Privacy policy

I take the protection of your personal data seriously. This page sets out which data I collect, what I use it for and which rights you have.

Controller

1. Which data I collect

When you visit this website, write to me or use one of my offerings, the following data may arise:

• Name and email address, if you give them to me voluntarily, for example through the contact form, when booking an appointment or when signing up for the newsletter.
• The content of your message, so that I can answer it.
• Server log data, automatically transmitted by your browser when you access the site: IP address, date and time, page accessed, browser type and operating system. This data is necessary for the technical operation and security of the website.

I do not actively collect special categories of personal data within the meaning of Article 9 GDPR. If you share sensitive information with me of your own accord in a conversation or a message, I treat it confidentially and use it solely for the work in question.

2. What I use it for

• To reply to you and to arrange appointments.
• To provide and invoice agreed services.
• To send you the newsletter if you have signed up for it.
• To meet legal obligations, in particular tax retention requirements.

I do not sell your data and I do not pass it on for advertising purposes.

3. Legal bases

• Consent pursuant to Article 6(1)(a) GDPR, for example for the newsletter. You can withdraw it at any time with effect for the future.
• Contract or pre-contractual measures pursuant to Article 6(1)(b) GDPR, for example for an appointment request or ongoing work together.
• Legal obligation pursuant to Article 6(1)(c) GDPR, for example for retention periods.
• Legitimate interest pursuant to Article 6(1)(f) GDPR in the secure and trouble-free operation of the website.

4. Services I use

• Hosting and delivery. The website is delivered through a content delivery network operated by Cloudflare in order to serve it quickly and securely. Connection data is processed in the course of this.
• Fonts. The fonts on this website are served from my own server. No connection to Google servers is made.
• Newsletter window. On some pages a window with my newsletter form opens by itself shortly after the page loads. You do not have to click anything for this to happen. Only at that moment is the form loaded from link.thorstenenderlin.com, and your IP address is transmitted to HighLevel in the process. If you close the window, your browser stores an entry so that it is not shown to you again. That entry stays on your device and is not transmitted. You can delete it at any time in your browser settings.
• Appointment booking. For appointments I use the booking widget from HighLevel (LeadConnector). The details you enter there are processed for appointment management.
• Contact form. The details from the form are transmitted to my email address and stored there.
• Newsletter. For the newsletter, forms and appointment booking I use HighLevel, Inc. (LeadConnector), 400 North Saint Paul Street, Dallas, Texas, USA, connected through Mastermind.com, as a processor. Data may be transferred to the USA in the course of this. If you sign up, the service stores your first name, email address and the time and IP address of the sign-up as evidence. You can unsubscribe at any time using the link in every email.
• Language selection. A technically necessary setting is stored in your browser for the German and English versions of the site.

External links on this site, for example to Spotify, YouTube or the community, only open when you click them. Only then do the privacy terms of the respective provider apply.

5. Cookies

This website uses technically necessary cookies so that it works. For any cookies beyond that I obtain your consent in advance. You can delete or block cookies in your browser at any time.

6. How long I keep data

I store personal data only for as long as is necessary for the purposes stated. After that I delete it, unless a statutory retention obligation applies. For documents of tax relevance the statutory periods of six and ten years respectively apply.

7. Your rights

• Access to the data I hold about you.
• Rectification of incorrect or incomplete data.
• Erasure of your data, unless a retention obligation prevents it.
• Restriction of processing.
• Objection to processing based on legitimate interests.
• Data portability in a common format.
• Withdrawal of consent with effect for the future, for example for the newsletter.

An informal message is enough, to hello@thorstenenderlin.com.

8. Right to complain

If you believe that the processing of your data infringes the GDPR, you can complain to a supervisory authority. The authority responsible for me is:

9. Data security

I take technical and organisational measures to protect your data against unauthorised access, loss and misuse. The website is available with encryption throughout.

10. Changes

I update this policy when the legal situation or the services used change. The version published here is the one that applies.

Last updated: September 2026