Privacy policy

This is a courtesy translation. The German version at psychotherapie-bust.de is the legally binding one.

Privacy policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter referred to simply as “data”) within our online offering and the websites, functions and content connected with it, as well as external online presences such as our social media profiles (hereinafter jointly referred to as the “online offering”). With regard to the terms used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

Patricia Bust
Andreaestr. 2
30159 Hannover

Tel.: 0172 4033331

Types of data processed:

- Inventory data (e.g. names, addresses).
- Contact data (e.g. e-mail, telephone numbers).
- Content data (e.g. text entries, photographs, videos).
- Usage data (e.g. websites visited, interest in content, access times).
- Meta/communication data (e.g. device information, IP addresses).

Categories of data subjects

Visitors and users of the online offering (hereinafter we also refer to the data subjects collectively as “users”).

Purpose of processing

- Provision of the online offering, its functions and content.
- Responding to contact enquiries and communication with users.
- Security measures.
- Reach measurement/marketing

Terms used

“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more special characteristics which express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically every handling of data.

“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures which ensure that the personal data are not attributed to an identified or identifiable natural person.

“Profiling” means any form of automated processing of personal data consisting of the use of those personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Relevant legal bases

In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. Where the legal basis is not stated in this privacy policy, the following applies: the legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; the legal basis for processing in order to provide our services and carry out contractual measures as well as to respond to enquiries is Art. 6(1)(b) GDPR; the legal basis for processing in order to fulfil our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing in order to safeguard our legitimate interests is Art. 6(1)(f) GDPR. In the event that the vital interests of the data subject or of another natural person make processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.

Security measures

In accordance with Art. 32 GDPR and taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as the access, input, disclosure, availability and separation relating to it. Furthermore, we have established procedures which ensure that data subjects can exercise their rights, that data are erased and that we can respond to threats to the data. In addition, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in line with the principle of data protection by design and by default (Art. 25 GDPR).

Cooperation with processors and third parties

Where, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit data to them or otherwise grant them access to the data, this is only done on the basis of a legal permission (e.g. where a transfer of the data to third parties, such as to payment service providers, is necessary for the performance of the contract pursuant to Art. 6(1)(b) GDPR), where you have consented, where a legal obligation provides for this, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

Where we commission third parties to process data on the basis of a so-called “data processing agreement”, this is done on the basis of Art. 28 GDPR.

Transfers to third countries

Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or where this occurs in the course of using third-party services or disclosing or transferring data to third parties, this only takes place where it is necessary in order to fulfil our (pre-)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have data processed in a third country only where the special requirements of Art. 44 et seq. GDPR are met. This means that processing takes place, for example, on the basis of special guarantees, such as the officially recognised finding of a level of data protection equivalent to that of the EU (e.g. for the USA through the “Privacy Shield”) or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).

Rights of data subjects

You have the right to request confirmation as to whether data concerning you are being processed and to obtain information about these data as well as further information and a copy of the data in accordance with Art. 15 GDPR.

In accordance with Art. 16 GDPR, you have the right to request the completion of the data concerning you or the rectification of inaccurate data concerning you.

In accordance with Art. 17 GDPR, you have the right to request that the data concerned be erased without delay, or alternatively, in accordance with Art. 18 GDPR, to request a restriction of the processing of the data.

You have the right to request that the data concerning you which you have provided to us be received in accordance with Art. 20 GDPR and to request their transmission to other controllers.

You also have the right, pursuant to Art. 77 GDPR, to lodge a complaint with the competent supervisory authority.

Right of withdrawal

You have the right to withdraw consent you have given with effect for the future, pursuant to Art. 7(3) GDPR

Right to object

You may object at any time to the future processing of the data concerning you in accordance with Art. 21 GDPR. The objection may in particular be made against processing for the purposes of direct marketing.

