Privacy Policy

2. Hosting and server logs

This website is hosted by Netlify, Inc., USA.

When the website is opened, the host may process technical data needed to deliver it securely and reliably. This may include in particular the IP address, the date and time of access, the requested address or resource, the browser and operating system type and – if transmitted by the browser – the address of the referring page.

The purpose of the processing is to ensure the availability, security and error-free operation of the website. The legal basis is Art. 6(1)(f) GDPR, namely my legitimate interest in operating the website securely and reliably.

Netlify acts as a processor. The processing is governed by the data processing agreement (DPA) linked to Netlify’s terms of service.

For transfers to the USA, Netlify relies on the EU–U.S. Data Privacy Framework. For transfers to which this framework does not apply, it uses the Standard Contractual Clauses (SCC) adopted by the European Commission.

Netlify determines how long technical data is kept based on the nature of the data, the purpose of processing, security risks and applicable law. Data is kept only as long as needed to operate the service securely, investigate misuse or meet legal obligations.

More information: https://www.netlify.com/privacy/

3. Contact by email

If you write to hello@bakaiadam.com, I process your email address, your name, the content of your message and the technical data associated with the email in order to reply to your enquiry and for any further communication.

The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to concluding, preparing or performing a contract; otherwise Art. 6(1)(f) GDPR, namely my legitimate interest in replying to enquiries I receive.

The email provider is Namecheap, Inc., USA, via the Namecheap Private Email service. Namecheap’s data processing agreement forms part of its terms of service. According to Namecheap, the Private Email servers are located in the USA. Transfers are governed by the Standard Contractual Clauses under European Commission Implementing Decision (EU) 2021/914 (SCC, Module 2: controller to processor).

General enquiries that do not lead to a contract are normally kept for no more than six months from the last substantive communication. Where the correspondence is a business record that must be kept for contractual, accounting, tax or other legal reasons, the applicable statutory retention period applies. This is normally six years for business correspondence and eight years for accounting records. Where data is needed to establish or defend legal claims, it may be kept until the relevant limitation period ends.

More information: https://www.namecheap.com/legal/general/privacy-policy/

4. Booking via Calendly

The booking buttons are plain links to the booking page of Calendly, LLC, USA. Calendly is not embedded in the website, so no automatic connection to Calendly is made when you open bakaiadam.com.

If you open the Calendly link and book a time, Calendly processes the data you enter there. This may include your name, email address, chosen time, time zone, technical booking data and your answers to the booking questions. I also receive the data needed to organise and hold the conversation.

The legal basis is Art. 6(1)(b) GDPR, namely steps taken at your request before entering into a contract, or performance of the service relationship that has been established.

Calendly acts as a processor with regard to booking data. Calendly’s data processing agreement (DPA) forms part of its terms of service.

For transfers to the USA, Calendly relies primarily on the EU–U.S. Data Privacy Framework. Where this does not apply to a transfer, it uses Module 2 of the Standard Contractual Clauses under European Commission Implementing Decision (EU) 2021/914.

Free-text answers and preparatory information provided at booking are kept in Calendly for no more than six months after the appointment. If the conversation is followed by an ongoing coaching relationship, I continue to process the data needed for our work in the coaching documentation and delete detailed answers no longer needed in Calendly. Data required for contractual, accounting or legal reasons is kept until the applicable statutory deadline.

Calendly’s own privacy notice also applies to the use of its service: https://calendly.com/legal/privacy-notice

5. Newsletter via Brevo – double opt-in

To send the newsletter I use the service of Sendinblue SAS – Brevo, 17 rue Salneuve, 75017 Paris, France.

For the sign-up form on the homepage and on the Hungarian reader page (/olvasoknak) to work, your browser loads technical files from the sibforms.com domain used by Brevo. In doing so, Brevo receives your IP address and the connection data your browser transmits automatically.

When you submit the form, Brevo processes your first name, your email address, the time of sign-up and confirmation, and the IP address and technical log data associated with the sign-up. Your subscription only takes effect once you click the link in the confirmation email.

The legal basis for sending the newsletter is your consent, Art. 6(1)(a) GDPR. Keeping the log data needed to prove sign-up and consent is based on Art. 6(1)(c) GDPR and the accountability obligation under Art. 5(2) and Art. 7(1) GDPR. Processing the minimum data needed to establish or defend legal claims may be based on Art. 6(1)(f) GDPR.

Newsletter opens and clicks on links in them are measured in anonymised form. From the aggregated statistics I do not determine which individual subscriber opened which email or clicked which link.

Brevo’s data processing agreement forms part of Brevo’s terms of service. Brevo is based in France, but some of its sub-processors may process data outside the European Economic Area. Under Brevo’s current data processing agreement, such transfers are based on an adequacy decision, on Standard Contractual Clauses adopted by the European Commission or on other appropriate safeguards under the GDPR.

I process newsletter sign-up data until you unsubscribe or withdraw consent. After unsubscribing, the email address may remain on a suppression list in minimal form to ensure no further newsletters are sent to it. Minimal log data proving that consent was given and withdrawn is kept for three years from the end of the year of withdrawal, unless ongoing legal proceedings require longer retention.

Consent can be withdrawn at any time via the unsubscribe link in every newsletter or by emailing hello@bakaiadam.com.

More information: https://www.brevo.com/en/legal/privacypolicy/

6. External purchase platform – Big Cartel

The book purchase buttons lead to an external online shop operated by Big Cartel, LLC, USA. Big Cartel is not embedded in bakaiadam.com. Until you open the purchase link, no order or payment data is passed to Big Cartel through this website.

