Privacy Policy
This English version is provided for convenience. In case of any discrepancy, the German version shall prevail.
On this page you will find two privacy notices:
Privacy information for the website: what is processed when you visit drchristopherschwake.com (for example when you open a page or subscribe to the newsletter).
Privacy information for clients: what is processed within a coaching, training or academy course relationship.
As a rule, both are relevant to you. You get to know me through this website and later enter into a working relationship. If you have questions about data protection, you can reach me at contact (at) drchristopherschwake.com.
Privacy information for the website
Basic information
Data subjects
This privacy policy is addressed to all persons who visit this website. All personal designations refer to all genders.
Controller
The controller responsible for the processing described here is: Dr. Christopher Schwake, Gutenbergstr. 65, 14467 Potsdam, Germany, phone: +49 331 96795086, email: contact (at) drchristopherschwake.com.
Rights
(1) With regard to the data stored about them, data subjects have the following rights: the right of access, the right to rectification of inaccurate data, the right to erasure of data for which there is no longer any reason to retain it, the right to restriction of processing and the right to data portability. They also have the right to lodge a complaint with the supervisory authority responsible for the controller.
(2) Insofar as processing is based on the consent of the data subjects, they may withdraw their consent at any time with effect for the future, for example by an informal message to one of the contact channels mentioned above (controller).
(3) Insofar as processing is based on a legitimate interest, i.e. on Article 6(1)(f) GDPR, data subjects may object to the processing at any time, for example by an informal message to one of the contact channels mentioned above (controller). If the objection is justified, the processing will be stopped. Where the legitimate interest lies in direct marketing, the objection is always justified.
Complaint to the supervisory authority and right to object
Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The competent authority is: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, phone +49 33203 356 0, poststelle@lda.brandenburg.de. You may also contact the supervisory authority of your usual place of residence or workplace.
Notice of the right to object under Article 21 GDPR. Insofar as data is processed on the basis of a legitimate interest under Article 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. The data will then no longer be processed unless compelling legitimate grounds can be demonstrated that override your interests, or the processing serves the establishment, exercise or defense of legal claims. If data is processed for direct marketing, you may object at any time without giving reasons. An informal objection to contact@drchristopherschwake.com is sufficient.
Further information
(1) There is no automated decision-making, including profiling.
(2) There is a legal obligation to process data only insofar as reference is made below to Article 6(1)(c) GDPR.
Data processing in principle
(1) Data subjects initially use the website for information purposes only, i.e. they open the website without actively interacting with it. In doing so, the controller collects the following data, insofar as technically necessary to display the website: IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred, website from which the request comes, browser, operating system and its interface, language and version of the browser software. The purpose is to display the website. The legal basis is Article 6(1)(f) GDPR, the legitimate interest arising from the purpose mentioned above.
(2) After the end of informational use, the data is deleted. The purpose is the fulfillment of a legal obligation (Article 5(1)(a) and (e) GDPR). The legal basis is Article 6(1)(c) GDPR.
Cookies, reach measurement and advertising
This website does not set any cookies for analysis, marketing or advertising purposes. There is no reach measurement, neither with Google Analytics nor with Matomo or any comparable tool. No tracking pixels or advertising networks are integrated, and there is no profiling.
For this reason, there is no consent banner on this site. There is nothing for which consent would need to be obtained.
The Rank Math extension is used for search engine optimization. It generates titles, descriptions and a sitemap and does not process any visitor data.
The Polylang extension is used for the multilingual version. It may store a small file in your browser that only remembers the language you selected. This is technically necessary. The legal basis for storage is Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), and Article 6(1)(f) GDPR for the subsequent processing.
Fonts and external content
The fonts used are stored locally on the server and loaded from there. When the site is opened, no connection is made to Google Fonts or any other external font provider.
Beyond that, no content from third-party servers is loaded when this site is simply opened. Connections to third-party services only arise through your own action, namely by clicking the booking link or submitting the newsletter form. Both are pointed out at the relevant place.
Data processing on the basis of a legitimate interest
(1) In addition to data processing in principle, the controller processes the data of website visitors on the basis of a legitimate interest. The legal basis is then Article 6(1)(f) GDPR.
