Privacy Policy | STEFANIE WOITUN

1. Privacy at a glance

This privacy policy explains which personal data is processed when you visit this website and use my services, why this happens and what rights you have. Personal data is any data that can be used to identify you personally.

2. Controller

The controller responsible for data processing on this website is:

Stefanie Woitun
Emsdettener Str. 10
c/o Postflex #8530
48268 Greven
Germany

Email: stefaniewoitun@gmail.com

I am not required to appoint a data protection officer. If you have any questions about data protection, just email me at the address above.

3. General information

Legal bases
I only process personal data where there is a legal basis for it, in particular:
- your consent (Art. 6(1)(a) GDPR; for health data Art. 9(2)(a) GDPR),
- the performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR),
- a legal obligation, e.g. tax retention requirements (Art. 6(1)(c) GDPR),
- my legitimate interest in operating a secure and functioning website (Art. 6(1)(f) GDPR).
Where information is stored on or read from your device, this is done on the basis of Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Storage period
I only store personal data for as long as is necessary for the respective purpose or as required by statutory retention periods (e.g. 8 years for invoices and 10 years for accounting records under German commercial and tax law). The data is then deleted.

Transfers to third countries
Some of the services I use are based outside the EU, e.g. in Israel or the USA. The European Commission has issued an adequacy decision for Israel. Transfers to the USA are based on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.

Data processing agreements
I have concluded data processing agreements under Art. 28 GDPR with service providers who process data on my behalf (e.g. Wix, MailerLite, Zoom).

Your rights
You have the right at any time:
- to access the data stored about you (Art. 15 GDPR),
- to have incorrect data rectified (Art. 16 GDPR),
- to have your data erased (Art. 17 GDPR),
- to restrict processing (Art. 18 GDPR),
- to data portability (Art. 20 GDPR),
- to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).
To exercise these rights, simply send me an email.

Right to object (Art. 21 GDPR)
Where I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. I will then no longer process the data unless there are compelling legitimate grounds for the processing or it serves to establish, exercise or defend legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.

Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement.

SSL/TLS encryption
This website uses SSL/TLS encryption. You can recognise it by "https://" and the padlock symbol in your browser's address bar. Payment data is also only ever transmitted in encrypted form.

Objection to advertising emails
I hereby object to the use of the contact details published in the legal notice (Impressum) for sending unsolicited advertising and information material. I reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.

4. Hosting with Wix

This website is built and run with the website builder Wix. The provider is Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel. Wix stores the content of this website and processes the data generated when you visit it (e.g. IP address, browser, time of access), as well as the data you enter in forms or in the shop. Wix also uses servers and sub-processors in the EU and the USA.
The legal basis is my legitimate interest in a reliable and secure presentation of my website (Art. 6(1)(f) GDPR) and, where orders are concerned, the performance of a contract (Art. 6(1)(b) GDPR). The European Commission has issued an adequacy decision for Israel. A data processing agreement is in place with Wix.
More information: https://www.wix.com/about/privacy

5. Cookies

This website only uses cookies that are technically necessary for the site to work and stay secure (e.g. for sessions, the shopping cart and protection against misuse). These cookies are set by Wix. The legal basis is Section 25(2) no. 2 TDDDG and my legitimate interest in a functioning website (Art. 6(1)(f) GDPR). Technically necessary cookies do not require consent.
I do not use any cookies for analytics, marketing or advertising purposes. You can delete or block cookies in your browser at any time, although the website may then not work fully.

6. Server log files

When you visit this website, information transmitted by your browser is automatically stored in server log files: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the request and IP address. This data is not combined with other data sources. The legal basis is my legitimate interest in a technically error-free and secure website (Art. 6(1)(f) GDPR).

7. Error monitoring with Sentry

Wix uses the Sentry service on this website to detect and fix technical errors. The provider is Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. Technical data such as browser, operating system and error messages is processed. The legal basis is my legitimate interest in a stable website (Art. 6(1)(f) GDPR).

8. Spam protection with Google reCAPTCHA

Google reCAPTCHA may be used to protect my forms from spam and automated attacks. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA uses various characteristics (e.g. IP address, mouse movements, time spent on the page) to check whether an entry was made by a human. Data may be transferred to Google LLC in the USA. The legal basis is my legitimate interest in protecting my website from misuse (Art. 6(1)(f) GDPR).
More information: https://policies.google.com/privacy

9. Contact form, email and phone

If you contact me via the contact form, by email or by phone, I process the information you provide (e.g. name, email address, message) in order to answer your enquiry. The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR) or my legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Health data: As I work as a coach and as a non-medical practitioner for psychotherapy (Heilpraktikerin für Psychotherapie, Germany), messages may contain information about your health or emotional wellbeing. I only process this specially protected data on the basis of your consent (Art. 9(2)(a) GDPR), which you give by sending it voluntarily. You can withdraw it at any time. In your first message, please only share what you really want to share.
Your enquiry stays with me until its purpose has been fulfilled (e.g. your enquiry has been fully answered) or you ask me to delete it. Statutory retention obligations remain unaffected.

10. Online shop, customer and contract data

When you buy a session, a package or digital content (e.g. a meditation) in my shop, I process the data required for this: name, email address, billing address, order details and payment information. I use it to process the contract, to send you access to digital content or the link for booking your sessions, and to issue an invoice. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and my statutory retention obligations (Art. 6(1)(c) GDPR).
I only pass on data where this is necessary to process the contract, e.g. to the payment provider you choose or for invoicing.

11. Payment providers

I use external payment providers for payments in the shop. Which data they process depends on the payment method you choose. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). The privacy policy of the respective payment provider applies to its processing of your data.

PayPal: The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. More information: https://www.paypal.com/de/legalhub/privacy-full

Stripe (credit card and other payment methods): The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Data may also be transferred to Stripe, Inc. in the USA. More information: https://stripe.com/privacy

12. Appointment booking with SavvyCal

After buying a session or package, you receive a link to book your appointments via SavvyCal. The provider is SavvyCal, Inc., USA. When you book, SavvyCal processes your name, email address, the chosen time and any other information you enter there. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). Transfers to the USA are based on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider is certified under it.
More information: https://savvycal.com/legal/privacy

13. Online sessions with Zoom

I use Zoom for online sessions and discovery calls. The provider is Zoom Communications, Inc., 55 Almaden Boulevard, Suite 600, San Jose, CA 95113, USA. Data processed includes name, email address, audio and video data during the call, IP address and technical data. Sessions are not recorded. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). Zoom is certified under the EU-US Data Privacy Framework. A data processing agreement is in place with Zoom.
More information: https://explore.zoom.us/en/privacy/

14. Newsletter with MailerLite

If you sign up for my newsletter, I process your email address and, if provided, your first name in order to send you the newsletter. Sign-up uses the double opt-in procedure: after signing up, you receive an email asking you to confirm. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email.
I use MailerLite to send the newsletter. The provider is MailerLite Limited, Ground Floor, 71 Lower Baggot Street, Dublin 2, D02 P593, Ireland. MailerLite may analyse whether a newsletter was opened and which links were clicked, so I can improve the newsletter. A data processing agreement is in place with MailerLite. After you unsubscribe, your email address is deleted or, where necessary, kept on a block list so that you no longer receive emails.
More information: https://www.mailerlite.com/legal/privacy-policy

15. Links to social networks

This website links to my profiles on Instagram and Facebook. These are simple links, not embedded plugins. Only when you click a link are you taken to the respective network's site, where the privacy policy of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland applies.

16. Last updated

This privacy policy was last updated in October 2026. I will update it if my website or the legal requirements change.