Privacy policy

1. Controller

The controller responsible for data processing on this website is: Franziska Oeser, Overbeckstr. 42, 29640 Schneverdingen, Germany. Email: franziska.oeser@gmx.de, phone: +49 151 252 707 08

2. General information

Protecting your personal data matters to me. I only process personal data insofar as this is necessary to provide this website, my content and my services, or where you have given your consent. The legal bases are the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3. Hosting and server log files

This website is operated via Lovable (Lovable Labs, Stockholm, Sweden) and delivered through the network of Cloudflare, Inc. (San Francisco, USA). When you visit the website, information transmitted by your browser is recorded automatically: IP address, date and time of access, page visited, browser type and operating system. This data serves the secure and stable operation of the website. The legal basis is Art. 6(1)(f) GDPR. A data processing agreement is in place with Lovable. Where data is transferred to the USA, this takes place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. The storage period of the log files follows the provider's rules [deletion period per the Lovable data processing agreement to be added].

4. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar.

5. Cookies and local storage

This website does not set any cookies for analytics or advertising purposes. Your language choice is stored locally in your browser (localStorage) so that the site greets you in your language on your next visit. This is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). You can delete this data in your browser at any time. When the embedded scheduling calendar loads, Calendly sets its own cookies (see section 7). Lovable may compile anonymised visitor statistics [check whether this is active and how it is collected].

6. Masterclass registration and Burst-of-Courage Plan

When you register for the masterclass or request the Burst-of-Courage Plan, I process your first name (masterclass only), your email address, the selected language and the time of registration. I use this data to send you the Zoom link, a reminder and the Burst-of-Courage Plan. The legal basis is Art. 6(1)(b) GDPR (provision of the service you requested). The data is stored in a database at Supabase, Inc. (USA), with servers located in the USA (Oregon). Transfer to the USA takes place on the basis of the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. The data is deleted no later than three months after the masterclass, unless you have consented to receiving further emails. To send the emails I use Brevo (Sendinblue SAS, Paris, France); a data processing agreement is in place with the provider.

7. Appointment booking via Calendly

To book the discovery call, I use Calendly (Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA). When you book, your name, email address, the selected appointment and any information you provide voluntarily are transmitted to Calendly. The legal basis is Art. 6(1)(b) GDPR. The calendar is embedded on this page and loads automatically when you open the page, without asking first. Data such as your IP address is then transmitted to Calendly in the USA and Calendly may set cookies. The legal basis for this is § 25(1) TDDDG; by using the page you give your consent. You can withdraw it at any time by closing the page and deleting Calendly cookies in your browser (Art. 21 GDPR). Data is transferred to the USA on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Further information can be found in Calendly's privacy policy.

8. Video sessions via Zoom

The masterclass and coaching sessions take place via Zoom (Zoom Communications, Inc., 55 Almaden Blvd., San Jose, CA 95113, USA). Zoom processes technical data such as IP address, device information and attendance times, as well as video and audio if you turn on your camera and microphone. The legal basis is Art. 6(1)(b) GDPR. I do not record sessions. Data is transferred to the USA on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

9. Contact via WhatsApp, email or phone

If you contact me via WhatsApp, email or phone, I process your information in order to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR for enquiries about my services, otherwise Art. 6(1)(f) GDPR. WhatsApp is a service of WhatsApp Ireland Limited (Merrion Road, Dublin 4, Ireland). Data may also be transferred to the USA. If you do not want this, please write to me by email.

10. Fonts

This website uses the Jost typeface. The font is loaded locally from my server; no connection to Google is made.

11. Coaching log for ICF certification

For my certification with the International Coaching Federation, I keep a log of my coaching hours. It contains only name, email address, date and duration of the sessions. The content of our conversations is not recorded. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is providing evidence of my coaching practice.

12. Storage period

I store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods, for example up to ten years for invoices under tax law.

13. Provision of data and automated decision-making

Providing your data is voluntary. Without it, however, I cannot send you the Zoom link, the Burst-of-Courage Plan or an appointment. No automated decision-making, including profiling, takes place.

14. Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future. An informal message to franziska.oeser@gmx.de is sufficient.

Right to object under Art. 21 GDPR: Where I process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. A message to franziska.oeser@gmx.de is sufficient.

15. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, for example the authority where you live or the authority responsible for me: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.