Note: This is a courtesy translation of the German Datenschutzerklärung, which is the legally binding version. See the German privacy policy for the authoritative text.

Privacy Policy

This policy explains what happens to your personal data when you visit this website, book an appointment with me, sign up for my newsletter or a workshop, or use my consulting services.

Data controller

Kim Pinelli
In den Peterswiesen 25, 71566 Althütte, Germany
Phone: +49 15678205570
Email: info@kimpinelli.com

Hosting

This website is hosted by Strato AG, Pascalstraße 10, 10587 Berlin, Germany. When you visit this website, Strato collects server log files including your IP address, on the basis of my legitimate interest (Art. 6(1)(f) GDPR) in reliably presenting this website. A data processing agreement is in place with Strato.

Legal bases

I process personal data to perform a contract or take pre-contractual steps (Art. 6(1)(b) GDPR), to comply with legal obligations, in particular tax and commercial record-keeping requirements (Art. 6(1)(c) GDPR), on the basis of my legitimate interests (Art. 6(1)(f) GDPR), and, where expressly stated, on the basis of your consent (Art. 6(1)(a) GDPR).

Recipients and processors

I use external service providers to run my business (e.g. for hosting, scheduling, video calls, newsletter delivery, client management, payments and accounting). They process personal data solely on my behalf and according to my instructions, under data processing agreements (Art. 28 GDPR). The individual providers are listed in the sections below.

Transfers to third countries

Some of my service providers are based in or process data in the USA. Such transfers are based on an adequacy decision of the European Commission, in particular the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Storage period

Unless a more specific storage period is stated in this policy, your personal data is kept until the purpose of processing no longer applies. If you make a justified request for deletion or withdraw your consent, your data will be deleted unless there are other legal grounds for keeping it (e.g. statutory tax or commercial retention periods).

Server log files

The hosting provider automatically collects and stores information in server log files that your browser transmits, including browser type/version, operating system, referrer URL, hostname, time of the request, and IP address. This data is not merged with other data sources.

Cookies and analytics

This website does not use cookies for analytics or marketing purposes and does not use any analytics or tracking tools. Only technically necessary cookies from the hosting provider may occur. Since no non-essential cookies are set, no consent is required under Section 25 of the German TDDDG.

Fonts

All fonts used on this website are hosted locally on the server. No connection is made to third-party font providers such as Google Fonts.

Contact by email

If you contact me by email, your request — including all personal data resulting from it (name, request) — is stored and processed for the purpose of handling your inquiry. I use Google Workspace for email (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Processing is based on Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps, and otherwise on my legitimate interest in handling inquiries effectively (Art. 6(1)(f) GDPR).

Booking appointments

I use the online scheduling tool TidyCal (provider based in the USA) for appointment bookings. When you book an appointment, the data you enter (e.g. name, email address, chosen time, time zone and your answers in the booking form) is processed by TidyCal on my behalf. Appointments are synced with my Google Calendar (Google Workspace). Processing is based on Art. 6(1)(b) GDPR and on my legitimate interest in efficient scheduling (Art. 6(1)(f) GDPR).

Video calls and recording of sessions

I hold consultations and calls via Zoom (provider: Zoom Communications, Inc., USA). This involves processing your name, email address, video and audio data, screen-share content and technical connection data.

My sessions are recorded. For recording, transcription and automatic summaries I use Fathom (provider: Fathom Video, Inc., USA). This involves processing video and audio, an automatically generated transcript and an AI-generated summary of the call. Recording is announced before the session and is visible to all participants during the call.

The recording serves to document the call, to provide the recording to clients, to prepare and follow up on my services, and to provide a record of the services delivered. For booked services, recording is part of the contract (Art. 6(1)(b) GDPR). Otherwise, it is based on my legitimate interest in complete documentation and in protecting myself against legal claims (Art. 6(1)(f) GDPR). For sessions where recording is not part of a contract, you may object to the recording before the session begins.

Recordings, transcripts and summaries are kept for as long as they are needed for these purposes, and at most until the statutory limitation period for claims arising from our collaboration has expired (generally three years from the end of the calendar year in which the session took place). They are then deleted as part of an annual review.

Client management and project work

I manage contact, appointment and project data of prospects and clients (e.g. name, email address, company, call notes, project status) in Notion (provider: Notion Labs, Inc., USA) and organise my communication and appointments via Google Workspace. This processing serves to prepare and carry out our collaboration (Art. 6(1)(b) GDPR) and my legitimate interest in well-organised client care, including following up after an initial call (Art. 6(1)(f) GDPR).

Payments and invoicing

Payments for my services are processed by Stripe (provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Your name, email address, payment details and billing information are transmitted to Stripe. Payment details such as card numbers are processed solely by Stripe and are not visible to me.

For invoicing and accounting I use Lexware Office (provider: Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany). Invoice-related data is stored for the statutory retention periods. Processing is based on Art. 6(1)(b) and (c) GDPR.

If you subscribe to my newsletter, I process your email address and, if provided, your name in order to send you regular information about my topics, offers and events. I use rapidmail to send the newsletter (provider: rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg im Breisgau, Germany). A data processing agreement is in place with rapidmail.

Sign-up uses a double opt-in process: after signing up, you receive an email asking you to confirm your subscription. The time of sign-up and confirmation and your IP address are stored so that the subscription can be verified.

Processing is based on your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe link in every email or by contacting me. After you unsubscribe, your email address is removed from the mailing list or, where necessary, kept on a blocklist so that you receive no further newsletters.

The newsletters include performance tracking that shows whether a newsletter was opened and which links were clicked. This analysis is based on your consent (Art. 6(1)(a) GDPR), which you give when subscribing.

Online workshops and webinars

If you register for one of my online workshops, I process your name, email address and any optional details you provide in the registration form in order to send you access details, reminders and materials for the workshop. Registrations are managed via rapidmail (see “Newsletter” above). Processing serves to enable your participation (Art. 6(1)(b) GDPR).

Workshops take place via Zoom (see “Video calls and recording of sessions” above). This involves processing in particular your display name and, where applicable, video and audio data and chat messages. You decide whether to turn on your camera and microphone and may use any display name you like.

Workshops may be recorded in order to make the recording available to participants. I point this out in the invitation and at the start of the workshop. If you do not want to appear in the recording, you can keep your camera and microphone off and ask questions via the chat. Recording is based on my legitimate interest (Art. 6(1)(f) GDPR), and the recording is deleted once it is no longer needed for this purpose.

Your rights

You have the right to access your stored personal data, its origin and recipients and the purpose of processing, as well as the right to rectification, erasure, restriction of processing and data portability. You may withdraw any consent given at any time with effect for the future, and you have the right to lodge a complaint with a supervisory authority.

Right to object (Art. 21 GDPR): Where processing is based on Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation. I will then no longer process your data unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Last updated: October 2026