1. Controller and Data Protection

1.1 Controller (Art. 4(7) GDPR)

The controller responsible for the processing of personal data on this website and within our services is:

Hanaa Soliman (Belonging Within)

Business postal address: Will be added once available — Hannover, Germany

Email: info@belongingwithin.com

VAT Identification Number (USt-IdNr.): In progress

Postal address is available from the controller upon request.

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g., names, email addresses).

1.2 Supervisory Authority

The competent data protection authority is the State Commissioner for Data Protection for Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen, LDD), Wieserstraße 5, 30625 Hannover. Contact details are available on its website (www.ldd.niedersachsen.de).

1.3 Revocation of Consent

Many processing operations are performed only on the basis of your express consent. You may revoke any consent you have already given at any time with effect for the future. An informal email to info@belongingwithin.com is sufficient. The lawfulness of the processing carried out before the revocation remains unaffected.

1.4 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. This right is without prejudice to any other administrative or judicial remedy.

1.5 Right to Data Portability

You have the right to receive, or have transmitted to another controller, the personal data you have provided, in a structured, commonly used and machine-readable format, where the processing is based on your consent or on a contract and is carried out by automated means.

1.6 Information, Correction and Erasure

Within the limits of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipient and the purpose of the processing, and, where necessary, to the correction or erasure of that data. Please contact the controller at the address given above.

1.7 Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data, in particular where the accuracy of the data is contested or the processing is based on your consent which you have revoked.

1.8 Right to Object (Art. 21 GDPR)

Where processing is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest) — for example the storage of server log files — you have the right to object at any time, on grounds relating to your particular situation, to such processing. If you object, we will cease to process the personal data concerned unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the purpose of establishing, exercising or defending legal claims.

1.9 SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content (e.g., inquiries or bookings), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the address line changing from “http://” to “https://” and the padlock icon in your browser.

2. Data Collection on This Website

2.1 Server Log Files

The provider of this website automatically collects information in so-called server log files, which your browser transmits to us:

• Browser type and version
• Operating system used
• Referrer URL (the page previously visited)
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a technically error-free presentation and optimisation of the website). Retention period: log files are deleted automatically within 14 days, unless there is a specific suspicion of unlawful use.

2.2 Contact Form and Email Inquiries

If you send us inquiries via the contact form (WPForms) or by email, your details from the inquiry, including the contact details you provided, will be stored for the purpose of processing the inquiry and in case of follow-up questions. We do not pass on this data without your consent.

The legal basis is Art. 6(1)(b) GDPR where your request relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) where such consent has been requested.

Retention period: inquiries are deleted once they are no longer required for processing and no statutory retention obligations apply (generally upon completion of the matter).

2.3 Newsletter Subscription

You can subscribe to our newsletter via the signup form on our homepage, which sends you new blog posts, updates and event announcements. On subscription, your email address and — to document your consent — the time and circumstances of registration are processed.

The legal basis is your consent under Art. 6(1)(a) GDPR. Consent is given at the point of subscription and can be revoked at any time via the unsubscribe link contained in every newsletter.

Retention period: the email address is stored until you revoke your consent or unsubscribe, after which it is deleted.

2.4 Google Fonts

To ensure a consistent display of fonts, this website uses so-called Google Fonts provided by Google Ireland Limited / Google LLC, Mountain View, USA. When a page is opened, your browser loads the required fonts into the browser cache, and at the same time your IP address and other information are transmitted to Google.

The legal basis is our legitimate interest in a consistent, appealing presentation (Art. 6(1)(f) GDPR).

Storage and third-country transfer: Because Google is based in the USA, data may be processed in a third country. We rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) for this transfer.

Retention period: fonts are stored in the browser cache until deleted.

2.5 Links to Social Networks (Facebook, Instagram)

Our website contains links to profiles on social networks (e.g., Facebook / Meta Platforms, Inc. and Instagram / Meta). When such a link is clicked, your IP address and possibly other usage data are transmitted to the respective provider, because a connection to their servers is established (cf. CJEU, judgment of 05.06.2018, C-639/21).

We are not responsible for this processing, but we can influence it by avoiding technical integrations (e.g., “Like” buttons that already transmit data when the page is loaded). The legal basis is our legitimate interest in linking to our social media presences (Art. 6(1)(f) GDPR).

