Privacy Policy
This is a translation for your convenience. Only the German version is legally binding.
1. Who is responsible for your data
The controller responsible for this website is:
Lena Gehret – Holistic Horizon
Werner-von-Siemens-Straße 67
97076 Würzburg, Germany
Email: hey@holisti[nospam]c-horizon.de
Phone: +49 176 [nospam]34943693
No data protection officer has been appointed; I am not required to appoint one. If you have any questions about data protection, simply write to me at the address above.
2. What data I process – an overview
This website does without advertising, social media plugins and cookies that recognise you. Data is only created when you visit the site or send me something yourself.
| When | Which data | Purpose | Legal basis |
|---|---|---|---|
| You visit the website | IP address, time, page visited, browser, referring page | delivering the site, fending off attacks | Art. 6(1)(f) GDPR |
| You visit a page (statistics) | page visited, referring page, browser, device, country, scroll depth, time on page, clicks on external links and files; only a daily changing checksum is derived from the IP address, the IP address itself is not stored | anonymous visitor statistics | Art. 6(1)(f) GDPR |
| You write to me (form, email, phone) | name, email, phone number, your message | answering your enquiry | Art. 6(1)(b) or (f) GDPR |
| You book a Clarity Call | name, email, phone number, note, appointment | arranging and confirming the appointment | Art. 6(1)(b) GDPR |
| You take the self-test | answers, comment if any, score, name, email, IP address | sending you the evaluation, preparing a first conversation, detecting misuse | Art. 6(1)(a) GDPR (consent); IP address: Art. 6(1)(f) GDPR |
| We talk in the Clarity Call (video call) | name, email, IP address, picture and sound | holding the conversation | Art. 6(1)(b) GDPR |
Who else sees your data. I do not pass your data on and I do not sell it. Only service providers I need to run the website have access, and they work on my behalf and according to my instructions: my technical service provider Martin Müller KI Beratung with the data centre of Hetzner Online GmbH (section 3), my email provider STRATO (section 5) and Defiant for attack defence with Wordfence (section 3). For video calls I also use a video conferencing service that acts partly under its own responsibility (section 6). Authorities only receive data if I am legally obliged to provide it.
3. Hosting, server logs, security and statistics
Hosting. The website runs on a server that Martin Müller KI Beratung, Solitudestr. 49/2, 71638 Ludwigsburg, Germany, operates on my behalf (data processing under Art. 28 GDPR). The data centre is provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as a sub-processor; the server is located in Germany.
Server logs. With every request the server automatically stores: IP address, date and time, the address requested, referring page, browser and operating system, and the server’s response. I need this data to deliver the website and to detect attacks (Art. 6(1)(f) GDPR). The logs are deleted after 14 days.
Backups. The server is backed up regularly so that the website can be restored after an error. The backups remain in Germany and are overwritten automatically, the oldest after 13 months at the latest. Data I have deleted therefore only disappears completely when the respective backup expires; until then I only use it to restore the website after an error.
Encryption. The connection to the website is encrypted with TLS – recognisable by “https://” and the padlock in your browser.
Wordfence. To protect against attacks I use the security software Wordfence by Defiant, Inc., 1700 Westlake Ave N Ste 200, Seattle, WA 98109, USA. It checks every request directly on my server and blocks suspicious access; your IP address is processed in the course of this. If it detects an attack, your IP address, the address requested, the technical details of your browser (HTTP headers) and the content of the blocked request may be transferred to Defiant so that attacks can be recognised and fended off. Defiant processes this data on my behalf (Art. 28 GDPR). Defiant is based in the USA; the transfer is based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which Defiant agrees to in its terms of use. You can obtain a copy from me on request. Defiant keeps this data for as long as I use Wordfence and deletes or anonymises it no later than one month afterwards. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is the secure operation of the website.
Security logs. Wordfence stores on my server blocked requests (IP address, address requested, browser, time) for no more than 30 days, a daily list of blocked IP addresses for one month, and login attempts to the website’s admin area (IP address, user name, browser, time) for 12 months. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is being able to detect and trace attacks.
