Privacy Policy

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Data We Collect and How We Use It

2.1 Contact Form / Initial Consultation Requests

When you submit our contact form, we collect:

• Name (required)
• Email address (required)
• Phone number (optional)
• Assessment answers / situation description (optional)
• Free-text message (optional)
• Wheel of Life results (optional, only if you check the corresponding box in the form). This data is stored locally in your browser (localStorage) and only transmitted at your explicit request.
• Timestamp of your last form submission (localStorage), used to prevent multiple submissions within 5 minutes. This value never leaves your browser.

This data is used to respond to your inquiry, schedule an initial consultation, and potentially begin a coaching relationship.

2.2 Server Log Files

Our hosting provider Firebase Hosting (Google LLC, USA) automatically collects server log data when you visit this website. This includes: anonymised IP address, date and time of access, requested URL, HTTP status code, data volume transferred, and browser user-agent. These logs are not combined with other personal data and are deleted after a maximum of 30 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure, stable website).

2.3 Web Analytics (Firebase Analytics)

If you have consented to analytics cookies, we use Firebase Analytics (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Firebase Analytics collects anonymised usage statistics (page views, session data, device type). Data may be transferred to the USA on the basis of Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time on the Cookie Settings page.

3. Legal Bases for Processing

• Art. 6(1)(a) GDPR – Consent: Processing of analytics data (Firebase Analytics) based on your explicit consent in the cookie banner.
• Art. 6(1)(b) GDPR – Pre-contractual measures: Processing of contact-form data to respond to your inquiry and initiate a coaching contract.
• Art. 6(1)(f) GDPR – Legitimate interests: Processing of server log files to ensure the secure operation of this website.

4. Processors and Third-Party Recipients

We use the following data processor, bound by a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR:

4.1 Google Firebase (Google LLC, USA) – Hosting, Database & Analytics

We use multiple Firebase services by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA): Firebase Hosting (website hosting), Cloud Firestore (contact form storage, located in Frankfurt, EU — no third-country transfer), and Firebase Analytics (anonymised usage statistics, consent-only). For Firebase Analytics and hosting logs, transfers to the USA are based on Standard Contractual Clauses (SCC) under Art. 46(2)(c) GDPR and the EU-US Data Privacy Framework. Privacy policy: firebase.google.com/support/privacy

We do not sell, trade, or otherwise transfer your personal data to other third parties without your explicit consent, except where required by law.

5. Cookies

We use the following cookies:

For full cookie details, see our Cookie Policy.

6. Data Retention

• Contact submissions: Deleted 6 months after last contact unless a coaching relationship commences. If coaching begins, data is retained for the duration of the engagement plus any statutory retention period (typically 10 years under German tax law).
• Server log files: Maximum 30 days.
• Analytics data (Firebase Analytics): Aggregated statistics are retained indefinitely; as no personal data is collected, individual erasure is not applicable.

7. Your Rights as a Data Subject

Under the GDPR you have the following rights:

• Right of access (Art. 15): You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data.
• Right to rectification (Art. 16): You have the right to request correction of inaccurate or completion of incomplete personal data.
• Right to erasure (Art. 17): You have the right to request deletion of your personal data, subject to statutory retention obligations.
• Right to restriction of processing (Art. 18): You have the right to request that we restrict the processing of your data.
• Right to data portability (Art. 20): You have the right to receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): You have the right to object to processing based on our legitimate interests (Art. 6(1)(f) GDPR).
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at: contact@danielkalisch.com

8. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. In Germany, the competent authority depends on the state (Bundesland) in which the controller is domiciled. A directory of all German data protection authorities is available at: bfdi.bund.de

9. SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content (e.g. contact form submissions), this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser address bar changing from “http://“ to “https://“ and by the padlock icon. When SSL/TLS encryption is enabled, data you submit to us cannot be read by third parties in transit.

10. No Sale or Transfer of Personal Data to Third Parties

Your personal data will not be sold, traded, or otherwise transferred to third parties beyond the processors listed in Section 4, or where required by law (e.g. on official order or for the prosecution of criminal offences).