Privacy policy

Overview

This privacy policy explains which personal data is processed when you visit this website, send a contact request, book an appointment online, pay for a session, or take part in a video session. We process as little data as possible: there is no advertising and no third-party tracking. Reach measurement uses only a privacy-preserving, cookieless, self-hosted analytics tool without personal profiles.

Controller

Liam Kennedy — Praxis für Hypnosetherapie (Hypnotherapy Practice)
Liam Kennedy, Bergstraße 46, 24340 Eckernförde, Germany
Email: kontakt@liamkennedyhypnotherapy.com
Phone: +49 1520 9059868

Hosting and server log files

This website runs on a virtual server operated by netcup GmbH in a data centre in Germany. When you visit the website, the web server (nginx) automatically records access logs. The following is stored:

• IP address of the requesting device
• date and time of the request
• requested page or file and HTTP status code
• transferred data volume, browser identifier (user agent) and referrer URL

The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in operating the website securely and reliably, in particular in detecting and defending against attacks. The log files are not merged with other data and are deleted automatically after a short period as part of log rotation.

Reach measurement (Plausible Analytics)

For privacy-preserving reach measurement we use the open-source software Plausible Analytics. We operate it ourselves on our own server in Germany; it is not a cloud analytics service, and no data is sent to third-party analytics providers. No cookies and no identifiers in local storage (localStorage) on the device are set. There is no cross-site tracking and no use for advertising.

Only aggregated statistical information is recorded:

• visited pages
• referrer source
• campaign parameters
• country and region
• device class and browser

No personal profiles are created. The IP address and the browser identifier (user agent) are used only transiently to derive a daily-rotating anonymised identifier and are not stored. The website transmits to the analytics endpoint only the page path plus campaign parameters (utm_*, ref, source); query strings that could contain booking references or access tokens are stripped in the browser before anything is sent. No names, email addresses, message contents or health information are recorded.

The analytics endpoint is reached via the same domain as this website (first-party). Processing takes place on our self-managed server stats.tristankennedy.art in Germany (Hetzner). Data is not shared with third parties.

The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in privacy-preserving reach measurement.

Contact form

When you send a request via the contact form, we process your name, your email address, your message and — if provided — your concern and preferred session format.

The processing serves to answer your request and to initiate a therapeutic relationship (Art. 6(1)(b) GDPR) and is otherwise based on your consent (Art. 6(1)(a) GDPR), which you give when submitting the form and can withdraw at any time with effect for the future.

The request is delivered by email via the service provider Resend acting as our processor (see the section on transactional emails). Request data is deleted as soon as it is no longer needed to handle your request and no statutory retention obligations apply.

Online appointment booking

When you book an appointment online, we process your name, your email address, optionally your phone number, an optional note, and the appointment details (selected service, date and time, booking status and booking reference).

This data is stored in a PostgreSQL database on the same server in Germany. The legal basis is Art. 6(1)(b) GDPR (performance of the appointment or treatment contract, including appointment management, confirmations and reminders).

Personal booking data is automatically anonymised after a fixed retention period (currently twelve months); after that, only statistical data without any personal reference remains. Statutory retention obligations — for example for invoice records under § 147 of the German Fiscal Code (AO) — remain unaffected.

Payment processing (Stripe)

Online payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. You enter your payment details (e.g. card data) directly with Stripe; we do not receive full payment data — only confirmation of the payment and the details required for the invoice or payment receipt.

The legal basis is Art. 6(1)(b) GDPR. Stripe may also transfer data to Stripe, Inc. in the USA; this transfer is safeguarded by appropriate guarantees under Art. 46 GDPR (EU standard contractual clauses) or by certification under the EU-U.S. Data Privacy Framework. For details, see the Stripe privacy policy: https://stripe.com/privacy

Transactional emails (Resend)

We use the service Resend, operated by Resend, Inc. (USA), as our processor to send transactional emails (e.g. booking and payment confirmations, appointment reminders, delivery of contact requests).

This involves processing the recipient address, the name and the content of the respective email. Data is transferred to the USA; this transfer is safeguarded by EU standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis for sending these emails is Art. 6(1)(b) GDPR.

Video sessions (Jitsi Meet)

Intro calls and online sessions take place via video using Jitsi Meet. In normal operation, we operate the software ourselves on our own server at meet.liamkennedyhypnotherapy.com. That server is hosted by netcup GmbH in a data centre in Germany — the same hosting provider as this website. In this case, this does not involve an additional processor; video sessions do not entail a transfer to a third country within the meaning of Art. 44 et seq. GDPR.

In exceptional cases (technical issues), we may temporarily use the public service meet.jit.si operated by 8x8, Inc. (USA). This service is subject to 8x8's privacy policy; data would then be transferred to the USA. Affected clients will be informed separately before any such appointment.

A separate video room is set up for each appointment and protected by a personal, time-limited access link. The link is shared only with the participants of that appointment and is valid only around the appointment time. We do not record sessions.

When you join a session, we process in particular your IP address, connection and device data, and the transmitted audio and video content. Transmission is transport-encrypted; one-to-one calls run peer-to-peer where technically possible. The legal basis for this use is Art. 6(1)(b) GDPR (conducting the agreed appointment); insofar as health data is processed, the processing is carried out for the purpose of health care under Art. 9(2)(h) GDPR in conjunction with Section 22(1) no. 1 lit. b of the German Federal Data Protection Act (BDSG).

Feedback

After an attended appointment the practice may invite you by email or through a one-time link shared with you personally to leave voluntary feedback. A copied direct link does not require the website to store contact details for the recipient.

The purpose of the processing is the publication of your voluntary feedback on the practice website. The legal basis is your consent under Art. 6(1)(a) GDPR and — where health data may be involved — Art. 9(2)(a) GDPR. You give this consent by submitting the form.

We store the chosen display form of the name, the text, the language, and the time and version of the consent. The feedback is stored until withdrawal.

You may withdraw your consent at any time with effect for the future by emailing kontakt@liamkennedyhypnotherapy.com. Recipients of published feedback are visitors to the public website.

Cookies

This website only uses technically necessary, functional cookies — such as session cookies for booking and appointment management. There are no tracking, analytics or advertising cookies and no third-party trackers.

Storing these cookies is strictly necessary for the functions you request (§ 25(2) no. 2 of the German TDDDG); the legal basis for the associated data processing is Art. 6(1)(b) or (f) GDPR. Reach measurement sets no cookies and stores no identifiers on the device. A consent banner is therefore not required.

Your rights

With regard to the personal data concerning you, you have the following rights against us:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

You may withdraw any consent you have given at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Independent Centre for Data Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, https://www.datenschutzzentrum.de

No automated decision-making

No automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.