Privacy Policy

1. General information

1.1 Preamble, introduction & scope

Preamble

Protecting your personal data is important to me. I process personal data exclusively in accordance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR). As my place of business is in Denmark, the Danish Data Protection Act (Databeskyttelsesloven) also applies. As my services are also aimed at clients in Germany, German data protection provisions, in particular the Federal Data Protection Act (BDSG), may apply as well. This privacy policy informs you about which data is collected on my website, for what purposes this is done and what rights you have in this context.

Introduction

This privacy policy gives you a transparent overview of how your personal data is processed in connection with my sessions and services. I aim for the greatest possible clarity: only the data required to use my website, to communicate with you or to provide my services is collected. Data is passed on to third parties only within the framework of legal requirements or on the basis of contractual agreements with processors.

My work is based on the principles of transparency, personal responsibility and privacy. This also applies to data protection: you remain in control of your data.

Scope

This privacy policy applies to all content of the website www.niniasimon.com and to all services offered through it (e.g. contact form, appointment booking, blog comments, podcast page with a form for topic suggestions and audio playback). It relates to the processing of personal data of visitors to and users of this website.

It does not cover external websites to which I merely refer by means of links (e.g. social media profiles). The respective providers are solely responsible for data processing on these platforms.

1.2 Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:

Ninia Simon
Øster Allé 56
5500 Middelfart
Denmark
Self-employed psychologist

Email: contact@niniasimon.com

You can also contact me at any time via the contact form on www.niniasimon.com.

1.3 Data protection officer

Under the statutory provisions, my business is not required to appoint a data protection officer. Therefore, no data protection officer has been appointed.

1.4 Target group & age limit

My services are aimed exclusively at persons who have reached the age of 16.

I do not request data from children under the age of 16, nor do I knowingly process such data. Should personal data of children under 16 nevertheless have been transmitted without parental consent, it will be deleted without delay.

1.5 Rights of data subjects

As a data subject, you have the following rights under the General Data Protection Regulation (GDPR) with regard to personal data concerning you:

– Right of access (Art. 15 GDPR)
You have the right to request information as to whether personal data concerning you is being processed. If this is the case, you can in particular request information about the purposes of processing, the categories of data, the recipients, the planned storage period and your further rights.

– Right to rectification (Art. 16 GDPR)
You can request the rectification of inaccurate personal data or the completion of incomplete personal data without undue delay.

– Right to erasure (Art. 17 GDPR)
You can request the erasure of your personal data, unless statutory retention obligations or other overriding reasons prevent this.

– Right to restriction of processing (Art. 18 GDPR)
You have the right to request the restriction of the processing of your data if one of the conditions set out in Art. 18 GDPR applies.

– Right to data portability (Art. 20 GDPR)
You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, or to request its transmission to another controller, where technically feasible.

– Right to object (Art. 21 GDPR)
You can object to the processing of your personal data at any time, insofar as the processing is based on Art. 6(1)(e) or (f) GDPR. This applies in particular to any direct marketing.

– Withdrawal of consent (Art. 7(3) GDPR)
You can withdraw consent once given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

– Right to lodge a complaint (Art. 77 GDPR)
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

1.6 Legal bases for processing

Personal data on this website is processed exclusively in accordance with the provisions of the General Data Protection Regulation (GDPR). Depending on the purpose, the processing is based on the following legal bases:

– Consent (Art. 6(1)(a) GDPR)
    – Contact details provided voluntarily (name, email address) in the form for podcast topic suggestions
    – Playing podcast episodes via the player on the podcast page (connection to Substack, transmission of the IP address)
    – Optional storage of name, email address and website in comment cookies (convenience function in the blog)

– Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR)
    – Conducting initial consultations and sessions
    – Appointment booking via Simply Schedule Appointments
    – Processing of payments (currently by bank transfer)
    – Responding to enquiries via the contact form or by email, insofar as they relate to my services
    – Use of the comment function in the blog

– Legal obligation (Art. 6(1)(c) GDPR)
– Compliance with retention obligations under tax and commercial law (e.g. invoicing, accounting)

– Legitimate interest (Art. 6(1)(f) GDPR)
    – Ensuring the IT security and functionality of the website (e.g. through server log files, login protection, spam protection, backups)
    – Statistical reach measurement and analysis (Matomo, cookieless and with IP anonymisation)
    – Communication and handling of general enquiries that are not directly aimed at a contract
    – Prevention of misuse and moderation of blog comments

1.7 Obligation to provide data / consequences of not providing it

In most cases, providing personal data is voluntary.

