Privacy Policy
Effective: August 2026
1. Responsible
The person responsible for processing personal data on this website is:
Johanna Spatz
Johanna Spatz - Coaching & Consulting
Tierparkallee 9
22527 Hamburg
Germany
Email: hello@johannaspatz.com
2. General information on data processing
I process personal data only to the extent necessary to provide this website, communicate with you, take steps before entering into or perform a contract, comply with legal obligations, or on the basis of your consent.
Unless a more specific retention period is stated below, I delete personal data once the relevant purpose no longer applies and there is no statutory retention obligation or legitimate interest in continued storage. Accounting vouchers and certain tax-relevant records may in particular be retained for eight years, and received and sent business correspondence for six years. Contract data may also be retained where required for those obligations or to establish, exercise or defend legal claims until the relevant limitation periods have expired.
3. Hosting and delivery by Squarespace
This website is hosted and delivered through Squarespace. The provider for users in the European Economic Area is:
Squarespace Ireland Limited
Squarespace House
Ship Street Great
Dublin 8, D08N12C
Ireland
When you visit the website, Squarespace processes technically necessary data, including your IP address, date and time, content accessed, referrer URL, browser and device information and, where applicable, security and error data. This processing is necessary to deliver the website securely, reliably and without errors.
The legal basis is Article 6(1)(f) GDPR. My legitimate interest is the secure and functional provision of my online offering. Where information is stored on or accessed from your device, this is based on section 25(2) no. 2 TDDDG to the extent strictly necessary to provide the website service expressly requested by you.
Squarespace processes part of the data on my behalf under its data processing terms. Squarespace may use additional service providers and group companies outside the EU or European Economic Area. Where data is transferred to a country without an adequacy decision, Squarespace relies in particular on appropriate safeguards such as the EU Standard Contractual Clauses. Where applicable, the EU-US Data Privacy Framework may also be used.
More information: https://www.squarespace.com/privacy and https://www.squarespace.com/dpa
4. Strictly necessary cookies and similar technologies
Squarespace uses strictly necessary cookies and similar storage technologies to provide core functions such as navigation, security, form protection and storage of your cookie choices. These may include session and consent cookies.
Processing is based on Article 6(1)(f) GDPR. Where access to your device is strictly necessary, section 25(2) no. 2 TDDDG applies. My legitimate interest is the secure, user-friendly and lawful provision of the website.
5. Squarespace Analytics – only with your consent
With your consent, I use Squarespace Analytics to understand in aggregated form how the website is used and which content is particularly relevant. Data processed may include pages viewed, time spent, approximate location, referrer, browser and device information, and a pseudonymous visitor identifier.
Squarespace may in particular set the following analytics cookies:
· ss_cid, ss_cpvisit and ss_cvr – retained for up to two years according to Squarespace;
· ss_cvisit and ss_cvt – retained for approximately 30 minutes according to Squarespace.
The legal basis is your consent under Article 6(1)(a) GDPR. Storing information on or accessing information from your device is based on your consent under section 25(1) TDDDG. You may withdraw or change your consent at any time with effect for the future through the “Cookie Settings” link in the footer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Squarespace Analytics is activated only after you have consented to analytics cookies. The Squarespace Activity Log is disabled.
6. Cookie settings
On your first visit, you can accept, reject or individually manage non-essential cookies. Your choice is stored in consent cookies. According to Squarespace, these are retained for up to 30 days.
If you delete cookies in your browser, the website may no longer recognise your choice and may ask you again.
7. Language versions provided through Weglot
I use Weglot to provide different language versions. The provider is:
Weglot SAS
7 cité Paradis
75010 Paris
France
Weglot processes the website source text and translations, as well as technically necessary data, to deliver the appropriate language version. This may include technical information such as your IP address, browser data and selected language. Weglot may use storage technologies required for translations and language paths.
The legal basis is Article 6(1)(f) GDPR. My legitimate interest is to provide my services in multiple languages in a user-friendly manner. Where device access is strictly necessary for the translation function requested by you, section 25(2) no. 2 TDDDG applies. Any non-essential storage of a language preference takes place only with your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG.
Weglot states that it stores data on servers in the EU. Where subprocessors outside the EU or European Economic Area are used, Weglot states that it relies on appropriate transfer mechanisms such as adequacy decisions, the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
More information: https://www.weglot.com/privacy
8. Contact form and enquiries
If you contact me through a form or by email, I process the information you provide. This may include your name, organisation, email address, telephone number, message and related communication data. Required fields are marked in the form.