(2) The following processing operations are pointed out:
Promotional communication with contractual partners
The controller processes the email address and name of data subjects in order to send them useful information by email at regular or irregular intervals. He also stores the information that a contractual relationship exists or existed between them and him, in order to be able to prove the legitimate interest. The legitimate interest follows from the fact that a contractual relationship exists between the data subjects and the controller, in the context of which promotional communication by email is part of the usual expectations of the data subjects. This is supported by Recital 47 sentence 7 GDPR. The following data is processed: (1) email address, (2) name and (3) status data on the contractual relationship. Special notice of the right to object: data subjects may object to the use of their data for this purpose at any time, for example by an informal message to the controller (contact channels can be found at the beginning of this policy and in the legal notice). In particular, data subjects may object without incurring any costs other than transmission costs at basic rates.
Rights management and external legal advice, if applicable
If data subjects assert claims of any kind against the controller, the data is processed as follows:
1. The controller receives the request and stores all associated data.
2. The controller uses this data to examine the request. If necessary, he obtains external legal advice.
3. If the request is justified, he uses the data to comply with it. Otherwise, he uses the data to inform the data subjects.
4. The controller retains the data arising from processing under items 1 to 3 for three years, starting on 31 December of the calendar year in which step 3 took place. The legitimate interest for items 1 to 3 follows from the interest of the data subjects in having their claims processed and from the controller’s interest in avoiding claims and sanctions. The legitimate interest for item 4 follows from the controller’s need to be able to defend himself later against civil claims and administrative or criminal allegations. This interest in storage ends when the limitation period under Sections 193 and 195 of the German Civil Code (BGB) expires. The following data is processed: name, contact details and content of communications.
Hosting and server log files
This website is hosted by Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany. The servers are located in Germany. A data processing agreement under Article 28 GDPR is in place with Raidboxes.
Each time a page is opened, data is automatically transmitted to the server and stored there in so-called log files: the IP address, date and time of the request, the page requested, the access status and HTTP status code, the amount of data transferred, the previously visited page, as well as browser, operating system and language.
This data is necessary to deliver the site, keep operations stable, and detect and fend off attacks on the server. The legal basis is Article 6(1)(f) GDPR, the legitimate interest following from the purposes mentioned. This data is not merged with other sources, and there is no analysis aimed at identifying individual persons.
The log files are automatically deleted after seven days. Individual entries are only stored longer if they are needed to clarify a specific security-related incident, and even then only until it has been clarified.
Transmission between browser and server is encrypted with TLS.
Data processing in connection with contracts
(1) In addition to data processing in principle, the controller processes the data of website visitors in order to establish, perform and/or terminate contracts. The legal basis is then generally Article 6(1)(b) GDPR. Only where the data subjects are employees (including applicants) is the legal basis Article 88 GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG 2018).
(2) The following processing operations are pointed out:
Automation in contract-related communication
In the context of establishing, performing and/or terminating contracts, the controller has automated parts of the communication with you. In doing so, he processes all communication data of the data subjects that trigger automatic reactions by the controller, such as the delivery of a product or service. To this extent, he controls
1. the collection of your personal data when initiating the respective contract,
2. the communication with the data subjects required to establish, perform and/or terminate the contract (in particular by email), and
3. the delivery of the products and/or services.
The following data is processed: (1) all contact and order data entered by you, (2) payment data if applicable, (3) data on delivery and (4) data on the assertion of rights by the data subjects and the controller’s response.
Email and phone
If you write to me by email or call me, your contact details and the content of the communication are processed. Emails are delivered to the controller’s mailbox, which is hosted by Zoho Mail.
The purpose is to answer the inquiry. If the inquiry relates to a contract or its initiation, the legal basis is Article 6(1)(b) GDPR. In all other cases, the legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in being able to answer inquiries.
Inquiries are deleted as soon as they have been dealt with and no statutory retention obligation applies, at the latest after two years. If a working relationship results from the inquiry, the periods set out in the privacy information for clients apply.
A note: on their way through the internet, emails are generally not end-to-end encrypted. If you wish to share something confidential, you can first simply ask for a call back.
Appointment booking via Zoho Bookings
For the free initial call and for further appointments, you can choose a free slot yourself. The buttons “Book a free 30-minute call” lead to the page drchristopherschwake.zohobookings.eu. This is an external service, not an embedded window on this website. As long as the button is not clicked, no data is transmitted to the provider.
When the booking page is opened, the provider processes the access data, in particular the IP address. When a booking is made, the information from the booking form is processed, usually name, email address, preferred format and time, and an optional message. The controller receives a notification, and the person booking receives a confirmation with a link through which the appointment can be rescheduled or cancelled.
The purpose is to arrange and hold the appointment. The legal basis is Article 6(1)(b) GDPR. The booking data is stored in Zoho’s European data center; details on the provider chain can be found below under “Recipients and transfers to third countries”.