However, certain information may be required in order to use my services or to respond to your enquiry:

– Booking sessions and performing contracts requires certain data (e.g. name, contact details, payment information). Without this data, no contract can be concluded or performed.

– Processing personal data is mandatory for invoicing and for compliance with legal obligations (e.g. retention under tax and commercial law).

– The comment function in the blog requires a name and email address in order to provide the function technically and to prevent misuse.

– General enquiries (e.g. by email or via the contact form) require contact details so that I can respond to your enquiry.

– Topic suggestions for the podcast do not require any personal information. The form can be submitted without a name or email address; without this information, however, a personal reply is not possible.

In all other cases, providing personal data is voluntary. If required data is not provided, this may mean that certain functions or services cannot be used.

1.8 Automated decision-making / profiling

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place on this website.

1.9 Recipients & processors

To provide my services and operate this website, I use external service providers who process personal data. Where the respective provider makes this possible, I conclude a data processing agreement with processors in accordance with Art. 28 GDPR. For the video conferencing service Brave Talk, see 3.5.

Categories of recipients include in particular:

– Hosting providers (provision of server infrastructure, data storage, operation of the website)
– Email and IT service providers (sending and receiving emails, technical administration, SMTP services)
– Booking tools (appointment scheduling, calendar functions, e.g. Simply Schedule Appointments)
– Podcast hosting (provision and delivery of audio files, Substack Inc., only when playback is actively started, see 6.8)
– Video conferencing service (Brave Talk, Brave Software Inc., with technical infrastructure from 8×8 Inc., see 3.5)
– Payment and financial service providers (banks for payment processing, tax advisers for legal obligations)

Personal data is passed on to other recipients only if this is required by law or if you have expressly consented beforehand.

Data is not passed on to third parties for advertising or marketing purposes.

1.10 Transfers to third countries & safeguards

Personal data is transferred to countries outside the European Union (EU) or the European Economic Area (EEA) only in the cases listed below. The operation of the website itself (hosting, email, appointment booking and reach measurement) takes place on servers within the EU.

– Playback of podcast episodes (Substack Inc., USA): If you actively start an episode via the player on the podcast page, your IP address is transmitted to Substack in the USA. This transfer takes place exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which you give by clicking the play button; in addition, Substack relies on the Standard Contractual Clauses of the European Commission. No transfer takes place before your click. For details, see 6.8.

– Video sessions (Brave Talk, USA): Sessions take place via Brave Talk, a service provided by Brave Software Inc. (USA), whose technical infrastructure is operated by 8×8 Inc. (USA). In the process, connection data such as your IP address may also be transmitted to the USA. For details, see 3.5.

Should a transfer by service providers I use or their subcontractors be necessary beyond this (e.g. in the context of technical support services), this will take place exclusively under the conditions of Art. 44 et seq. GDPR.

In such cases, appropriate safeguards are ensured, for example by concluding EU Standard Contractual Clauses (SCC) or on the basis of an adequacy decision of the European Commission.

Beyond this, personal data is transferred only if you have expressly given me your consent or if there is a legal obligation to do so.

1.11 Storage period & deletion periods

Personal data is stored only for as long as is necessary for the respective purposes or as required by statutory retention obligations. The storage period is determined by the following criteria:

– Contract and billing data: Stored until the contract has been fully processed and in accordance with the statutory retention obligations under commercial and tax law (usually 6 to 10 years).

– Communication data (email, contact form, telephone enquiries): Deleted no later than 12 months after the enquiry has been dealt with, unless further retention is required to perform a contract or to meet a legal obligation to provide evidence.

– Booking data (Simply Schedule Appointments): Stored until the appointment and for a period of up to 12 months to document the booking; then deleted or anonymised.

– Comment data in the blog: Stored permanently until the comment is deleted by the user or at their request.

– Topic suggestions for the podcast: Deleted as soon as the suggestion has been dealt with, at the latest 12 months after receipt, unless statutory retention obligations prevent this. The data is not stored in the website database; it exists only in the email inbox.

