Privacy Policy (Datenschutzerklärung)

1. Who is responsible for your data

The controller is Inga Romanenko, consultant, 79400 Kandern, Germany. For questions about personal data, exercising your rights or withdrawing consent: privacy@inga.life.

This policy describes processing when you use inga.life, book consultations or contact Inga about related services. Visiting the website or reading this policy does not, by itself, constitute consent to processing for all purposes.

2. What information may be processed

Depending on your request, this may include your name, email, telephone number, technical website data, booking and rescheduling information, correspondence, order and payment data. During consultations, it may include information you voluntarily share about your life. Each purpose has its own legal basis.

3. Website, Cloudflare and technical statistics

The website is hosted on Cloudflare Pages. Cloudflare also provides page delivery through its network, DNS and website protection. Requests involve technical information such as IP address, time, requested URL, browser and device information, response status and errors. The purposes are operating the website, preventing abuse and troubleshooting; the basis is the legitimate interest in a secure, accessible website under Article 6(1)(f) GDPR.

Cloudflare Web Analytics is used for visit and page performance statistics. According to Cloudflare documentation, this tool does not use cookies or localStorage for analytics or create individual visitor profiles. This does not remove the processing of technical data needed to deliver pages. Google Analytics is disabled on this website.

Cloudflare, Inc. is based in the USA and uses international infrastructure: processing is not limited to the EU. See the Cloudflare privacy policy and data processing terms. International transfers are addressed in section 14.

4. Enquiries and correspondence

When you contact Inga by email, chat or a messenger you choose, your contact details and message are processed to respond, arrange a meeting and handle your request. The basis is Article 6(1)(b) GDPR for service enquiries and contractual performance; for other enquiries it is Article 6(1)(f), the legitimate interest in responding.

Hostinger is used for email, including booking emails. Telegram and Chatwoot may be used for organisational correspondence. Ordinary Telegram cloud chats do not have end-to-end encryption by default. Where possible, avoid sharing sensitive information through organisational correspondence. Links to social networks and other websites open services with their own data processing rules.

5. Booking — Cal.com

Bookings use self-hosted Cal.com at booking.inga.life. It processes name, email, consultation type, date, time, time zone, form responses and information about confirmations, changes and cancellations. The basis is Article 6(1)(b) GDPR; the minimum information needed for security and evidence of performance is processed under Article 6(1)(f).

Cal.com and its PostgreSQL database are hosted on a managed Hetzner server in Helsinki, Finland. Imprints Media provides technical administration within its assigned tasks. Special category data is processed under section 8, rather than on the basis of booking alone.

6. Payments — Stripe

Stripe processes information needed for payment: amount, currency, transaction status and identifiers, payer information and the chosen payment method. Full card details are sent directly to the payment service. Inga receives necessary payment and order information.

The bases are contractual performance, accounting and tax obligations, and protecting rights in a dispute: Article 6(1)(b), (c) and (f) GDPR. Stripe may act as an independent controller for particular operations, such as fulfilling its own legal obligations. See the Stripe privacy policy.

7. Online meetings — Zoom

Consultations take place through Zoom. Inga does not make audio or video recordings of consultations. Organisational meeting records, such as date, duration and connection information, are not recordings of the conversation.

To provide video communication, Zoom processes participant and connection data, including name, technical information and transmitted audio and video. Arranging the meeting is based on Article 6(1)(b) GDPR; special category information also requires a condition under Article 9. See the Zoom privacy statement.

8. Sensitive information and professional notes

During a paid or free consultation, you may voluntarily share information about personal and family circumstances, emotional wellbeing, health, religious beliefs or sex life. You are not required to discuss all these areas. Health information, religious beliefs and sex life are special categories of data under Article 9 GDPR.

Preparing and providing consultations and necessary professional notes rely on Article 6(1)(b) GDPR and separate explicit consent under Article 9(2)(a) for special category data. This consent is requested separately from acknowledgement of this policy. You may withdraw it at any time through privacy@inga.life; withdrawal does not affect the lawfulness of earlier processing. Where the chosen consultation format requires processing this information, continuing consultations may become impossible after withdrawal.

Professional notes are retained for up to one year after the last consultation. An individually justified need may extend this by no more than one further year: the total limit is two years. Only Inga has access to the contents of these notes. Notes are deleted after the applicable period. This does not replace mandatory retention periods for financial documents.

Where particular information is necessary to establish, exercise or defend legal claims, the minimum necessary information may be retained on a separate basis, including Article 6(1)(f) and, for special categories, Article 9(2)(f) GDPR. A dispute does not, by itself, justify retaining all consultation information indefinitely.

9. Forms, materials and newsletter — Kit

Kit forms load after you select “Allow and show form”. Loading sends technical information, including your IP address, to Kit and may involve cookies or similar technologies. The basis for the authorised loading is consent under Article 6(1)(a) GDPR and section 25(1) TDDDG for non-essential storage or access to device information.

