Privacy Policy

---

1. Who is responsible

The controller for this website and our services is:

[to be completed] [to be completed], [to be completed] Berlin, Germany Email: dina@dinahegazi.com · Phone: [to be completed]

For anything about your data, write to dina@dinahegazi.com. We don't have a data protection officer because the law doesn't require one for a business of our size.

2. The short version

• We collect what we need to run bookings, courses, the Practice Circle and your account, and to answer you.
• Readings and live sessions can reveal very personal things: your beliefs, health, grief, family. We treat this as special-category data. We only record or keep it with your explicit consent, and only Dina and her authorised team can see it.
• Analytics and advertising cookies run only if you say yes. Change your choice any time under Cookie settings in the footer.
• We don't sell your data.
• Some of our providers are in the USA. We only use them with legal safeguards (section 14).

3. Visiting the website

What: IP address, date and time, page, browser, device, referrer. Our hosting provider processes this in server logs. Why and basis: to deliver the site securely and to find errors and attacks. Art. 6(1)(f) GDPR (legitimate interest in a secure, working website); storage on your device only as strictly necessary (§ 25(2) Nr. 2 TDDDG). Retention: server logs are deleted after 30 days at most, unless needed to investigate an attack.

Strictly necessary storage on your device: your login session (Supabase), your cookie choice, your language and currency choice, and whether you've closed a pop-up. These don't need consent (§ 25(2) Nr. 2 TDDDG).

4. Your account, orders and payments

What: name, email, phone number (for live services and reminders), password (stored encrypted), time zone, what you bought, bookings, course progress, invoices, and the consents you gave (with date and wording). Why and basis: to make and perform the contract with you: access, bookings, reminders, receipts (Art. 6(1)(b)). To keep tax and accounting records (Art. 6(1)(c) with § 147 AO and § 257 HGB). Payments: Stripe processes your payment details. We never see your full card number. Stripe also uses some data for fraud prevention and to meet its legal duties as an independent controller (Stripe privacy policy). Practitioner readings: if you book a practitioner, we share your name, the booking time and your notes with that practitioner so they can give the reading. They work for us under confidentiality.

5. Private readings

What: your booking notes, what is said in the reading, and (if you agree) the video and audio recording and an automatic transcript. Why: to give you the reading, send you your recording (usually within about 24 hours), and answer follow-up questions. Basis: the reading itself is performance of the contract (Art. 6(1)(b)). Because a reading can reveal beliefs, health and other sensitive matters, we record and transcribe it only with your explicit consent (Art. 9(2)(a) and 6(1)(a)), which you give with a separate box at booking. Readings are recorded so you receive your recording. You can ask us at any time to delete your recording and transcript; email dina@dinahegazi.com. Who can see it: you, Dina (or your practitioner), and her authorised admin team. Recordings are stored privately in the EU, never at a public link. Retention: we keep reading recordings and transcripts for 12 months after the reading so you can download them, then delete them, unless you ask us to delete them earlier or agree that we keep them longer. Withdrawing consent: email us or use your account. We then delete the recording and transcript. Withdrawal doesn't affect what we did before. We never publish anything from your reading without your separate, written permission for that specific use.

6. Recordings of live group sessions

• What we record: video, sound and an automatic transcript of live group sessions, the display name you use in the room, and who attended.
• Why: to deliver replays of courses, workshops and events you bought (not the Practice Circle); keep Dina's private archive and improve her teaching; develop courses, articles, a book and other content, anonymised unless you agreed otherwise; and for safeguarding and handling complaints.
• Legal basis: your explicit consent under GDPR Articles 6(1)(a) and 9(2)(a), because sessions can reveal beliefs, health or personal circumstances; contract performance under Article 6(1)(b) for replays included in what you bought; and separate optional consent under Article 6(1)(a) for public use of identifiable clips, logged with the date and wording. For publishing images of identifiable people, we also rely on your consent under § 22 KUG.
• Access: Dina and her authorised admin team only. Recordings are stored privately in the EU, never at a public link.
• Retention: full recordings and transcripts are kept while needed for these purposes, and the archive is reviewed every two years. Published clips stay online until you withdraw consent.
• Your rights: withdraw clip consent any time in account settings or by email; ask us to delete or blur the parts where you are identifiable. All other rights in section 16 apply.
• Children: if a child appears in a family event, we need a parent's consent for recording and never publish a child without separate written consent from a parent.

7. Contact form, chat, WhatsApp and Telegram

Contact form and website chat: we store your name, email and messages to answer you (Art. 6(1)(b) or (f)). If you tell us about your health, beliefs or other sensitive matters, we use that only to answer you (Art. 9(2)(a); you choose to share it). Chats are kept for 24 months after the last message.

Telegram alerts: when you write in the website chat, Dina gets a short alert in the Telegram app with your first name and a link to our admin chat. The message itself is not sent to Telegram; it stays on our own systems.

WhatsApp: if you click the WhatsApp button, you leave our site and message us through WhatsApp (WhatsApp Ireland Ltd, Meta). WhatsApp's own privacy policy applies. Don't send sensitive details there if you'd rather not.