– Server log files: Stored by the hosting provider for a maximum of 30 days; longer storage takes place only in anonymised form.

– Security and backup data: Stored in regular backup cycles; overwritten or deleted when the backup interval expires.

Unless specific statutory retention obligations exist, personal data is deleted as soon as the purpose of processing no longer applies.

1.12 Processing to meet legal obligations

Certain personal data must be stored or passed on irrespective of the actual purpose of processing if this is necessary to comply with legal obligations.

These include in particular:

– Obligations under tax and commercial law: Invoices and accounting records must usually be kept for 6 to 10 years in accordance with statutory requirements.

– Retention obligations under civil law: Contract-related data may be stored for up to 3 years after the end of the year in which the claim arose, in order to safeguard possible civil law claims (e.g. limitation periods).

– Requirements of public authorities: Processing or disclosure may be necessary if I am legally obliged to do so (e.g. towards tax or supervisory authorities).

2. Security and technology

2.1 Hosting & server log files

The website www.niniasimon.com is hosted by ALL-INKL.COM, Neue Medien Münnich (owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany).

Data processing takes place exclusively on servers in Germany. A data processing agreement in accordance with Art. 28 GDPR has been concluded with the hosting provider.

When you visit my website, the browser you use automatically transmits information to the server, where it is stored in so-called log files.

The following data in particular may be recorded:

– IP address (in shortened/anonymised form, where technically possible)
– Date and time of access
– Page/file accessed and amount of data transferred
– Notification of successful retrieval
– Browser type and browser version
– Operating system
– Referrer URL (previously visited page)

This data is processed for the following purposes:

– Ensuring a smooth connection to the website
– Ensuring IT security and system stability
– Technical administration of the server
– Detection of misuse and attacks

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and stability of the website).

Storage period: The log files are usually stored by the hosting provider for a maximum of 30 days. Longer storage takes place only in anonymised form.

This data is not combined with other data sources.

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. I will then no longer process the personal data unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

2.2 SSL/TLS encryption

For security reasons and to protect the transmission of confidential content (e.g. enquiries via the contact form, appointment bookings or login data), this website uses SSL or TLS encryption.

You can recognise an encrypted connection by the fact that the address bar of your browser changes from “http://” to “https://” and by the padlock symbol in the browser bar.

When encryption is activated, the data you transmit cannot be read by third parties.

2.3 Security measures

To protect your data and to ensure the security of my website, I use various technical and organisational measures. These include in particular:

– Login protection: Technical measures to protect the administration area against unauthorised access attempts, including a limit on failed login attempts.

– Spam protection: Use of the Antispam Bee plugin to detect and prevent spam entries (e.g. in forms and comments).

– IP shortening: Where technically possible, IP addresses are stored in shortened or anonymised form.

– Updates & maintenance: Regular updates of the systems and plugins used in order to close known security gaps.

– Privacy-compliant configuration: All plugins used are configured in such a way that no unnecessary personal data is collected or forwarded to external services.

These measures serve the legitimate interest in ensuring the security and functionality of my website (Art. 6(1)(f) GDPR).

2.4 Caching

A page cache is used to optimise performance. Page content is stored temporarily in order to reduce loading times. No personal usage profiles are created for visitors. Any technically necessary cookies serve exclusively the secure delivery of cached content and fall under Art. 6(1)(f) GDPR (legitimate interest in a fast and stable website). Any cache cookies usually concern only logged-in users/administrators and are not used to profile visitors.

2.5 Backups & data recovery

Backups are created regularly to ensure the availability and integrity of my website. For this purpose, I use the UpdraftPlus Backup plugin.

– Purpose: Backups serve exclusively to restore the website in the event of technical problems, data loss or security incidents.

– Scope of data: Backups may also contain personal data processed on the website (e.g. form or comment data).

– Storage location: The backups are created and stored on the servers of my hosting provider in Germany. In addition, I download backup copies to local systems in Denmark used exclusively by me. Backups therefore exist in both locations. No transfer to external cloud services or other third-party providers takes place.

– Storage period: Backups are overwritten in regular cycles, so personal data is stored only until it is replaced by newer backups. For details, see 1.11.

– Security: Access to backups is restricted on a role basis. Transfers between the server and local systems take place via secure connections.

– Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data security and the functionality of the website) and Art. 6(1)(c) GDPR (compliance with legal obligations to provide evidence, where required).