Cookies and the right to object to direct marketing

“Cookies” are small files that are stored on users’ computers. Different pieces of information can be stored within cookies. A cookie serves primarily to store information about a user (or about the device on which the cookie is stored) during or after their visit to an online offering. Cookies that are deleted after a user leaves an online offering and closes their browser are referred to as temporary cookies, or “session cookies” or “transient cookies”. Such a cookie may store, for example, the contents of a shopping basket in an online shop or a login status. Cookies that remain stored even after the browser has been closed are referred to as “permanent” or “persistent”. For example, the login status can be stored in this way if users return after several days. Likewise, such a cookie may store users’ interests, which are used for reach measurement or marketing purposes. A “third-party cookie” is a cookie offered by providers other than the controller operating the online offering (otherwise, if they are only the controller’s own cookies, they are referred to as “first-party cookies”).

We may use temporary and permanent cookies and provide information about this within our privacy policy.

If users do not wish cookies to be stored on their computer, they are asked to deactivate the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. Excluding cookies may lead to functional restrictions of this online offering.

A general objection to the use of cookies used for online marketing purposes can be declared for a large number of services, above all in the case of tracking, via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. Furthermore, the storage of cookies can be prevented by switching them off in the browser settings. Please note that in that case it may not be possible to use all the functions of this online offering.

When you visited this website for the first time, you saw a consent dialogue. Using the following links you can view the settings made there, change your consent or withdraw it:

• Your UUID (unique identification number):
• Change privacy settings
• History of privacy settings
• Withdraw consent

Erasure of data

The data processed by us are erased or their processing is restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated within this privacy policy, the data stored by us are erased as soon as they are no longer required for their intended purpose and the erasure does not conflict with any statutory retention obligations. Where the data are not erased because they are required for other, legally permissible purposes, their processing is restricted. This means that the data are blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

Under statutory requirements in Germany, data are retained in particular for 10 years pursuant to Sections 147(1) AO, 257(1) nos. 1 and 4, (4) HGB (books, records, management reports, accounting vouchers, commercial ledgers, documents relevant for taxation, etc.) and for 6 years pursuant to Section 257(1) nos. 2 and 3, (4) HGB (commercial letters).

Under statutory requirements in Austria, data are retained in particular for 7 years pursuant to Section 132(1) BAO (accounting documents, vouchers/invoices, accounts, receipts, business papers, statement of income and expenditure, etc.), for 22 years in connection with real property and for 10 years in the case of documents relating to electronically supplied services, telecommunications, radio and television services supplied to non-entrepreneurs in EU Member States and for which the Mini One Stop Shop (MOSS) is used.

Therapeutic services and coaching

We process the data of our clients and prospective clients and of other principals or contractual partners (uniformly referred to as “clients”) in accordance with Art. 6(1)(b) GDPR in order to provide our contractual or pre-contractual services to them. The data processed in this context, the nature, scope and purpose of their processing and the necessity of that processing are determined by the underlying contractual relationship. The data processed generally include the inventory and master data of the clients (e.g. name, address, etc.), as well as the contact data (e.g. e-mail address, telephone, etc.), the contract data (e.g. services used, fees, names of contact persons, etc.) and payment data (e.g. bank details, payment history, etc.).

In the course of our services, we may also process special categories of data pursuant to Art. 9(1) GDPR, in particular information on the health of clients, where applicable relating to their sex life or sexual orientation, ethnic origin or religious or philosophical beliefs. Where necessary, we obtain the express consent of the clients for this purpose pursuant to Art. 6(1)(a), Art. 7, Art. 9(2)(a) GDPR, and we otherwise process the special categories of data for health care purposes on the basis of Art. 9(2)(h) GDPR, Section 22(1) no. 1 b. BDSG.

Where necessary for the performance of the contract or required by law, we disclose or transmit the clients’ data in the course of communication with other professionals, to third parties necessarily or typically involved in the performance of the contract, such as billing offices or comparable service providers, where this serves the provision of our services pursuant to Art. 6(1)(b) GDPR, is required by law pursuant to Art. 6(1)(c) GDPR, serves our interests or those of the clients in efficient and cost-effective health care as a legitimate interest pursuant to Art. 6(1)(f) GDPR, or is necessary pursuant to Art. 6(1)(d) GDPR in order to protect the vital interests of the clients or of another natural person, or within the scope of a consent pursuant to Art. 6(1)(a), Art. 7 GDPR.

