Privacy policy

1. Controller

Isabell Naomi Hautz
Rübenkamp 140
22307 Hamburg
Email: isabellnaomihautz@gmail.com

The controller is the natural person who alone or jointly with others determines the purposes and means of the processing of personal data (Art. 4 no. 7 GDPR).

2. General information

The following notes give an overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. Protecting your data matters to me; processing takes place exclusively within the framework of the GDPR, the BDSG (German Federal Data Protection Act) and the TDDDG (German Telecommunications Digital Services Data Protection Act).

3. Hosting and audience measurement

This website is hosted by Vercel Inc. (Covina, California, USA). Vercel delivers the pages through a worldwide server network, usually from a location near you; the contact form is processed by a server function in Frankfurt am Main. In doing so, Vercel processes the log data listed in section 4 and the details from the contact form (section 5). The service is used in the interest of a secure, fast and reliable provision of this website (Art. 6 (1) (f) GDPR).

A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel. Vercel may also process data in the USA. Standard contractual clauses of the European Commission have been agreed for such transfers (Art. 46 (2) (c) GDPR); in addition, Vercel states that it participates in the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR).

Vercel Web Analytics is used for audience measurement, but only if you have enabled the "Analytics" category in the cookie notice. Without that consent the service is not loaded and no measurement takes place. What is then recorded: time, page requested, referrer, approximate location, operating system, browser and device type, as well as individual actions on the page — clicks on booking and WhatsApp buttons or on the link to the Google reviews, opening a question in the FAQ, and sending the contact form (with the selected topic and language) — in each case without names, email addresses or message contents. The service sets no cookies and stores nothing in your browser. To group page views of the same visit, Vercel derives a checksum from your request that is discarded after 24 hours; no recognition beyond that period or across other websites takes place. Vercel processes this data as a processor, also in the USA (safeguards as above). The reports are available to me for twelve months; how long Vercel retains the underlying data is determined by Vercel.

The legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You may withdraw it at any time with effect for the future by opening "Cookie settings" in the footer and deselecting the category; measurement then ends immediately.

4. Server log files

On every visit, Vercel automatically processes log data transmitted by your browser: IP address, date and time, the page requested, referrer, browser and operating system, and the status of the response. The data serves to deliver the website, analyse errors and keep the website secure (Art. 6 (1) (f) GDPR) and is not merged with other data sources. It is available in my log view at Vercel for one day; how long Vercel retains it beyond that for security purposes is determined by Vercel.

5. Contact by form, email and WhatsApp

This website offers a contact form. Your details (name, email address, optionally the selected topic, your message and the language of the page) are transmitted on sending to a server function at Vercel in Frankfurt am Main and sent from there by email to my inbox. They are not stored on the server of this website.

For sending I use Resend (Plus Five Five, Inc., San Francisco, USA) as a processor under Art. 28 GDPR. Resend stores the message sent, together with the delivery log, for 30 days, in the USA. Standard contractual clauses of the European Commission have been agreed for the transfer (Art. 46 (2) (c) GDPR); in addition, Resend relies on the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

My email inbox is hosted by Google (Gmail; the provider in the European Economic Area is Google Ireland Limited, Dublin, Ireland). Google may also process the messages in the USA; Google LLC states that it is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

To protect against automated bulk submissions, the number of send operations per IP address is briefly limited in memory. The IP address is not stored permanently.

If you write to me directly by email instead, the message also arrives in this inbox. In both cases I process your details in order to answer your enquiry and, where applicable, arrange an appointment (Art. 6 (1) (b) GDPR), and on the basis of my legitimate interest in handling enquiries (Art. 6 (1) (f) GDPR). I delete the messages once they are no longer needed for that purpose and no statutory retention obligations (e.g. § 147 AO, German Fiscal Code) apply.

You can also message me on WhatsApp. The WhatsApp buttons on this website are plain links: opening the page establishes no connection to WhatsApp, and no data is transmitted to WhatsApp. Only when you click one of the buttons does WhatsApp open, and you leave this website.

WhatsApp is provided by WhatsApp Ireland Limited (Dublin, Ireland). If you write to me there, your phone number, your profile name and, where applicable, your profile picture as well as your messages with date and time are processed. Message contents are end-to-end encrypted; connection and usage data, however, are processed by WhatsApp under its own responsibility, also together with other Meta companies and outside the European Economic Area, in particular in the USA. Details, including the safeguards for such transfers, are set out in WhatsApp's privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea.