2.6 Cookies and Consent Banner

We use a cookie-consent plugin (WP Consent). It stores your consent decision in the cookie `wpconsent_preferences` (30-day duration) so you are not asked again on a return visit. This cookie is technically necessary and requires no separate consent.

An overview of all cookies used, with their purpose and duration, is provided in our Cookie Policy.

3. Data Processing in the Course of the Client Relationship (Online and In-Person Sessions)

3.1 Categories of Data Processed

To provide all sessions offered through this website, we process the following personal and contractual data:

• Client data: name, date of birth, contact details (address, email, phone number)
• Contract and billing data: booking dates, service descriptions, invoices, payment status, bank and payment details
• Session notes: handwritten or digital notes to track your progress

3.2 Special Categories of Personal Data (Art. 9 GDPR)

Our services are explicitly structured as non-medical personal development coaching, personality development and somatic relaxation. We do not diagnose or treat medical or psychological conditions.

In the course of a session, however, information about your emotional, physical or psychological state may arise (e.g., spontaneous disclosures during somatic exercises, and confirmations within our intake / consent document). Such information constitutes special categories of personal data within the meaning of Art. 9 GDPR.

The legal basis for processing such data is your explicit consent under Art. 9(2)(a) GDPR, which you give by signing our intake / consent document (Intake Waiver). This consent is voluntary; refusing it does not affect the provision of the service but may limit the carrying out of certain exercises. The data are processed solely to conduct the booked session safely and appropriately.

3.3 Legal Basis (Standard Data)

The processing of standard client data is based on Art. 6(1)(b) GDPR (performance of the contract or pre-contractual measures). Processing for tax and accounting purposes (e.g., retention of invoices) is based on Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB.

3.4 Retention Periods

Contract, billing data and business correspondence are kept in accordance with statutory retention periods (generally 8 to 10 years under § 147 AO and § 257 HGB). Pure session notes that are not required for a tax or accounting audit are deleted once they are no longer required for the client relationship, or upon your explicit request, provided no statutory retention obligations apply.

4. In-Person Sessions

If you take part in local, in-person sessions, the following rules apply:

• Access control: data collected for scheduling physical appointments is restricted to organisational administration.
• Physical security: physical documents, signed intake forms and handwritten session notes are kept in a locked archive protected against third-party access.
• Digital transmission: where physical forms are scanned, they are stored on encrypted media meeting GDPR security standards.

5. Online Sessions via Zoom

We use the video conferencing tool Zoom for online sessions, coaching and consultations.

Provider: Zoom Video Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA.

Data processed:

• User data: first and last name, email address, (optional) profile picture
• Meeting metadata: topic, description (optional), participants’ IP addresses, device/hardware information
• Video and audio data: to enable video and audio, your microphone and camera data are processed encrypted during the session. You can switch off your camera or mute your microphone at any time.

Data-minimising security configuration:

• No cloud recordings: sessions are never recorded in the Zoom Cloud or on any other cloud server. Local recordings are made only with your separate, explicit and prior written consent.
• Disabled transcription and AI features: automated transcription, chat-log archiving and Zoom AI features are disabled for our sessions.
• Enhanced meeting security: every session requires a unique passcode and uses the Waiting Room feature to prevent unauthorised access.

Legal basis: Art. 6(1)(b) GDPR (performance of or initiation of a contract for coaching/consulting services).

Third-country transfer: Because Zoom is based in the USA, data is processed in a third country. We rely on a data processing agreement with Zoom incorporating the EU Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR. Where technically feasible, data processing is routed through data centres in the European Economic Area (EEA).

6. Transfer to Third Parties

Your personal data is transferred to third parties only in the following cases:

• you have given your express consent (Art. 6(1)(a) GDPR);
• the transfer is necessary for the performance of a contract with you (Art. 6(1)(b) GDPR), such as transferring payment details to a bank or payment service provider;
• a legal obligation exists (Art. 6(1)(c) GDPR), such as submitting accounting and payment records to our tax adviser or the relevant tax office.

7. Your Rights as a Data Subject (Overview)

You have the following rights against the controller:

• Right to access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw a given consent (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

8. Changes to This Privacy Policy

We will update this Privacy Policy if the types of data collected, the purpose of processing, or the technologies used change. The current version is always available on this website.