Data protection
PRIVACY NOTICE in accordance with Art. 13 of the General Data Protection Regulation (GDPR)
I would like to point out that data transmission over the Internet (e.g. when communicating by e-mail) can have security gaps. Complete protection of data against access by third parties is not possible. In order to protect your data as comprehensively as possible from unwanted access, I take so-called technical and organizational measures. Specifically, I use an encryption process on my website. Your data is transmitted over the internet from your computer to my computer and vice versa using what is known as TLS encryption. TLS stands for “Transport Layer Security” and is an encryption protocol for data transmission on the internet. You can usually recognize “TLS” by the fact that the lock symbol in the status bar of your browser is closed and the address begins with https://.
Responsible body according to Art. 4 No. 7 GDPR
Responsible is:
Daniela Erber
E-Mail: hi@danielaerber.com
You can also find more information in the Impressum.
I. Data processing on my website
1. Hosting of my website
This website automatically collects and stores server log file information that your browser transmits to me as part of the hosting process. These are
- the page accessed (URL)
- the browser or browser version
- the operating system used
- the referrer URL (the previously visited page)
- the host name and IP address of the accessing computer
- the time of the server request
The legal basis for this data processing is my legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR. This is based on being able to identify indications of unlawful use of my website. This anonymous data is stored separately from any personal data you may have provided and therefore does not allow any conclusions to be drawn about a specific person
Your personal data will not be transferred to third parties. I have concluded an order processing contract [ED1] with the provider of this website, World4You Internet Services GmbH, in accordance with Art. 28 GDPR.
The data collected is stored for a maximum of 2 weeks in server log files that your browser automatically transmits to us. We only store the server log files for longer than 2 weeks in the event of attacks on our server infrastructure or other legal violations. This longer storage is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies in the preservation of evidence [ED2] [ED3].
2. Inquiries by e-mail, telephone, contact [ED4] – or booking form
Information and personal details that you send me by e-mail, telephone or contact form will of course be treated confidentially. I use your data exclusively for the purpose of processing inquiries. The legal basis is the implementation of (pre-)contractual measures in the context of this communication (Art. 6 para. 1 lit. b) GDPR). Another legal basis for data processing is my legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR. The legitimate interest arises from my interest in responding to inquiries from customers, business partners and interested parties and in maintaining and promoting customer satisfaction.
I do not disclose the data to third parties. I use the data processor World4You Internet Services GmbH to carry out communication by email; we have concluded a data processing agreement in accordance with Art. 28 GDPR.
I will delete or anonymize all personal data that I receive in response to inquiries no later than 180 days after the final answer has been given. The retention period of 180 days is due to the fact that I may occasionally be contacted again about the same matter after a reply and I would like to be able to refer to the previous correspondence. Experience has shown that, as a rule, there are no more queries about my answers after 180 days.
3. Use of cookies and comparable technology for processing usage data
Cookies are set through my homepage. These are small text files that can be stored and displayed on your end device. In addition to session cookies, which are deleted as soon as the browser is closed, there are also permanent cookies.
Technically required (necessary) cookies and similar technologies are used, for example, to enable certain basic functions of my website (page navigation, display). For this purpose, information is stored on your end device and read by me. Some of these cookies and similar technologies contain information about certain settings and are therefore not personally identifiable. Without such cookies and similar technologies, my website will not function correctly.
The legal basis for the use of the technically necessary cookies listed above is Art. 6 para. 1 lit. b) GDPR. The processing is based on the initiation or execution of a contract.
For all other cookies, the legal basis is your consent in accordance with Art. 6 para. 1 lit. a) GDPR and Art. 49 para. 1 lit. a) GDPR.
All companies listed as providers in our cookie notices act as processors for us, unless this data protection notice refers to joint responsibility.