Forms are provided through Squarespace. In addition to being delivered by email, submitted information may be stored in Squarespace Contacts. The form message is sent to my mailbox at hello@johannaspatz.com, which is hosted by IONOS.
Processing is carried out to respond to your enquiry. If your enquiry relates to steps before entering into or performing a contract, the legal basis is Article 6(1)(b) GDPR. General enquiries are processed on the basis of Article 6(1)(f) GDPR; my legitimate interest is responding appropriately and maintaining business contacts.
I delete enquiries once they have been fully dealt with, unless contractual, statutory or evidentiary reasons require continued retention. The periods in section 2 may apply to business correspondence and contract records.
Please do not submit health data or other particularly sensitive information through the general contact form.
9. Email hosting by IONOS
My email mailbox is provided by:
IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany
IONOS processes email and connection data to the extent necessary to provide, deliver, secure and administer the mailbox. Where IONOS acts as my processor, a data processing agreement is in place.
The legal basis depends on the content of the communication: Article 6(1)(b) GDPR for pre-contractual or contractual communications and Article 6(1)(f) GDPR for other business communications. My legitimate interest is secure and reliable email communication.
10. Accessing email through Microsoft Outlook
I use Microsoft Outlook to manage my email communication. The Outlook version I use synchronises a copy of the IONOS mailbox with Microsoft Cloud. Microsoft therefore processes email content, sender and recipient information, attachments, timestamps, and technical connection and usage data.
The provider for customers in the European Economic Area is generally Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Where Microsoft processes data on my behalf, Microsoft's contractual data protection terms apply. Microsoft may process data outside the EU or European Economic Area. Where required, such transfers rely on appropriate safeguards such as the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual communications and Article 6(1)(f) GDPR for other business communications. My legitimate interest is the secure, cross-device organisation of business email.
More information: https://privacy.microsoft.com/privacystatement
11. Form protection through Google reCAPTCHA
Squarespace protects this website's forms by default using Google reCAPTCHA to prevent automated submissions, spam and abuse. Technical and behavioural signals are evaluated for this purpose, such as IP address, browser and device information, referrer, time and interactions with the website. Google processes this data for Squarespace to assess risk and detect abuse.
Processing is based on Article 6(1)(f) GDPR. My legitimate interest is protecting the website, forms and IT systems against spam and abusive access. Where information is stored on or accessed from your device and this is strictly necessary to protect the form expressly requested by you, section 25(2) no. 2 TDDDG applies.
Google may process data outside the EU or European Economic Area. Where required, such transfers rely on appropriate safeguards such as the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
12. External links, including LinkedIn
This website contains ordinary links to external services, including LinkedIn. A connection to the external provider is established only after you click the relevant link. From that point onward, the external provider is responsible for its processing. Please review the privacy information provided there.
13. Recipients and processors
Personal data may be disclosed to technical service providers to the extent necessary, in particular Squarespace, IONOS, Weglot and – depending on the Outlook option used – Microsoft. Where these providers act on my behalf, they are engaged under a data processing agreement. Data is otherwise disclosed only where necessary to perform a contract, required by law, based on your consent, or covered by another lawful basis.
14. Your rights
Subject to the statutory requirements, you have in particular the following rights:
· access to your personal data (Article 15 GDPR),
· rectification of inaccurate or completion of incomplete data (Article 16 GDPR),
· erasure (Article 17 GDPR),
· restriction of processing (Article 18 GDPR),
· data portability (Article 20 GDPR),
· objection to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR),
· withdrawal of consent at any time with effect for the future (Article 7(3) GDPR).
To exercise your rights, email hello@johannaspatz.com.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany
Email: mailbox@datenschutz.hamburg.de
Website: https://datenschutz-hamburg.de
15. Right to object to processing based on legitimate interests
Where I process personal data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. I will then cease processing the relevant data unless I demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required to establish, exercise or defend legal claims.
16. No automated decision-making
No decision based solely on automated processing, including profiling, within the meaning of Article 22 GDPR takes place.
17. Updates to this Privacy Policy
I update this Privacy Policy if the website, services used or applicable law changes. The current version is available on this website.