Privacy Policy

1. Controller

The party responsible for the processing of personal data on this website is:

CÉCILE GmbH
Knesebeckstraße 56-58
10719 Berlin

Phone: +49 30 35182-9879
Email: hello@cecilestudios.com

Managing Directors: Caroline Jander, Caroline Schweitzer
Court of registration: Amtsgericht Charlottenburg, HRB 278203 B

Our event venue, for example for the Teacher Training, is our studio at Lietzenburger Straße 93, 10719 Berlin.

2. Overview of processing

This privacy policy applies to the website cecilestudios.com.

The website displays public content such as the homepage, Method, memberships, Journal, Training, waitlist, gift vouchers and careers page in German and English. You can join our waitlist, apply for a position, book and pay for a place on our Teacher Training, take out a membership in the Members Club, or buy and redeem a gift voucher. You can also withdraw from and cancel contracts via the website. In addition, we operate campaign short links under cecilestudios.com/go. There are no user accounts and no login.

The following sections explain what data arises on which occasion, for what purpose, on what legal basis, and for how long we store it.

3. Hosting and server logs

Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Requests are routed via the Frankfurt edge location, but processing may also take place in the USA.

On every visit, Vercel automatically stores the IP address, date and time, requested URL, referrer, browser, operating system, HTTP status and technical request identifiers. This log data is deleted after 30 days at the latest, without being passed on to third parties. Our own error logs are likewise held by Vercel; in the event of technical faults, these may contain internal identifiers such as booking or Stripe transaction numbers, but no names or email addresses.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in the secure and reliable provision of the website. Data is transferred to the USA. Vercel is certified under the EU-U.S. Data Privacy Framework (DPF), and Standard Contractual Clauses apply in addition.

4. Cookies and reach measurement

Our website sets a single cookie: NEXT_LOCALE, value “de” or “en”, used to remember your language for redirecting between the German and English pages. It is a session cookie with no fixed expiry date, SameSite lax, set on every page visit. The legal basis is Section 25(2) No. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act, since it is strictly necessary, as well as Art. 6(1)(f) GDPR. No consent is required for this cookie.

We also use Vercel Web Analytics for reach measurement. The script is served from our own domain (/_vercel/insights/script.js) and records the time, the page visited, the referrer, filtered URL parameters, the country, region and city derived from the request, the operating system, browser, device type and script version. It sets no cookies and uses no local storage. Visitors are recognised via a hash derived from the request, which is discarded after 24 hours; after that, only aggregated statistics remain. There is no tracking across websites, no advertising, and no recording of individual clicks.

The recipient is Vercel Inc. (see Section 3), USA, DPF-certified. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in anonymised reach measurement. You may object under Art. 21 GDPR, see Section 20.

We also use Plausible Analytics for reach measurement. The script is loaded from plausible.io and records the page visited, the referrer, browser, operating system, device type, and the country, region and city derived from the IP address. Plausible sets no cookies and uses no local storage. Your IP address is not stored; together with your browser identifier and a random value that changes daily, it is turned into a daily identifier that can no longer be attributed after 24 hours. The provider is Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Data is processed exclusively within the EU, on servers in Germany and Finland; no third-country transfer takes place. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in anonymised reach measurement; you may object under Art. 21 GDPR, see Section 20.

We do not use Google Analytics, Meta Pixel, TikTok Pixel or comparable tools.

5. Fonts

We use DM Sans, Alta and Cormorant Garamond, all three delivered from our own server. DM Sans and Alta are stored as local files; Cormorant Garamond is downloaded when the website is built and is then likewise self-hosted. As a result, no connection to Google or other font providers is made when the site is visited. Our emails also do not load any fonts from Google.

6. Map excerpt

In the footer of most pages, we display a placeholder for a map excerpt showing our studio address. Before a click, no connection to Google is made. Only after clicking “Load map” do we load the map excerpt as an embedded element from maps.google.com. In doing so, Google receives your IP address and browser data and may set its own cookies; the address of our page is not transmitted as a referrer.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer to Google LLC in the USA is possible; Google is DPF-certified.

The legal basis is your consent given by the click, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You withdraw your consent by reloading the page and not opening the map again. There is also an ordinary “Open in Maps” link to google.com/maps, which leaves our website.

