Privacy policy

This English version is a translation provided for your convenience. Only the German version is legally binding.

This website sets no cookies and uses no analytics, marketing or tracking services, no externally loaded fonts and no embedded maps or videos. Merely visiting the website does not store any information in your browser’s storage either. Only individual functions that you expressly use – the coaching tools and team sessions (section 7) – store technically necessary information in your browser’s storage (localStorage, sessionStorage or IndexedDB). I process personal data only insofar as this is technically necessary or you provide me with data yourself.

1. Controller

Peter Hoenig, MY COACHING FOR YOU, Bürgermeister-Eilts-Str. 20, 26817 Rhauderfehn
Phone: 04952 9527002 · Email: peter.hoenig@my-coaching4you.de

2. Hosting, email and server log files

This website and my email mailbox are operated by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. I have concluded a data processing agreement with STRATO pursuant to Art. 28 GDPR. For operation, spam filtering and mailbox software, STRATO uses further service providers based in Germany (IONOS SE, Eleven GmbH, Open-Xchange GmbH).

When the website is accessed, the server automatically stores information transmitted by your browser in log files: IP address, date and time of access, page accessed, amount of data transferred, referrer URL, browser type and operating system. These data are technically necessary in order to deliver the website and to ensure the security of the system. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in secure and stable operation. STRATO stores the log files about visitors for a maximum of 6 weeks; during this time I can retrieve them in my customer area at STRATO. If I need log files to investigate a specific security incident, I retain them only for as long as is necessary for that purpose.

Protection against malware: To secure the website, I use the SiteLock service (Scan and Repair) offered by STRATO and provided by SiteLock, LLC, 8701 East Hartford Drive, Suite 200, Scottsdale, AZ 85255, USA. SiteLock checks the files of this website daily for vulnerabilities and malware and automatically removes any malware found. In doing so, SiteLock may also access personal data stored as files on the web server – such as blog comments or the content of ongoing team sessions. SiteLock is engaged by STRATO as a further processor; for the transfer to the USA, see section 8. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in the security of the website and of the data stored on it (cf. Art. 32 GDPR).

Analysis of website access: In order to find out which pages are accessed and how often, I occasionally download the log files from my customer area at STRATO and analyse them exclusively on my own computer – for example page views per page, origin of visits, downloads and an estimate of the number of visitors. In doing so, I do not create profiles of individual persons and do not combine the data with other sources. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in designing my services to meet demand. I delete the downloaded log files after the analysis, at the latest after one week; only the aggregated figures, which contain no personal reference, are retained.

Language version based on your browser setting: This website is available in German and in English. If you open a German page directly (i.e. not via a link within this website) and your browser is set to a preferred language other than German, the server redirects you to the English version of the same page. For this, the server only evaluates information that your browser transmits with every request anyway (preferred language, referrer URL and browser type – search engines and other automated requests are not redirected). Nothing additional is stored, no cookies are set and no profile is created. You can switch the language yourself at any time using the “DE/EN” language switcher at the top of every page. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in showing you the website in a language you understand.

3. Contacting me

If you contact me by email, telephone or via the contact form, I process your details (name, email address, where applicable company, telephone number and content of the message) in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at concluding or performing a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Providing your details is voluntary; however, without contact details I cannot reply to you.

The contact form transmits your details to the web server using TLS encryption; the web server forwards them by email to my mailbox at STRATO. This does not involve end-to-end encryption of the email. Please do not send me any particularly sensitive information, for example about your health, via the form or by unencrypted email. The form data are not stored on the web server itself. An invisible field and a time stamp serve to protect against automated spam submissions.

I delete your enquiry as soon as it has been dealt with conclusively, unless statutory retention obligations prevent this – for example if the enquiry results in an assignment. Under the data processing agreement, STRATO stores technical logs of the email service for a maximum of 6 months after they were created.

4. Provision of consulting and coaching

For the performance of an assignment, I process the data required for this purpose (for example contact, contract and billing data as well as the content of the collaboration) on the basis of Art. 6(1)(b) GDPR. I retain documents relevant to invoicing in accordance with the retention obligations under commercial and tax law (Art. 6(1)(c) GDPR). Content from coaching sessions is treated confidentially and is not passed on to third parties.

Documentation in coaching: In coaching, you may also confide very personal information to me, for example about your health or about burdens you are facing. I document the course of the coaching – for example your concerns, agreed goals, key content and results of the sessions – insofar as you have expressly consented to this in the coaching agreement. If the documentation contains special categories of personal data (Art. 9 GDPR), your explicit consent is the legal basis (Art. 9(2)(a) GDPR). I keep the documentation confidential and protected against access by third parties.

