Privacy
Who is responsible for your data
Controller within the meaning of Article 4(7) of the GDPR:
- Robin Klein, Casa Luz
- Address: Am Goldsteinpark 31, 60529 Frankfurt am Main, Germany
- Email: info@casa-luz.eu
I have not appointed a data protection officer and am not required to appoint one. I do not have 20 or more persons permanently engaged in the automated processing of personal data (Section 38(1) sentence 1 BDSG); my processing is not of a kind that requires a data protection impact assessment, and I do not process personal data commercially for the purpose of transfer or for market or opinion research (Section 38(1) sentence 2 BDSG); and my core activities consist neither of processing operations requiring regular and systematic monitoring of data subjects on a large scale, nor of processing special categories of personal data on a large scale (Article 37(1) of the GDPR). Please address all data protection matters directly to me.
What data is collected, and where it comes from
Through the contact form I receive the email address you enter, the name you enter (this field is optional), the content of your message, and the date and time you sent it. The same applies if you write by email, and to the information you give me if you telephone.
I do not obtain any personal data about you from other sources, and I do not buy, rent or receive data from third parties.
About health information. The contact form does not ask about your health. If you choose to describe your situation and this includes information about your health, that information is a special category of personal data under Article 9 of the GDPR. It is read by me alone and treated with the same protection it would receive at a medical practice. You are under no obligation to tell me anything about your health in order to make contact: you may describe your enquiry in general terms, or tell me that you would rather speak, and we will arrange a call.
Why it is processed
To read your message, to reply to it, and where appropriate to agree an appointment with you. For nothing else. Your data is never used for advertising, no profiles are built from it, and no decisions about you are taken by automated means.
Legal basis
Your contact details and the content of your message. Where your enquiry concerns a possible session, the legal basis is Article 6(1)(b) of the GDPR: the processing is carried out at your request in order to take steps prior to entering into a contract. Where your enquiry does not relate to a possible session, the legal basis is Article 6(1)(f) of the GDPR; my legitimate interest is in being able to answer enquiries addressed to me.
Health information. If your message contains information about your health, or any other special category of personal data within the meaning of Article 9(1) of the GDPR, I process that information solely on the basis of your explicit consent under Article 9(2)(a) of the GDPR, which you give by ticking the box provided for that purpose on the form. If your message contains health information although you have not ticked that box, I will use it only in order to reply to you, and will delete it as soon as your enquiry has been dealt with.
Server log files. Article 6(1)(f) of the GDPR — see the separate section below, where the legitimate interest is stated.
Documents subject to statutory retention. Article 6(1)(c) of the GDPR, together with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).
Withdrawing your consent
You may withdraw your consent at any time, with effect for the future and without giving reasons, by sending me an informal message to info@casa-luz.eu or to the postal address above. Withdrawal does not affect the lawfulness of the processing carried out on the basis of that consent before it was withdrawn. After a withdrawal I delete the health information you sent me, unless I am legally required to keep it or need it to establish, exercise or defend legal claims (Article 9(2)(f) of the GDPR).
Instagram Automation and Data Privacy
Casa Luz uses an application called Casa Luz Automation to automatically respond to certain Instagram comments and messages.
When you comment on a Casa Luz Instagram post using a specified keyword, such as “PESTO”, the application may temporarily process your Instagram username, account identifier, comment and post information through Meta’s official Instagram API and Cloudflare Workers.
This information is used solely to identify the requested resource and send an appropriate private reply through Instagram. Processing is based on our legitimate interest in responding to requests voluntarily initiated by Instagram users (Article 6(1)(f) GDPR).
Casa Luz does not maintain a separate database of Instagram comments, messages or followers for this automation. Information may be temporarily processed by the technical providers, including limited operational and security logs, according to their applicable settings.
Messages and comments remain available through Instagram in accordance with Meta’s own privacy policies.
You can request information about or deletion of any personal data held by Casa Luz in connection with this automation by contacting info@casa-luz.eu. Requests are handled in accordance with applicable data protection law.
For information about Instagram’s independent data processing, please see Meta’s Privacy Policy.
Whether you have to provide it
Providing your email address and your message is necessary in order to receive an answer; without them there is no way to reply to you. Giving your name is optional. There is no obligation to provide any information about your health, and choosing not to has no consequence for you.