7. External links and social media

Our website links to Instagram (instagram.com/cecile.studios), TikTok (tiktok.com/@cecile.studios), YouTube (youtube.com/@cecilestudios) and our WhatsApp channel. These are plain links only, not embedded plug-ins, pixels or feeds. Simply visiting our site therefore sends no data to these platforms; only a click leaves our website.

We have no influence over how these social networks process data, and a transfer of your data to third countries cannot be ruled out. Please therefore consider carefully what information you share with us there, and use our other contact options if in doubt. We accept no liability for the conduct of the operators or their members.

If you communicate with us via our social media presences, we process the information you make available to us for that purpose, such as your name, profile page and message content, in line with the purpose of your communication. We delete this data as soon as storage is no longer necessary, or restrict processing where statutory retention obligations apply. For public posts, we decide on a case-by-case basis whether and when to delete them there. The legal basis is Art. 6(1)(a), (b) and (f) GDPR, our legitimate interest in maintaining effective contact with customers. The providers may set their own cookies in doing so, over which we have no influence.

WhatsApp channel

You can join our WhatsApp channel via a link, a one-to-many form of communication, not a group. Followers cannot write to the channel, but can only react with emojis and take part in polls.

The provider for the EEA is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; privacy policy at whatsapp.com/legal/privacy-policy-eea. Data is transferred to the USA, based on Standard Contractual Clauses.

If you follow the channel, WhatsApp processes your phone number, profile information and usage data under its own responsibility. As the operator, we are shown your profile name and, depending on your privacy settings, your profile picture, as well as your reactions and poll votes. We do not see your phone number unless you are already saved in our contacts.

The purpose is to inform you about, and advertise, our offering. The legal basis is Art. 6(1)(a) GDPR; joining is voluntary. You end the processing at any time by leaving the channel.

8. Waitlist

On our homepage and at /waitlist, you can join our waitlist. Required fields are first name and email, plus surname on the homepage, and a consent checkbox that starts unchecked. On /waitlist, the surname is optional. We automatically record your language, the source of the entry and the time of your consent. While you type, the page checks live against our own server whether your email is already registered, without storage and without involving third parties.

The checkbox text reads: “I'd like to receive news about CÉCILE Studios, including the opening.”

The purpose is to inform you about the studio opening, launch announcements and offers by email, in other words advertising. The legal basis is your consent, Art. 6(1)(a) GDPR. You may withdraw at any time by emailing hello@cecilestudios.com.

We store your details with Supabase, see Section 17. Your email is unique; duplicate entries are ignored. You receive a confirmation email via Brevo containing your first name; no internal notification is sent. We store your data until you withdraw your consent or until we no longer need the waitlist, after which we delete it.

9. Applications

You can apply via our careers page (/hiring). Required fields are the position (Lagree Instructor, Hot Strength Instructor or Shake Bar Barista), first name, surname, email, experience, motivation, availability and a consent checkbox. The phone number is optional; a file upload is not provided for. We automatically record your language and the time of your consent.

The checkbox text reads: “I agree that CÉCILE Studios may process my application data to evaluate my application.”

The purpose is to carry out the application process. The legal basis is Section 26(1) BDSG, the German Federal Data Protection Act, in conjunction with Art. 6(1)(b) GDPR; by ticking the checkbox you additionally confirm your consent. Your data is not used for advertising purposes.

We store your details with Supabase. Via Brevo, we send two emails: one to our team containing all details, and an acknowledgement to you with a link to this policy and to our legal notice (Impressum). Within our internal area, only those involved in handling your application have access.

We delete your application data no later than six months after receipt; the period runs from receipt, not from a rejection. Exceptions apply if you are hired, in which case we transfer the data into our personnel records, or if you consent to longer storage.

10. Booking the Teacher Training

10.1 Registration

You can book a place via our training page. Required fields are first name, surname, email, phone number, country, professional background, experience with Lagree, motivation and the number of places (one to four). In addition, there is a mandatory checkbox covering the training terms and cancellation policy, referring to our terms and conditions (AGB). Optional fields are your Instagram handle and a second checkbox, starting unchecked: “Send me occasional news about trainings and the studio.” We also automatically store your language setting and the time of your consent.