8. Newsletter and emails

• Newsletter and free resources: we send them only if you sign up and confirm your email address (double opt-in). Basis: your consent (Art. 6(1)(a)). We log the signup time, the confirmation time and the wording you agreed to.
• Opens and clicks: our emails include a small image and tracked links so we can see whether an email was opened and which link was clicked. This is tied to your email address, and we use it to improve our emails and send less to people who don't read them. It's part of the consent you give when you sign up. You can unsubscribe at any time with the link in every email.
• Emails to customers: if you bought from us, we may email you about similar courses and events (§ 7(3) UWG, Art. 6(1)(f)). You can object any time, free of charge, with the link in every email or by replying.
• Review requests: after a completed reading, course or event we may ask you once, with one reminder, to review it (Art. 6(1)(f), § 7(3) UWG). You can object any time.
• Unfinished checkout: we send a reminder only if you agreed to it at checkout [build: consent box; otherwise switch these emails off].
• Service emails (confirmations, reminders, access links, receipts, changes to your booking) are part of the contract (Art. 6(1)(b)).
• Emails are sent by Resend (section 14).

9. Analytics and advertising (only with your consent)

We use these only if you click "Accept" or turn them on in Cookie settings. Basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw at any time in Cookie settings (footer). We then stop, and delete our advertising cookie.

• Google Analytics 4 (Google Ireland Ltd): how visitors use the site (pages, device, rough location, events such as "started checkout"). GA4 doesn't store full IP addresses. Retention in GA: 14 months.
• Google Ads measurement (Google Ireland Ltd): if you accept marketing cookies, we store which ad or campaign brought you here (for example a Google Ads click ID or UTM tags) in a first-party cookie (dh_attr, 90 days). We share whether you then booked, bought, subscribed or signed up with Google Ads and Google Analytics, so we can see which ads work. For Google Ads enhanced conversions, your email address is hashed (SHA-256) in your browser before it is sent. Google may process this data as an independent controller (Google privacy).
• Google may transfer data to the USA (section 14).
• Before you consent we don't set any analytics or advertising cookies or identifiers. [build: move gclid capture behind marketing consent; see gap report #40]
• Global Privacy Control: if your browser sends a GPC signal, we treat it as "reject marketing cookies" [build].

Cookie settings

10. AI tools we use

We use AI to run parts of our service. We never use AI to make decisions about you that have legal or similarly significant effects.

Our AI providers process your inputs on our behalf and, under their business terms, don't use them to train their models. AI answers are labelled as AI and can be wrong.

11. Account tools, journal and course activities

If you use the journal, exercises, quizzes or practice tools in your account, we store what you enter so you can see your progress (Art. 6(1)(b)). Anything personal you write there (for example about health or beliefs) is stored because you chose to enter it (Art. 9(2)(a)), is visible only to you and to admins only for support, and is deleted with your account. Push notifications: only if you allow them in your browser (§ 25(1) TDDDG, Art. 6(1)(a)); your browser's push service (Google, Apple or Mozilla) delivers them. You can turn them off in the browser or your account.

12. Withdrawal and cancellation buttons

If you use "Withdraw from a purchase" or "Cancel a subscription", we process your name, email, the contract and the time, to handle your request and send the legally required confirmation (Art. 6(1)(c) with § 356a and § 312k BGB). Kept for 3 years after the end of the year (limitation period).

13. How long we keep data

14. Service providers and international transfers

We use these providers. Each one that processes data for us has signed a data processing agreement (Art. 28). Where data leaves the EU/EEA, we rely on the EU-US Data Privacy Framework (DPF; the provider is certified) and/or the EU Standard Contractual Clauses (SCC). The DPF remains valid as of today; an appeal is pending at the EU Court of Justice.

We share data with authorities only when the law requires it, and with our tax adviser for accounting.

15. Children

Our services are for adults. You must be 18 to book a reading or buy on this site. We don't knowingly collect data from children under 16 (or under 13 in the USA). Family workshops need a parent to book and be present. If you think a child has given us data, write to us and we'll delete it.

16. Your rights

You have the right to:

• access your data (Art. 15) and get a copy;
• correct it (Art. 16);
• delete it (Art. 17) or restrict its use (Art. 18);
• take it with you in a common format (Art. 20);
• withdraw any consent at any time with effect for the future (Art. 7(3)): in your account, in Cookie settings, with the unsubscribe link, or by email;
• object at any time to processing based on legitimate interest, including direct marketing (Art. 21). For direct marketing we always stop.

Email dina@dinahegazi.com. We answer within one month.

You can also complain to a data protection authority, for example ours: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de, or the authority where you live or work.

Automated decisions: we don't make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Art. 22).

17. If you live in the USA

• We don't sell your personal information, and we don't share it for cross-context behavioural advertising unless you accept marketing cookies. You can switch them off at any time in Cookie settings. We honour Global Privacy Control signals [build].
• Depending on your state, you may have rights to know, access, correct and delete your data and to opt out of targeted advertising. Email dina@dinahegazi.com; we'll respond whether or not your state's law applies to us. We won't discriminate against you for using these rights.
• Our site is not directed at children under 13 and we don't knowingly collect their data (COPPA).

18. If you live in the UK or Switzerland

We process your data under the UK GDPR / Swiss Federal Act on Data Protection as well. You can complain to the UK Information Commissioner's Office (ico.org.uk) or the Swiss FDPIC (edoeb.admin.ch). Transfers from the UK/Switzerland to the EU are covered by adequacy decisions.

19. Changes

We update this policy when our services or the law change. The date at the top shows the current version. If a change affects something you consented to, we'll ask you again.