DATA PROTECTION
Privacy Policy
Last updated: October 17, 2026
1. General Information
Protecting your personal data is important to me. This Privacy Policy explains how I collect, use, store and protect personal data when you visit my website, www.joshuaschumann.com, or use my coaching services.
Personal data means any information relating to an identified or identifiable individual, such as names, email addresses, contact details and information shared through personal or professional communication.
I process personal data in accordance with applicable data protection laws, in particular the European Union's General Data Protection Regulation (GDPR).
This Privacy Policy applies to website visitors, prospective clients, coaching clients, organisations commissioning coaching services and their contact persons.
2. Data Controller
The person responsible for processing your personal data is:
Joshua Schumann
c/o Impressumservice Dein-Impressum
Stettiner Straße 41
35410 Hungen
Germany
Email: mail@joshuaschumann.com
Website: www.joshuaschumann.com
For any questions regarding privacy or the processing of your personal data, please contact me by email.
3. Website Hosting and Domain Management
Wix
My website is created and hosted using Wix.
The service provider is:
Wix.com Ltd.
40 Namal Tel Aviv St.
Tel Aviv 6350671
Israel
When you visit my website, technically necessary information may be processed to ensure that the website functions properly and securely.
This may include:
-
IP address
-
Date and time of access
-
Pages visited
-
Browser type and operating system
-
Technical connection and usage information
The legal basis for this processing is Article 6(1)(f) GDPR. My legitimate interest is to provide a secure, functional and reliable website.
Wix may process personal data outside the European Economic Area (EEA). Where personal data is transferred to third countries, the applicable safeguards under Articles 44 et seq. GDPR must be observed.
Further information:
https://www.wix.com/about/privacy
https://www.wix.com/about/privacy-dpa-users
STRATO
My website domain is managed by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.
For domain registration and management, STRATO may process personal data necessary for the registration, configuration and administration of the domain.
Depending on the processing activity, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR. My legitimate interest is the reliable administration and availability of my domain.
Further information:
https://www.strato.de/datenschutz/
4. Cookies and Consent Management
My website uses cookies and similar technologies to ensure its technical functionality, security and, where applicable, the integration of third-party services.
Strictly necessary cookies and similar technologies may be used without prior consent in accordance with Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where personal data is processed, the legal basis is, where applicable, Article 6(1)(f) GDPR.
For non-essential technologies requiring consent, such as certain analytics or third-party services, consent is obtained before these technologies are activated. The legal bases are Section 25(1) TDDDG and, where personal data is processed, Article 6(1)(a) GDPR.
I use Usercentrics for Wix to manage cookie preferences and consent. This may involve processing information about your consent choices and technical records necessary to document those choices. The legal basis is Article 6(1)(c) or Article 6(1)(f) GDPR, as applicable.
You can change or withdraw your consent at any time, with effect for the future, through the cookie settings on my website.
Further information:
https://usercentrics.com/privacy-policy/
5. Embedded YouTube Videos
My website includes an embedded video from YouTube, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When a YouTube video is loaded, personal data such as your IP address and technical usage information may be transmitted to Google. Google may also use cookies and similar technologies.
Where consent is required, the video will only be loaded after you have given your consent.
The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG.
Personal data may also be processed outside the European Economic Area. Any such transfers must comply with the applicable requirements under Articles 44 et seq. GDPR.
Further information:
https://policies.google.com/privacy
6. Google Reviews via Elfsight
My website displays Google reviews using the Elfsight service.
The provider is Elfsight, LLC, USA.
This integration allows publicly available reviews to be displayed on my website. In this context, personal data such as IP addresses, browser information and information about interactions with the embedded content may be processed.
Where the integration requires consent for accessing information on your device or processing personal data, the content will only be loaded after your consent has been obtained.
The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
The use of Elfsight may involve transfers of personal data to countries outside the EEA, particularly the United States. Such transfers must comply with Articles 44 et seq. GDPR.
Further information:
https://elfsight.com/privacy-policy/
7. Contact and Email Communication
If you contact me by email or through other communication channels, I process the personal data you provide.
This may include your name, email address, contact details, professional information and the content of your message.
I use this information to respond to inquiries, communicate with you, prepare a potential coaching engagement or manage an existing coaching relationship.
Where processing is necessary to enter into or perform a contract with you, the legal basis is Article 6(1)(b) GDPR.
For other business-related communications, processing is based on Article 6(1)(f) GDPR. My legitimate interest is to respond to inquiries and maintain professional relationships.
Personal data is deleted when it is no longer required for these purposes, unless legal retention obligations or other lawful grounds justify continued storage.
8. Microsoft 365 and STRATO
For my business communication and administrative activities, I use Microsoft 365, provided through STRATO.
The Microsoft service provider is:
Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown, Dublin 18
Ireland
I use Microsoft 365 in particular for:
-
Email communication
-
Calendar and appointment management
-
Creation and administration of business documents
-
Coaching documentation using Microsoft OneNote
-
Preparation and sending of invoices
Personal data processed in this context may include names, contact information, email correspondence, calendar information and documentation relating to coaching engagements.
Depending on the processing activity, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR.
Where processing is necessary to comply with legal obligations, particularly accounting and tax requirements, the legal basis is Article 6(1)(c) GDPR.
Where special categories of personal data are processed, the additional requirements of Article 9 GDPR must be met.
Microsoft 365 may involve the processing of personal data outside the European Economic Area. Any such transfers are subject to the applicable data protection safeguards.
A data processing agreement pursuant to Article 28 GDPR is in place with STRATO.
Further information:
https://privacy.microsoft.com/en-us/privacystatement
https://www.strato.de/datenschutz/
9. Appointment Scheduling via Calendly
I use Calendly to schedule introductory coaching conversations.