The data are erased when they are no longer required for the fulfilment of contractual or statutory duties of care or for dealing with any warranty and comparable obligations, whereby the necessity of retaining the data is reviewed every three years; otherwise, the statutory retention obligations apply.

External payment service providers

We use external payment service providers via whose platforms users and we can carry out payment transactions (e.g., in each case with a link to the privacy policy, Paypal (https://www.paypal.com/de/webapps/mpp/ua/privacy-full), Klarna (https://www.klarna.com/de/datenschutz/), Skrill (https://www.skrill.com/de/fusszeile/datenschutzrichtlinie/), Giropay (https://www.giropay.de/rechtliches/datenschutz-agb/), Visa (https://www.visa.de/datenschutz), Mastercard (https://www.mastercard.de/de-de/datenschutz.html), American Express (https://www.americanexpress.com/de/content/privacy-policy-statement.html)

In the context of the performance of contracts, we use the payment service providers on the basis of Art. 6(1)(b) GDPR. Otherwise, we use external payment service providers on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR in order to offer our users an effective and secure payment option.

The data processed by the payment service providers include inventory data, such as the name and the address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, total and recipient-related details. The details are necessary in order to carry out the transactions. However, the data entered are processed and stored only by the payment service providers. This means that we do not receive any account- or credit card-related information, but only information confirming or declining the payment. In some circumstances, the data are transmitted by the payment service providers to credit agencies. The purpose of this transmission is to check identity and creditworthiness. In this respect, we refer you to the terms and conditions and data protection notices of the payment service providers.

The terms and conditions and the data protection notices of the respective payment service providers, which can be accessed within the respective websites or transaction applications, apply to the payment transactions. We also refer you to these for further information and for asserting rights of withdrawal, access and other rights of data subjects.

Administration, financial accounting, office organisation, contact management

We process data in the context of administrative tasks as well as the organisation of our business, financial accounting and compliance with statutory obligations, such as archiving. In doing so, we process the same data that we process in the course of providing our contractual services. The bases for processing are Art. 6(1)(c) GDPR, Art. 6(1)(f) GDPR. Customers, prospective customers, business partners and website visitors are affected by the processing. The purpose and our interest in the processing lie in administration, financial accounting, office organisation and the archiving of data, that is, tasks which serve to maintain our business activities, to perform our duties and to provide our services. The erasure of data with regard to contractual services and contractual communication corresponds to the information given for those processing activities.

In this context we disclose or transmit data to the tax authorities, advisers such as tax advisers or auditors, as well as to further fee offices and payment service providers.

Furthermore, on the basis of our business interests, we store details of suppliers, organisers and other business partners, e.g. for the purpose of contacting them later. We generally store these mainly company-related data permanently.

Comments and contributions

If users leave comments or other contributions, their IP addresses may be stored for 7 days on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. This is done for our own security, in case someone leaves unlawful content in comments and contributions (insults, prohibited political propaganda, etc.). In such a case, we ourselves may be held liable for the comment or contribution and are therefore interested in the identity of the author.

Furthermore, on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR, we reserve the right to process users’ details for the purpose of spam detection.

On the same legal basis, we reserve the right, in the case of surveys, to store users’ IP addresses for the duration of the survey and to use cookies in order to avoid multiple votes.

The data provided in the context of comments and contributions are stored by us permanently until users object.

Contacting us

When you contact us (e.g. by contact form, e-mail, telephone or via social media), the user’s details are processed for the purpose of handling and dealing with the contact enquiry pursuant to Art. 6(1)(b) GDPR. Users’ details may be stored in a customer relationship management system (“CRM system”) or comparable enquiry management system.

We erase the enquiries once they are no longer required. We review the necessity every two years; the statutory archiving obligations also apply.