The purpose is to initiate and perform the training contract, including invoicing and statutory retention. The legal basis is Art. 6(1)(b) GDPR. For retention, Art. 6(1)(c) GDPR in conjunction with Section 147 AO, the German Fiscal Code, and Section 257 HGB, the German Commercial Code, additionally applies. For optional updates, the legal basis is Art. 6(1)(a) GDPR. No booking is possible without the required information. We store your booking with Supabase, together with status (open, paid, expired, refunded), timestamps, Stripe transaction number and booking reference.

10.2 Payment via Stripe

After the form, we redirect you to a payment page hosted by Stripe (checkout.stripe.com). We pass on your email, number of places, language and booking number. You enter your billing address, payment details and, optionally, your VAT ID directly with Stripe. Stripe calculates the tax, generates the invoice, which can be retrieved via a link, and creates a customer record.

The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; privacy policy at stripe.com/privacy. A transfer to Stripe, Inc. in the USA is possible; Stripe is DPF-certified, and Standard Contractual Clauses apply in addition. For payment processing and fraud prevention, Stripe acts partly under its own responsibility, and partly as our processor for tasks such as invoice generation.

Depending on your country, device and currency, Stripe displays a selection of the payment methods enabled in our account: card payment, Apple Pay, Amazon Pay, Link, PayPal, Samsung Pay, Klarna, as well as regional methods such as Bancontact, BLIK, EPS, MB WAY, Pix, Kakao Pay, Naver Pay and PAYCO. Depending on the payment method chosen, the relevant payment service provider, for example PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, receives the data required for that purpose and processes it under its own responsibility. We do not store any payment data ourselves; we only receive the payment status, amount, invoice link and transaction numbers from Stripe.

Stripe automatically checks every payment for suspected fraud (Stripe Radar) and may decline it automatically. This is an automated decision within the meaning of Art. 22 GDPR, over which we have no influence and of which we are not directly informed. If your payment is declined, please get in touch with us; we will then look for another way together. The legal basis for payment processing is Art. 6(1)(b) and (c) GDPR.

10.3 Confirmation and ticket

Once payment has been received, we send a confirmation email via Brevo containing your first name, the number of places, the amount paid, the training date and location, the booking reference, the invoice link, information on the right of withdrawal and our legal notice details. You receive a PDF ticket and a calendar file as attachments.

Internally, we additionally store a random ticket identifier intended for a future admission check. Our team can resend the confirmation from the admin area.

10.4 Retention period

If a booking remains incomplete because the payment page is abandoned or the payment fails, we check with Stripe 48 hours after creation whether payment was made. Once it is established that no payment was made, we immediately anonymise your name, email, phone number, country, Instagram handle, profession, experience and motivation. The remaining anonymised record is permanently deleted 90 days after creation. This check runs daily.

In the event of a full refund, we likewise anonymise immediately and also delete the remainder after 90 days. Tax-relevant records such as the invoice and credit note remain with Stripe.

For paid, completed bookings, we retain the data for as long as necessary to carry out and follow up the training, plus statutory retention beyond that, generally ten years for tax-relevant records.

10.5 Internal notifications

In the event of anomalies, for example a payment without a booking, a chargeback, a dispute or a technical fault, our team automatically receives an email via Brevo containing the booking number, status, Stripe transaction numbers and amounts. Only in the case of a chargeback does it additionally contain your email address. The recipient is hello@cecilestudios.com or a designated team address. We also regularly reconcile the payments of the last few days at Stripe against our bookings, using transaction numbers and amounts.

11. Membership in the Members Club

11.1 Signing up

You can take out a membership in the Members Club via our memberships page. Required details are the tier you choose, the billing mode (monthly or yearly in advance), first name, last name and email address. In addition there are two mandatory checkboxes: the confirmation that you are at least 18 years old, and your agreement to the membership terms and the withdrawal notice. A third checkbox, unticked by default, is optional: occasional updates about the Members Club and CÉCILE Studios. We also automatically store your language setting, the time of your agreement and of your age confirmation, and the version of the terms you agreed to. We do not ask for a phone number, postal address, date of birth or health information on the website.

The two questions on the memberships page, from which the page suggests a suitable tier, are evaluated in your browser only. Your answers are neither transmitted to us nor stored.