Google Analytics with anonymization function
This website uses Google Analytics if you have given your consent within the meaning of Art. 6 para. 1 lit. a) GDPR. This is a service provided by Google Ireland Limited (“Google”), a company incorporated and operated under Irish law (registration number: 368047) with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland and Google LLC (USA) (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookies about your use of this website is usually transmitted to a Google server in the USA and stored there. The data processing is also essentially carried out by Google. Both Google and the state authorities in the USA have access to this data.
The IP anonymization function is activated on this website, i.e. according to Google, your IP address will be shortened beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. [Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Google will use this information on behalf of the operator of this website for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator.
The IP address transmitted by your browser as part of Google Analytics is linked to other data about you, such as your search history, personal accounts, usage data from other devices and all other data that Google has about you.
I do not store any user and event data.[ED6] You can revoke your consent at any time.
Consent management via “click cookie”
I use the cookie consent technology of “Clickkeks” from the company Clickskeks GmbH & Co KG, based in Austria, to obtain your consent under data protection law to the storage of certain cookies on your end device or to the use of certain technologies and to document these in accordance with data protection regulations.
This is used to obtain the legally required consent for the use of cookies. The legal basis for this is our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR, which lies in the legally secure documentation and verifiability of consents (Art. 6 para. 1 lit. c) GDPR), in order to fulfill our accountability obligation pursuant to Art. 5 para. 2 GDPR. No personal data is stored.
4. Google Tag Manager
I use the Google Tag Manager of the provider Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland. Google Tag Manager allows website tags to be managed via an interface. This enables me as a marketer to manage website tags via a single interface. Tags are small sections of code that record (track) your activities on my website, for example. The Google Tag Manager itself does not set any cookies, but ensures that other tags, such as Google Analytics, are activated, which in turn can collect data under certain circumstances. By implementing the Google Tag Manager, your IP address is transmitted to Google anonymously. This may also result in data being transferred to Google servers in the USA. We have concluded a contract with Google for order processing in accordance with Art. 28 GDPR and the data transfer to third countries, such as the USA, is based on standard contractual clauses. In the account settings of the Tag Manager, we have not allowed Google to receive non-anonymized data from us. [The storage duration of the integrated tracking tools, such as Google Analytics, depends on the tool used, which is loaded via the Google Tag Manager.
5. Use of the appointment booking function of Calendly[ED8]
Calendly“ is an appointment booking tool that you can use to book an appointment with me directly. After booking, you will receive an appointment confirmation by email. To simplify the booking of appointments, I use the software “Calendly” from the provider Calendly LCC, based in the USA, with whom I have concluded a contract for order processing in accordance with Art. 28 GDPR. I do not pass on your data to third parties beyond this. From a data protection perspective, the USA is an unsafe third country. Data is transferred on the basis of so-called standard contractual clauses issued by the European Commission.
The legal basis for booking via Calendly for natural persons is the implementation of pre-contractual measures in accordance with Art. 6 para. 1 lit. b) GDPR. Another legal basis for data processing is my legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR. The legitimate interest lies in simplifying appointment bookings for interested parties and business partners and working in a time-saving manner.
II. Data processing of business partners and customers
1. Fulfillment of contractual obligations (Art. 6 para. 1 lit. b) GDPR)
The purposes of data processing arise from the implementation of pre-contractual measures that precede a contractually regulated business relationship and in the fulfillment of obligations arising from the coaching contract concluded. I process your first and last name, your address (street, zip code and town) for the purpose of issuing invoices.2. Kundenkommunikation per WhatsApp for Business [ED10]
To fulfill my contracts, I offer support via the messenger WhatsApp. Data processing in this context is based on the legal basis of contract fulfillment pursuant to Art. 6 para. 1 lit. b) GDPR. In the context of the use of WhatsApp, WhatsApp Ireland Limited is the recipient of your data and processor in accordance with Art. 28 GDPR. WhatsApp is a product of the Meta Companies (formerly Facebook Inc.). When using Messenger, your data will also be transferred to third countries outside the European Union for which there is no adequacy decision. The legal basis for the transfer of data to third countries such as the USA in the context of use are standard contractual clauses pursuant to Art. 46 para. 1 lit. c) GDPR.