Server log files
When you open this website, technical access data is automatically recorded in server log files by the hosting provider: the date and time of the request, the page or file requested, the amount of data transferred, the status code, the referring page, and the browser and operating system reported by your browser, together with the visitor’s IP address. According to the information published by the hosting provider, IP addresses are stored in the log files in anonymised form, and log data is kept for a maximum of eight weeks and then deleted. This data is not merged with any other data and is not used to identify individual visitors.
The legal basis is Article 6(1)(f) of the GDPR. The legitimate interest, mine and the hosting provider’s, lies in delivering this website reliably, in keeping the server stable and secure, and in detecting, preventing and investigating attacks and misuse.
How long it is kept
I keep your enquiry and our correspondence for as long as is needed to deal with it and to handle any questions arising from it. Where there is no further contact, the enquiry is deleted at the latest 12 months after the last communication. If you ask for it to be deleted sooner, it is deleted without delay.
Where an enquiry leads to a session, the documents that are commercial or accounting records are kept for the statutory periods of six or eight years under Section 257 HGB and Section 147 AO; during that time they are restricted to that purpose and not otherwise processed. Health information does not form part of those records: it is deleted once your enquiry has been dealt with, and at the latest 12 months after the last communication, unless you have asked me to keep it or I need it to establish, exercise or defend legal claims.
The website’s outgoing mail log is switched off, so messages are not stored in the website’s database.
Who else receives it
Your data is processed on my behalf by the hosting and email provider IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, on the basis of a data processing agreement under Article 28 of the GDPR. IONOS may engage sub-processors, which it is obliged to bind to equivalent obligations.
Apart from the services named below under “Sessions and conversations at a distance” and “Payment”, I do not pass your data to anyone, unless I am legally obliged to do so or need to in order to establish, exercise or defend legal claims — for example to a tax adviser, a lawyer, a court or a public authority. I do not sell your data and I do not use it for advertising.
The servers and mailboxes behind this website are located within the European Union. For the website itself and for email correspondence with me, no transfer to a country outside the EU or the EEA takes place.
A transfer to the United States does take place when we hold a session over Zoom or speak over WhatsApp, and when you pay by PayPal. What happens in each case, and what the transfer rests on, is set out in the sections “Sessions and conversations at a distance” and “Payment”. Beyond that I do not intend to transfer your data to a third country or to an international organisation; should it become necessary in an individual case, it will take place only where the conditions of Chapter V of the GDPR are met — in particular an adequacy decision under Article 45 or appropriate safeguards under Article 46.
Sessions and conversations at a distance
How we speak is something I agree with you individually before we begin. The usual options are the telephone, Zoom and WhatsApp. What each one means for your data is set out here, so that you can choose knowing enough.
Telephone. The usual connection data arises at the telephone providers involved. I record nothing, and I keep nothing from the conversation itself beyond what I need for scheduling and for my books.
Zoom. The provider is Zoom Communications, Inc., 55 Almaden Boulevard, Suite 600, San Jose, CA 95113, USA. Zoom processes the data on my behalf on the basis of the Data Processing Addendum that forms part of the Zoom Terms of Service (Article 28 GDPR). What arises: the name or display name you join under, your email address if you have a Zoom account, your IP address, details of your device, operating system and connection quality, the start, end and length of the session, and, while the session runs, picture and sound. I do not record sessions and I use neither transcription nor the AI features. By default Zoom sessions are encrypted in transit but not end to end, which means Zoom could technically see the content. The data is transferred to the United States. This rests on the European Commission’s standard contractual clauses under Article 46(2)(c) GDPR, which Zoom has agreed in its Data Processing Addendum; you can ask me for a copy. If you would rather not, we speak by telephone instead — it changes nothing about the work itself.
WhatsApp. The provider for the European Economic Area is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Messages and calls there are encrypted end to end, so WhatsApp cannot read the content. What does arise is traffic data: your telephone number, when, how often and for how long messages or calls are made, together with your IP address and details of your device. That data goes to Meta and is also transferred to the United States. I use WhatsApp only if you approach me there yourself, and WhatsApp has no access to the address book on my device. For anything touching your health, please use the telephone or a Zoom session — over WhatsApp I deal with practical matters such as appointments.
Another route. If you would prefer a different service, say so. I will tell you first what it means for your data, and if we agree on it, the same applies as described here.