The purpose is to initiate and perform the membership contract, including invoicing and statutory retention. The legal basis is Art. 6(1)(b) GDPR. For retention, Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB applies in addition. For optional updates, the legal basis is Art. 6(1)(a) GDPR. Without the required details, no membership can be taken out.

When you submit the form, we store your order with Supabase and reserve one of the 30 seats for you for 36 minutes, before you have saved your card. There is at most one reservation and one membership per email address; for this we compare your address with existing orders. We also store the status, timestamps, the key terms of your contract (tier, billing mode, amounts, term) and your contract reference. The number of free seats shown on the website is a plain count without personal data.

11.2 Saving your card and charges via Stripe

After the form we redirect you to a page hosted by Stripe (checkout.stripe.com). There you save a credit or debit card and enter your billing address and, optionally, your VAT ID. Nothing is charged when the contract is concluded. We pass your name, email address, language, our order number, tier and billing mode to Stripe.

Stripe creates a customer record, stores the payment method and charges the agreed fees on the agreed dates: for the first time after the free months following the opening of the studio, and then on a recurring basis for as long as the membership runs. Stripe calculates the tax and issues the invoices. If a charge fails or your bank asks for confirmation, Stripe retries the charge according to its own rules and may send you emails with a link for this purpose.

We do not store any card data ourselves. From Stripe we receive and store identifiers (customer number, identifier of the saved payment method, numbers of the payment schedule and the subscription, transaction number), the status and the link to the first invoice. For memberships we only offer cards as a means of payment. Section 10.2 applies accordingly to the provider, the transfer to the USA, the role of Stripe and the automated fraud check. The legal basis is Art. 6(1)(b) and (c) GDPR.

11.3 Confirmation and further emails

As soon as your card is saved, we send you a confirmation via Brevo containing your first name, tier, billing mode, term, amounts, the date of the first charge, contract reference, withdrawal notice and company details. The contract documents are attached as a PDF. During the membership we write to you where the contract gives reason to: when the opening date is set or changes, a few days before the first charge, after a withdrawal or a cancellation, and if the pre-sale is called off. Our team can resend the confirmation from the admin area.

The page you see after signing up shows the tier, billing mode, amounts and your contract reference, but neither your name nor your email address.

11.4 Retention period

If you do not complete the process, the reservation lapses by itself. 48 hours after creation we remove first name, last name and email address from an order that was not completed. What remains is information without reference to a person, such as tier, billing mode, amounts, timestamps and status. We keep the data of a completed membership for the duration of the contract, plus statutory retention beyond that, generally ten years for tax-relevant records. Invoices remain with Stripe.

11.5 Internal notifications

For every new membership and for irregularities, such as a failed charge or an ended subscription, our team automatically receives an email via Brevo with the tier, billing mode, order number, Stripe identifiers, amounts and status. Notifications about a withdrawal or a cancellation additionally contain your name and email address so that our team can process your declaration. We also regularly reconcile payment schedules and subscriptions at Stripe with our orders.

11.6 Access to the booking system

For the opening of the studio we set up access to our booking system (CÉCILE Studios App) for members. For this we will transfer your name, email address, tier and the identifier of your subscription to it. The legal basis is Art. 6(1)(b) GDPR. We inform you separately in the app about the data processing there.

12. Gift vouchers

12.1 Purchase

You can buy a gift voucher on our voucher page. Required details are the amount, the name of the person the voucher is for (“For”), your name (“From”) and your email address. In addition there is a mandatory checkbox for the voucher terms and the withdrawal notice. Optional are a personal message (at most 160 characters), the recipient’s email address and a delivery date. We also store your language setting, the time of your agreement and the version of the terms you agreed to.

The purpose is to conclude and perform the voucher contract, including billing and statutory retention. The legal basis is Art. 6(1)(b) GDPR. For retention, Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB applies in addition. Without the required details, no purchase is possible.

We process the recipient’s name and email address so that the voucher reaches them. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest and that of the buyer in delivering the gift. Please only provide these details if you may assume that the recipient agrees.

We store your details with Supabase, see Section 17, together with the voucher code, the amount, the status, timestamps and Stripe’s transaction numbers.