I delete the documentation three years after the end of the calendar year in which the coaching ended. This corresponds to the standard limitation period (Sections 195 and 199 of the German Civil Code (BGB)) within which claims arising from the collaboration can be asserted; until then, the documentation also serves to prove and defend against such claims (Art. 17(3)(e) GDPR). If a dispute is pending at that time, I retain the relevant documents until it has been concluded. If you withdraw your consent, I will not document anything further from that point on; I will then retain existing records only for the defence of claims (Art. 9(2)(f) GDPR). I retain invoices and other accounting records for eight years in accordance with tax regulations.

5. External links

This website contains links to LinkedIn, XING, YouTube, Udemy, OpenStreetMap and Google Maps. These are simple links: no data are transmitted to these providers when you access this website. Only when you click on a link do the privacy policies of the respective provider apply.

6. Blog

The blog is part of this website. It sets no cookies and does not embed any external content. You can subscribe to the RSS feed with a feed reader of your choice; your feed reader then retrieves the file directly from this server.

Comment function

Some blog posts offer a comment function. If you write a comment, the name you provide (a pseudonym is welcome), the title and text of the comment and the time are stored and immediately displayed publicly below the post; there is no review before publication. No email address is requested. Published comments can be read, stored or quoted by third parties – please do not provide anything that is not intended for the public. The legal basis is your consent, which you give by ticking a box before submitting (Art. 6(1)(a) GDPR).

The comments are stored as a file on my web server at STRATO. An invisible field, a time stamp and a limit on the number of submissions per IP address serve to protect against automated spam submissions. For this purpose, the IP address is processed in pseudonymised form (as a hash value) for a time window of ten minutes, is not stored together with the comment and is deleted once the time window has expired – at the latest during the daily automatic clean-up run on the server.

I am notified of every new comment by email. The message contains the date and time, the title of the blog post, the title of the comment and a link to the post; it is delivered via STRATO’s email service (section 2) and deleted as soon as I have reviewed the comment. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in being able to respond to comments promptly and to remove impermissible content.

Comments remain published until I remove them or you withdraw your consent or request their erasure or rectification. As no email address is collected, please tell me the post, the name you used and, if possible, the time of the comment (peter.hoenig@my-coaching4you.de). The withdrawal does not affect the lawfulness of the processing carried out up to that point.

Editing, deleting or replying to comments is reserved for me as the operator and is password-protected. No cookie is set for this login; the browser stores a login token in session storage (sessionStorage), which is deleted when the tab is closed. On the server, the token becomes invalid after 12 hours at the latest and is deleted during the daily clean-up run.

7. Coaching tools and team sessions

On this website I provide free tools, for example editors for genograms, the social atom or mind maps, as well as questionnaires. They run entirely in your browser; your input is not transmitted to me or to third parties – with the exception of the team sessions and the company search in the sales tool Vertriebs-Navigator (see below). Anything you save, you store yourself as a file on your device. If you record information about other people in the tools – for example contacts, contracts, documents or emails imported as files in the Vertriebs-Navigator or in the customer tool Kunden-Navigator – you process this information under your own responsibility; I do not receive it. The Kunden-Navigator does not retrieve any mailbox and does not log in to any email service; it only reads email files that you give it, and prepares outgoing emails only as a file or link for your own email program. The HTML-PY-Editor (a website builder available as a downloadable program package) runs as a small program on your own computer; it transmits your website only when you start the upload, and only to the server that you enter yourself. It does not store your password in the project but, if you so wish, in your operating system’s keychain; it keeps track of which files have already been uploaded in your user folder. The MC4Y Productivity Suite and the MC4Y Taskbar (likewise program packages available for download) are installed on your own computers or servers and operated by you yourself; you are responsible for the data they contain. Neither of them transmits anything to me. The Taskbar connects only to the suites whose address you enter, remembers the address, login name and device name for each connection in your user folder and stores the device key that the suite issues to it when logging in, protected by your operating system (encrypted for your user account under Windows, in the keychain under macOS and Linux, where available) – it does not store your password. The graphical installer in the Suite package likewise runs only on your own computer and can only be reached from there. It downloads missing prerequisites only after your confirmation, directly from the respective provider (PHP from windows.php.net, the Visual C++ runtime from Microsoft, Python via Microsoft’s winget package manager, or packages from your operating system’s sources or from Homebrew); as with any download, these providers receive your IP address. On a Mac, the installation script downloads PHP from the download server of the free project static-php-cli (dl.static-php.dev) and verifies the file against a fixed checksum; this server also receives your IP address. The installer does not transmit anything to me either.