Statistics (Plausible). To see which pages are read and how visitors find the website, I use the analytics software Plausible Analytics. It runs on a server of my technical service provider in Germany; no data is transferred to the maker of Plausible or other third parties. Plausible does not set cookies and does not store anything in your browser. It records the page visited, the referring page, browser, operating system, device type and the country derived from the IP address, as well as how far you scroll on a page and how long it is in the foreground, clicks on links to other websites and on files (each with their address), and the fact that a form was submitted – not what it contains. Your IP address is not stored in the statistics: only a checksum is formed from it, the browser identifier and a key that is deleted and newly generated every 24 hours, so that you are not recognised on another day. The result is visitor statistics without any reference to you as a person, which I keep indefinitely. Requests to the statistics appear in the server logs for 14 days like any other page request (see above). The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is improving the website. You can object at any time by sending me an informal email (section 11) or block the statistics script with a content blocker in your browser.
4. Cookies and consent
This website only sets cookies and storage entries that it needs to work. There are no tracking or advertising cookies. I do not need your consent for necessary entries (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). The website creates these entries in your browser:
| Entry | Purpose | Storage period |
|---|---|---|
pll_language |
remembers the language of the page you visited (German or English) so that forms and booking reply in the same language | 1 year |
mlw_quiz_start_date1/2, mlw_time_consumed_quiz1/2 (local storage), quiz1page/quiz2page (session storage) |
progress in the self-test | until you delete them in your browser or close the browser |
webp_lossy_supported, webp_lossless_supported (local storage) |
checks which image format your browser supports | until you delete them in your browser |
There is no cookie notice because the website sets nothing that would require consent. The visitor statistics, too, do not set cookies and do not store anything in your browser (section 3).
5. Contact by form, email or phone
If you write to me using the contact form (on the contact page and the “Workshops for schools” page), by email or by phone, I process your details to answer your enquiry: in the form your first and last name, email address, optionally your phone number, and your message; technically, the page from which you send the form is also transmitted. Mandatory fields are marked.
The form does not store your message on the website but sends it to me by email. To fight spam it uses an invisible check field and a minimum time for filling it in – both run on my server, without any third-party provider.
Form statistics. On my server, the form counts how often it is displayed and submitted and how long it was visible. For this it uses a random identifier that only applies to the respective page visit; form contents are not evaluated, and nothing is stored in your browser. The legal basis is Art. 6(1)(f) GDPR; my interest is keeping the form clear and easy to use. The counts have no reference to you as a person; I keep them indefinitely.
My mailbox is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The website also sends all emails via STRATO – messages from the contact form, booking confirmations and the self-test evaluation. A data processing agreement is in place with STRATO.
The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns coaching or a contract, otherwise Art. 6(1)(f) GDPR (my interest in answering enquiries). I delete your enquiry once it has been dealt with, unless statutory retention periods apply (see section 9).
6. Online booking (Clarity Call)
On the contact page you can book a free Clarity Call. For this I use the booking plugin Bookly, which runs on my server.
I process your first and last name, your email address (mandatory), your phone number, your notes and the chosen appointment. The details are stored in the website’s database. You receive a confirmation by email and I receive a notification; if an appointment is cancelled or declined, Bookly informs both sides. No payment is involved.
The phone field is preset to Germany; no geolocation service is queried.
Video call. I hold the Clarity Call via a free video conferencing service of a provider based in the USA; you can see which one in the invitation. The provider processes your name or display name, your IP address and picture and sound during the call – partly under its own terms and its own responsibility. Data may be transferred to the USA; the provider is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). The legal basis is Art. 6(1)(b) GDPR.
The legal basis for the booking is Art. 6(1)(b) GDPR (arranging and holding the appointment). I delete booking data 12 months after the appointment unless there is a duty to retain it. This also applies to the related emails in my mailbox.
7. Free self-test
In the self-test you answer seven questions about your financial situation and your circumstances, for example about goals, debts, savings or who depends on your income; for the last question you can add a comment if you wish. At the end you enter your email address and, optionally, your name and tick the box for the privacy policy.