12.2 Payment via Stripe

After the form we redirect you to a payment page hosted by Stripe (checkout.stripe.com). We pass your email address, the amount, the language and an internal identifier of the voucher to Stripe. Stripe does not calculate VAT on the voucher and does not issue an invoice, because no VAT is due when a multi-purpose voucher is bought. We send you your receipt ourselves by email.

Section 10.2 applies accordingly to the provider, the payment methods, the transfer to the USA, the role of Stripe and the automated fraud check. The legal basis is Art. 6(1)(b) GDPR.

12.3 Delivery by email

After payment we send you a confirmation via Brevo with the amount, code, validity, your details for “For”, “From” and the message, the voucher as a PDF and the voucher terms. If you entered the recipient’s email address, they receive an email with the PDF, either immediately or on the chosen day at 8 am Berlin time. For delivery on a chosen day, our system checks every hour which vouchers are due.

Our team receives an internal email about every voucher sold, with the amount, code, the names from “For” and “From” and the delivery method, without email addresses.

12.4 Redemption

When you check a code on our website or redeem it when taking out a membership, we match it against our database. To limit trying out codes, we count the requests per IP address, see Section 14.

When a voucher is redeemed for a membership, we link it to that membership and credit the amount to the membership’s customer account at Stripe. Stripe deducts it from the next payments. The buyer is not informed of this. The person redeeming the voucher learns nothing about the buyer beyond the details on the voucher. The legal basis is Art. 6(1)(b) GDPR.

12.5 Retention

We store vouchers, including purchase and redemption data, until the end of their validity, plus statutory retention beyond that, generally ten years for tax-relevant records. We remove the personal message and the recipient’s email address six months after the voucher was sent to them. If there is no recipient, we remove the message six months after it was sent to you.

For abandoned purchases without payment, we check with Stripe 48 hours after the start whether payment was made after all. Once it is clear that no payment was made, we remove names, message and email addresses.

13. Withdrawal and cancellation via the website

13.1 Withdrawing from a contract

On the page “Withdraw from contract” you can withdraw online from a contract concluded with us (§ 356a BGB). Required details are your name and your email address. In addition there is the contract reference or a description of the contract and, optionally, a reason. We store your declaration with the time of receipt and your language setting with Supabase and match it to your contract using the reference or your email address. You immediately receive an acknowledgement of receipt via Brevo with the content of your declaration and the date and time of receipt. Our team is informed by email, reviews the declaration and gets back to you.

13.2 Cancelling a contract

On the page “Cancel contracts here” you can cancel a membership online (§ 312k BGB). We collect the type of cancellation (ordinary or extraordinary), your name, your email address, the contract reference or a description of the contract, the desired date and, for an extraordinary cancellation, the reason. Storage, matching and acknowledgement of receipt work as for a withdrawal. For an ordinary cancellation, the confirmation states the end of the contract as soon as it is established.

13.3 Declarations from a different email address

If a withdrawal or a cancellation arrives from an email address other than the one stored in the contract, we inform the address stored in the contract that a declaration concerning this contract has been received. This message contains neither the name nor the email address nor the reason of the person making the declaration. It protects against someone ending a contract in another person’s name.

13.4 Legal basis and retention period

The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a and § 312k BGB, and Art. 6(1)(b) GDPR insofar as we process your declaration to handle the contract. The stored declarations serve as proof of their receipt. We keep them for as long as this is necessary to handle the contract and as proof, generally until the statutory limitation periods have expired, and beyond that only insofar as statutory retention obligations exist.

14. Protection against abuse

Our forms for the waitlist, applications, training bookings, memberships, voucher purchases, withdrawals and cancellations, as well as the checking of voucher codes, are protected against mass automated requests. For this we count how often a form is submitted or a code is checked from one IP address within a short time. The IP address is stored together with the counter for a few hours at most with our service provider Upstash and then deleted automatically. We do not store it in our database.

In addition, the forms contain a field that is invisible to humans. If it is filled in, we discard the request without storing it.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in protecting the website and the limited number of seats against abuse. The provider is Upstash, Inc., USA. The data is held in a data centre in Frankfurt am Main. Upstash is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses apply in addition.

15. Sending emails

We send all transactional emails, meaning confirmations for the waitlist, applications, bookings, memberships and voucher purchases, vouchers sent to recipients, messages about withdrawals and cancellations, as well as internal notices, via Brevo, sender address hello@cecilestudios.com.

