. Because we are established in the European Union, the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) apply to our processing of personal data — regardless of where you are located when you visit this site (Art. 3(1) GDPR). Visitors from outside the EU therefore benefit from the same rights described below.
3. Hosting and server log files
This website is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA, and by Netlify's European entity where applicable. When you access this site, your browser automatically transmits information that our hosting provider stores in server log files: IP address of the requesting device, date and time of the request, name and URL of the file retrieved, referrer URL, browser type and version, operating system, and amount of data transferred.
This data is processed to enable delivery of the website, to ensure system security and stability, and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technically error-free presentation and security of our website. This data is not merged with other data sources and is not used to identify you personally.
We have concluded a data processing agreement (Art. 28 GDPR) with Netlify. Because Netlify is a US provider, personal data may be transferred to the United States. This transfer is safeguarded by the EU Standard Contractual Clauses and by Netlify's certification under the EU–US Data Privacy Framework.
4. Fonts
This website uses the typefaces "Anton" and "Inter", which are stored locally on our own server. No connection to third-party servers such as Google is established when fonts are loaded, and no data about you is transmitted to third parties for this purpose.
5. Cookies and tracking
This website uses Cloudflare Web Analytics, a privacy-focused analytics service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. It sets no cookies, uses no localStorage, no fingerprinting and no cross-site tracking, and it does not create user profiles or recognise you on a later visit. It records only aggregate information about page requests: the page visited, the referring website, and technical data such as country, browser and device type, derived from data your browser sends with every request. No data is used to identify you personally.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in understanding, in aggregate, which pages of our website are useful. Because no information is stored on or read from your device, no consent under § 25 TDDDG is required. We have concluded a data processing agreement with Cloudflare; transfers to the USA are safeguarded by the EU Standard Contractual Clauses. Cloudflare’s privacy policy: cloudflare.com/privacypolicy
This website sets no cookies of its own and uses no retargeting or advertising services. The only exception arises if you actively start the video on the “Work with me” page; see section 10.
6. Contacting us by email
If you contact us by email ([email protected]) or via one of the mailto links on this site, the data you provide (your email address, your name and the content of your message) is stored by us in order to process your enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in answering enquiries addressed to us. We delete this data as soon as it is no longer required, unless statutory retention obligations apply — commercial correspondence is generally retained for 6 years under German commercial and tax law.
7. Booking an advisory call (Calendly)
To schedule calls we use Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, GA 30363, USA. Our website does not embed Calendly; the buttons on our site are plain links. Only when you click such a link are you taken to Calendly's own platform, where Calendly's privacy policy applies.
If you book an appointment there, Calendly processes the data you enter (name, email address, appointment details, time zone, any information you add to the booking form) on our behalf as our processor, and additionally records technical data such as your IP address. The legal basis for the appointment booking is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures). We have concluded a data processing agreement with Calendly; transfers to the USA are safeguarded by the EU Standard Contractual Clauses. Calendly's privacy policy: calendly.com/privacy
8. Newsletter (5 Minute Sunday)
Our newsletter, 5 Minute Sunday, is published on LinkedIn. The “Subscribe” links on this website take you to LinkedIn, where subscription happens on LinkedIn’s own pages and under LinkedIn’s terms and privacy policy. We do not receive an email address from you through that route, and we do not operate an email distribution list of our own for it.
LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland is the controller for what happens on its own platform. Its privacy policy: linkedin.com/legal/privacy-policy
Every past issue is also published in full on this website, where it can be read without subscribing to anything and without giving us any data.
9. The delegation guide (download form)
On the page that shows what staying hands-on is costing you, you can enter your first name and email address to receive a guide. We process those two pieces of information, together with the language and page you submitted from, for two purposes: to give you the guide, and to add you to the 5 Minute Sunday newsletter. Both are stated on the form before you submit it, and the legal basis for both is your consent under Art. 6(1)(a) GDPR, given by submitting the form.
