Last updated: March 2026 · Controller: Jonas Alexander Grodhues, Fechingerstraße 43a, 66271 Kleinblittersdorf · [email protected]
1. Principles and Legal Bases
We process personal data only to the extent permitted by law. The legal bases are:
- Art. 6 (1)(b) GDPR – Performance of a contract (order processing, ticketing, provision of access)
- Art. 6 (1)(c) GDPR – Legal obligations (retention requirements under the German Commercial Code and Fiscal Code, HGB/AO)
- Art. 6 (1)(a) GDPR – Consent (e.g. marketing, tracking via the Facebook Pixel)
- Art. 6 (1)(f) GDPR – Legitimate interests (security, fraud prevention, technical operation)
2. Data We Collect at Purchase
When you place an order, we collect: first and last name, email address, phone number (optional), billing address, products purchased, IP address, and time of purchase. Payment data is processed directly by Stripe or PayPal. We store only reference IDs, never full card details.
Purpose: Contract fulfillment, ticket issuance, access provisioning, invoicing.
Retention period: Invoice data for 10 years (§ 147 AO); contact data until withdrawal or the end of the business relationship, plus a 3-year limitation period.
3. Payment Service Providers
3.1 Stripe
Payment processing via Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA). Stripe processes credit card data in a PCI-DSS-compliant manner. Data transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 GDPR).
Privacy policy: stripe.com/de/privacy
3.2 PayPal
As an alternative, you can pay via PayPal (Europe) S.à r.l. et Cie, S.C.A. PayPal may carry out credit checks. Data transfer to the USA is based on the EU Standard Contractual Clauses.
Privacy policy: paypal.com/de/…/privacy-full
4. Hosting and Infrastructure
4.1 Cloudflare
Our website is operated via Cloudflare, Inc. (USA) as a CDN and DNS provider. All incoming requests are routed through Cloudflare servers, during which IP addresses and request data may be processed. Data transfer to the USA is based on the EU Standard Contractual Clauses. Legal basis: legitimate interest (secure, fast operation).
Privacy policy: cloudflare.com/de-de/privacypolicy/
4.2 Google Fonts
This website loads fonts from Google Fonts (Google Ireland Ltd., Ireland). In doing so, your IP address is transmitted to Google servers. Legal basis: legitimate interest (a consistent visual appearance).
Privacy policy: policies.google.com/privacy
4.3 Wistia (Video Hosting)
Videos are embedded via Wistia, Inc. (USA). When you play a video, usage data is transmitted to Wistia. Data transfer to the USA is based on the EU Standard Contractual Clauses.
Privacy policy: wistia.com/privacy
5. Tracking and Marketing
5.1 Facebook Pixel (Meta)
This website uses the Facebook Pixel from Meta Platforms Ireland Ltd. (Ireland). The pixel enables conversion measurement and the creation of custom audiences for advertising. Data is transmitted to Meta, potentially to the USA. Legal basis: consent (Art. 6 (1)(a) GDPR). You can object to this use at: facebook.com/settings?tab=ads
6. Automation and CRM
6.1 N8N (Workflow Automation)
We use N8N to automate our workflows. In doing so, purchase data (name, email, product) is processed. Legal basis: performance of a contract (Art. 6 (1)(b) GDPR).
Privacy policy: n8n.io/legal/privacy
6.2 Airtable (CRM)
Customer data (name, email, purchase information) is stored in Airtable (Formagrid Inc., USA). Data transfer to the USA is based on the EU Standard Contractual Clauses. Legal basis: legitimate interest (customer management).
Privacy policy: airtable.com/privacy
7. AI Services (Sophia AI)
As part of our offerings, you may be granted access to the AI assistant "Sophia" (provided via fragsophia.ai). When you use it, your inputs and conversation data are processed. We recommend that you not enter particularly sensitive personal data into the chat. Legal basis: performance of a contract (Art. 6 (1)(b) GDPR).
8. Community Platform (Skool)
Community content is provided via Skool (Skool PBC, USA). By joining the community, you agree to Skool's terms of use.
Privacy policy: skool.com/privacy
9. Email Communication
After a purchase, we send confirmation emails and product-related information (legal basis: Art. 6 (1)(b) GDPR). For promotional emails, we obtain your separate consent. You can unsubscribe at any time by clicking the unsubscribe link or by emailing [email protected].
10. Your Rights (GDPR)
You have the following rights regarding your personal data:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR)
- Withdrawal of consent at any time with effect for the future
Requests to: [email protected]
Complaints to the State Commissioner for Data Protection of Saarland: datenschutz.saarland.de
11. Data Security
Our website uses SSL/TLS encryption. Payment data is transmitted exclusively through the secure systems of Stripe and PayPal and is not stored by us in plain text.