Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Johanna Clas-Bundschuh

Ostendstraße 200

90482 Nürnberg

Email: jc@johannaclas.com

2. General information on data processing

2.1 Scope of processing of personal data

We only process personal data of our users to the extent necessary to provide a functioning website along with our content and services. Personal data of our users is regularly only processed with the user's consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by legal provisions.

2.2 Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.

When processing personal data that is necessary for the performance of a contract or pre-contractual measures — for example to arrange an appointment or to process payment for a workshop ticket — Art. 6(1)(b) GDPR serves as the legal basis.

Insofar as the processing of personal data is necessary to safeguard a legitimate interest of ours or of a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis.

2.3 Data erasure and storage period

The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Storage may continue beyond this if required by statutory obligations (e.g., commercial or tax retention periods).

3. Hosting with Squarespace

This website is hosted with Squarespace. The provider is Squarespace Ireland Ltd., 2nd Floor, The Anchorage, 17-19 Sir John Rogerson's Quay, Dublin 2, Ireland. In the course of using this service, personal data may also be transferred to and processed by the US parent company Squarespace, Inc., 225 Varick Street, New York, NY 10014, USA.

Squarespace automatically collects data and information every time the website is accessed, in the form of server log files, including:

  • Browser type and version

  • Operating system used

  • IP address

  • Date and time of access

  • Referrer URL (the site from which the visitor arrived)

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable provision of our website.

Third-country transfer: According to its own statements, Squarespace, Inc. is an active participant in the EU-U.S. Data Privacy Framework (DPF), for which the European Commission has issued an adequacy decision under Art. 45 GDPR. In addition, EU Standard Contractual Clauses under Art. 46 GDPR are used where necessary. By registering with Squarespace, a Data Processing Addendum (DPA) automatically becomes part of the terms of service.

Further information: Squarespace Privacy Policy

4. Contact form (Squarespace Contact Form Block)

4.1 Description and scope of data processing

Our website features a contact form (Squarespace Contact Form Block) that can be used to get in touch electronically. If a user makes use of this option, the data entered in the input form is transmitted to us and processed and stored via Squarespace's infrastructure. This data includes:

  • [Name]

  • [Email address]

  • [Phone number, if applicable]

  • [Message text / other fields requested]

  • Time of transmission

No data is passed on to third parties in this context, except for the technical processing carried out by Squarespace as our processor (see Section 3 regarding location and third-country transfer).

Alternatively, contact can be made via the email address provided. In this case, the personal data of the user transmitted with the email will be stored.

4.2 Legal basis

Where the user's consent has been obtained, Art. 6(1)(a) GDPR serves as the legal basis for processing the data.

Art. 6(1)(f) GDPR serves as the legal basis for processing data transmitted in the course of sending an email. If the contact aims at the conclusion of a contract (e.g., an inquiry about a workshop), Art. 6(1)(b) GDPR provides an additional legal basis.

4.3 Purpose of data processing

The processing of personal data from the input form serves solely to handle the contact request.

4.4 Storage period

Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case once the respective conversation with the user has ended and it can be inferred from the circumstances that the matter in question has been conclusively clarified.

4.5 Right to object and to request deletion

The user has the right to withdraw consent to the processing of personal data at any time by contacting us informally via email at [your email address]. In this case, all personal data stored will be deleted, unless a statutory retention obligation applies.

5. Appointment booking (Squarespace Scheduling)

5.1 Description and scope of data processing

For booking appointments (e.g., coaching sessions), we use Squarespace Scheduling, a native booking tool provided by Squarespace. When booking an appointment, the following data is processed:

  • [Name]

  • [Email address]

  • [Phone number, if requested]

  • Service booked, date and time of the appointment

  • Any information the user voluntarily leaves in a notes field

This data is used to organize appointments, including for confirmation and reminder emails. Processing takes place via Squarespace's infrastructure; regarding the provider's location and third-country transfer to the USA, see Section 3.

5.2 Legal basis

The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary for carrying out pre-contractual measures or for the performance of a contract (the appointment booking).

