Privacy Policy | Der Eifelercoach

Privacy Policy – Your Privacy Matters

We process your personal data only as far as necessary, transparently and in line with the EU General Data Protection Regulation (GDPR) and Bulgarian data protection law. This policy explains what we collect, why, on which legal basis, with whom we share it and which rights you have.

1. Who is responsible for your data

The controller within the meaning of Art. 4(7) GDPR is:

Der Eifelercoach EOOD
UIC (ЕИК): 207447536 · VAT no.: BG207447536
Registered office: 1 Sredna Gora Street, flat 18, 8217 Aheloy, Bulgaria
Practice address: ul. St. St. Cyril & Methodius 18, 8238 Ravda, Bulgaria
Managing director: Abi Saloom Dean
Email: info@der-eifelercoach.eu

We are not legally required to appoint a data protection officer. For all questions about data protection, please write to the email address above.

2. Legal bases and your rights

We process personal data only on one of these legal bases:

Consent (Art. 6(1)(a) GDPR; for health-related data Art. 9(2)(a) GDPR), which you can withdraw at any time with effect for the future.
Contract or steps before a contract at your request (Art. 6(1)(b) GDPR), e.g. when you book a session.
Legal obligation (Art. 6(1)(c) GDPR), e.g. retention duties under Bulgarian accounting and tax law.
Legitimate interests (Art. 6(1)(f) GDPR), e.g. the secure and stable operation of our website.

You have the right to:

access your data (Art. 15 GDPR)
rectification of inaccurate data (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
object to processing based on legitimate interests or used for direct marketing (Art. 21 GDPR)
withdraw your consent at any time (Art. 7(3) GDPR)

To exercise these rights, simply email info@der-eifelercoach.eu. It is free of charge.

Right to lodge a complaint: You may complain to a supervisory authority, in particular in the EU country where you live or work. The authority responsible for us is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg.

3. Visiting our website

Hosting and server log files

Our website, our online courses and our questionnaires are hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, on the basis of a data processing agreement (Art. 28 GDPR). When you visit our pages, the server automatically records technical data: IP address, date and time of access, page requested, referring page, browser and operating system. We need this to deliver the website and to detect misuse and attacks (Art. 6(1)(f) GDPR). Log files are deleted after a short period unless needed to investigate a security incident.

All pages are transmitted with SSL/TLS encryption (recognisable by “https://” in your browser).

We use technically necessary cookies so that the website works, for example to remember your language and your cookie choices. Their legal basis is Art. 6(1)(f) GDPR and the Bulgarian Electronic Communications Act.

All other cookies and similar technologies, such as the Meta Pixel, are used only after you consent via our cookie banner (Art. 6(1)(a) GDPR). We use the WordPress plugin Complianz to manage consent; it stores your choice and a consent record on our server. You can change or withdraw your consent at any time via the cookie settings on our website. Details are in our EU Cookie Policy.

Meta Pixel

With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). It helps us measure how effective our Facebook and Instagram ads are and show our ads to people who have visited our website. The pixel records which pages you view and actions such as submitting a form, together with your IP address and browser data, and uses cookies for this. Meta may link this information to your Facebook or Instagram account.

We and Meta are jointly responsible for collecting and transmitting this data (Art. 26 GDPR). Meta is responsible for any further processing; see Meta’s privacy policy. Data may be transferred to Meta Platforms, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR).

Fonts

Some of our pages, including our online courses, load fonts from Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your browser then connects to Google’s servers and transmits your IP address. Transfers to Google LLC in the USA are covered by the EU-U.S. Data Privacy Framework. Legal basis: our legitimate interest in a consistent, readable design (Art. 6(1)(f) GDPR).

Google Maps

To show you where our practice is, we embed maps from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is loaded only after you consent via our cookie banner. Google then receives your IP address and may set cookies and link the visit to your Google account. Transfers to Google LLC in the USA are covered by the EU-U.S. Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR).

YouTube videos

We embed videos from YouTube, a service of Google Ireland Limited (address above). A video is loaded only after you consent via our cookie banner. When you play it, Google receives your IP address, information about the page you are on and your viewing behaviour, and may set cookies and link this to your Google account. Transfers to the USA are covered by the EU-U.S. Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR). See Google’s privacy policy.

Spam protection (Google reCAPTCHA)

To protect our contact form against spam and automated abuse, we use Google reCAPTCHA (Google Ireland Limited, address above). reCAPTCHA checks whether a form is filled in by a person, using data such as your IP address, mouse movements, time on the page and browser information. Transfers to the USA are covered by the EU-U.S. Data Privacy Framework. Legal basis: our legitimate interest in protecting our website from abuse (Art. 6(1)(f) GDPR).