Your data, such as the chat history, will be stored for the duration of the current contract and then irrevocably deleted.
Further information on data processing in the context of my social media presences and the use of the messengers there can be found in the section Information on my social media presences.
3. For the fulfillment of legal obligations (Art. 6 para. 1 lit. c) GDPR)
The purposes of data processing also result from legal requirements. These legal obligations include, for example, the fulfillment of retention and identification obligations, e.g. in the context of requirements for tax control and reporting obligations and data processing in the context of inquiries from authorities.
4. Data processing to document compliance with the GDPR
Insofar as your data is processed on the basis of consent pursuant to Art. 6 para. 1 lit. a) GDPR,. Art. 9 para. 2 lit. a) GDPR or Art. 49 para. 1 lit. a) GDPR, I process your data exclusively for a specific purpose and after separate information in order to be able to prove within the scope of my legal accountability that you have consented to the data processing in question (Art. 5 para. 2 GDPR).
If you assert your rights as a data subject under the GDPR against me, I will also process and store your data in order to be able to prove that I have complied with the GDPR when processing and responding to your request as part of my accountability obligation pursuant to Art. 5 para. 2 GDPR.
III. Communication via Zoom video conferencing system
I use the Zoom tool from Zoom Video Communications Inc. to hold telephone conferences, online meetings and video conferences. You will receive access to the agreed appointments via a link provided by e-mail. You can enter my video room by clicking on the link. Before joining, you can decide for yourself whether you want to activate the transmission of your video. You are muted by default and must manually enable your microphone if you wish. If you switch on your camera and/or microphone, this data will be processed as part of the meeting.
The following additional data may also be processed depending on the type and scope of specific use
Personal details (e.g. first and last name, email address, profile picture)
Meeting metadata (e.g. date, time and duration of communication, name of the meeting, participant IP address)
Device/hardware data (e.g. IP addresses, MAC addresses, client version)
Text, audio and video data (e.g. chat histories, video, audio and presentation recordings)
Connection data (e.g. phone numbers, country names, start and end times, IP addresses)
Your personal data may also be processed. This also depends specifically on your use, such as use of the chat or the whiteboard. I explicitly draw your attention to the fact that any information you provide during the meeting will be processed at least for the duration of the meeting.
Legal basis
The legal basis for data processing for direct contractual partners is Art. 6 para. 1 lit. b) GDPR, for business partners or contact persons at external bodies the legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR. My legitimate interest lies in the organization of virtual communication.
I cannot rule out the possibility that data may also be routed via internet servers located outside the EU or the EEA. In some countries, e.g. the USA, there is a risk that authorities may access the data for security and surveillance purposes without you being informed or being able to take legal action. We have agreed EU standard contractual clauses with Zoom as the legal basis for data transfer.
Receiver
The provider Zoom necessarily receives knowledge of the above-mentioned data insofar as this is contractually regulated within the framework of our order processing contract in accordance with Art. 28 GDPR. There are no other recipients.
You are not obliged to communicate with me via Zoom. Alternatively, you can also communicate by email or telephone.
We always delete personal data when there is no need for further storage.
IV. Information zu meinen Social-Media-Präsenzen
Ich betreibe folgende Social-Media-Präsenzen:
LinkedIn: https://www.linkedin.com/in/daniela-erber/
Datenverarbeitung durch mich:
a. Operation of the above-mentioned social media pages
The personal data entered on social media pages such as comments, videos, images, likes, public messages, etc. are published by the respective social media platform. I reserve the right to delete content if necessary. I may share your content on the site and contact you via the social media platform, e.g. via the messengers offered. The legal basis is the legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR, which is in the interest of my public relations and communication.
b. Page Insights
The social media platforms provide anonymized statistics and insights that help me gain knowledge about the types of actions people take on my site (so-called “page insights”). These Page Insights are created on the basis of certain information about people who have visited my site.
