Privacy policy
1. Overview
General information
The following gives a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information on data protection can be found in the privacy policy set out below this text.
Data collection on this website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. Their contact details can be found in the section "Information about the controller" in this privacy policy.
How do I collect your data?
Some data is collected because you provide it to me, e.g. by email, or when you book an appointment with me. Other data is collected automatically when you visit the website, by my IT systems or those of my hosting provider. This is mainly technical data (e.g. browser, operating system, or time of the page request). This data is collected automatically as soon as you enter this website.
What do I use your data for?
Some of the data is collected to ensure the website is provided without errors. Other data may be used to process your contact request or to book a consultation call.
What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the origin, recipient, and purpose of your stored personal data. You also have a right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time with future effect. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. If you have any questions on this or other data protection matters, you can contact me at any time (see contact details below).
2. Hosting
I host the content of this website with the following provider:
External hosting
This website is hosted externally. The personal data collected on this website is stored on the hosting provider's servers. This may include, in particular, IP addresses, contact requests, meta and communication data, website visits, and other data generated through a website.
External hosting is carried out in the interest of a secure, fast, and efficient provision of this online service by a professional provider (Art. 6(1)(f) GDPR).
The hosting provider will only process your data to the extent necessary to fulfil its service obligations and will follow my instructions with regard to this data.
I use the following hosting provider: Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA.
Data processing agreement: Netlify's Data Processing Agreement is automatically incorporated into the contractual relationship with Netlify and ensures that Netlify processes website visitors' personal data only on my instructions and in compliance with the GDPR. Netlify also participates in the EU-U.S. Data Privacy Framework (as well as its UK and Swiss extensions), which provides an additional legal basis for the transfer of data to the USA. More information: netlify.com/privacy.
3. General information and mandatory disclosures
Data protection
I take the protection of your personal data very seriously. I treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.
When you use this website, various pieces of personal data are collected. This privacy policy explains what data I collect and what I use it for. It also explains how and for what purpose this happens.
Please note that data transmitted over the internet (e.g. when communicating by email) may be subject to security gaps. Complete protection of data against access by third parties is not possible.
Information about the controller
The controller responsible for data processing on this website is:
Rafael Gaviria Consulting
Hauptstr. 81, 10317 Berlin, Germany
Email: hola@rafaelgaviria.de
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
Storage period
Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with me until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted, unless I have other legally permissible reasons for storing your personal data (e.g. tax or commercial law retention periods); in the latter case, deletion will take place once those reasons no longer apply.
General information on the legal basis for data processing
Where you have given consent to data processing, I process your personal data on the basis of Art. 6(1)(a) GDPR. In the case of explicit consent to the transfer of personal data to third countries, processing is additionally based on Art. 49(1)(a) GDPR. Where you have consented to the storage of cookies or access to information on your device, processing is additionally based on Section 25(1) TDDDG (German Telecommunications-Telemedia Data Protection Act). Consent can be revoked at any time. Where your data is required for the performance of a contract or to carry out pre-contractual measures, I process your data on the basis of Art. 6(1)(b) GDPR. Data processing may also be based on my legitimate interest under Art. 6(1)(f) GDPR. The relevant legal basis in each case is stated in the following sections.
Recipients of personal data
As part of my business activities, I work with various external parties (e.g. hosting and appointment-booking providers). I only pass on personal data to external parties where this is necessary for the performance of a contract, where I am legally obliged to do so, where there is a legitimate interest under Art. 6(1)(f) GDPR in the disclosure, or where another legal basis permits the disclosure of data.
Withdrawing your consent to data processing
Many data processing operations are only possible with your express consent. You can revoke consent already given at any time. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.
Right to object to data collection in specific cases (Art. 21 GDPR)
Where data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right, at any time and for reasons arising from your particular situation, to object to the processing of your personal data. If you object, I will no longer process your affected data unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.
Right to lodge a complaint with the competent supervisory authority
In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged breach. The competent authority for me is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
Right to data portability
You have the right to have data which I process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a commonly used, machine-readable format.
Information, rectification, and erasure
Within the scope of applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of data processing, and, where applicable, a right to rectification or erasure of this data. You can contact me at any time regarding this or with further questions.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data, including where:
- you dispute the accuracy of your data stored with me, for the duration of the verification;
- the processing was/is unlawful and you request restriction instead of erasure;
- I no longer need the data, but you need it to assert legal claims;
- you have objected under Art. 21(1) GDPR, pending the outcome of that objection.
4. Data collection on this website
Contact by email
If you send me inquiries by email, your inquiry, including all resulting personal data (name, email address, content of the message), will be stored and processed by me for the purpose of handling your request. I do not pass on this data without your consent.
Processing is based on Art. 6(1)(b) GDPR, where your inquiry relates to the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on my legitimate interest in the effective handling of inquiries addressed to me (Art. 6(1)(f) GDPR).
Data you send me via a contact inquiry remains with me until you ask me to delete it, you revoke your consent to storage, or the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected.
5. Plugins and tools
Web fonts (self-hosted)
This website uses the "DM Sans" typeface for a consistent display of text. The font files are hosted locally on my own server; no connection is made to any third-party servers (e.g. Google), and no data is transmitted to third parties as a result.
Cal.com (appointment booking)
For appointment booking, I use "Cal.com", an online scheduling service provided by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA ("Cal.com"). The buttons "Book a free Profit-Check" and "Book your free Profit-Check" take you to a booking form provided by Cal.com (cal.com). On mobile devices the form opens in a new tab. On larger screens it is embedded in this page only after you click the button. Without your click, no connection to Cal.com is made. When you open the form and book an appointment, personal data such as your name, email address, your answers to the booking questions, the selected time slot, and technical data such as your IP address is transmitted to and processed by Cal.com. Booked appointments are also entered in my own calendar (see "Google Calendar and Google Meet" below).
The link or embedding is provided in my legitimate interest in straightforward and efficient appointment scheduling (Art. 6(1)(f) GDPR). Where a contract is being initiated as part of the booking, processing is additionally based on Art. 6(1)(b) GDPR.
Cal.com processes the data in the USA. The transfer is secured by the EU Standard Contractual Clauses (Art. 46 GDPR). A data processing agreement under Art. 28 GDPR exists with Cal.com. Cal.com's representative in the EU under Art. 27 GDPR is Felix Kolodziej, CAYA Postbox 1040588, 96035 Bamberg, Germany, privacy@cal.com. Further information on how Cal.com handles your data can be found in its privacy policy: cal.com/privacy.
Google Calendar and Google Meet
Booked appointments are entered in my calendar, "Google Calendar", a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your name, email address, and the time of the appointment are processed there.
For video calls that take place as part of booked appointments, I use "Google Meet", also a service provided by Google Ireland Limited. When you join a Meet call, personal data such as your name, email address, and, where applicable, video and audio data is processed.
This use is based on Art. 6(1)(b) GDPR for the performance of the agreed consultation, as well as on my legitimate interest in smooth communication (Art. 6(1)(f) GDPR).
Google also processes some data in the USA; this transfer is based on appropriate safeguards under Art. 46 GDPR and/or the EU-U.S. Data Privacy Framework. Further information: policies.google.com/privacy.