The submission is recorded in two places. It is stored by Netlify, Inc., our hosting provider (see section 3), in our account. It is also written to a spreadsheet held in our Google Workspace account, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which is also our email provider. Both act as our processors under Art. 28 GDPR, and transfers to the USA are safeguarded by the EU Standard Contractual Clauses as described in section 3.
The guide itself is handed to you on the page immediately after you submit. It is not emailed, and you do not need to confirm anything to receive it. Your address is not passed to any newsletter or email marketing service, and it is not added to an automated mailing list. We keep it so that we can contact you about the guide and about our work; the legal basis is your consent under Art. 6(1)(a) GDPR, given when you submit the form. You may withdraw that consent at any time by writing to [email protected], and we will delete your name and address from both places.
10. Video (YouTube)
On our “Work with me” page we make a video available that is hosted on YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
The video is embedded using a two-click solution. When you open the page, no connection to YouTube or Google is established. You see only a preview image stored on our own server and a play button. No cookies are set and no data is transmitted to Google at this point.
Only when you click the play button is the video loaded from YouTube. At that moment your IP address and technical data about your browser and device are transmitted to Google, and Google may store information on your device. If you are logged in to your Google account at that time, Google can assign your viewing behaviour to your personal profile; you can prevent this by logging out of your Google account beforehand. We use YouTube’s extended data protection mode (youtube-nocookie.com), in which, according to Google, no cookies for personalised advertising are set before you start playback — but this does not prevent a connection to Google being established once you press play.
The legal basis for loading the video is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, which you give by clicking the play button. You can withdraw your consent at any time with effect for the future by not playing the video and by reloading the page. Data may be transferred to servers of Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Further information can be found in Google’s privacy policy: policies.google.com/privacy
11. Links to social networks
Our website links to our profile on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). These are simple text links; no plugins, buttons or pixels from LinkedIn are embedded on our site, and no data is transmitted to LinkedIn until you actively click the link. From that point onwards, LinkedIn's privacy policy applies: linkedin.com/legal/privacy-policy
12. Client and coaching data
Where we work with you as a client, we process the personal data needed to deliver the engagement: contact and invoicing details, appointment data, session notes and the documents you share with us. The legal basis is Art. 6(1)(b) GDPR (performance of our contract) and, for invoicing and retention, Art. 6(1)(c) GDPR together with German commercial and tax law. Coaching content is treated as confidential and is not disclosed to your employer or to third parties without your explicit instruction. Contract and accounting records are retained for the statutory periods of up to 10 years.
13. Recipients of your data
We only pass on personal data where this is necessary and legally permitted: to the processors named above (hosting, email, scheduling, newsletter), to our tax advisor and, where required, to tax authorities, and to payment service providers where you make a payment. All processors are bound by data processing agreements under Art. 28 GDPR.
14. Transfers to third countries
Some of the services described above are provided by companies based in the United States. Where personal data is transferred there, we rely on the EU Standard Contractual Clauses adopted by the European Commission and, where available, on the recipient's certification under the EU–US Data Privacy Framework. You should be aware that US authorities may have access rights that fall short of EU standards and that enforcing your rights there may be more difficult.
15. Your rights
You have the right to: access the personal data we hold about you (Art. 15 GDPR); rectification of inaccurate or incomplete data (Art. 16 GDPR); erasure of your data (Art. 17 GDPR); restriction of processing (Art. 18 GDPR); data portability in a structured, machine-readable format (Art. 20 GDPR); object to processing based on legitimate interests (Art. 21 GDPR); and withdraw consent at any time with effect for the future (Art. 7(3) GDPR).
To exercise any of these rights, write to [email protected].
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
datenschutz-berlin.de
16. Data security
This website is transmitted exclusively via an encrypted HTTPS/TLS connection, which you can recognise by the lock symbol in your browser's address bar. We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.
17. Changes to this privacy policy
We update this privacy policy when changes to our website or to legal requirements make it necessary. The current version always applies and is available at this address.