Booking data is deleted once the appointment has been completed and no tax or contractual retention obligations apply. Appointments without subsequent collaboration are deleted after twelve months at the latest.
Data processing on the basis of consent
(1) In addition to data processing in principle, the controller processes the data of website visitors on the basis of consent. The legal basis is then generally Article 6(1)(a) GDPR. Only where the data subjects are employees (including applicants) is the legal basis Article 88 GDPR in conjunction with Section 26(2) BDSG 2018.
(2) The following processing operations are pointed out:
Newsletter
The newsletter can be subscribed to on the home page. It is published about once a month.
What data is processed. Only the email address is required for subscription. No further information is requested. It is also stored whether you subscribed on the German or the English site, so that the newsletter reaches you in the right language. In addition, the mailing service automatically stores the time and IP address of the subscription and the time and IP address of the confirmation. This information serves as proof of consent.
How subscription works. The double opt-in procedure applies. After submitting the form, you receive an email from contact@drchristopherschwake.com with a confirmation link. The subscription only becomes effective when you click it. Without confirmation, no newsletter is sent, and the data is deleted after 30 days at the latest.
What happens technically on submission. The subscription form is a separate form on this site. As long as it is not submitted, no script and no visible window of the mailing service is loaded. On submission, the entry and the IP address are transmitted to the mailing service’s server at avlf-zcmp.maillist-manage.eu, whose response is loaded in an invisible frame on the page.
Who handles the mailing. Zoho Campaigns is used. The data is processed in Zoho’s European data center. The provider is bound as a processor under Article 28 GDPR; details can be found below under “Recipients and transfers to third countries”.
Legal basis. Consent under Article 6(1)(a) GDPR in conjunction with Section 7(2) No. 2 of the German Act against Unfair Competition (UWG). For the proof data from the double opt-in procedure, the legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR.
Unsubscribing and withdrawal. You can unsubscribe at any time; this acts as a withdrawal of consent for the future. The easiest way is the unsubscribe link at the end of every newsletter email; an informal message to contact@drchristopherschwake.com is also sufficient. Processing carried out up to that point remains lawful.
Storage period. The email address is stored until you unsubscribe. The proof data on consent and withdrawal is kept for a further three years, calculated from the end of the year of unsubscription.
No performance tracking. There is no analysis of whether and when an email was opened or which link was clicked. The address is not passed on to third parties.
Health-related information in coaching
No health data is requested via this website or the booking form. Please do not enter any information about your health there.
In coaching. During our conversations you may, of your own accord, share information that counts as health data (Article 9(1) GDPR), for example about stress, sleep or ongoing treatment. Such information is only processed if you have given your explicit prior consent (Article 9(2)(a) GDPR), and only to the extent necessary for the coaching. Dr. Christopher Schwake works exclusively as a coach and does not make diagnoses.
Consent and withdrawal. Consent is obtained with the coaching agreement. It is voluntary and can be withdrawn at any time with effect for the future, for example by email to contact (at) drchristopherschwake.com. Before the coaching begins, you will receive separate privacy information with details on storage locations, periods and recordings.
Data processing to fulfill a legal obligation
(1) In addition to data processing in principle, the controller processes the data of website visitors in order to fulfill a legal obligation. The legal basis is then Article 6(1)(c) GDPR.
(2) The following processing operations are pointed out:
Retention of data in connection with contracts
Insofar as the controller collects data in order to establish, perform and/or terminate contracts, he generally retains data relevant to his taxation for six years. By way of exception, data is retained for ten years if it results from internal documents (books and records, inventories, annual financial statements, management reports, the opening balance sheet and the work instructions and other organizational documents required to understand them, accounting vouchers). The purpose is to fulfill the statutory retention obligation under Section 147 of the German Fiscal Code (AO).
Retention of data proving consent
Insofar as the controller processes data on the basis of consent, he stores the data proving that consent was given for three years. The period begins when consent is withdrawn or the processing covered by the consent ends, whichever occurs first. The purpose is to fulfill the retention obligation under Article 7(1) GDPR in conjunction with Article 5(2) GDPR. The period is determined by the limitation periods for administrative offenses under Section 31(2) No. 1 of the German Administrative Offenses Act (OWiG) in conjunction with Article 83(4) and (5) GDPR.
Recipients and transfers to third countries
In connection with this website, the following bodies have access to personal data.
Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany. Hosting of this website. Processor under Article 28 GDPR. Server location Germany.
Zoho, for the services Zoho Bookings (appointment booking), Zoho Campaigns (newsletter mailing) and Zoho Mail (email inbox). The data is processed in Zoho’s European data centers. The contractual partner is Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands. In addition, Zoho Corporation Pvt. Ltd., based in India, is bound for processing on behalf, because maintenance and technical support are provided from there.