Legal basis. For holding the agreed session, Article 6(1)(b) GDPR. Where information about your health comes up, it is processed on the basis of your explicit consent under Article 9(2)(a) GDPR, which you give by choosing one of these routes having read this. You can withdraw it at any time and change route.
Payment
Bank transfer. You transfer the money to my business account. The banks involved receive your name, your IBAN, the amount and the reference; with a transfer that cannot be avoided. The legal basis is Article 6(1)(b) GDPR.
PayPal. If you pay by PayPal, the payment runs through PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal processes the payment data as a controller in its own right and not on my behalf; there is therefore no processing agreement between us, and PayPal’s own privacy policy governs what happens there. From PayPal I receive what I need in order to match the payment, usually your name, the email address held at PayPal and the transaction data. PayPal may also transfer data to the United States and states that it does so on the basis of standard contractual clauses and intra-group agreements. The legal basis for the transfer to PayPal is Article 6(1)(b) GDPR: you choose this way of paying.
Cash. Paying in cash creates no payment data at any third party. What remains is the receipt, which I am required to keep.
Payment records are accounting records. They are kept for the statutory periods set out above under “How long it is kept”.
Security
I apply appropriate technical and organisational measures under Article 32 of the GDPR. This website is delivered over an encrypted TLS connection (recognisable by “https://” and the padlock in your browser), so the contents of the form are encrypted on their way to me. Access to the mailbox and to the website’s administration area is protected by passwords held only by me.
Please note that the form reaches me as an email. Transport encryption is used wherever the mail servers involved support it, but no email can be guaranteed to be encrypted end to end along its whole route. If you would rather not send health information by email, just tell me that you would rather speak, and we will arrange a call.
Cookies
This website uses no cookies or comparable technologies for analytics, advertising, tracking, profiling or social media, and embeds no content from third-party servers. Fonts, scripts, stylesheets and images are stored on this website’s own web space and delivered from there, so your browser establishes no connection to a third-party provider when you visit this site.
Accordingly, no information is stored on your device and no information already stored there is accessed within the meaning of Section 25 TDDDG, and this website therefore displays no consent banner.
The only cookies that can be set are the strictly necessary cookies of the WordPress content management system, which arise when I sign in to the administration area: a cookie testing whether the browser accepts cookies, an authentication cookie, and a cookie storing display preferences for the administration area, the last of which has a lifetime of up to one year. These cookies are not set when you visit the public pages of this website. They are strictly necessary in order to provide a service expressly requested by the user within the meaning of Section 25(2) no. 2 TDDDG, so no consent is required for them.
Your rights
You may at any time request access to your personal data (Article 15), its rectification (Article 16) or erasure (Article 17), the restriction of its processing (Article 18), and its portability (Article 20). You may withdraw a consent you have given at any time with effect for the future (Article 7(3)).
To exercise any of these rights, write to info@casa-luz.eu saying which right you wish to exercise. I will answer without undue delay and in any event within one month of receiving your request. Where a request is particularly complex, or where I receive a large number of requests, that period may be extended by a further two months; I will tell you about any such extension, and the reasons for it, within one month of receiving your request.
Your right to object
Where I process your personal data on the basis of Article 6(1)(f) of the GDPR — on this website the server log files, and any correspondence not connected with a session — you have the right under Article 21(1) of the GDPR to object at any time, on grounds relating to your particular situation, to that processing. If you object, I will no longer process the data concerned unless I can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims. An informal message to info@casa-luz.eu is enough. I do not process your data for direct marketing purposes.
Complaints
If you consider that your data has not been handled in accordance with the law, you may lodge a complaint with a supervisory authority (Article 77 of the GDPR), in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The authority responsible for me is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Postfach 31 63, 65021 Wiesbaden — visitors: Wilhelmstraße 7, 65185 Wiesbaden Telephone +49 611 1408-0 — poststelle@datenschutz.hessen.de — datenschutz.hessen.de
You are also welcome to write to me directly first, at info@casa-luz.eu.
Children
This website and the work described on it are directed at adults. I do not knowingly collect personal data from children. If you are under 16, please do not send me personal data through the contact form — and in particular no health information — without the consent of the holder of parental responsibility (Article 8 of the GDPR; the age limit in Germany is 16). If I become aware that I have received data from a child without such consent, I delete it.
Changes to this policy
This policy may be updated to reflect changes in the way the website works or in the applicable law. The date of the last update is shown below, and the version in force is always the one published here.
Last updated: 15 September 2026