Allowing the form to load does not subscribe you to emails. When you subscribe or request a resource, Kit processes your email, any name you provide, the selected resource and subscription and confirmation information. Newsletter emails rely on separate consent under Article 6(1)(a); sending a requested resource may rely on Article 6(1)(b). You can unsubscribe using the link in an email or by contacting Inga.

Kit, Inc. is based in the USA. For subscriber data processing, see the Kit data processing terms. After unsubscribing, minimal records of the opt-out and previous consent may be retained to avoid unwanted emails and demonstrate compliance.

10. Website chat — Chatwoot

The standard Chatwoot widget loads automatically when you open a page and connects to crm.inga.life. Loading involves technical information, including IP address and browser data; browser storage may be used for the chat. Responding to a message you send relies on the bases in section 4.

Chat processes messages, contact information you provide, conversation metadata and files you voluntarily send. Chatwoot, PostgreSQL and primary file storage are hosted on the Hetzner server in Helsinki; Imprints Media provides technical administration. Please do not send detailed sensitive information through chat. Correspondence is retained while needed for your request, contract or justified protection of rights, then deleted; backups are retired on a separate cycle.

11. Videos and external resources

Course page videos open at your choice through Bunny Stream (bunny.net). On playback, the service receives technical information such as IP address, video address and device data to provide the video. Optional loading relies on consent under Article 6(1)(a) GDPR and, where non-essential storage is involved, section 25(1) TDDDG. See the bunny.net privacy policy.

Fonts and the icons used on the site are hosted locally; loading them does not require a request to Google Fonts or an external icon CDN.

12. Notifications, orders and resource access

Cal.com and email are used for booking confirmations, meeting and booking management links, rescheduling messages and other necessary notices. Course and resource orders involve order information, access provision and payment confirmations. The bases are Article 6(1)(b) and, for mandatory records, (c) GDPR.

On requested resource pages, localStorage may retain an access-granted flag and its expiry for seven days. This supports access to the chosen resource, rather than advertising profiling (section 25(2), point 2 TDDDG). Deleting this flag in your browser removes the saved access.

13. Your choices for Kit forms

You can leave Kit forms disabled. Permission to load a form applies to the current page and is not stored as automatic permission for later visits. After enabling a form, a disable-and-reload button is available; after reloading, the form requires your choice again. The chat widget loads automatically as described in section 10.

Disabling a form does not cancel your subscription or delete cookies previously created by a service. Unsubscribe through an email, remove cookies in your browser settings, or contact privacy@inga.life about deleting personal data, including chat messages. Storage strictly necessary for an explicitly requested function is assessed separately under section 25(2) TDDDG.

14. Recipients and transfers outside the EEA

Recipients depend on the function you choose: Cloudflare for the website and protection; Hetzner and Imprints Media for infrastructure and technical maintenance; Hostinger for email; Stripe for payments; Zoom for video communication; Kit for forms and newsletters; bunny.net for video; Telegram for correspondence you choose. Access is limited to necessary information and assigned tasks. Professional notes are not intended for newsletter or advertising systems.

Some providers and their contractors are outside the EEA, including in the USA. Transfers require a basis under Chapter V GDPR: an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, with necessary supplementary measures. Permission to load a form does not replace these safeguards. Information about applicable safeguards and a copy may be requested through privacy@inga.life. Processing on behalf of the controller is subject to Article 28 GDPR.

15. Retention periods

Data is retained while needed for the stated purpose. For correspondence and bookings, this takes account of completion of the request or contract and applicable periods for protecting rights; for technical logs, security and troubleshooting needs; for subscriptions, their duration and minimal evidence of consent or opt-out. Financial documents are retained for mandatory tax and accounting periods. Notes are governed by section 8.

Backups are renewed and retired on an established cycle; deletion from a working system does not mean immediate deletion from all backups. Information retained by law or for a particular legal claim is restricted to that purpose.

16. Your rights

Where the GDPR provides, you may access and obtain a copy of your data, correct it, request erasure or restriction, and exercise data portability (Articles 15–20). You may also object to legitimate-interest processing on grounds relating to your situation (Article 21); you may object to direct marketing at any time.

You may withdraw consent at any time without affecting the lawfulness of earlier processing. Contact privacy@inga.life. A response is normally provided within one month of receiving your request; where a lawful extension applies, you will be notified within that period. You may complain to a supervisory authority, including LfDI Baden-Württemberg.

17. Required and voluntary information

Required booking or payment fields are identified in the relevant form: without necessary contact and payment information the service cannot be arranged. Additional personal information is voluntary. Special categories are governed by section 8. The website does not make decisions with legal or similarly significant effects for you based solely on automated processing.

18. Security and policy updates

Access restrictions and technical protection measures take account of the nature of the information and processing risks. Avoid sending details through public forms that are better discussed directly during a consultation. This policy is updated when processing changes; its version date is fixed and does not depend on the date of your visit.