Some tools store information in your browser’s storage. These are not cookies, but they are likewise storage on your terminal device. They take place only insofar as they are necessary for the function you have expressly used (Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG)), and the information does not leave your device. It is created only when you actually use the function in question – for example when you edit something, change a view, select a file or folder or pass something on to another tool; merely opening a tool does not store anything:

Team sessions in the analysis and dialogue editor

The analysis and dialogue editor (e.g. SWOT, GROW, SOAR) additionally offers team sessions, in which several people work on the same board at the same time. You use this function only if you expressly start or join a session; without a team session, all input remains on your device.

In a team session, the following are processed on my web server at STRATO: the name or initials you provide (a pseudonym is welcome); the content of the board (cards and their texts, points awarded, field names, notes, title, date and settings such as focus and timebox); the session code, the PIN and a key with which the person who started the session can end it (PIN and key only as hash values); the time of the last activity per person, so that it can be shown who is currently taking part (the entry is removed after about 30 seconds without activity). To protect against misuse, the number of requests per IP address is limited; for this purpose, the IP address is processed in pseudonymised form (as a hash value) for a time window of one minute, is not stored together with the content and is deleted once the time window has expired – at the latest during the daily automatic clean-up run on the server. For the server log files and the security check by SiteLock, in the course of which the session files may also be accessed, see section 2; for the transfer to the USA, see section 8.

I am responsible for the technical provision, storage, access protection and deletion of the data in the context of the team sessions. The participants – in particular the person who starts a session – are responsible for entering only content that they are authorised to process and share.

The content is visible to anyone who knows the session code and PIN. Each session is given a random eight-character code and a PIN of at least six characters; pass both on only to the participants. A procedure using a code and PIN is no substitute for a personal login with rights management. Please therefore do not enter any health information or similarly sensitive data, use pseudonyms, roles or general descriptions instead of real names for third parties, and end the session once it is finished. The editor does not set any cookies for the team session; what it stores in your browser’s storage is listed in the table above.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by ticking a box before starting or joining. You can withdraw it at any time with effect for the future by leaving the session and notifying me of the withdrawal, stating the session code (peter.hoenig@my-coaching4you.de). The withdrawal does not affect the lawfulness of the processing carried out up to that point. You can delete your own cards yourself until the end of the session or request their deletion; in individual cases, the rights of other participants may prevent immediate and complete deletion.

Storage period: The person who started a session can end it at any time; the data on the server are then deleted immediately. Otherwise, sessions are deleted after 7 days without activity; this is ensured by a daily automatic clean-up run on the server. Anything participants save or export on their own device remains there and is their responsibility.

Company search in the Vertriebs-Navigator

The Vertriebs-Navigator can search for companies in open datasets. Only if you expressly start this search does your browser send a request directly to the servers concerned: for OpenStreetMap to an Overpass server (overpass-api.de, alternatively overpass.private.coffee), for Wikidata to servers of the Wikimedia Foundation, Inc., USA (www.wikidata.org and query.wikidata.org). The search area or region and the selected categories are transmitted; for technical reasons, the operators also receive your IP address and the usual information sent by your browser. Contacts and other data that you have recorded in the tool are not transmitted. I myself do not receive any of these data. Processing by the operators is subject to their privacy policies. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing you with the search function you have requested. Without the company search, the Vertriebs-Navigator does not establish any connection to third-party servers.

8. Recipients and third countries

I pass on personal data only as described in this policy: to STRATO and its service providers as processors (section 2), to the other participants in a team session (section 7) and – in the case of comments – to the public (section 6). Contract and billing data may be passed on to tax advisers and tax authorities insofar as this is required by law. In the context of the security check by SiteLock (section 2), data stored as files on the web server may be transferred to, or retrieved from there by, SiteLock, LLC in the USA. This is based on the EU standard data protection clauses (Art. 46(2)(c) GDPR) that STRATO has agreed with SiteLock. If you use the company search via Wikidata in the Vertriebs-Navigator, your browser connects directly to servers of the Wikimedia Foundation, Inc. in the USA (section 7); I myself do not pass on any data in this process. Beyond this, no data are transferred to countries outside the European Union or the European Economic Area.

9. Encryption

For security reasons, this website uses TLS encryption. You can recognise it by “https://” in the address bar of your browser.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), as well as the right to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw any consent you have given at any time with effect for the future; the lawfulness of the processing carried out up to that point remains unaffected. To do so, please contact peter.hoenig@my-coaching4you.de.

Unless otherwise stated, providing your details is voluntary; without them, individual functions – such as a reply to an enquiry, a comment or a team session – cannot be used. There is no automated decision-making, including profiling (Art. 22 GDPR).

11. Right to lodge a complaint

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for me is the supervisory authority of the German federal state of Lower Saxony (LfD Niedersachsen), Prinzenstraße 5, 30159 Hannover.

12. Changes

I will adapt this privacy policy if the website or the legal requirements change.