Data Privacy

1. Controller

André Munzinger – Your Next Step
Gronachblick 3, 74589 Satteldorf, Germany
Email: Contact Form

We comply with the GDPR and the Federal Data Protection Act (BDSG).

2. Data We Collect & Why

Contact Forms & Submissions

Name, email, and message content. Stored in a MySQL database on all-inkl.com (Germany) and forwarded to our CRM (Mautic, self-hosted) for follow-up.
Legal basis: Consent (Art. 6 I a) / Legitimate interest (Art. 6 I f).

Appointment Bookings

Processed via TidyCal: name, email, booked time.
Legal basis: Contract performance (Art. 6 I b). Privacy: tidycal.com/privacy

Client & Session Records

To manage ongoing coaching relationships, I keep a record of bookings, session dates, the coaching package booked, and session notes in an internal client-management system inside the CMS — stored in the same MySQL database on all-inkl.com (Germany) as the rest of this site. Transactional emails related to your engagement (e.g. booking confirmations, reminders) are logged for a support/communication history.
Legal basis: Contract performance (Art. 6 I b) and legitimate interest in maintaining accurate business records (Art. 6 I f).

Payments

The Lead Yourself workbook, discovery session bookings, coaching bookings, and the personalised assessment PDF report are all processed through Stripe. Stripe processes card data directly — we never see or store it. Stripe privacy: stripe.com/privacy

Assessments & 360°/Team Feedback

Self-assessment answers are processed to generate your personalised results. For 360°/team assessments, participants' survey responses (ratings and any free-text comments) are transmitted over an encrypted connection to a separate analysis service that I operate on my own private server in Germany — not a third-party cloud AI provider. There, a locally-hosted, open-weight language model (not ChatGPT, Claude, or any externally hosted AI service) drafts a first-pass written analysis. I personally review, edit, and approve every AI-drafted section before a report is shared with anyone — no AI-generated text ever reaches a client unreviewed. In this analysis step, individual raters are identified only by role (e.g. "peer," "manager"), not by name.
Legal basis: Contract performance (Art. 6 I b) for the person/organisation who commissioned the assessment; legitimate interest (Art. 6 I f) for raters providing feedback as part of that process.

Newsletter

Your email (and optionally name). Delivered via Mautic (self-hosted, Germany) via All-inkl SMTP.
Legal basis: Consent (Art. 6 I a). Withdraw anytime via unsubscribe link.

Analytics

Matomo (self-hosted) with IP anonymization. No third-party transfers. Only active after you accept cookies.
Legal basis: Consent (Art. 6 I a).

Fonts & Hosting

Fonts are self-hosted — no Google Fonts calls. Hosted by all-inkl.com (Germany). Server logs kept up to 14 days.

Cookies

Managed via Klaro consent manager. Only strictly necessary cookies without consent. Withdraw via "Cookie Settings" in the footer.

3. Storage Periods

• Contact form & application submissions: 90 days — unless you opt in to marketing emails, in which case your details are kept until you unsubscribe or object
• Client engagement records (bookings, session notes, coaching package): kept for the duration of the coaching relationship, then per German commercial/tax retention rules (6-10 years under §147 AO/§257 HGB) for anything tied to invoicing
• Newsletter subscriptions: until unsubscribed
• Assessment/survey results: name and email deleted after 90 days; anonymized, non-identifying demographic data (industry, company size, etc.) is kept indefinitely for aggregate benchmarking
• Field guide downloads: 90 days
• 360°/Team assessment group sessions: 90 days after the session is closed
• Client file-delivery download logs: 90 days
• Server logs: 14 days
• Consent records: 3 years
• GDPR request records: 5 years (documentation obligation)

4. International Transfers

TidyCal and Stripe may process data outside the EU. Protected by standard contractual clauses or adequacy decisions.

5. Security

• All transmission is SSL/TLS encrypted (HTTPS)
• Storage on servers at all-inkl.com (Germany)
• Access by authorized persons only

6. Your Rights & How to Exercise Them

Under GDPR you have the right to access, correct, delete, restrict, receive (portability), or object to the processing of your personal data, and to withdraw consent at any time. Use the form below or our contact form. Response within 30 days guaranteed.

You may also lodge a complaint with the Federal Commissioner for Data Protection (BfDI).