5.3 Purpose of data processing

Processing serves to organize, confirm, and carry out booked appointments, as well as to communicate matters related to the appointment (e.g., reminders, rescheduling).

5.4 Storage period

Data is deleted or anonymized as soon as it is no longer required for appointment handling, unless commercial or tax retention obligations require otherwise.

5.5 Right to object

Users may withdraw any consent given at any time by informally contacting [your email address]; already scheduled appointments may remain unaffected if their fulfillment or billing requires this.

6. Payment processing for workshop bookings via PayPal

6.1 Description and scope of data processing

When booking a paid workshop ticket via our website, we offer payment through the payment service provider PayPal. The provider within the EU is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. As part of the payment process, we or the user directly transmit the following data to PayPal, to the extent necessary for the performance of the contract:

  • [First and last name]

  • [Address]

  • [Email address]

  • [Phone number, if applicable]

  • Amount and subject of payment (workshop ticket booked)

Important: PayPal processes this data as an independent controller, not as our processor. Therefore, no data processing agreement under Art. 28 GDPR exists; PayPal is itself responsible for the lawfulness of its own processing. For details, see PayPal's Privacy Policy.

6.2 Legal basis

The transmission of data to PayPal takes place in order to fulfil the purchase contract for the workshop ticket and is based on Art. 6(1)(b) GDPR. In addition, PayPal has a legitimate interest in secure payment processing (Art. 6(1)(f) GDPR).

6.3 Third-country transfer

PayPal may also transfer personal data to its US parent company, PayPal, Inc. As a basis for this, PayPal uses EU Standard Contractual Clauses pursuant to Art. 46(2) and (3) GDPR.

6.4 Right to object

Transmitting data to PayPal is mandatory for processing payment through this provider; without it, payment via PayPal cannot be carried out. [Optional, if applicable: mention an alternative payment method here, if you offer one.]

7. Squarespace Analytics

7.1 Description and scope of data processing

We use Squarespace's built-in analytics tool, Squarespace Analytics, on our website to evaluate aggregated statistics on page views and general use of our website. The provider is Squarespace Ireland Ltd. (see Section 3 regarding location and third-country transfer). This includes, among other things, the following data:

  • Pages viewed and time spent on the site

  • Visitor origin (referrer)

  • Device type and browser used

The "Visitor Activity Log," which would allow statistical data to be linked to individual visitors via their IP address, is disabled in our settings. There is therefore no personal, visitor-specific tracking; the data collected exists only in aggregated, statistical form.

7.2 Legal basis

Since no individual tracking of specific visitors takes place, we base this aggregated statistical evaluation on our legitimate interest in the needs-based design and optimization of our website (Art. 6(1)(f) GDPR). No cookie consent banner is used for this processing.

(Note: This classification only applies as long as the Visitor Activity Log remains disabled and no other cookie-based tracking tools are used. If either of these changes, this section must be revised accordingly — potentially including a cookie banner with consent.)

7.3 Storage period

The storage period is determined by Squarespace; further information can be found in Squarespace's Privacy Policy.

7.4 Right to object

You may object to this processing under our legitimate interest at any time pursuant to Art. 21 GDPR by contacting us informally via email at [your email address].

8. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights against the controller:

  • Right of access (Art. 15 GDPR)

  • Right to rectification (Art. 16 GDPR)

  • Right to erasure (Art. 17 GDPR)

  • Right to restriction of processing (Art. 18 GDPR)

  • Right to data portability (Art. 20 GDPR)

  • Right to object (Art. 21 GDPR)

  • Right to withdraw consent under data protection law (Art. 7(3) GDPR)

  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You may contact us at any time using the contact details provided above.

9. SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the padlock icon in your browser bar.

10. Currency and amendment of this privacy policy

This privacy policy is currently valid and dated [September, 2026]. Due to the further development of our website and offerings, or due to changed statutory or regulatory requirements, it may become necessary to amend this privacy policy.