Contact form and email

If you contact us via our contact form or by email, we process the data you provide (e.g. name, email address, phone number if given, your message) to answer your enquiry. Legal basis: steps before a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Please share only what is needed for a first reply; sensitive details are better discussed in person. We delete enquiries once they are fully dealt with, unless statutory retention duties apply.

Booking appointments (Google Calendar)

You can book appointments via the booking pages of Google Calendar, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data you enter – first name, surname, email address, the chosen time and, if you provide it, your WhatsApp number – to schedule the appointment and to send a calendar invitation, confirmations and reminders. Giving your WhatsApp number is voluntary; we use it only to contact you about your appointment, for example if it has to be moved. Legal basis: steps before a contract or the contract with you (Art. 6(1)(b) GDPR). Transfers to Google LLC in the USA are covered by the EU-U.S. Data Privacy Framework. See Google’s privacy policy.

When you sign up for our newsletter or one of our free online courses, we process your first name and email address. We use Mailchimp, a service of The Rocket Science Group LLC (Intuit), 405 N Angier Ave NE, Atlanta, GA 30308, USA, which is certified under the EU-U.S. Data Privacy Framework.

We use the double opt-in procedure: you receive an email asking you to confirm your sign-up. Mailchimp stores the time of sign-up and confirmation and your IP address as proof of consent. Mailchimp also measures whether emails are opened and which links are clicked, so that we can improve our content. Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email or by writing to us; we then remove you from the list.

Your progress and answers in our online courses are saved only in your own browser (local storage). They are not transmitted to us, and you can delete them at any time by clearing your browser data.

5. Self-assessments and questionnaires

We offer online self-assessments, such as our stress check, burnout self-check and ADHD self-reflection questionnaire. They run on our own survey software (LimeSurvey) at surveys.der-eifelercoach.eu, hosted by Hostinger as described above. No data is passed to the makers of LimeSurvey.

We process your answers and, where you choose to give them, your first name, email address and phone number. Your answers can reveal information about your wellbeing, which may count as health data under Art. 9 GDPR. We therefore process them only with your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), which you give via the consent field in the questionnaire. You can withdraw it at any time by emailing us; we will then delete your answers.

We use your answers to show you your personal result and, if you wish, to prepare a conversation with you. If you have agreed to receive emails from us, we may add your first name and email address to our mailing list (see section 4). The results are a self-assessment for reflection, not a diagnosis.

We delete questionnaire responses after 3 months at the latest, unless you become a client and the data is needed for your coaching.

6. Coaching and counselling clients

Client data

If you use our coaching, counselling or other services, we process your contact details, appointment data, notes from our sessions and, where relevant, results of measurements such as HRV scans or biofeedback. Some of this may be health data. Legal basis: the contract with you (Art. 6(1)(b) GDPR) and, for health data, your explicit consent (Art. 9(2)(a) GDPR), which we obtain in writing or electronically at the start of our work together.

We treat everything you share with us as strictly confidential. We keep client data for as long as our work together requires, and afterwards only as long as statutory retention duties or the defence of legal claims require.

Online sessions

If we hold a session online, we use Google Meet (Google Ireland Limited, address above) or, if you prefer, WhatsApp (WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). The provider processes connection data such as your IP address, device information and your name, email address or phone number; we do not record sessions. Transfers to the USA are covered by the EU-U.S. Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR. You are welcome to choose an in-person session instead.

Payment and invoicing

You can pay in cash at our practice or via PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg). PayPal processes your payment data under its own privacy statement. We keep invoices and accounting records for the periods required by Bulgarian accounting and tax law (Art. 6(1)(c) GDPR).

Backups

To protect against data loss, we regularly back up our website, including data submitted through it. Backups are created with the UpdraftPlus plugin and stored in Google Drive (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Transfers to Google LLC in the USA are covered by the EU-U.S. Data Privacy Framework. Legal basis: our legitimate interest in data security (Art. 6(1)(f) and Art. 32 GDPR).

7. General information

Transfers outside the EU

Some of our service providers are based in the USA or may access data from there. We use only providers that are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision (10 July 2023), or that use the EU Standard Contractual Clauses.

How long we keep data

We keep personal data only as long as needed for the purpose for which it was collected, or as long as statutory retention periods require. Where we rely on your consent, we delete the data when you withdraw it, unless another legal basis applies.

No automated decision-making

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).

Children

Our website and services are intended for adults. We do not knowingly collect data from children.

Links to other websites

Our website contains links to other websites and social media profiles. No data is transmitted to these providers until you click a link. We are not responsible for the content or data practices of other websites; please read their privacy policies.

Disclosure required by law

We disclose personal data to authorities only where we are legally obliged to do so, for example in response to a court order.

Language versions

This privacy policy is available in English, German and Bulgarian. If the versions differ, the English version prevails.

Changes to this policy

We update this policy when our services or the law change. The current version is always available on this page.

Last updated: October 2026