Privacy Policy

1. Controller

The controller responsible for data processing within the meaning of the GDPR is:

Benedikt Rüschen
Mainzer Straße 5
10247 Berlin, Germany
Email: benni@z38.health

2. Your Rights as a Data Subject

Under the contact details above, you may exercise the following rights at any time:

• Right of access to your data stored by us and its processing (Art. 15 GDPR)
• Right to rectification of incorrect personal data (Art. 16 GDPR)
• Right to erasure of your data stored by us (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to data portability (Art. 20 GDPR)

Where you have granted us consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

3. Collection of General Information (Server Log Files)

Nature and purpose of processing: When you visit this website, information of a general nature is automatically collected (server log files). This includes browser type and version, operating system, the domain name of your internet service provider, IP address, and the time of access. This data is used to ensure a proper connection, smooth use of the website, and to evaluate system security and stability.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the operation, stability, and security of the website).

Recipient: We use Vercel Inc. as a processor for hosting this website.

Storage period: Log files are automatically deleted once they are no longer required for their purpose, typically after a few days.

4. Analytics and Tracking Tools (PostHog)

Nature and purpose of processing: We use the web analytics service PostHog to statistically evaluate usage of our website, improve our offering, and track the effectiveness of marketing campaigns (including via UTM parameters). Events such as page views and clicks are recorded and associated with a browser via a cookie.

Legal basis: Art. 6(1)(a) GDPR (your consent). Without your consent, no analytics cookies are set and no corresponding data is processed. You may withdraw your consent at any time, for example through your browser's cookie settings.

Recipient: PostHog Inc. / PostHog EU as processor.

Storage period: Data is stored until you withdraw your consent, or in accordance with PostHog's retention settings.

5. Contact and Purchase-Flow Requests

Nature and purpose of processing: If you leave your phone number during the purchase process, use our contact form, or request account deletion, we process the data you provide (e.g. phone number, email address, message content) to handle your request, contact you regarding your contract, or fulfil your deletion request.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) or Art. 6(1)(a) GDPR (consent), where you contact us voluntarily.

Recipient: We use Resend as a processor to send these requests to us by email.

Storage period: Data is deleted once it is no longer required to process your request, unless statutory retention obligations require otherwise.

6. Health-Related Information in the Purchase Process

Nature and purpose of processing: Before you can book one of our online courses, we ask you in the purchase process about potential exclusion criteria (e.g. acute mental health crisis or acute suicidality, severe mental or physical illness) and, optionally, your personal goals. This information is used solely to assess whether the respective course is suitable for you and to tailor the course to your needs.

Legal basis: As this may constitute health data within the meaning of Art. 9 GDPR, processing takes place exclusively on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give by actively confirming this in the purchase process.

Recipient: This information is processed internally only and transmitted to us by email via Resend; it is not shared with any other third parties.

Storage period: This information is deleted once it is no longer required to perform the contract.

7. Payment Processing (PayPal)

Nature and purpose of processing: To process payments, we offer payment via PayPal. PayPal (Europe) S.à r.l. et Cie, S.C.A. collects and processes the data required for payment processing, including name, address, and payment details.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention obligations under tax and commercial law).

Recipient: PayPal (Europe) S.à r.l. et Cie, S.C.A. acts as an independent controller for payment processing. Further information can be found in PayPal's own privacy policy.

Storage period: We store payment-related data for as long as necessary to perform the contract and to comply with statutory tax and commercial retention periods.

8. Account Deletion

If you request deletion of your account, we transmit the information required to process your request (e.g. your phone number) to us by email via Resend. Your personal data is subsequently deleted or anonymized, unless statutory retention obligations require otherwise.

9. Data Security

We implement appropriate technical and organizational security measures to protect your data against loss, misuse, or unauthorized access. Data transmission is encrypted (TLS/SSL).

10. Profiling

We do not carry out any automated individual decision-making that has a legal effect on you. Evaluation of usage behavior is carried out on a purely statistical basis.

11. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your data violates data protection law, or that your data protection rights have otherwise been violated, you have the right to lodge a complaint with a data protection supervisory authority.

12. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy if the legal situation, our data processing, or our offering changes.