Yoga by Vanessa

Privacy Policy

Last updated: September 2026

1. Controller

The controller responsible for data processing on this website is:

Vanessa Winkler
Herthastraße 36
80639 München
Email: hello@vanessa-yoga.com

2. Overview

This policy describes which personal data I process when you visit this website, write to me, book a yoga class or take part in an online class.

  • I do not use any analytics or tracking tools and no advertising cookies.
  • The fonts are hosted on the server of this website. When you visit the site, no connection is established to Google Fonts or other font providers.
  • The website is transmitted in encrypted form (HTTPS).

3. Hosting and server log files

This website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. Each time the site is accessed, Netlify processes technically necessary data: IP address, date and time, the page accessed, browser and operating system, and the previously visited page. Netlify needs this data to deliver the website and to protect it against attacks and misuse, for example by limiting the number of requests per IP address. Netlify does not specify a fixed retention period for this; the logs serve only to deliver the website, to troubleshoot and to fend off attacks, and are deleted as soon as they are no longer needed for these purposes. I do not look at or evaluate them myself.

The legal basis is my legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). Netlify processes the data on my behalf (Art. 28 GDPR).

Further information: Netlify’s privacy policy

4. Storage in the browser

  • Language selection: If you choose a language using the language switcher, your browser saves this choice (local storage, entry vy.lang) so that the website appears in your language on your next visit. This is strictly necessary for this function, which you have requested (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG)). You can delete the entry in your browser at any time.
  • Source: If you come to the website via a link with source information (e.g. ?ref=newsletter), the page remembers this information only as long as it is open. It is not stored in the browser and is only transmitted together with a booking or request (see sections 5 and 6).

I do not set any cookies myself. On Stripe’s payment page, Stripe sets its own cookies (see section 6, “Payment processing by Stripe”).

5. Contact form, date requests and reviews

For the contact form, the date request form and the review form, I use the Netlify Forms service (Netlify, Inc., USA). Your entries are stored at Netlify, and I receive a notification by email.

  • Contact form: name, email address, message and language of the page.
  • Date request: first and last name, email address, telephone number (optional), requested class and time slot or preferred date, language of the page, your time zone and, where applicable, the source information.
  • Review: first and last name, email address, your text, language of the page and your consent to publication.

I use the contact form and date requests to answer your request and to arrange a date with you. The legal basis is the implementation of pre-contractual measures (Art. 6(1)(b) GDPR) and, beyond that, my legitimate interest in answering requests (Art. 6(1)(f) GDPR).

I publish a review on the website, and only with your first name and the first letter of your last name. I use your email address only for questions about it. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future; a short message is sufficient. Before publication, I check your name and email address against my bookings so that I only publish reviews from participants (Art. 6(1)(f) GDPR). I also publish reviews in translation and, where necessary, shortened. If a review contains information about your health, the legal basis in this respect is your explicit consent (Art. 9(2)(a) GDPR).

Netlify automatically checks every submission for spam and uses the Akismet service of Automattic Inc. (USA) for this; your entries as well as your IP address and browser identifier are transmitted in the process. Netlify stores the IP address and browser identifier together with the submission. The legal basis is my legitimate interest in protecting the forms against spam and misuse (Art. 6(1)(f) GDPR). Automattic is certified under the EU-US Data Privacy Framework (see section 11).

I delete submissions at Netlify no later than 6 months after they have been dealt with, unless retention obligations apply. Published reviews remain online until you withdraw your consent.

6. Booking and payment

Booking via the website

When you book a class, the website sends your details to a function on Netlify’s servers. This function checks them and uses them to create a payment page at Stripe. The following data is processed:

  • first and last name, email address, telephone number (optional, so that I can reach you in the event of short-notice changes)
  • booked date, language of the page and your time zone (so that times are shown in your local time)
  • where applicable, the source information (e.g. newsletter), so that I can see through which channels bookings come in
  • whether you have booked before (for the discount on the first class)

The function itself does not store any of this data. I need your name and email address for the booking; without them, booking is not possible. All other details are optional. Whether you receive the discount on the first class follows automatically from whether a booking already exists under your email address. This automated check has no legal or similarly significant effect on you within the meaning of Art. 22 GDPR; it only decides on an additional price reduction.