2.6 Plugins with security and logging functions

To ensure reliable communication and the technical security of the website, I use plugins that log certain processes:

– WP Mail SMTP: This plugin ensures that emails (e.g. from contact forms or appointment bookings) are sent correctly via the server of the hosting provider.

– Email Log: This plugin stores information about which emails were sent by the website (e.g. time, recipient address, subject). The content of the emails is not stored permanently.

Logging serves exclusively technical purposes (ensuring functionality, error analysis).

Storage period: For operational and security reasons, log data is kept for a maximum of 180 days and then deleted automatically. In the event of specific security incidents or for legal defence, relevant entries may be kept in restricted form until the matter has been clarified, but for no longer than 12 months, and then deleted.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and traceable email communication).

3. Communication & services

3.1 Contact form (WPForms Lite)

If you send me enquiries via the contact form on www.niniasimon.com, the data you enter (e.g. name, email address and your message) is processed for the purpose of handling your enquiry.

– Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual measures) where the enquiry concerns my services; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to general enquiries).

– Storage period: The data is deleted once your enquiry has been fully dealt with, and at the latest after 12 months, unless statutory retention obligations apply.

– Storage: Form entries are stored in the website database and deleted in accordance with 1.11; they are not passed on to third parties.

– Spam protection: The Antispam Bee plugin is used to protect against misuse. It is configured in compliance with the GDPR and does not transmit any data to third parties.

3.2 Email communication

If you contact me directly by email, the personal data transmitted (e.g. email address, name, content of the message) is processed.

– Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to general enquiries).

– Storage period: Emails are deleted in accordance with the retention periods under commercial and tax law (up to 10 years if they are relevant to a contract or invoice) or, in the case of purely organisational enquiries, after 12 months at the latest.

– Security measures: Emails are sent via my hosting provider in Germany (ALL-INKL).

3.3 Telephone enquiries

If you contact me by telephone, the data you provide (e.g. name, telephone number, concern) is used exclusively to deal with your enquiry.

– Legal basis: Art. 6(1)(b) GDPR (where the enquiry concerns my services) or Art. 6(1)(f) GDPR (legitimate interest in communication).

– Storage period: Telephone notes or call data are stored only for as long as is necessary to deal with the enquiry and are then deleted.

3.4 Appointment booking (Simply Schedule Appointments)

To book sessions, I use the Simply Schedule Appointments tool, which is integrated into my website. The data you enter (e.g. name, email address, requested appointment) is processed and stored in the database of my website.

– Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract).

– Storage period: Booking data is stored until the appointment and for a period of up to 12 months and then deleted or anonymised, unless there are legal obligations to retain it for longer.

– Technical security: The data remains on my server in Germany (ALL-INKL).

3.5 Video sessions (Brave Talk)

Sessions usually take place by video conference via Brave Talk. Brave Talk is a service provided by Brave Software Inc., San Francisco, USA, and is based on the open-source software Jitsi. The technical infrastructure through which video and audio are transmitted is operated by 8×8 Inc., USA. I use Brave Talk under the provider’s terms of use and privacy terms; there is no separate data processing agreement.

– Data processed: Technical data is processed for the connection, in particular IP address, browser information and the time and duration of the session. According to Brave, no tracking takes place. Sessions are not recorded.

– Encryption: Video and audio are always transmitted in encrypted form. In addition, I use Brave Talk’s end-to-end encryption. It requires all participants to use a supported browser on a computer (e.g. Chrome, Edge or Brave). It is not possible on smartphones and tablets or in other browsers; the transmission is then still encrypted, but not additionally end-to-end encrypted. When end-to-end encryption is active, neither Brave nor 8×8 has access to the content of the conversation.

– Transfer to third countries: As Brave Software Inc. and 8×8 Inc. are based in the USA, a transfer of connection data to the USA cannot be ruled out. The USA is a third country within the meaning of the GDPR. The transfer is subject to Art. 44 et seq. GDPR and the safeguards provided by the provider. Further information can be found in Brave’s privacy notices at brave.com.

– Type of use: Sessions can be held either as a video conference (with camera) or as an audio conference (without camera).

– Legal basis: Art. 6(1)(b) GDPR (performance of the contract for my services).