The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin. The servers are located in the EU, in Germany and France; privacy policy at brevo.com/legal/privacypolicy.

The recipient address, first name, email content and any attachments are transmitted. We do not use open or click tracking in our emails. Depending on the occasion, the legal basis is Art. 6(1)(b) or (a) GDPR; Brevo processes the data as our processor.

16. Campaign short links

For posters and QR codes, we use short links under cecilestudios.com/go. The request is passed server-side to our internal admin system, which counts it and redirects you to the relevant destination.

Only the short-link identifier and the time are counted, neither IP address nor browser, neither referrer nor cookie or device identifier. This count data does not constitute personal data.

The request itself, like any page visit, generates an ordinary server log at Vercel, see Section 3. Destinations are pages on our website or third-party services, such as our WhatsApp channel; the respective provider's privacy policy applies there.

17. Recipients and service providers

We use the following service providers (DPF: EU-U.S. Data Privacy Framework, SCC: Standard Contractual Clauses):

Where legally required, we have data processing agreements in place with our service providers under Art. 28 GDPR.

18. Retention periods at a glance

• Server logs at Vercel: deleted after 30 days at the latest.
• NEXT_LOCALE cookie: ends when you close your browser.
• Analytics identifiers (Vercel, Plausible): discarded after 24 hours, after which only aggregated statistics remain.
• Waitlist: until withdrawal or until we no longer need it.
• Applications: no later than six months after receipt, except in the case of hiring or longer consent.
• Incomplete bookings: anonymisation after 48 hours, permanent deletion after 90 days.
• Refunded bookings: anonymisation immediately after the full refund, permanent deletion after 90 days.
• Paid, completed bookings: for as long as necessary to carry out and follow up the training, plus statutory retention beyond that, generally ten years for tax-relevant records.
• Membership order that was not completed: name and email address are removed after 48 hours.
• Memberships: for the duration of the contract, plus statutory retention beyond that, generally ten years for tax-relevant records.
• Gift vouchers: until the end of their validity, plus statutory retention beyond that, generally ten years for tax-relevant records.
• Personal message and recipient’s email address: removed six months after delivery.
• Abandoned voucher purchase without payment: names, message and email addresses are removed after 48 hours, once it is clear that no payment was made.
• Withdrawal and cancellation declarations: for as long as needed to handle them and as proof, generally until the statutory limitation periods have expired.
• IP address for protection against abuse: a few hours at most.
• Emails via Brevo: according to the respective purpose, see the sections on the waitlist, applications, bookings, memberships and gift vouchers.

19. Your rights

You have the rights set out in Art. 15 to 21 GDPR: access to the data we hold about you, rectification of inaccurate data, erasure, restriction of processing, data portability, and objection.

To exercise these rights, please contact hello@cecilestudios.com or by post at the address given in Section 1.

20. Right of withdrawal and objection

You have the right under Art. 7(3) GDPR to withdraw consent given under Art. 6(1)(a) GDPR at any time. We will then discontinue the processing based on that consent for the future. Withdrawal does not affect the lawfulness of processing carried out up to that point.

Where we process data on the basis of legitimate interests, you have the right under Art. 21 GDPR to object at any time for reasons arising from your particular situation. Where the objection concerns processing for direct marketing purposes, a general right of objection applies, which we implement even without your stating reasons.

An informal notice to the contact details given in Section 1 is sufficient for a withdrawal or objection.

21. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding our processing. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, phone +49 30 13889-0, email mailbox@datenschutz-berlin.de, datenschutz-berlin.de. You may also contact any other supervisory authority.

22. Obligation to provide data, automated decisions, data security

The information marked as required is necessary either contractually or for processing. Without it, no booking, membership, voucher purchase, application or registration is possible. Optional fields are marked accordingly.

We do not carry out automated decision-making within the meaning of Art. 22 GDPR, with the exception of the automated fraud check carried out by Stripe, see Sections 10.2, 11.2 and 12.2.

We protect your data through TLS encryption, access to our database exclusively via our servers, and a password-protected admin area accessible only to staff members responsible for this area.

23. Changes to this policy, currency

We update this policy whenever the website or the underlying processing changes. The version currently published always applies.

Last updated: October 2026. This version replaces the version of September 2026.