Privacy Policy
Last updated: April 2026
1. Who We Are
Dina Hegazi ("we", "us") operates dinahegazi.com. Our registered business address is in Berlin, Germany. For data protection inquiries, contact us at dina@dinahegazi.com.
2. Data We Collect
We collect the following categories of personal data:
- Account data: name, email address, and password when you create an account.
- Booking data: name, email, phone number, session preferences, and payment information processed by Stripe.
- Contact form data: name, email, subject, and message content.
- Usage data: pages visited, browser type, device type — only if you consent to analytics cookies.
- Newsletter data: email address when you subscribe.
3. Why We Process Your Data
- To provide our services (readings, courses, community access).
- To process payments via Stripe.
- To respond to your inquiries.
- To send transactional emails (booking confirmations, course access).
- To send marketing communications (only with your consent).
- To improve our website (only with your consent to analytics).
4. Legal Basis (GDPR Art. 6)
- Contract performance: processing bookings, enrollments, and account management.
- Consent: marketing emails, analytics cookies, newsletter.
- Legitimate interest: fraud prevention, service improvement.
5. Cookies
We use a cookie consent banner compliant with GDPR and TTDSG (§ 25 TDDDG). Only essential cookies are set by default. Analytics and marketing cookies are only activated after your explicit consent.
Essential cookies:
- Session authentication (Supabase)
- Cookie consent preferences (localStorage)
Analytics cookies (consent required):
- Google Analytics 4 — used to understand how visitors use the site. IP anonymization is enabled. Data is processed by Google LLC under Standard Contractual Clauses.
Advertising measurement (marketing consent required): If you accept marketing cookies, we share which ad or campaign brought you here (for example a Google Ads click ID or UTM tags) and whether you then booked, bought, subscribed or signed up with Google Ads and Google Analytics 4 (Google LLC), so we can see which ads work. For Google Ads enhanced conversions, your email address is hashed (SHA-256) in your browser before it is sent. You can withdraw this at any time in Cookie settings; we then stop sending it and delete the attribution cookie.
6. Third-Party Processors
- Supabase (Singapore Pte. Ltd.): database hosting, authentication. Data stored in EU (Frankfurt).
- Stripe (Stripe Payments Europe, Ltd.): payment processing.
- Resend (Resend Inc.): transactional and marketing emails.
- Google (Google LLC): analytics (with consent only).
- Lovable (Lovable AB): application hosting.
7. Your Rights
Under GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Request deletion of your data
- Restrict or object to processing
- Data portability
- Withdraw consent at any time
- Lodge a complaint with the Berlin Commissioner for Data Protection (BlnBDI)
To exercise any of these rights, email dina@dinahegazi.com.
8. Data Retention
We retain personal data only as long as necessary for the purposes stated above, or as required by law (e.g., tax records for 10 years under German law). Account data is deleted upon request.
9. Contact
Dina Hegazi
Berlin, Germany
dina@dinahegazi.com