Privacy Policy
Last Updated: July 2025

1. General Information
   This website respects your privacy and processes your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection laws. This Privacy Policy explains what data we collect, for what purpose, and how you can exercise your rights.

2. Data Collection on This Website

a) Server Logs
When you visit this website, your browser automatically sends the following data to our server:

• IP address

• Date and time of access

• Browser type and version

• Referring URL

• Operating system

This data is stored temporarily for technical and security purposes. It is not used to personally identify visitors.
Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in operating the website securely)

b) Contact Forms and Email
If you contact us via the website’s contact form or email, we may collect the following:

• Name

• Email address

• Phone number (optional)

• Inquiry or form content

This data is used solely for communication and service delivery and will not be shared without your explicit consent.

Legal Basis:
Art. 6(1)(a) GDPR (consent)
Art. 6(1)(b) GDPR (contract initiation)

1. Cookies and Analytics

a) Essential Cookies
Necessary for the operation of the site (e.g., navigation, security).
Legal Basis: Art. 6(1)(f) GDPR

b) Google Analytics
We use Google Analytics with IP anonymization (anonymizeIP) to understand website usage patterns (e.g., page visits, session duration, user region). No personally identifiable data is stored.
Legal Basis: Art. 6(1)(a) GDPR (consent via cookie banner)

c) Cookie Consent Management
On your first visit, you are asked to consent to optional cookies via a cookie banner. You can withdraw your consent at any time by adjusting your browser settings or revisiting the cookie preferences panel.

1. Hosting and Third-Party Services

a) Website Hosting
This website is hosted by [Insert Hosting Provider, e.g., Webflow, IONOS, GoDaddy]. Hosting servers may log and process data such as IP addresses as part of their infrastructure services.
A Data Processing Agreement (DPA) exists with the hosting provider under Art. 28 GDPR.

b) Google Workspace
We use Google Workspace tools (e.g., Gmail, Google Calendar, Google Drive, Google Forms) to communicate, organize appointments, and securely store client-related data. Google acts as our data processor.
Processing takes place under a GDPR-compliant Data Processing Addendum, including Standard Contractual Clauses (SCCs) for data transfer to the U.S.

• Google’s privacy policy

• Google Workspace DPA
  Legal Basis:
  Art. 6(1)(b) GDPR (contractual necessity)
  Art. 6(1)(f) GDPR (legitimate interest in using secure professional tools)

c) Other Third-Party Tools
If additional tools are used (e.g., for scheduling or newsletters), their privacy policies will apply. You will be informed before any data is submitted.

1. Data Retention
   We store your personal data only for as long as necessary to fulfill the stated purposes or to meet legal obligations. After this period, your data will be deleted or anonymized.

2. Your Rights Under the GDPR
   You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)

• Right to rectification (Art. 16 GDPR)

• Right to erasure (Art. 17 GDPR)

• Right to restriction of processing (Art. 18 GDPR)

• Right to data portability (Art. 20 GDPR)

• Right to object (Art. 21 GDPR)

• Right to withdraw consent (Art. 7(3) GDPR)

• Right to lodge a complaint with a data protection authority (Art. 77 GDPR)

To exercise these rights, contact:
hi@gentlerebellions.com