Payment processing by Stripe

Payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

On the payment page, you enter your payment details (e.g. card number, expiry date, security code, cardholder’s name, country) directly with Stripe. In doing so, Stripe also collects device and connection data (including the IP address) and sets cookies in order to prevent fraud. I do not receive full card or account details; I see, among other things, the payment method, card brand, the last four digits and the country. If the payment page offers to save your details with “Link” and you accept, Stripe alone is responsible for this.

As soon as you click “Continue to payment” in the booking window, Stripe creates a customer record for you with your name, email address, telephone number (if provided) and language – even if you then cancel the booking. After a booking, Stripe also stores the date and the details listed above. This allows me to see whether you have booked before, and Stripe creates the payment receipt and invoice and sends them to you by email. This is not a customer account that you can log in to.

Stripe processes the data mainly on my behalf. For some purposes, such as fraud prevention and compliance with its own legal obligations, Stripe is itself the controller. Transfers to Stripe, Inc. in the USA are based on the EU-US Data Privacy Framework and additionally on the European Commission’s standard contractual clauses.

The legal bases are the performance of the contract (Art. 6(1)(b) GDPR), my legal retention obligations (Art. 6(1)(c) GDPR) and my legitimate interest in secure payments and in knowing how customers find me (Art. 6(1)(f) GDPR).

I keep invoices and payment receipts for 8 years (§ 147(3) of the German Fiscal Code (AO), § 14b of the German VAT Act (UStG)) and emails relating to a booking for 6 years. I delete customer records without a booking after 30 days at the latest. If you have booked, I delete your customer record (name, email address, telephone number, language) if you have not booked for 3 years or if you request it; receipts remain stored until the end of the retention period.

If you pass your place on to another person (section 6.2 of the terms and conditions), I process the name and email address of that person that you give me in order to inform them and enable them to take part (Art. 6(1)(b) and (f) GDPR). I delete this information after the class.

Where necessary for accounting and my tax obligations, the tax office and, where applicable, my tax advisor receive invoice and payment data; payouts are made via my bank. The legal basis is my legal obligations (Art. 6(1)(c) GDPR).

Further information: Stripe’s privacy policy

Apple Pay and Google Pay

If you pay with Apple Pay or Google Pay, Apple or Google respectively also process payment data, under their own responsibility and in accordance with their own privacy policies: Apple, Google.

7. Online classes via Google Meet

Online classes take place via Google Meet, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you take part, Google processes, among other things, your display name, your IP address, device information, and video, audio and chat messages during the class. I currently use Google Meet with a private Google account. Google processes the data as an independent controller in accordance with its own privacy policy, including for its own purposes (such as security and improving its services); Google does not offer a data processing agreement for private accounts. Google may transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.

I myself see and hear you during the class in order to guide you. In group classes, the other participants also see and hear you, under the name you enter when joining. I do not record the classes.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). You decide for yourself whether to switch on your camera.

Further information: Google’s privacy policy

8. Information about your health

Whether you tell me about health problems, injuries or a pregnancy is up to you. If you only tell me verbally during the class, I do not write anything down. If you tell me in writing, I use the information only to tailor the class to it and ask you for your explicit consent to this (Art. 9(2)(a) GDPR). You can withdraw it at any time with effect for the future. I delete such information no later than after the last class for which you gave it to me, and I do not keep it together with the other emails relating to your booking.

9. Contact by email

If you send me an email, I store your message and your contact details in order to answer it (Art. 6(1)(b) or (f) GDPR). My mailbox is operated on my behalf by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (Google Workspace), on the basis of a data processing agreement (Art. 28 GDPR); the notifications of form submissions also arrive there. In the process, Google may transfer data to Google LLC in the USA (see section 11). I delete messages as soon as they have been dealt with and no retention obligations apply; I keep emails relating to a booking for up to 6 years.

The website links to Google Maps (addresses of the studios) and to my Instagram profile. These are simple links; no content from these services is embedded. Data is only transmitted to the respective provider when you click on a link: Google Ireland Limited (privacy) or Meta Platforms Ireland Limited (privacy).

11. Transfers to third countries

Netlify, Inc., Stripe, Inc., Google LLC and Automattic Inc. are certified under the EU-US Data Privacy Framework. Transfers to them in the USA are based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR), and in the case of Stripe and Google Workspace additionally on standard contractual clauses. Apple and Meta process data under their own responsibility, including outside the EU.

12. Your rights

You have the following rights:

  • Access to your stored data (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object: If I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An informal message to the address above is sufficient for all of this.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for me: Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach.

13. Changes

I update this privacy policy when the website or the services used change. The version published here at the time applies.