– Special categories of data: Information about health or personal circumstances may come up in sessions. This information is processed only insofar as this is necessary to conduct the session, and exclusively on the basis of your explicit consent (Art. 9(2)(a) GDPR).

– Documentation of consent: Insofar as special categories of personal data (e.g. health data) are discussed in sessions, your explicit consent pursuant to Art. 9(2)(a) GDPR is obtained and documented before we begin working together.

3.6 Professional services (psychological sessions)

In the course of my services, I process personal data that is necessary for performing the contract (e.g. contact details, appointment arrangements, billing data).

In addition, I take notes during or after the sessions which may contain personal data. They serve exclusively to document the course of our work together and to prepare follow-up sessions in a meaningful way.

– Legal basis: Art. 6(1)(b) GDPR (performance of the agreement on our work together). Insofar as special categories of personal data are concerned (e.g. health data), processing additionally takes place on the basis of your explicit consent (Art. 9(2)(a) GDPR).

– Storage period: The notes are kept for as long as they are needed for our work together. Once our work together has ended, they are deleted unless statutory retention obligations apply.

3.7 Payment processing (bank transfer)

My services are currently paid for exclusively by bank transfer.

– Data processed: Bank details, name and, where applicable, invoice information.

– Recipients: The data is processed by the banks involved. In addition, it is passed on to my tax adviser insofar as this is necessary to comply with tax obligations.

– Legal basis: Art. 6(1)(b) GDPR (processing of payments under the contract) and Art. 6(1)(c) GDPR (compliance with obligations under tax and commercial law).

– Storage period: 6 to 10 years in accordance with the requirements of tax and commercial law.

3.8 Topic suggestions for the podcast (WPForms)

On the podcast page, you can send me a question or a topic suggestion via a form. Providing your name and email address is voluntary; the form can also be submitted without this information.

– Data processed: The message you enter and, if provided, your name and email address.

– Purpose: The data is delivered to me by email and used exclusively to deal with your suggestion and for any reply. It is not passed on to third parties. The form is transmitted in encrypted form (see 2.2).

– Legal basis: The processing of contact details provided voluntarily is based on Art. 6(1)(a) GDPR (your consent), which you give by submitting the form. You can withdraw this consent at any time without giving reasons, for example by email to contact@niniasimon.com. The lawfulness of processing carried out before the withdrawal remains unaffected.

– Storage period: Your information is deleted as soon as the suggestion has been dealt with, unless statutory retention obligations prevent this.

– Technical implementation: The WPForms plugin is used for the form. The form data is not stored in the website database but is forwarded exclusively by email. IP address and browser identifier are not recorded, and the form does not set any cookies.

– Spam protection: The Antispam Bee plugin is used to protect against misuse. It is configured in compliance with the GDPR and does not transmit any data to third parties.

4. Analytics & cookies

4.1 Web analytics (Matomo, cookieless)

For the statistical evaluation of access to my website, I use the open-source software Matomo. Data is collected by a small script (JavaScript) that runs when a page is loaded, without cookies and without storing any information permanently on your device.

– Operation: Matomo runs on my web server (hosted by ALL-INKL, Germany). The data is not passed on to third parties.

– Data collected: shortened (anonymised) IP address, pages visited, date, time and length of visit, the previously visited page (referrer), clicks on links and buttons, browser type, operating system, device type and screen resolution.

– Anonymisation: The IP address is shortened by two bytes before it is stored (e.g. 192.168.xxx.xxx), so that it can no longer be linked to you.

– No cookies, no profiles: No cookies are set. To group the pages viewed during a single visit, Matomo creates a temporary identifier from technical characteristics (shortened IP address, browser, operating system). Visitors are not recognised across several days, and no cross-device user profile is created.

– Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a privacy-friendly analysis of how the website is used and in optimising the website).

– Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. I will then no longer process the personal data unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can also prevent data collection by disabling JavaScript in your browser or by using a tracking blocker.

– No cookie banner: As no cookies are set and no information is stored permanently on your device, I do not use a cookie banner.

4.2 Cookies & consent management

This website currently does not use any cookies that require consent under the relevant national provisions on storing information on end devices: in Denmark the Cookie Order (Cookiebekendtgørelsen), in Germany the Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG).