India is a third country without an adequacy decision by the European Commission. The transfer is therefore based on the European Commission’s standard contractual clauses under Article 46(2)(c) GDPR, supplemented by technical and organizational additional measures of the provider. A copy of the safeguards can be requested from the controller.
Beyond this, data from this website is not passed on, in particular not for advertising purposes and not to data brokers.
Glossary
A glossary follows. Not all matters explained in the glossary necessarily play a role on this website. They serve general understanding and thus transparency.
Personal data: any information that directly or indirectly allows conclusions to be drawn about natural persons, i.e. human beings.
Processing of personal data: any active or passive handling of personal data, from collection through core processing to deletion.
Consent: a verifiable declaration of intent, given voluntarily before personal data is processed, which permits a specific processing of the personal data of the data subject making the declaration.
Privacy information for clients
Data subjects
This privacy policy is addressed to all persons who contact the controller in connection with the services and products offered under the name “Dr. Christopher Schwake”, and in all other cases in which the controller refers to this privacy information. All personal designations refer to all genders.
Controller
The controller responsible for the processing described here is: Dr. Christopher Schwake, Gutenbergstr. 65, 14467 Potsdam, Germany, phone: +49 331 96795086, email: contact@drchristopherschwake.com.
Rights
(1) With regard to the data stored about them, data subjects have the following rights: the right of access, the right to rectification of inaccurate data, the right to erasure of data for which there is no longer any reason to retain it, the right to restriction of processing and the right to data portability. They also have the right to lodge a complaint with the supervisory authority responsible for the controller.
(2) Insofar as processing is based on the consent of the data subjects, they may withdraw their consent at any time with effect for the future, for example by an informal message to one of the contact channels mentioned above (controller).
(3) Insofar as processing is based on a legitimate interest, i.e. on Article 6(1)(f) GDPR, data subjects may object to the processing at any time, for example by an informal message to one of the contact channels mentioned above (controller). If the objection is justified, the processing will be stopped. Where the legitimate interest lies in direct marketing, the objection is always justified.
Further information
(1) There is no automated decision-making, including profiling.
(2) There is a legal obligation to process data only insofar as reference is made below to Article 6(1)(c) GDPR.
Data processing
(1) The initiation of the contract proceeds as follows: either the data subjects make first contact with the controller or vice versa. The controller processes all data that the data subjects provide voluntarily. These are often contact details (name, contact details such as email address, postal address, phone number) and communication data (description of the matter, conversation notes, form entries). On this basis, the controller prepares an offer and stores this data. The purpose is to initiate or establish a contract. The legal basis is Article 6(1)(b) GDPR.
(2) After the contract has been concluded, the controller collects further communication data (delivery of the service, answering questions) in order to perform the contract. The purpose is the performance of a contract. The legal basis is Article 6(1)(b) GDPR.
(3) After the end of the contract, client data is retained as follows:
Data relevant to the controller’s taxation is generally retained for six years. By way of exception, data is retained for ten years if it results from internal documents (books and records, inventories, annual financial statements, management reports, the opening balance sheet and the work instructions and other organizational documents required to understand them, accounting vouchers). The respective period begins in the year in which the document was created. The purpose is to fulfill a statutory retention obligation. The legal basis is Article 6(1)(c) GDPR in conjunction with Section 147 AO.
Insofar as data processing is based on consent, the data processed on the basis of consent is retained until consent is withdrawn or until the purpose associated with its processing ceases to apply. The purpose is stated in the respective declaration of consent. The legal basis is Article 88 GDPR in conjunction with Section 26(2) BDSG 2018.
Data proving that consent was given is retained for three years, this period beginning on 31 December of the calendar year in which either consent is withdrawn or the data is deleted for other reasons. The purpose is to fulfill a statutory retention obligation. The legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR.
Data arising when data subjects assert data protection claims against the controller (see “Rights” above) is retained for three years, beginning on 31 December of the calendar year in which the controller responds. The legal basis is Article 6(1)(f) GDPR. The legitimate interest in processing follows from the controller’s need to be able to defend himself later against civil claims and administrative or criminal allegations. This interest in storage ends when the limitation period under Sections 193 and 195 BGB or Section 31(2) No. 1 in conjunction with (3) OWiG in conjunction with Article 83(4) and (5) GDPR expires.