When you order in the Big Cartel shop, I receive, as merchant and controller, the data needed to fulfil the order – in particular name, email address, billing and delivery address, the product ordered and the order details. Big Cartel acts as a processor for this data. Payment data is processed by the external payment provider chosen at checkout, such as Stripe or PayPal, under its own privacy policy.

The legal basis for processing order data is Art. 6(1)(b) GDPR, namely preparing and performing the purchase contract. The legal basis for keeping invoicing, accounting and tax data is Art. 6(1)(c) GDPR. Data needed to fulfil the order is kept until the contract has been performed and then until the applicable accounting, tax and commercial retention periods end.

The detailed data-protection terms of the Big Cartel shop are set out in a separate privacy notice available in the shop. Big Cartel’s own privacy policy also applies to its service:

https://www.bigcartel.com/resources/policies/privacy-policy

7. Fonts

The typefaces Newsreader and Manrope are loaded directly from this website. No connection is made to Google Fonts or any other font provider.

8. Links to social networks

The links to LinkedIn, Instagram and Facebook are plain links. No plugins or embeds are used; data is only transmitted when you click a link, and the network’s own privacy policy then applies.

9. Analytics

No analytics or tracking tool is installed on this website, and website visits are not measured.

Separate from this is the measurement of opens and clicks in the newsletter, described in section 5.

10. Cookies and local storage

The website itself sets no cookies and uses neither localStorage nor sessionStorage.

For the newsletter sign-up form on the homepage and on the Hungarian reader page (/olvasoknak) to work, the browser loads external files from the sibforms.com domain used by Brevo. In doing so, Brevo technically receives your IP address and the connection data your browser transmits automatically.

A technical review of the current website and Brevo integration on 19 October 2026 found that no first-party or third-party cookie was set when the page was opened, and that the Brevo script did not write any data to the browser’s localStorage or sessionStorage. This result applies to the versions of the website and the Brevo script at the time of review; the review must be repeated after any change to the integration or the service.

With the current technical setup, I do not use a consent banner solely because of the Brevo form. If I later introduce analytics, marketing or other non-essential cookies or similar technologies, I will ask for prior consent to their use.

11. Purposes and legal bases at a glance

• Delivering and securing the website — Art. 6(1)(f) GDPR
• Replying to enquiries — Art. 6(1)(b) or (f) GDPR
• Booking and holding conversations — Art. 6(1)(b) GDPR
• Newsletter — Art. 6(1)(a) GDPR
• Proof of consent — Art. 6(1)(c) and (f) GDPR

12. Recipients and processors

The following recipients and processors may access personal data to the extent necessary to provide the services:

• Netlify, Inc., USA – web hosting and technical delivery;
• Namecheap, Inc., USA – email service;
• Sendinblue SAS – Brevo, France – newsletter management and delivery;
• Calendly, LLC, USA – booking;
• Big Cartel, LLC, USA – operation of the book’s online shop;
• the payment provider later specified in the Big Cartel shop and the shipping provider involved in delivering the order.

Data processing provisions or data processing agreements are attached to the terms of service of Netlify, Namecheap, Brevo, Calendly and Big Cartel. I use these services on the basis of the current terms accepted in the respective account.

13. Transfers outside the EEA

Some providers operate in the USA, and some European providers may use sub-processors outside the European Economic Area.

• Netlify and Calendly are certified participants in the EU–U.S. Data Privacy Framework. For transfers outside the scope of this framework, they use the Standard Contractual Clauses under European Commission Implementing Decision (EU) 2021/914.
• Namecheap’s data processing agreement contains Module 2 of the Standard Contractual Clauses under European Commission Implementing Decision (EU) 2021/914.
• For Brevo’s sub-processors outside the European Economic Area, an adequacy decision, Standard Contractual Clauses or another appropriate safeguard applies under the current data processing agreement.
• Big Cartel and its sub-processors may process data in the USA and other countries. The detailed terms of transfer are set out in Big Cartel’s current data processing agreement and privacy policy.

14. Retention

I keep personal data only as long as needed for the purpose concerned or as long as the law requires it to be kept.

The main retention periods in this notice:

• technical server data: under Netlify’s current retention rules, as long as needed for security and operational purposes;
• general email enquiries: no more than six months from the last substantive communication;
• Calendly booking questions and free-text answers: no more than six months after the appointment;
• active newsletter subscription data: until you unsubscribe or withdraw consent;
• minimum data proving newsletter consent: three years from the end of the year of withdrawal;
• business correspondence: where required by law, normally six years;
• accounting records: where applicable, normally eight years;
• other accounting and tax documents: for the period required by applicable law.

Where data is needed to establish, exercise or defend an ongoing legal claim, the relevant data may be kept until the end of the proceedings or the limitation period. Once the retention period has expired, I delete the data or irreversibly anonymise it.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). An email to hello@bakaiadam.com is enough.

16. Withdrawing consent

You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR) — for the newsletter via the unsubscribe link in every email, or by writing to hello@bakaiadam.com.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority under Art. 77 GDPR.

As my business is based in Munich (Bavaria), the supervisory authority competent for me is:

Bayerisches Landesamt für Datenschutzaufsicht – BayLDA
Promenade 18
91522 Ansbach
Germany
Website: https://www.lda.bayern.de/

18. Is providing data required?

You are not obliged to provide personal data. Without an email address you cannot subscribe to the newsletter, and without contact details you cannot book a conversation.

19. Automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place.