– Technically necessary cookies: These may be used to ensure the functionality of the website (e.g. session cookies or security cookies/“nonces” for form and comment functions). They are necessary to prevent misuse of forms or of the comment function, contain no personal data and are deleted again after a short time. Legal basis: Art. 6(1)(f) GDPR and the exemption for strictly necessary storage under the relevant national provisions (in Germany § 25(2) TDDDG). No consent is required for this.

– Comment cookies (convenience function): When you leave a comment, you can optionally agree to your name, email address and, if applicable, website being stored in cookies. This serves exclusively as a convenience function so that you do not have to enter this information again. Storage: one year. Legal basis: consent pursuant to Art. 6(1)(a) GDPR, which can be given directly in the comment form.

– Analytics without cookies: Analytics are carried out exclusively via the cookieless evaluation with Matomo described above (see 4.1), without cookies and without cross-device user profiles.

– External content only after a click: The podcast player on the podcast page loads content from an external provider only when you actively start playback (two-click principle, see 6.8). No cookies are set in the process; you give your consent by clicking the play button.

A consent banner is therefore currently not required.

Should further external content or services that use cookies or similar technologies be integrated in future (e.g. videos or social media plugins), I will use a suitable consent management tool to obtain your consent in advance.

5. Publications & interaction: blog & comments

On my website, I run a blog in which articles are published. Visitors have the option of leaving comments.

– Data processed: When you submit a comment, the data entered in the form (e.g. name, email address, comment text) and technical information (e.g. IP address, time stamp and, if applicable, browser and user agent data) are stored.

– Purpose: The data is stored in order to display the comment on the website, to ensure functionality and to prevent misuse and spam.

– Spam protection: The Antispam Bee plugin is used to protect against automated spam entries. It is configured in compliance with the GDPR and does not transmit any data to external providers.

– Legal basis: Art. 6(1)(b) GDPR (provision of the comment function as part of using the website) and Art. 6(1)(f) GDPR (legitimate interest in security and the prevention of misuse).

– Storage period: Comments remain visible permanently for as long as the article is online. You can request the deletion of your comment at any time. Technical log data (IP address, user agent, time stamp) is stored only for as long as is necessary for spam prevention and IT security and is then deleted or anonymised.

– No disclosure to third parties: Comment data is processed exclusively on my own server and is not passed on to third parties.

6. External content & services

6.1 Social media profiles

I maintain publicly accessible profiles on social networks (LinkedIn, X/Twitter, Nostr).

– Linking: These profiles are only linked on my website. Content is not embedded automatically and no social plugins are used.

– Consequence: Data (e.g. IP address, browser information) is transmitted to the respective platform only when you click on a link.

– Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a professional public presence and in communicating with interested parties).

If you contact me via direct message on these platforms, data processing is subject to the data protection provisions of the respective provider. I process the data you transmit there exclusively to respond to your enquiry (Art. 6(1)(b)/(f) GDPR).

6.2 Google Fonts

To ensure a consistent appearance of the website, I use Google Fonts, which are stored locally on my own server.

– Data protection: Therefore, no data is transmitted to Google servers when you visit my pages.

– Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a user-friendly and consistent presentation of the website).

6.3 Other tools & organisational software

I do not use any CRM systems, project management tools or other tools in which personal data is processed.

– Currently: No personal data is processed via such services.

– Future: Should I use such tools in future (e.g. CRM, project management, cloud software), this will be added to this privacy policy and explained transparently (including legal basis, recipients, storage period).

– Other WordPress plugins: In addition, plugins for design and search engine optimisation are used. According to the current state of knowledge, these do not process any personal data of visitors, do not transmit any data to third parties and do not set any cookies that require consent.

6.4 No messengers, chatbots or push notifications

No messenger services or chatbots are used on my website. Push notifications are not offered either.

6.5 Job applications

No job applications are currently accepted via my website. Should this become possible in future, this privacy policy will be supplemented by a corresponding section (including information on processing purposes, legal bases and storage period).

6.6 CRM systems

A CRM system (customer data management) is currently not used. Should such a system be introduced in future, this privacy policy will be extended accordingly and all necessary information (legal basis, recipients, storage period) will be added.

6.7 Visitor tracking / heatmaps

No visitor tracking tools (e.g. Hotjar) or heatmaps are currently used. Should such a tool be used in future, I will obtain your consent in advance and update this privacy policy.