I use your WhatsApp messages solely to answer your enquiry and delete the chat once it is no longer needed for that purpose and no statutory retention obligations apply. The legal basis is Art. 6 (1) (b) GDPR (initiation or performance of a contract) or Art. 6 (1) (f) GDPR (legitimate interest in straightforward communication by the channel you have chosen). If you would rather not use WhatsApp, you can reach me just as well via the contact form or by email.

6. Appointment booking via Cal.com and online sessions via Zoom

You can request appointments via my booking pages at the booking service Cal.com. The booking buttons on this website are plain links: opening the website establishes no connection to Cal.com, and no content from Cal.com is embedded. Only when you click a button does the booking page at Cal.com open.

There you enter your name, your email address, your preferred appointment and the location (in person or online), and optionally notes or further guests. I process these details in order to reserve the appointment, send you my offer with price, terms and withdrawal instructions, and carry out the session (Art. 6 (1) (b) GDPR). Please do not enter any information about your health in the notes.

Cal.com (Cal.com, Inc., San Francisco, USA) processes this data as my processor under Art. 28 GDPR in the USA and sends the booking confirmation on my behalf. Standard contractual clauses of the European Commission apply to the transfer to the USA (Art. 46 (2) (c) GDPR). Cal.com's privacy notice additionally applies to the use of the booking page itself: https://cal.com/privacy.

If you choose an online session, it takes place via Zoom (Zoom Communications, Inc., USA). Zoom processes your name, where applicable your email address, technical connection data such as your IP address, and video and audio during the session (Art. 6 (1) (b) GDPR). Zoom states that it is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and additionally uses standard contractual clauses. Details are set out in Zoom's privacy statement.

I delete booking data once it is no longer needed for carrying out and invoicing the session and no statutory retention obligations apply.

7. Health-related information

If, in the course of an enquiry or a session, you voluntarily give me information about your physical or mental condition, this constitutes special categories of personal data (Art. 9 GDPR). I process such data exclusively on the basis of your explicit consent (Art. 9 (2) (a) GDPR), in strict confidence and only for the purpose of preparing and carrying out the sessions. You may withdraw this consent at any time with effect for the future.

8. Cookies and consent management

This website uses no marketing cookies and embeds no third-party content. On your first visit you are asked which categories you allow:

• Strictly necessary (always on): what is stored in your browser's local storage is exclusively your consent decision itself, with time and version. This is exempt from consent under § 25 (2) no. 2 TDDDG, because it is strictly necessary in order not to ask you again on every visit.
• Analytics (off by default): permits the audience measurement described under section 3. Without your explicit agreement it is not loaded.

There are no pre-ticked boxes; "Decline all" is just as easy to reach as "Accept all". Clicking the notice away or closing it does not count as consent — the question then appears again on your next visit. You can read the legal notice, privacy policy and terms without making a choice; the notice does not appear on its own on those pages. You may change or fully withdraw your decision at any time via the "Cookie settings" link in the footer (Art. 7 (3) GDPR); withdrawal is as easy as giving consent and takes effect immediately.

9. Fonts

The fonts used on this website (Cormorant Garamond and Jost) are delivered exclusively from my own server and loaded locally when the page is opened. No connection to third-party servers is established in the process — in particular, no Google Fonts are loaded and no IP address is transmitted to Google or any other provider.

10. SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption when it is accessed via a correspondingly configured domain (https://). You can recognise an encrypted connection by the padlock symbol in your browser's address bar.

11. Your rights

With regard to your personal data you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent given, with effect for the future (Art. 7 (3) GDPR)

An informal email to the address given above is enough to exercise your rights.

You are not obliged to provide me with personal data. Without a name and email address, however, I cannot answer an enquiry, and without the booking details I cannot arrange an appointment. No automated decision-making, including profiling, takes place.

12. Right to lodge a complaint with a supervisory authority

In the event of breaches of data protection law you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is in particular: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 7th floor, 20459 Hamburg, https://datenschutz-hamburg.de.

13. Currency and amendment of this privacy policy

This privacy policy is adapted as required, for instance when the website or the legal requirements change. The version published here applies in each case.

Last updated: September 2026