Privacy policy

Controller responsible for data processing on this website:

Ekaterina Ponomareva

Schwarzhölzlstr. 10

85221 Dachau

Deutschland

Email: ekattim@gmail.com

When you register and use an account: email address, name (if provided), authentication data, preferred language and role information.

For bookings and purchases: booking details (class/workshop, time, status), payment-related metadata (e.g. Stripe session/payment IDs), video access and membership credits.

Technical data: IP address, browser/device information and server logs as needed for operations and security.

Voluntary information in forms (e.g. creative-group applications): the content you submit.

Contract performance (Art. 6 (1)(b) GDPR): account, class and workshop bookings, memberships, video access and payments.

Legitimate interests (Art. 6 (1)(f) GDPR): secure website operation, abuse prevention and service improvement.

Legal obligations (Art. 6 (1)(c) GDPR): retention of records where required by tax or commercial law.

Consent (Art. 6 (1)(a) GDPR): only where obtained separately (e.g. optional newsletter or non-essential cookies).

Website hosting and delivery: Vercel.

Database, authentication and storage: Supabase (EU region, e.g. Frankfurt, when configured).

Payments on this website: Stripe Payments Europe (cards, SEPA, Apple Pay/Google Pay, etc.). Full card numbers are not stored on our servers.

Video streaming: Bunny Stream (CDN). Time-limited playback links are issued to entitled users.

Transactional email (booking confirmations, etc.): Resend.

Note: Sales or communication outside this website (e.g. Instagram, PayPal or Gumroad) are governed by those platforms’ privacy notices and are outside the scope of this website policy unless used here.

Data processing agreements (DPAs) are concluded with these providers where legally required.

If you contact me by email or via forms on this website, your details are processed to handle the request (Art. 6 (1)(b) or (f) GDPR).

Data is not shared with third parties without your consent unless required for contract performance or by law (e.g. payment processing via Stripe).

Account data is kept while the account exists and thereafter only as long as legal retention duties require.

Booking and payment data are typically retained for the business relationship and applicable tax periods (often up to 10 years).

Server logs are kept only briefly for security and operations unless longer retention is needed to investigate incidents.

Under the GDPR you may have rights of access, rectification, erasure, restriction of processing, objection and data portability.

Where processing is based on consent, you may withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority.

Technically necessary cookies or storage mechanisms are used, e.g. for session/login and language preference (locale).

Non-essential analytics or marketing cookies are not used by default. If that changes, consent will be obtained and this notice updated.

Please send privacy and data-subject requests to the email address stated in the Impressum.