The provider is Calendly, LLC, USA.
My website contains links to Calendly's external booking platform. When you follow one of these links, you are redirected to Calendly's website.
When booking an appointment, Calendly may process personal data such as your name, email address, selected appointment time and any additional information you voluntarily provide.
This information is used to organise, prepare and conduct the scheduled appointment.
Where scheduling is necessary for entering into or performing a contract with you, the legal basis is Article 6(1)(b) GDPR.
For other business-related appointments, processing is based on Article 6(1)(f) GDPR. My legitimate interest is efficient and reliable appointment scheduling.
The use of Calendly may involve the transfer of personal data to the United States. Such transfers are subject to the applicable requirements and safeguards under Articles 44 et seq. GDPR.
Alternatively, appointments can be arranged directly by email.
Further information:
https://calendly.com/legal/privacy-notice
10. Processing of Personal Data in Coaching
As part of my professional coaching activities, I process personal data relating to prospective clients, coaching clients, organisations commissioning coaching services and their contact persons.
This may include:
-
Names and contact details
-
Employer, organisation and professional role
-
Appointment and scheduling information
-
Coaching objectives and agreed development steps
-
Email correspondence
-
Contractual and billing information
The processing is carried out to prepare, organise, deliver and administer coaching services.
Where a contract exists or is being negotiated directly with the individual concerned, the legal basis is Article 6(1)(b) GDPR.
Where I process professional contact details of individuals working for client organisations, processing may be based on Article 6(1)(f) GDPR. My legitimate interest is the management of professional relationships and the delivery of agreed coaching services.
Coaching Notes in Microsoft OneNote
Where necessary, I maintain brief coaching notes in Microsoft OneNote to prepare for and support coaching sessions.
These notes may include coaching objectives, key reflections, personal challenges and agreed next steps.
I limit my documentation to information necessary for the coaching process and generally avoid detailed records of private conversations.
Coaching notes are treated confidentially and protected through appropriate technical and organisational security measures.
Where special categories of personal data within the meaning of Article 9 GDPR, such as health-related information, are processed, the additional legal requirements of Article 9 GDPR must be met.
Coaching notes are generally deleted no later than twelve months after the coaching engagement has ended, unless legal obligations or other lawful grounds justify longer retention. Sensitive information that is no longer required will be deleted earlier where possible.
Confidentiality
Confidentiality is a fundamental principle of my coaching practice.
Personal conversations and coaching notes are treated confidentially.
Where coaching is commissioned or financed by an organisation or employer, personal coaching content is not disclosed to that organisation or employer merely because it commissioned or financed the coaching.
Personal information is only shared where there is an appropriate legal basis for doing so.
11. Invoicing and Accounting
To invoice my coaching services, I process the personal data necessary for billing and accounting purposes.
This may include names, billing addresses, descriptions of services, invoice amounts, invoice dates and, where applicable, payment information.
Invoices are prepared manually using my office software.
Depending on the circumstances, the processing is based on Article 6(1)(b) GDPR for contractual obligations with the individual concerned, Article 6(1)(c) GDPR for statutory accounting and tax obligations, or Article 6(1)(f) GDPR for business contact information.
Invoices are generally retained for eight years in accordance with applicable German statutory retention requirements. Other business documents may be subject to different statutory retention periods. The relevant statutory rules determine when the retention period begins.
12. Data Retention and Deletion
I retain personal data only for as long as necessary for the purposes for which it was collected and processed.
Coaching notes are generally deleted no later than twelve months after the coaching engagement has ended, unless another lawful reason for continued retention applies.
Business correspondence, contracts, invoices and other documents may be subject to statutory retention obligations.
Once the applicable retention periods have expired, personal data is deleted unless further retention is legally justified.
13. Disclosure of Personal Data
Personal data is shared with third parties only where necessary for the provision of my services, where required by law or where another lawful basis applies.
Recipients may include the IT and communication service providers described in this Privacy Policy, professional tax advisers and competent public authorities.
Where external service providers process personal data on my behalf, the applicable contractual arrangements for data processing are used.
14. Your Rights Under the GDPR
Subject to the applicable legal requirements, you have the following rights regarding your personal data:
Right of access (Article 15 GDPR): You may request information about the personal data I process about you.
Right to rectification (Article 16 GDPR): You may request correction of inaccurate or completion of incomplete personal data.
Right to erasure (Article 17 GDPR): You may request deletion of your personal data under the applicable conditions.
Right to restriction of processing (Article 18 GDPR): You may request that the processing of your personal data be restricted under certain circumstances.
Right to data portability (Article 20 GDPR): Where the legal requirements are met, you may request to receive certain personal data in a structured, commonly used and machine-readable format or have it transferred to another controller.
Right to object (Article 21 GDPR): Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time.
Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint: You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that your personal data has been processed unlawfully.
To exercise your rights or ask questions about data protection, please contact:
15. Data Security
I implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and misuse.
My website uses SSL/TLS encryption to protect data transmitted between your browser and the website.
Although appropriate security measures are used, communication over the internet, particularly by email, may involve certain risks.
I therefore recommend avoiding the unsolicited transmission of particularly sensitive personal information via unencrypted email.
16. Provision of Personal Data
Providing personal data is generally voluntary.
However, certain information may be required to respond to inquiries, schedule coaching appointments, enter into contractual relationships or provide and invoice coaching services.
Without the necessary information, it may not be possible to respond to a request or provide the requested service.
17. Automated Decision-Making
I do not use solely automated decision-making within the meaning of Article 22 GDPR that produces legal effects concerning individuals or similarly significantly affects them.
18. Changes to This Privacy Policy
I may update this Privacy Policy when legal requirements, services or data processing practices change.
The current version is available on my website at: