Deutsche Fassung (verbindlich)

Privacy Policy

This English version is a translation for your information. Only the German version (Datenschutzerklärung) is legally binding.

This privacy policy explains, in accordance with Articles 13 and 14 GDPR, which personal data we process, for what purpose, on which legal basis and for how long. It covers our website, contacting us and the provision of our services.

1. Controller

ApproMentor, owner Robin Eigenblut
Graf-Douglas-Straße 7, 75053 Gondelsheim, Germany
Phone and WhatsApp: +49 15567 863349
Email: info@appromentor.de

Please send any questions about data protection to this address. We are not required to appoint a data protection officer.

2. General

We only process the data we need for the website, for answering enquiries and for the services you book. We do not sell data and do not use it for the owner’s other business activities. Within our business, only the owner and our mentor have access, and both are bound to confidentiality. We do not make automated decisions within the meaning of Art. 22 GDPR. The website is transmitted in encrypted form (HTTPS).

3. Website hosting and server log files

The website appromentor.de is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. Each time a page is accessed, Netlify automatically processes the IP address, date and time, the page accessed, the previously visited page (referrer), information on browser, operating system and device, and the amount of data transferred and the status code.

This serves to deliver the website and to keep it stable and secure. The legal basis is Art. 6 (1)(f) GDPR; our legitimate interest is a secure and functioning website. Netlify acts as our processor; the agreement for this forms part of Netlify’s terms of service. Netlify, Inc. is certified under the EU-US Data Privacy Framework. According to Netlify, IP addresses in access logs are deleted after 30 days. We have no access to these logs ourselves.

4. Cookies, analytics and external content

We do not use cookies, analytics or tracking tools, and we do not embed social media plugins. Fonts and images are hosted on our own web space; no connection is made to Google Fonts or other third parties.

5. Contacting us by email, phone and WhatsApp, online booking and withdrawal via our website

If you write to us or call us, we process your contact details (email address or phone number, name or profile name), the content of your message and the time, in order to deal with your request. The legal basis is Art. 6 (1)(b) GDPR where a booking or an existing contract is concerned, otherwise Art. 6 (1)(f) GDPR (answering enquiries). Enquiries that do not lead to a booking are deleted once they have been dealt with, unless we are required to keep them.

Our mailbox is provided by Google (section 7). For WhatsApp we use WhatsApp Business. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Messages are end-to-end encrypted, but WhatsApp processes connection and device data under its own terms and may transfer them to Meta group companies, including in the USA (section 8). More information: www.whatsapp.com/legal/privacy-policy-eea. On our device we only store contacts of people who have contacted us themselves. You can always reach us by email instead. Please do not send us documents or confidential information about your procedure via WhatsApp.

If you withdraw from a contract using the "Vertrag widerrufen" (withdraw from contract) button, we process your name, your email address, the contract details, your optional message and the date and time of receipt. We need this information to process the withdrawal and to confirm receipt to you. The legal basis is Art. 6 (1)(c) GDPR in conjunction with § 356a of the German Civil Code (BGB) and Art. 6 (1)(b) GDPR. The form is transmitted and stored via Netlify Forms (section 3); Netlify notifies us by email. We keep the information as evidence until any claims under the contract are time-barred, usually three years from the end of the year of the withdrawal.

If you book a service online, we store via Netlify Forms (section 3) your name, your email address, the service chosen, a booking number and the declarations you make when booking (terms and conditions, where applicable your request that we start before the withdrawal period ends, and for application support your consent to us viewing your certificate of health and certificate of good conduct), each with date and time. We then forward you to Stripe for payment (section 7) and pass on your email address and the booking number. The legal basis is Art. 6 (1)(b) and (c) GDPR; we document your consent in accordance with Art. 7 (1) GDPR. You can withdraw your consent at any time with effect for the future; an email is sufficient. We keep the information as evidence until any claims under the contract are time-barred, usually three years from the end of the year of the booking.