Spam protection by Cloudflare Turnstile

To protect the contact form against automated submissions (spam), we use the “Turnstile” service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile uses technical characteristics of the browser and behaviour on the page to check whether an entry comes from a person or from an automated program. For this purpose, a connection to Cloudflare servers is established when the page with the contact form is opened; in particular the IP address, information about the browser and operating system and the result of the check are processed. Turnstile does not set cookies and does not store data in the browser.

The legal basis is our legitimate interest in the security of our online offering and in preventing spam and abuse pursuant to Art. 6(1)(f) GDPR. Insofar as information on the user’s terminal equipment is accessed, this is strictly necessary to provide the contact form expressly requested by the user (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act).

Cloudflare is certified under the EU-US Data Privacy Framework. Further information can be found in Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/.

Hosting and e-mail dispatch

The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services and technical maintenance services which we use for the purpose of operating this online offering.

In doing so, we, or rather our hosting provider, process inventory data, contact data, content data, contract data, usage data and meta and communication data of customers, prospective customers and visitors to this online offering on the basis of our legitimate interests in an efficient and secure provision of this online offering pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement).

Collection of access data and log files

We, or rather our hosting provider, collect data on every access to the server on which this service is located (so-called server log files) on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. The access data include the name of the website or file accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.

Log file information is stored for security reasons (e.g. to investigate acts of misuse or fraud) for a maximum period of 7 days and is then erased. Data whose further retention is required for evidential purposes are exempt from erasure until the respective incident has been finally clarified.

Google Analytics 4

On this website we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is loaded only if you have consented to the “Statistics” category in the cookie banner. Without this consent no connection to Google is established and no data are transmitted to Google.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act). You can withdraw your consent at any time via the cookie settings at the bottom of the page; the withdrawal takes effect for the future.

With your consent, Google Analytics records page views, the approximate location (country, region), device and browser as well as certain interactions on the website: sending the contact form, clicks on the telephone number, the e-mail address, the route planner and the appointment calendar. The contents of the contact form are not transmitted. Google Analytics 4 does not use full IP addresses; the IP address is truncated at the point of collection and is not stored. Google Signals and the personalisation of advertising are deactivated. The data are deleted after 14 months.

Google processes the data on our behalf on the basis of a data processing agreement. A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245.

Google Ads conversion measurement

We place advertisements via Google Ads of Google Ireland Limited. In order to measure whether visitors who reached our website via an advertisement get in touch, the interactions named above are transferred from Google Analytics to Google Ads. This happens only if you have consented to the “Marketing” category in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent, Google Ads transmits only aggregated, non-personal modelled values (“consent mode”).

We do not use remarketing, customer lists or interest-based audience building. The advertisements are shown solely on the basis of the search term and the location. With your consent, Google Ads sets cookies in order to connect clicks on advertisements with subsequent contacts; from this we receive only statistical evaluations with no reference to individual persons.

Further information: https://policies.google.com/technologies/ads. You can withdraw your consent via the cookie settings at the bottom of the page.

Created with Datenschutz-Generator.de by RA Dr. Thomas Schwenke

Jameda

Seals or widgets of jameda GmbH, St. Cajetan-Straße 41, 81669 München, are integrated into our website. A widget is a small window that displays changing information. Our seal works in a similar way, i.e. it does not always look the same; instead, the display changes regularly. Although the corresponding content is shown on our website, it is retrieved from the jameda servers at that moment. This is the only way for the current content, above all the respective current rating, to be shown at all times. For this purpose, a data connection has to be established from this website to jameda, and jameda receives certain technical data (date and time of the visit; the page from which the request is made; the internet protocol address used (IP address), browser type and version, device type, operating system and similar technical information) which are necessary for the content to be delivered. These data are used solely for the provision of the content and are not stored or used in any other way. In integrating it we pursue the purpose and the legitimate interest of displaying current and correct content on our homepage. The legal basis is Art. 6(1)(f) GDPR. We do not store the aforementioned data on the basis of this integration. To arrange an appointment you are forwarded to www.jameda.de. jameda processes the data you provide there under its own responsibility. Further information on data processing by jameda can be found in the privacy policy of the site www.jameda.de/jameda/datenschutz.php.