Privacy policy

Jemma (“Rowan”) Deer, Deer Coaching and Yoga, Holländerstr. 63, 13407 Berlin, Germany, mindbodycoach@mailbox.org

This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit it, Cloudflare automatically records technical data such as your IP address, the date and time of access, your browser type, and the referring page. This is necessary to deliver the website securely. Legal basis: Art. 6(1)(f) GDPR. I do not keep any server logs myself. More information on how Cloudflare processes data is available in Cloudflare’s privacy policy: www.cloudflare.com/privacypolicy. A data processing agreement under Art. 28 GDPR is in place with the host. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework, so transfers of data to the USA are covered by the European Commission’s adequacy decision (Art. 45 GDPR).

The website’s forms are handled by a program that runs on Cloudflare’s servers (Cloudflare Workers), and the newsletter list is stored in Cloudflare’s database service (Cloudflare D1; see section 3); both are covered by the same data processing agreement. In my Cloudflare account, I can see the technical access data for 31 days and the visitor statistics (see section 10) for about six months. Beyond that, Cloudflare keeps its own logs for periods it sets itself.

The newsletter sign-up form, the confirmation step, and the unsubscribe form send your entries to a program on Cloudflare’s servers (Cloudflare Workers). It stores your email address, the language of the page, the consent text you ticked, and when you signed up, confirmed, or unsubscribed in a database at Cloudflare (Cloudflare D1; see section 2). Emails, to you to confirm your subscription and to me once you have confirmed or unsubscribed, are sent from the sender domain mail.rowandeer.com via Brevo (Brevo SAS, 17 rue de Salneuve, 75017 Paris, France), which processes your email address and these emails on my behalf under a data processing agreement (Art. 28 GDPR). For each email, Brevo keeps a log with details such as the recipient, the subject, and the time it was sent, and deletes it after one month; Brevo does not keep a copy of the email’s content. Brevo stores the data on servers in the EU (France and Belgium). Brevo’s service providers and group companies may access it from outside the EU, in particular from the USA and India; these transfers are covered by the EU–US Data Privacy Framework or by EU standard contractual clauses (Art. 45 and 46 GDPR). See also section 7.

Brevo does not allow tracking to be switched off completely. I have selected anonymous tracking: Brevo counts in aggregate whether these emails are opened (via a small image loaded from Brevo’s servers) and whether links in them are clicked (links are routed via Brevo), without associating this with you. When you open the email or click a link, Brevo receives technical data such as your IP address and browser details. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable delivery of the confirmation email).

To protect the forms against misuse, only a limited number of submissions per minute is accepted from each IP address. Your IP address is used only for this check and only briefly, and it is not included in the email to me. Legal basis: Art. 6(1)(f) GDPR; my legitimate interest is protecting the forms against spam and misuse.

Consultations are booked through meetergo, provided by meetergo GmbH, Hauptstraße 44, 40789 Monheim am Rhein, Germany. The booking calendar on this website only loads when you click “Load calendar”; until then, no data is sent to meetergo. When you click, meetergo’s script and booking page are loaded from meetergo’s servers. This transfers technical data such as your IP address to meetergo, and meetergo sets a session token (see section 10). Legal basis for loading the calendar: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you give by clicking. It applies only to that page view; on your next visit, the calendar loads only if you click again. You can also open the booking page directly on meetergo’s website.

When you book, meetergo processes your name, your email address, and the time you choose, and logs your IP address, details of your browser, and the time of booking. You receive a booking confirmation and a reminder by email, and the appointment is entered in my calendar. Your name, email address, and preferred time are needed to book; everything else is voluntary. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract). Where I keep booking data beyond the appointment (see section 13), this is based on my legitimate interest in keeping track of appointments and matching repeat bookings (Art. 6(1)(f) GDPR).

meetergo processes this data on my behalf under a data processing agreement (Art. 28 GDPR). The data is hosted in Germany, and emails are sent via a provider in the Netherlands. No data is transferred outside the EU or the European Economic Area. When you book, meetergo also shows you my privacy notice for prospective clients.

If you email me, your message and contact details are processed to respond to your enquiry. Legal basis: Art. 6(1)(b) or (f) GDPR. Email is provided by mailbox.org (Heinlein Hosting GmbH, Schwedter Straße 9a, 10119 Berlin, Germany), which processes data on my behalf under a data processing agreement (Art. 28 GDPR), on servers in Germany. If you call me or send me a text or Signal message, I process your phone number and your message in the same way, to respond to your enquiry or to arrange appointments.

Consultations, online coaching sessions, and the online yoga classes take place via OpenTalk, the video service of mailbox.org (see section 5), which processes data on my behalf under the same data processing agreement, on servers in Germany. During a call, OpenTalk processes the data needed to provide it, such as your IP address, the name you enter, and the audio, video, and chat content of the call. Legal basis: Art. 6(1)(b) GDPR.

