top of page
As of June 2026

Privacy Policy

Coaching — Clinical Hypnosis — NLP

§ 1 Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

 

makemebelieve UG (haftungsbeschränkt)

represented by the Managing Director Regina Henfling-Kistner

Römerstr. 7

80801 Munich

 

Munich Local Court (Amtsgericht München), HRB 304060

VAT ID: DE457418059

 

Responsible for content: Thorsten Kistner

E-Mail: kontakt@thorstenkistner.com

Website: https://www.thorstenkistner.com

 

§ 2 Principles of Data Processing

We process personal data exclusively on the basis of the applicable data protection regulations, in particular the GDPR. Processing only takes place where one of the following legal bases applies:

  • Art. 6(1)(a) GDPR – consent of the data subject

  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures

  • Art. 6(1)(c) GDPR – compliance with a legal obligation

  • Art. 6(1)(f) GDPR – safeguarding legitimate interests

 

Special category data (in particular data under Art. 9 GDPR arising in the context of consulting and coaching processes) is processed and stored exclusively locally on our own hardware. It is not transmitted to third-party providers.

 

§ 3 Website Operation (Wix)

3.1 Provider and Processing

This website is operated on the platform of Wix.com Ltd. (40 Namal Tel Aviv St., Tel Aviv 6350671, Israel). When the website is accessed, Wix automatically processes technical access data (IP address, browser type, operating system, date and time of access, URL accessed).

 

3.2 Legal Basis

Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website).

 

3.3 Third-Country Transfer

Wix is certified under the EU-U.S. Data Privacy Framework. An adequacy decision by the EU Commission exists. In addition, Standard Contractual Clauses (Art. 46(2)(c) GDPR) are in place as a supplementary safeguard.

 

3.4 Contact Forms via Wix

Contact forms on this website are currently operated via the Wix platform. When a form is submitted, the data entered (name, email address, message content) is transmitted to Wix servers and forwarded from there to us.

 

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR.

 

Note: Form processing is being migrated step by step to an end-to-end encrypted solution (Proton Mail). Once the migration is complete, form data will no longer be transmitted to Wix.

 

3.5 Data Processing Agreement

A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Wix.

 

3.6 Wix Privacy Policy

https://www.wix.com/about/privacy

 

§ 4 Cookie Management (Cookiebot)

4.1 Use and Purpose

This website uses Cookiebot (Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark) to obtain, document and manage consent to cookies and similar technologies in a data-protection-compliant manner.

 

4.2 Data Processed

Cookiebot processes your IP address in anonymized form, your consent decisions, and the timestamp of consent. This data is stored on servers in the EU.

 

4.3 Legal Basis

Art. 6(1)(c) GDPR (legal obligation to manage consent) and Art. 6(1)(f) GDPR (legitimate interest in being able to demonstrate the consent given).

 

4.4 Cookiebot Privacy Policy

https://www.cookiebot.com/de/privacy-policy/

 

§ 5 Website Analytics (Twipla)

5.1 Use and Purpose

For privacy-friendly analysis of website usage, we use Twipla (Twipla Internet Intelligence S.A., 16 Rue Jean-Pierre Brasseur, L-1258 Luxembourg). Twipla operates without cookies, without persistent identifiers, and without sharing data with third parties.

 

5.2 Data Processed

Twipla collects aggregated, non-personal usage statistics (page views, time on page, country of origin in anonymized form). Identification of individual persons is not possible.

 

5.3 Legal Basis

Art. 6(1)(f) GDPR (legitimate interest in improving the website offering). Since Twipla operates without cookies and without processing personal data, no consent under § 25(1) TTDSG is required.

 

5.4 Twipla Privacy Policy

https://www.twipla.com/en/privacy-policy

 

§ 6 Contact and Communication

6.1 Email (Proton Mail)

For email communication we use Proton Mail (Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland). Proton Mail is an end-to-end encrypted service operated exclusively on servers in Switzerland and the EU.

 

If you contact us by email, your details (name, email address, content of your message) are processed to handle your request. A data processing agreement is in place with Proton AG.

 

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (handling of inquiries).

 

Proton Privacy Policy: https://proton.me/legal/privacy

 

6.2 Video Calls (Proton Meet)

For online conversations (in particular exploratory conversations) we use Proton Meet (Proton AG, see above). Proton Meet is end-to-end encrypted. No recordings are made unless expressly consented to.

 

Data processed: connection data (IP address, device type) and, where applicable, video and audio data during the session.

 

Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures) or Art. 6(1)(a) GDPR (consent in the case of recording).

 

6.3 Data Storage (Proton Drive)

Customer-related documents (offers, contracts, invoices) are stored in Proton Drive (Proton AG, see above) – end-to-end encrypted on servers in Switzerland and the EU.

 

Legal basis: Art. 6(1)(b) and (c) GDPR (performance of contract and statutory retention obligations).

 

§ 7 CRM and Newsletter (HubSpot)

7.1 Use and Purpose

For our contact and customer relationship management as well as for sending newsletters and marketing communication, we use HubSpot (HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA; European office: HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland).

 

7.2 Data Processed

At our company, HubSpot processes exclusively contact data and communication histories within the scope of marketing and offer management:

  • Name and email address (upon newsletter sign-up)

  • Company and job title (insofar as voluntarily provided)

  • Interaction data (email opens, clicks in the newsletter)

  • Date and time of contact

 

Important: Content from coaching or consulting processes (in particular data under Art. 9 GDPR) is not stored in HubSpot. This is processed exclusively locally.