The legal basis for this data processing is my legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR, which lies in obtaining information about the actions and visitors to my website.
This processing of personal data is carried out by the social media platform and me as a so-called joint controller in accordance with Art. 26 GDPR. In the case of joint controllership, a separate agreement must be concluded.
LinkedIn: https://www.linkedin.com/help/linkedin/answer/124838/joint-controllership?lang=en
If you wish to object to certain data processing over which I have an influence, please use the contact details above.
Note: The provision of your data is not required by law or contract or necessary for the conclusion of a contract. You are not obliged to provide your personal data. The consequence of not providing your data is that you will not be able to communicate with me via my social media pages, interact with me or take part in the competition.
Data processing by the operator of the social media platform:
In addition to me, there is also the operator of the social media platforms themselves. From a data protection perspective, this is also regarded as another controller that carries out its own data processing. This means that the operator is also a separate controller under the GDPR. However, I only have limited influence on data processing by the operator. At the points where I can exert influence (e.g. through parameterization), I work within the scope of my possibilities to ensure that the operator of the social media platform handles data in accordance with data protection regulations. In many cases, I cannot influence the data processing by the operator of the social media platform and do not know exactly what data they process. The operator will inform you about the processing of personal data in its own privacy policy:
LinkedIn: https://de.linkedin.com/legal/privacy-policy?
Note: The operator of the social media platform uses web tracking methods. Web tracking can also take place regardless of whether you are logged in or registered with the social media platform. As already explained, I unfortunately have little influence on the web tracking methods of the social media platform. For example, I cannot switch this off. Please be aware: It cannot be ruled out that the provider of the social media platform may use your profile and behavioral data, for example to evaluate your habits, personal relationships, preferences, etc. I have no influence on the processing of your data by the provider of the social media platform.
Data transfer to third countries and recipients:
As part of platform use, personal data is also processed on servers in third countries, such as the USA. There is no adequate level of data protection in the USA. Data is transferred on the basis of standard contractual clauses. In some countries (such as the USA), there is a risk that authorities may access the data for security and monitoring purposes without you being informed or having the right to appeal.
V. Rights as a data subject
In accordance with Art. 15 (1) GDPR, you have the right to receive information about the personal data stored about you free of charge upon request. Furthermore, if the legal requirements are met, you have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR) of your personal data. If you have provided the processed data yourself, you have the right to data portability in accordance with Art. 20 GDPR.
If the data processing is based on Art. 6 para. 1 e) or f) GDPR, you have the right to object in accordance with Art. 21 GDPR. If you object to data processing, this will not take place in the future unless I can demonstrate compelling legitimate grounds for further processing which override the interests of the data subject in objecting.
If the data processing is based on consent in accordance with Art. 6 para. 1 lit. a), Art. 9 para. 2 lit. a) or Art. 49 para. 1 lit. a) GDPR, you can revoke your consent at any time with effect for the future without affecting the legality of the previous processing.
Please contact us at the above address or by email if you have any questions or complaints.
Zudem steht dir ein Recht zur Beschwerde bei einer Datenschutz-Aufsichtsbehörde zu. Die Beschwerde kann insbesondere bei einer Aufsichtsbehörde des EU-Mitgliedstaates deines Aufenthaltsortes, Arbeitsplatzes oder des Orts des mutmaßlichen Verstoßes geltend gemacht werden.
VI. No automated decision-making
There is no automated decision-making or profiling.
VII. Provision
Unless otherwise stated, the provision of personal data is neither legally nor contractually required or necessary for the conclusion of a contract. If you do not provide your personal data, I may not be able to interact with you via my social media presences.
This privacy policy was created in cooperation with SCALELINE. The legal texts are subject to copyright.