If you prefer, coaching sessions can also take place via Signal (Signal Messenger, LLC, USA). We can also use Signal for messages, for example to arrange appointments. Using Signal is optional. Calls and messages on Signal are end-to-end encrypted, so Signal cannot see or hear their content. To operate the service, Signal processes your phone number and limited technical data, on servers that may be located in the USA. Signal processes this data as an independent controller under its own terms and privacy policy (signal.org/legal), not on my behalf. Legal basis: your consent, Art. 6(1)(a) GDPR.

In the online yoga classes, other participants can see the display name you choose and, if your camera is on, your video. You can join under a pseudonym with your camera off. I record the classes with a separate device that is not connected to the call and does not capture participants’ names or images.

Consultations are not recorded. I record coaching sessions only with your explicit consent (Art. 9(2)(a) GDPR). The recording and its transcription are made entirely on my own computer: the audio never leaves it and is deleted once the transcript exists.

If you subscribe to the newsletter, I use your email address to send it to you. Legal basis: your consent, Art. 6(1)(a) GDPR. After you sign up, you receive an email with a link to confirm your subscription on my website. I add you to the newsletter only once you have confirmed, and the time of your confirmation is recorded as proof of your consent. You can unsubscribe at any time at rowandeer.com/newsletter#unsubscribe, by replying to any newsletter, or by sending me an email.

I send the newsletter myself from my mailbox.org email account (see section 5), with all recipients in blind copy (BCC), so that they cannot see each other’s addresses. I do not use a newsletter service to send the newsletter itself (Brevo only sends the emails for signing up and unsubscribing, see section 3), and I do not track whether you open the newsletter or click on links in it.

Coaching fees are paid by invoice and bank transfer; yoga subscriptions are paid by standing order from your bank account. For each payment, I receive the details shown on my bank statement, such as your name, your bank details, the amount, and the payment reference. Legal basis: Art. 6(1)(b) GDPR, and for my accounting records Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 14b UStG.

Information about your health that you share with me (for example in a consultation or an email) is special-category data under Art. 9 GDPR. I process it only with your explicit consent (Art. 9(2)(a) GDPR). At the start of a consultation, I ask for your consent to process any health information you share and to take notes on it, and I document your consent. Consent is voluntary; without it, the consultation still takes place but is limited to general questions about the coaching. I do not use health information that you send me by email unprompted, and I delete it together with your enquiry. Coaching clients and yoga subscribers receive a separate, detailed privacy notice.

The coaching page shows testimonials from clients. These often reveal something about the person’s health. I publish a testimonial only with the person’s explicit consent in text form, for example by email (Art. 9(2)(a) GDPR), covering the exact wording, the name and other details shown (such as age), and publication on this website. Like the rest of the website, published testimonials are stored by Cloudflare (see section 2) and can be read worldwide. Consent can be withdrawn at any time; I then remove the testimonial without delay.

This website itself does not set any cookies. When you load the booking calendar (see section 4) or open the booking page on meetergo’s website, meetergo sets a short-lived session token which, according to meetergo’s privacy policy, protects against misuse and double bookings. It is strictly necessary for booking, so it does not require your consent (§ 25(2) no. 2 TDDDG).

To see how often the pages are visited, this website uses Cloudflare Web Analytics, a statistics service of Cloudflare, Inc. (see section 2). On every page view, a script is loaded from Cloudflare’s servers and reports the address of the page, the referring page, your browser’s user agent, and technical data on how quickly the page loaded; your IP address is transmitted in the process, used to determine your country, and not stored for statistics. The script does not set cookies, store anything on your device, or recognise you across visits or websites. I only see aggregated figures, such as visits per page, referring websites, device type, browser, and country; I cannot identify individual visitors. Legal basis: Art. 6(1)(f) GDPR; my legitimate interest is understanding which pages are used, so that I can improve the website. You can object to this processing (see section 12).

The fonts on this website are delivered by the website itself; your browser does not connect to Google or any other font provider. Apart from the statistics script (see section 10), the only external content is the meetergo booking calendar, which loads only after you click (see section 4). Links to other websites, for example to studies, are plain links: the other website receives data from you only when you follow a link, and its own privacy policy then applies.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You may withdraw your consent at any time with effect for the future (Art. 7(3)). You also have the right to lodge a complaint with a supervisory authority, such as the Berlin Commissioner for Data Protection and Freedom of Information (www.datenschutz-berlin.de).

Right to object: Where I process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR).

I keep personal data only as long as it is needed for the purpose for which it was collected, unless statutory retention obligations require me to keep it longer. In particular:

Last updated: 30 October 2026