6.8 Playback of podcast episodes (Substack)

On the podcast page, you can play individual episodes directly in your browser. The audio files are hosted by Substack Inc., 548 Market St, San Francisco, CA 94104, USA.

– Two-click principle: A connection to Substack’s servers is established only when you click the play button. No transfer takes place before the click; the page does not load any content from Substack when it is opened. The cover image of the podcast page is also stored on my own server.

– Data processed: When playback starts, your IP address is transmitted to Substack. The usual connection data of your browser (e.g. browser type, time of access) is also technically necessary for this.

– Legal basis: Art. 6(1)(a) GDPR (your consent), which you give by actively starting playback. If you wish to avoid this transfer, do not start playback; alternatively, the episodes can be accessed directly via the platform or via a podcast app of your choice.

– Transfer to third countries: Substack also processes data in the USA. For the transfer, Substack relies on the Standard Contractual Clauses of the European Commission. Further information can be found in Substack’s privacy policy at https://substack.com/privacy.

– Cookies: No cookies are set by playback.

7. Internal organisation & IT tools

7.1 Email and communication systems

For electronic communication (e.g. by email or via the contact form), I use the infrastructure of my hosting provider (ALL-INKL, Germany).

– Processing: Emails are stored and sent exclusively on servers in Germany.

– Security measures: Sending is technically secured via WP Mail SMTP and the Email Log plugin. Log data (e.g. recipient address, time of sending) is stored, but not the content of the emails permanently.

– Legal basis: Art. 6(1)(b) GDPR (communication in the context of a contract or enquiry) and Art. 6(1)(f) GDPR (legitimate interest in secure and traceable email communication).

– Storage period: For details on the storage period, see 2.6.

7.2 Backup and security plugins

I use various technical solutions to secure my website:

– UpdraftPlus: Creation of regular backups of the website. These are stored on the hosting server in Germany; in addition, I download backup copies to local systems in Denmark. For details on storage location, security and storage period, see 2.5.

– Login protection: Limitation of failed login attempts to protect against unauthorised access.

– Antispam Bee: Protection against spam in forms and comments, GDPR-compliant without external data transfer.

– Privacy-compliant configuration: All plugins used are configured in such a way that no unnecessary personal data is collected or forwarded to external services.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and functionality of the website).

7.3 Tax advice & legal obligations

To meet my tax obligations, I transmit personal data (e.g. invoice data, name, address, bank details) to my tax adviser.

– Purpose: Accounting, annual financial statements, tax obligations.

– Legal basis: Art. 6(1)(c) GDPR (compliance with legal obligations).

– Storage period: Data is usually kept for 6 to 10 years in accordance with the requirements of tax and commercial law.

7.4 Internal administration

In addition, I process personal data in the context of general internal organisation (e.g. scheduling, documentation of session notes, contract management).

– Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

– Special categories of data: Insofar as sensitive information (e.g. health data) is processed in the course of our work together, this takes place exclusively with your explicit consent (Art. 9(2)(a) GDPR).

8. Rights & enforcement

8.1 Right to lodge a complaint with a supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

As my place of residence and business is in Denmark, the following supervisory authority is responsible for me as the controller:

– Datatilsynet (Denmark): Borgergade 28, 5, 1300 København K, telephone: +45 33 19 32 00, email: dt@datatilsynet.dk, website: www.datatilsynet.dk

In principle, you can contact the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.

8.2 Applicable law

This privacy policy is governed by the law of the European Union (GDPR) and, in addition, by the applicable national data protection law. Due to my place of residence and business in Denmark, the provisions of the Danish Data Protection Act (Databeskyttelsesloven) are particularly relevant; for activities relating to Germany, the BDSG and other specific German provisions apply in addition.

9. Final provisions

9.1 Changes to this privacy policy

I reserve the right to amend this privacy policy at any time if changes to my website, my services or legal requirements make this necessary. The current version replaces all previous versions.

9.2 Legal validity & severability clause

This privacy policy was written in German. This English version is a translation provided for convenience; only the German version is legally binding.

Should individual provisions of this privacy policy be or become invalid in whole or in part, the validity of the remaining provisions shall remain unaffected.

9.3 Availability

The current version of this privacy policy is available at any time on my website at www.niniasimon.com/datenschutz (German) and on this page (English translation).

Version: October 2026