Email Marketing
Data Collection and Purpose
What Data We Collect
When you subscribe to our email list, we collect and process the following personal data:
- Email address (mandatory)
- First and last name (if provided)
- Subscription date and time
- IP address at time of subscription
- Email engagement data (opens, clicks, unsubscribes)
- Browser and device information
- Geographic location (based on IP address)
- Referral source (how you found our subscription form)
Purpose of Processing
We process your personal data for the following purposes:
- Newsletter delivery: Sending you weekly LinkedIn strategy insights, tips, and educational content
- Service promotion: Informing you about our LinkedIn coaching services (Power Hour sessions and extended coaching programs)
- Engagement analysis: Understanding which content resonates with our audience to improve our services
- List management: Maintaining accurate subscriber records and managing unsubscribes
- Performance tracking: Measuring email campaign effectiveness and website traffic from email sources
Legal Basis for Processing
Our legal basis for processing your personal data is:
- Consent (Article 6(1)(a) GDPR): You have explicitly opted in to receive our marketing communications
- Legitimate Interest (Article 6(1)(f) GDPR): For analytics and improving our service quality, where your interests do not override our legitimate business interests
Data Recipients and Third-Party Access
Primary Email Service Provider
Kit (ConvertKit LLC)
- Location: United States
- Purpose: Email delivery, list management, and basic analytics
- Data shared: Email address, name, subscription data, engagement metrics
- Adequacy decision: Transfers protected under EU-US Data Privacy Framework
- Data Processing Agreement: In place with Kit as per Article 28 GDPR
Service Providers with Access
Beef Up Media LLP (Email Marketing Service Provider)
- Location: India
- Purpose: Email strategy development, content creation, campaign management, and performance analysis
- Data shared: Aggregated analytics data, subscriber engagement metrics (pseudonymized where possible)
- Data Processing Agreement: In place as per Article 28 GDPR
- Access level: Limited to operational requirements for email marketing services
- Individual subscriber data access: When specifically required for campaign optimization or technical support
Daniela Erber (Data Controller)
- Access level: Full access to all subscriber data for business operations
- Purpose: Direct communication, service delivery, and business management
Analytics and Tracking Providers
Google Analytics 4
- Purpose: Website traffic analysis, email campaign performance tracking
- Data shared: Pseudonymized user behavior data, traffic sources from email campaigns
- Location: United States (EU-US Data Privacy Framework)
- Retention: 26 months (automatically deleted thereafter)
Microsoft Clarity
- Purpose: User experience analysis, heat mapping, session recordings
- Data shared: Pseudonymized interaction data from users arriving via email links
- Location: United States (EU-US Data Privacy Framework)
- Data masking: Sensitive information automatically masked in recordings
Data Security Measures
Technical Safeguards
- Encryption: All data transmissions secured with TLS 1.2 or higher
- Access controls: Multi-factor authentication required for all admin accounts
- Data backup: Encrypted backups stored in geographically distributed locations
- API security: Secure API connections with authentication tokens for all integrations
Data Breach Protocol
In the event of a data breach affecting your personal data:
- We will notify relevant supervisory authorities within 72 hours
- You will be notified without undue delay if the breach poses high risk to your rights and freedoms
- We will document all breaches and remedial actions taken
Data Retention
Active Subscribers
- Email and engagement data: Retained while you remain subscribed
- Analytics data: Aggregated data retained for 36 months for business intelligence purposes
Unsubscribed Users
- Immediate removal: Your email address is instantly removed from active mailing lists upon unsubscription
- Suppression list: Email address retained in suppression list to prevent re-addition (legitimate interest basis)
- Complete deletion timeline: All personal data permanently deleted within 30 days of unsubscription, except:
- Suppression list entries (retained for regulatory compliance)
- Anonymized analytics data (no longer constitutes personal data)
Data Minimization
- We automatically delete inactive engagement data older than 24 months
- IP addresses are anonymized after 6 months
- Detailed tracking data is aggregated and pseudonymized after 12 months
International Data Transfers
Data may be transferred to and processed in:
- United States: Under EU-US Data Privacy Framework adequacy decision
- India: Under appropriate safeguards (Standard Contractual Clauses)
All international transfers are conducted with appropriate safeguards in place as required by Chapter V GDPR.