Privacy Policy

Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

If the contact details above change, this Privacy Policy will be updated accordingly.

General information about data processing

Personal data means any information relating to an identified or identifiable natural person. I process personal data only where there is a lawful basis for doing so and only to the extent necessary for the relevant purpose.

Legal bases

Depending on the context, processing may be based in particular on:

• Art. 6(1)(a) GDPR — your consent;
• Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract or performance of a contract;
• Art. 6(1)(c) GDPR — compliance with a legal obligation;
• Art. 6(1)(f) GDPR — legitimate interests, provided that your interests and fundamental rights do not override those interests.

Where processing is based on consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

Website hosting and server log files

This website is hosted by:

When you access the website, the hosting provider may automatically process technical connection data such as IP address, date and time of access, requested URL, referrer URL, browser type/version, operating system and HTTP status information. This processing is generally necessary to deliver the website securely and reliably.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure, stable and technically reliable provision of the website. Where the hosting provider processes personal data on my behalf, an appropriate data processing agreement is used where required.

Contact by email or other communication channels

If you contact me, I process the information you provide, such as your name, email address and the content of your message, for the purpose of responding to your enquiry and managing any subsequent communication.

The legal basis is Art. 6(1)(b) GDPR where the communication relates to a possible or existing contractual relationship. In other cases, processing is based on Art. 6(1)(f) GDPR, with the legitimate interest of responding to enquiries and communicating effectively.

Please avoid sending highly sensitive information by ordinary email unless necessary. Email transmission can have inherent security risks.

Appointment booking, CRM and communication through GoHighLevel

I use HighLevel / GoHighLevel to provide appointment booking, forms, CRM functions and, where configured, automated booking confirmations, reminders and related communications.

Data that may be processed

Depending on the booking form and your interaction with the service, this may include:

• name and contact details;
• appointment date and time;
• information you enter into booking or intake fields;
• communication and CRM history;
• technical data associated with the use of the booking interface.

Purpose and legal basis

The data is processed to arrange and manage appointments, respond to your request, provide booking confirmations and reminders, and organise subsequent communication. The primary legal basis is Art. 6(1)(b) GDPR. Where optional processing is based on consent, Art. 6(1)(a) GDPR applies.

HighLevel generally acts as a processor for customer data processed on behalf of its customers. A data processing agreement is available from HighLevel. HighLevel also publishes information about GDPR compliance, subprocessors and international data transfers.

Provider information: HighLevel Privacy Policy · Data Processing Agreement

Online sessions through Zoom

Online clarity calls, individual sessions and couples sessions may take place through Zoom.

When a Zoom meeting is arranged or joined, Zoom may process meeting and account information, technical connection data, IP address, device information and data exchanged during use of the service. I do not record coaching calls unless this has been separately agreed with you in advance.

Processing necessary to provide the agreed online meeting is based on Art. 6(1)(b) GDPR. Zoom provides data processing terms and mechanisms for international data transfers, including the EU-U.S. Data Privacy Framework and, where applicable, Standard Contractual Clauses.

More information: Zoom Privacy Statement

Google Analytics

If Google Analytics is enabled on this website, it is used to understand how visitors use the website and to improve its content and usability.

Google Analytics may process information such as page views, interactions, approximate location based on IP address, browser/device information and technical identifiers. Analytics data is not intended to identify you directly.

Where Google Analytics uses cookies or similar technologies that are not strictly necessary, it is activated only after your consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with the applicable requirements for access to or storage of information on your device. You may withdraw your consent at any time through the website’s cookie/privacy settings.

More information: Google Privacy Policy

Cookies, local storage and consent management

This website may use cookies or similar technologies. Some are technically necessary to provide functions requested by you. Others, particularly analytics or marketing technologies, may require your prior consent.

Non-essential cookies and comparable access to information stored on your device should only be activated after a valid consent choice. You can withdraw or change your consent for the future through the website’s consent settings.

Where a tool is technically necessary for a service you expressly request, processing may be possible without consent to the extent permitted by applicable law. Where consent is required, the legal basis for subsequent processing is Art. 6(1)(a) GDPR.

International data transfers

Some service providers used for this website or related services are based in or may process data in countries outside the European Economic Area, including the United States.

Where personal data is transferred to a third country, the transfer is carried out only where a lawful transfer mechanism applies. Depending on the provider and processing context, this may include an adequacy decision such as participation in the EU-U.S. Data Privacy Framework, or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Further information about the transfer mechanisms used by individual providers is available in their privacy and data-processing documentation linked above.

How long personal data is stored

I retain personal data only for as long as it is necessary for the purpose for which it was collected or as long as legal retention obligations require.

For example, enquiry and booking information may be retained for the duration of the communication or contractual relationship and subsequently for any legally required retention period. Where processing is based solely on consent, data will generally no longer be processed for that purpose after consent has been withdrawn, unless another lawful basis applies.

Exact retention periods can vary depending on the category of data and the applicable legal obligations.

Your data protection rights

Subject to the legal requirements, you have the following rights in relation to your personal data:

• the right of access (Art. 15 GDPR);
• the right to rectification (Art. 16 GDPR);
• the right to erasure (Art. 17 GDPR);
• the right to restriction of processing (Art. 18 GDPR);
• the right to data portability (Art. 20 GDPR);
• the right to object to processing based on legitimate interests (Art. 21 GDPR);
• the right to withdraw consent at any time for the future (Art. 7(3) GDPR).

To exercise your rights, please contact hi@john-lack.de.

Right to lodge a complaint

You also have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

Data security

Appropriate technical and organisational measures are used to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The website should be delivered using encrypted HTTPS connections.

No method of electronic transmission or storage can guarantee absolute security. Security measures are therefore reviewed and adjusted where appropriate.

Changes to this Privacy Policy

This Privacy Policy may be updated if legal requirements, the services used on the website or the way personal data is processed change. The current version is always available on this page.

Last updated: 16 September 2026