Data arising when data subjects assert other claims against the controller is retained for three years, beginning on 31 December of the calendar year in which the controller responds. The legal basis is Article 6(1)(f) GDPR. The legitimate interest in processing follows from the controller’s need to be able to defend himself later against civil claims. This interest in storage ends when the limitation period under Sections 193 and 195 BGB expires.
(4) In addition to paragraph 1, the controller gives prospective clients the choice of a preliminary conversation in person, by phone or by video conference. If they choose the video conference, he obtains the necessary consent. The consent status and the name are processed. The purpose is to fulfill a legal obligation. The legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR. If the prospective clients consent, he then conducts the preliminary conversation by video conference, processing image and sound data. The purpose is to conduct a preliminary conversation. The legal basis is Article 6(1)(a) GDPR.
(5) In addition to paragraph 2, the controller transmits accounting data to an external tax consultancy. The legal basis is Article 6(1)(f) GDPR. The legitimate interest follows from the need for external tax advice and support. Insofar as data is processed by the tax consultancy, this does not constitute processing on behalf (see DSK short paper 13), but a transfer of data which is itself justified by Article 6(1)(f) GDPR. It is therefore a case of other outsourcing.
(6) In addition to paragraph 2, the controller transmits accounting data to the provider of external accounting software. The legal basis is Article 6(1)(f) GDPR. The legitimate interest follows from the need for external tax advice and support.
(7) In addition to paragraph 2, the controller contacts the data subjects by email for promotional purposes, using the following data: name and email address. The purpose is promotional communication with data subjects who are in a contractual relationship with the controller. The legal basis is Article 6(1)(f) GDPR, the legitimate interest following from the aforementioned purpose in conjunction with Recital 47 GDPR. Data subjects are informed that they may object to this processing at any time and without giving reasons, without incurring any costs other than transmission costs at basic rates.
(8) In addition to paragraph 2, the controller gives prospective clients the choice of a contract conversation in person, by phone or by video conference. If they choose the video conference, he obtains the necessary consent. The consent status and the name are processed. The purpose is to fulfill a legal obligation. The legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR. If the prospective clients consent, he then conducts the conversation by video conference, processing image and sound data. The purpose is to conduct a contract conversation. The legal basis is Article 6(1)(a) GDPR.
Processors and third parties receiving data
The following third-party providers receive personal data:
Third-party provider: The following Zoho tools are used: Zoho WorkDrive, Zoho Calendar, Zoho Bookings, Zoho Books, Zoho TrainerCentral, Zoho One, Zoho CRM, Zoho Sign, Zoho Mail, Zoho Social, Zoho Projects and Zoho Campaigns. Regarding the identity of the provider: numerous companies operate under the name “Zoho” (see https://www.zoho.com/de/contactus.html). Since the controller is a business based within the European Union, he is connected with two contractual partners. As regards the obligation to provide the tool, the contractual partner is Zoho Corporation B.V. (the Netherlands, EU). As regards the processing of personal data on his behalf in the use of the tool, his second contractual partner and processor, in addition to Zoho B.V., is ZOHO CORPORATION PVT. LTD. (India). In other words: as regards the exchange of service and payment, Zoho B.V. is the contractual partner. Only as regards the processing of personal data are Zoho B.V. and ZOHO CORPORATION PVT. LTD. his contractual partners. The engagement of ZOHO CORPORATION PVT. LTD. (India) is not precluded by the fact that it is based outside the European Union, as it has committed itself to the EU standard contractual clauses.
Third-party provider: The webinar and video conference tool “Zoom” by Zoom Video Communications, Inc. (USA) is used, engaged under Article 28 GDPR. The engagement of this provider is not precluded by the fact that it is based outside the European Union, because personal data is only transferred if the data subjects consent to the associated transfer to the USA (see Article 49(1)(a) GDPR).
Third-party provider: Accounting data is transmitted to an external tax consultancy. Insofar as data is processed by the tax consultancy, this does not constitute processing on behalf (see DSK short paper 13), but a transfer of data which is itself justified by Article 6(1)(f) GDPR. It is therefore a case of other outsourcing.
Third-party provider: The accounting tool “DATEV” by DATEV eG (Germany, EU) is used, engaged under Article 28 GDPR.
Third-party provider: An external photographer is engaged to take photos, engaged under Article 28 GDPR.
Glossary
Personal data: any information that directly or indirectly allows conclusions to be drawn about natural persons, i.e. human beings.
Processing of personal data: any active or passive handling of personal data, from collection through core processing to deletion.
Consent: a verifiable declaration of intent, given voluntarily before personal data is processed, which permits a specific processing of the personal data of the data subject making the declaration.