 

7.3 Newsletter

Our newsletter is sent only with explicit consent (double opt-in procedure). Consent can be withdrawn at any time by clicking the unsubscribe link in the newsletter or by email to kontakt@thorstenkistner.com.

 

7.4 HubSpot Forms

Forms operated by HubSpot may be embedded on this website. When such forms are filled out and submitted, the data entered is transmitted directly to HubSpot and stored there in our CRM account. HubSpot may also collect technical data (IP address, browser data) for fraud prevention.

 

Legal basis: Art. 6(1)(a) GDPR (consent) for newsletter sign-ups; Art. 6(1)(b) GDPR for contact inquiries with a contractual context.

 

7.5 Legal Basis

Newsletter and marketing: Art. 6(1)(a) GDPR (consent).

CRM and offer management: Art. 6(1)(b) and (f) GDPR.

 

7.6 Third-Country Transfer

HubSpot is certified under the EU-U.S. Data Privacy Framework. Standard Contractual Clauses are also in place. A data processing agreement pursuant to Art. 28 GDPR is in place with HubSpot.

 

7.7 HubSpot Privacy Policy

https://legal.hubspot.com/privacy-policy

 

§ 8 Payment Processing (Stripe)

8.1 Use and Purpose

For processing payments we use Stripe (Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; for non-EU transactions: Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA).

 

8.2 Data Processed

Stripe processes exclusively the data required for payment processing:

  • Name and billing address

  • Payment data (credit card number in tokenized form, IBAN for SEPA direct debit)

  • Transaction data (amount, date, order reference)

  • IP address (for fraud prevention)

 

We ourselves do not store complete payment data. This remains exclusively with Stripe.

 

8.3 Legal Basis

Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in secure payment processing and fraud prevention).

 

8.4 Third-Country Transfer

Stripe is PCI-DSS certified and registered under the EU-U.S. Data Privacy Framework. Standard Contractual Clauses are in place.

 

8.5 Stripe Privacy Policy

https://stripe.com/de/privacy

 

§ 9 Processing of Special Category Data

In the course of coaching, consulting and hypnosis sessions, special category data may arise (Art. 9 GDPR), in particular information on mental and physical health, life circumstances and personal background.

 

Without exception, this data is:

  • processed and stored exclusively on locally operated, own hardware

  • not transmitted to cloud services, CRM systems or third parties

  • stored encrypted on the local system

  • deleted after the end of the collaboration in accordance with statutory retention periods

 

Legal basis: Art. 9(2)(a) GDPR (explicit consent), which is obtained in writing at the start of the collaboration.

 

§ 10 Retention Period and Deletion

Personal data is deleted or blocked as soon as the purpose of storage no longer applies. Longer retention only takes place insofar as statutory obligations exist:

 

  • Tax-relevant documents (invoices, contracts): 10 years pursuant to § 147 AO / § 257 HGB

  • Commercial and business letters: 6 years pursuant to § 257 HGB

  • Records of consent (newsletter): until withdrawal, then 3 years for evidentiary purposes

  • Coaching-related documents: by individual agreement, at least until the expiry of any warranty periods

 

§ 11 Data Subject Rights

With regard to your personal data, you have the following rights vis-à-vis us:

 

Access (Art. 15 GDPR): You may request information about the data we store about you.

Rectification (Art. 16 GDPR): You may request the correction of inaccurate data.

Erasure (Art. 17 GDPR): You may request the deletion of your data, insofar as no statutory retention obligations preclude this.

Restriction (Art. 18 GDPR): You may request the restriction of processing.

Data portability (Art. 20 GDPR): You may receive your data in a machine-readable format.

Objection (Art. 21 GDPR): You may object at any time to the processing of your data based on legitimate interests.

Withdrawal (Art. 7(3) GDPR): You may withdraw consent given at any time with effect for the future.

 

To exercise your rights, please contact: kontakt@thorstenkistner.com

 

Right to lodge a complaint: You have the right to lodge a complaint with the competent data protection supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, www.lda.bayern.de.

 

§ 12 Overview of Services Used

 

Service Provider / Location Legal Basis Third Country

  • Wix – Wix.com Ltd., Israel – Art. 6(1)(f) – DPF + SCC

  • Cookiebot – Cybot A/S, Denmark (EU) – Art. 6(1)(c), (f) – no

  • Twipla – Twipla Internet Intelligence S.A., Luxembourg (EU) – Art. 6(1)(f) – no

  • Proton Mail/Meet/Drive – Proton AG, Switzerland – Art. 6(1)(a), (b), (c) – CH (adequate)

  • HubSpot – HubSpot Ireland Ltd., Ireland (EU) – Art. 6(1)(a), (b), (f) – DPF + SCC

  • Stripe – Stripe Payments Europe Ltd., Ireland (EU) – Art. 6(1)(b), (f) – DPF + SCC

 

§ 13 Changes to This Privacy Policy

We reserve the right to amend this privacy policy insofar as this is necessary due to changes in the legal situation, case law or technical developments. The current version is available on our website. In the event of material changes, we will inform registered users by email.

bottom of page