I store your answers, your comment if any, the score, your name, your email address, the time, the time taken and your IP address in the website’s database (plugin Quiz and Survey Master, on my server). You see your evaluation immediately and receive it by email; I receive a copy. As soon as you open the page, your browser creates small entries for your progress (section 4).
By ticking the box you consent to my storing these details, sending you the evaluation by email and using them to prepare a possible first conversation. The legal basis is this consent (Art. 6(1)(a) GDPR). It is voluntary; without it I can neither show nor send you the evaluation. You can withdraw it at any time with effect for the future, for example by email to hey@holisti[nospam]c-horizon.de; I will then delete your details. Without withdrawal I delete them 12 months after you took part; this also applies to the related emails in my mailbox.
Score. The website automatically calculates a score from your answers and assigns you an evaluation. This is a simple assessment of your situation, but not a decision with legal or similarly significant effects within the meaning of Art. 22 GDPR. Whether and how I support you is something we discuss in person.
IP address. I store your IP address in order to detect and fend off abusive submissions – for example automated entries by bots using other people’s email addresses. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is protecting the self-test and the people whose addresses would otherwise be misused. The IP address is deleted together with your other details, no later than after 12 months.
Spam protection. To fight automated submissions, the self-test uses an invisible check field and a minimum time between opening the page and submitting. Both run on my server, without any third-party provider; no additional personal data is stored for this.
8. Fonts and content from other providers
All fonts and the video on the home page are loaded from my own server; when you visit the site there is no connection to Google or other providers; the statistics also run at my technical service provider (section 3). The website does not embed videos, maps or social media functions of other providers. Links to other websites only open them when you click on them; their privacy policies apply there.
9. How long I keep data
I only keep personal data for as long as I need it for the respective purpose or the law requires it.
| Data | Storage period |
|---|---|
| Server logs | 14 days |
| Blocked requests (Wordfence) | 30 days; daily list of blocked IP addresses 1 month |
| Login attempts to the admin area | 12 months |
| Attack data transferred to Defiant | as long as I use Wordfence, plus 1 month |
| Visitor statistics (Plausible) and form statistics | without reference to you as a person, indefinitely |
| Server backups | up to 13 months (then overwritten automatically) |
| Language choice | 1 year (in your browser) |
| Contact enquiries | until the enquiry has been dealt with |
| Appointment bookings | 12 months after the appointment |
| Self-test results | until withdrawal, no longer than 12 months |
| Business letters (e.g. emails relating to an assignment) | 6 years (Section 147 German Fiscal Code, AO; Section 257 German Commercial Code, HGB, where applicable) |
| Invoices and other accounting records | 8 years (Section 147 AO; Section 257 HGB, where applicable) |
These periods also apply to emails that the website sends me about your enquiry, booking or self-test: I delete them in my mailbox no later than at the same time.
Do you have to give me data? No. You are not obliged by law or by contract to give me any data. Without the mandatory details, however, I cannot reply to you, confirm an appointment or send you an evaluation. When you visit the website, the technical data described in section 3 is necessarily generated.
Automated decisions. I do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). For the score in the self-test, see section 7.
10. Your rights
Subject to the statutory requirements, you have the right to:
- access to the data stored about you (Art. 15 GDPR)
- rectification of incorrect data (Art. 16 GDPR)
- erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- withdraw your consent at any time with effect for the future (Art. 7(3) GDPR); processing carried out until then remains lawful
An informal email to hey@holisti[nospam]c-horizon.de is sufficient.
11. Your right to object (Art. 21 GDPR)
If I process your data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you can object to this at any time on grounds relating to your particular situation. I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal email to hey@holisti[nospam]c-horizon.de is sufficient.
12. Complaint to the supervisory authority
You can lodge a complaint with a data protection supervisory authority. The authority responsible for me is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
13. Last updated
Last updated: 12 October 2026. I adapt this privacy policy when the website or the legal situation changes.