Privacy Policy

The following notice provides a simple overview of what happens to your personal data when you visit our website. Personal data is any information that can be used to personally identify you.

The entity responsible for data processing on this website under the General Data Protection Regulation (GDPR) is:

Georg Johannes Sesterhenn
Breath & Chill
Eitelstraße 86
10317 Berlin
Germany

E-Mail
g.sesterhenn@gmail.com

Google Analytics (Google Ireland Ltd.) is loaded only after you click "Accept" in the cookie notice. It sets cookies and processes shortened IP addresses and usage data to create aggregated statistics; data may be transferred to the USA under the EU-US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw consent at any time via "Cookie settings" in the footer.

If you book a ticket or reserve a seat directly on breathandchill.com, we are the contracting party and the controller of your data. We store your name, email, optional billing address, ticket details and the time you accepted the terms, to fulfil the booking and issue invoices (Art. 6(1)(b) and (c) GDPR; invoices are kept for the statutory retention period). Payments by card or PayPal are processed by Stripe Payments Europe Ltd.; we never see your card data.

Some sessions are booked on a third-party platform such as Eventbrite. In that case our website only links to the platform; your booking, payment and account are handled there under the platform's own terms and privacy policy, and the platform is responsible for that data. As the organiser we receive the attendee details the platform provides to organisers (for example name and email) and use them to run the session. Our website does not send your personal data to these platforms when you merely view a session. To show current event pictures, our server reads the public image of the linked Eventbrite page; this request does not include any visitor data.

The website runs on Cloudflare's network. Supabase provides the database and hosting infrastructure used through Lovable Cloud, where bookings, messages and newsletter subscriptions are stored. Confirmation and newsletter emails are sent via our email service provider. Cloudflare, Supabase and the email service provider act as processors on our behalf (Art. 28 GDPR).

Forms are protected by Cloudflare Turnstile, which checks your browser for bot signals. To stop abuse we also count requests per IP address and email; only a keyed hash of these values is stored and deleted after two days (Art. 6(1)(f) GDPR).

To see how many different visitors use buttons such as "Book now" or the newsletter form, our server records the button, page and time of the click. To count visitors without cookies, it combines your IP address and browser identifier with a secret key and the current calendar week into a one-way hash; only this hash is stored, never your IP address. The hash changes every week, so visits cannot be linked across weeks or traced back to you. Nothing is stored on your device. Legal basis: our legitimate interest in understanding which content helps visitors (Art. 6(1)(f) GDPR).

Upcoming sessions are read from Google Calendar. The free discovery call is booked through Google's appointment page, where Google's privacy policy applies.

We process and store personal data only for the period necessary to achieve the purpose of storage, or as required by statutory laws (such as commercial or tax retention periods). Once the purpose no longer applies or a statutory period expires, the corresponding data is routinely deleted or blocked.

In particular, we apply the following storage criteria:

If you contact us via email or a contact form, your inquiry and personal details will be stored until your request has been fully resolved and no further communication is necessary, unless longer statutory storage obligations apply.

Data collected for booking breathwork sessions, workshops, or 1:1 offerings is retained for the duration of the customer relationship and service delivery.

Invoices, receipts, and accounting-related data associated with paid sessions or merchandise are stored for 10 years in accordance with statutory German commercial and tax regulations (§ 147 AO, § 257 HGB).

Technical access data collected automatically when visiting the website (such as IP addresses, browser types, and access times) is typically stored for 7 days for IT security and server protection purposes before being automatically anonymized or deleted.

Under applicable GDPR regulations, you have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): The right to request information about your stored personal data at any time, free of charge.
• Right to Rectification (Art. 16 GDPR): The right to request the correction of inaccurate data or completion of incomplete data.
• Right to Erasure (Art. 17 GDPR): The right to demand the deletion of your personal data stored by us.
• Right to Restriction of Processing (Art. 18 GDPR): The right to request the restriction of processing your personal data.
• Right to Data Portability (Art. 20 GDPR): The right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent (Art. 7(3) GDPR): The right to withdraw any previously given consent at any time with effect for the future.
• Right to Object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data based on grounds relating to your particular situation.

In the event of GDPR violations, you have the right to lodge a complaint with a supervisory authority (for example, the Berlin Commissioner for Data Protection and Freedom of Information / Berliner Beauftragte für Datenschutz und Informationsfreiheit).

If you have any questions about your data or wish to exercise any of your rights, please reach out directly via email to: g.sesterhenn@gmail.com