Privacy policy
1. Who is responsible
Daniël Stolk, Bogenstraße 18, 40227 Düsseldorf, Germany, email hello@danielstolk.com.
2. Visiting the website
The website runs on Cloudflare (Cloudflare, Inc., USA; certified under the EU-US Data Privacy Framework). When you open a page, your browser sends technical data such as your IP address, which Cloudflare needs to deliver the page and protect it against attacks (Art. 6(1)(f) GDPR). Cloudflare processes this data on my behalf under its data processing agreement and keeps it only briefly. To protect the booking and contact forms against abuse, the website also counts requests for a few minutes using a one-way code derived from your IP address (not the address itself); these counts are deleted automatically afterwards (Art. 6(1)(f) GDPR). The website uses no tracking cookies and no advertising. To see how many people visit, the public pages (not the booking or owner pages) use Cloudflare Web Analytics. It sets no cookies, stores nothing on your device and does not use your IP address to identify or follow you; it only counts page views with the page address, the referring website, browser and device type and country (Art. 6(1)(f) GDPR).
3. Booking a session
When you book, I process your name, email address, time zone, the chosen session and time, and your consents to the terms (Art. 6(1)(b) GDPR). The booking form keeps your booking temporarily in your browser's session storage so you can return after paying; this is deleted when you close the tab.
- Google Calendar and Google Meet (Google Ireland Ltd.): your appointment is created in my Google Calendar with your name and email address, and you receive an invitation with a Meet link.
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg): paid sessions are paid through PayPal. PayPal processes your payment data as its own controller. I receive the payment status, amount and reference.
- Resend (Resend, Inc., USA): sends me alert emails about bookings that need my attention and a receipt for each payment and refund (these contain only a booking reference, the session, the time, the amount or problem and the PayPal reference, never your name or email address), delivers messages from the contact form to me, and sends you emails about your booking (confirmation, changes, cancellation and refunds) from booking@danielstolk.com. These contain your name, the session, the time and your private booking link.
- Email: if you write to hello@danielstolk.com or booking@danielstolk.com, Cloudflare Email Routing forwards your email to my Gmail inbox (Google Ireland Ltd.), and my replies are sent through Resend.
Where these providers process data in the USA, this is based on the EU-US Data Privacy Framework or the EU standard contractual clauses.
4. Cancellations and refunds
If you cancel a booking (cancelling with a refund is also how you withdraw from the contract), I store the time of the cancellation and the booking reference, and for paid sessions the refund amount and PayPal's refund reference. I need these to process your refund and to prove it later (Art. 6(1)(b) and (c) GDPR).
5. Contact form
If you use the contact form, your name, email address and message are sent to me by email through Resend (see above), so that I can reply (Art. 6(1)(b) and (f) GDPR). The message is not stored on the website itself; it stays in my email inbox. If it concerns a booking, I keep it for up to 6 years from the end of the calendar year, as German tax law requires for business correspondence; otherwise I delete it once your request is handled.
6. How long data is kept
Your name, email address and private booking link are deleted automatically six months after the session. The date, session type, amount and payment reference, including records of cancellations and refunds, are kept for 8 years from the end of the calendar year of the payment, as German tax law requires for my bookkeeping (section 147 German Fiscal Code). The calendar entry in my own Google Calendar is not deleted automatically.
7. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object (Art. 15–21 GDPR). Contact me at hello@danielstolk.com. You can also complain to a data protection authority, for example the data protection authority of North Rhine-Westphalia (LDI NRW).