6. Introductory call and provision of our services

If you have an introductory call with us or book a service, we process:

The legal basis for the introductory call, the contract and teaching is Art. 6 (1)(b) GDPR, for invoices and bookkeeping Art. 6 (1)(c) GDPR in conjunction with § 147 AO and § 14b UStG. Assigning vouchers and referrals and our anonymous success statistics are based on Art. 6 (1)(f) GDPR. We only publish reviews with your name or picture with your consent (Art. 6 (1)(a) GDPR), which you can withdraw at any time.

We tell you at booking which information we need for the service. Without it we cannot provide the service; there is no legal obligation to provide it. We usually receive the data from you, for referrals also from the person who recommended us, and for payments from our bank.

We do not need copies of identity documents, diplomas, translations or official decisions. Please do not send us such documents. If you would like to know in a live session whether a document matches your checklist, you can show it via camera or screen sharing. We only look at it during the session, make no copies and only note the result. We do not look at medical certificates or police clearance certificates. Medical letters for training must not contain real patient data.

7. Services used, online profiles and recipients

For email, calendar, online booking of the introductory call, client folders in Google Drive and live teaching via Google Meet we use Google Workspace. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes this data on our behalf (Art. 28 GDPR) under the Google Workspace data processing terms. The parent company Google LLC is certified under the EU-US Data Privacy Framework.

You book the free introductory call via a Google Calendar booking page. We process your first and last name, your email address and the time you choose. You receive a confirmation with a calendar invitation and Google Meet link, and reminders by email. The legal basis is Art. 6 (1)(b) GDPR (pre-contractual steps at your request). Details of introductory calls not followed by a booking are deleted at the latest during our annual review.

Sessions are not recorded, transcribed or automatically summarised. You can join via a link without a Google account. Only you, our mentor and the owner have access to your client folder.

If you pay for a service online, the payment is processed by Stripe. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes your name, email address, payment details, the amount and technical data for fraud prevention. We do not receive full card details. The legal basis is Art. 6 (1)(b) GDPR, and Art. 6 (1)(f) GDPR for fraud prevention. For payment processing Stripe is partly a controller in its own right and subject to statutory retention obligations (stripe.com/privacy).

We maintain business profiles on Instagram and Facebook (provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) and on LinkedIn (provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). If you visit these profiles or message us there, the providers process your data under their own terms, including for advertising and in the USA. For the statistics about our profiles we are joint controllers with the respective provider (Art. 26 GDPR); the providers have published agreements on this and are primarily responsible for handling your rights. We only receive aggregated statistics. We answer messages you send us there on the basis of Art. 6 (1)(f) GDPR, or Art. 6 (1)(b) GDPR for booking enquiries. These services are not embedded on our website. More information: facebook.com/privacy/policy, privacycenter.instagram.com/policy, linkedin.com/legal/privacy-policy.

Reviews you post on our Google Business Profile are processed by Google as an independent controller. We see the name displayed there and the content of the review and may reply publicly (Art. 6 (1)(f) GDPR).

Other recipients are our bank for payment transactions, our tax adviser where engaged, and public authorities where we are legally required. We do not pass data to approbation authorities, medical chambers or employers.

8. Transfers to third countries

Netlify, Google, WhatsApp, Meta, LinkedIn and Stripe are US companies or belong to US groups. Transfers to recipients certified under the EU-US Data Privacy Framework are based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR), otherwise on the European Commission’s standard contractual clauses (Art. 46 (2)(c) GDPR). Access by US authorities cannot be ruled out entirely.

9. Retention

We delete data as soon as it is no longer needed for the purpose concerned. Client folders, notes and assessment sheets are deleted after your services have ended, at the latest during our annual review. We keep exam results only as long as we need them as evidence for our success statistics. Invoices and accounting records are kept for eight years, business correspondence for six years (§ 147 AO, § 14b UStG), each from the end of the calendar year. Data that only has to be kept is blocked for any other use.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7 (3)). An informal message to us is sufficient.

You can also lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

11. Right to object

Where we process data on the basis of Art. 6 (1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

12. Status

Status: 01.11.2026. Only the German version is legally binding; this English version is a translation.