Privacy Policy

Preamble

With the following Privacy Policy, we would like to inform you about the types of personal data (hereinafter also referred to as “Data”) we process, the purposes for which we process it, and the scope of such processing. This Privacy Policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “Online Offer”).

As of: June 2, 2026

Table of Contents

• Preamble
• Overview of Processing Activities
• Relevant Legal Bases
• Security Measures
• Transfer of Personal Data
• International Data Transfers
• General Information on Data Storage and Deletion
• Rights of Data Subjects
• Payment Procedures
• Provision of the online service and web hosting
• Contact and inquiry management
• Social media presence (Social Media)
• Changes and Updates
• Definitions

Data Controller

Petra Epp
c/o IP-Management #7161
Ludwig-Erhard-Str. 18
20459 Hamburg
Deutschland

Email Address: info@baumtreemeditation.com

Overview of Processing Activities

The following overview summarizes the types of data processed and the purposes of their processing, and identifies the data subjects.

Types of Data Processed

• Master data.
• Payment data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication, and process data.
• Log data.

Categories of data subjects

• Service recipients and clients.
• Prospective customers.
• Communication partners.
• Users.
• Business and contractual partners.

Purposes of processing

• Provision of contractual services and fulfillment of contractual obligations.
• Communication.
• Security measures.
• Organizational and administrative procedures.
• Feedback.
• Provision of our online services and user-friendliness.
• IT infrastructure.
• Public relations.
• Business processes and operational procedures.

Applicable Legal Bases

Applicable Legal Bases under the GDPR: Below is an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country of residence or our country of domicile. Should more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

• Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the data subject’s request.
• Legitimate interests (Art. 6(1)(f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Act on the Protection against the Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains, in particular, special provisions regarding the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and the transfer of data, as well as automated decision-making in individual cases, including profiling. Furthermore, state data protection laws of the individual federal states may apply.

Note on the applicability of the GDPR and the Swiss DPA: This privacy notice serves to provide information in accordance with both the Swiss Data Protection Act (DSG) and the General Data Protection Regulation (GDPR). For this reason, please note that the terms used in the GDPR are employed here due to its broader geographical scope and greater clarity. In particular, instead of the terms “processing” of “personal data,” “overriding interest,” and “sensitive personal data” used in the Swiss Data Protection Act (DSG), the terms “processing” of “personal data,” “legitimate interest,” and “special categories of data” used in the GDPR are employed. However, the legal meaning of the terms continues to be determined in accordance with the Swiss Data Protection Act (DSG) within the scope of its applicability.

Applicability of data protection regulations in the country of establishment: In the country where the controller is established, national data protection regulations apply in addition to the General Data Protection Regulation (GDPR).

Security measures

In accordance with legal requirements, and taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, input of, and disclosure of the data, ensuring its availability, and maintaining its separation. Furthermore, we have established procedures that ensure the exercise of data subjects’ rights, the erasure of data, and responses to data breaches. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software, and procedures in accordance with the principle of data protection by design and by default.

IP address truncation: If IP addresses are processed by us or by the service providers and technologies we use, and the processing of a full IP address is not necessary, the IP address is truncated (also referred to as “IP masking”). In this process, the last two digits or the last part of the IP address after a dot are removed or replaced with placeholders. The purpose of truncating the IP address is to prevent or significantly hinder the identification of a person based on their IP address.

Securing online connections using TLS/SSL encryption technology (HTTPS): To protect user data transmitted via our online services from unauthorized access, we rely on TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is being transmitted securely and encrypted.

Transfer of Personal Data

In the course of our processing of personal data, it may occur that such data is transferred to or disclosed to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to ensure the protection of your data.

Transfer of Personal Data

In the course of our processing of personal data, it may occur that such data is transferred to or disclosed to other agencies, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, service providers entrusted with IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to ensure the protection of your data.

International Data Transfers

Data Processing in Third Countries: If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in connection with the use of third-party services or the disclosure or transfer of data to other entities or companies entities, or companies (which can be identified by the postal address of the respective provider or if the privacy policy explicitly refers to data transfers to third countries), this is always done in accordance with legal requirements.

For data transfers to the U.S., we primarily rely on the Data Privacy Framework (DPF), which was recognized as a safe legal framework by an adequacy decision of the European Commission dated July 10, 2023. In addition, we have entered into standard contractual clauses with the respective providers that comply with the requirements of the European Commission and establish contractual obligations to protect your data.

This two-fold safeguard ensures comprehensive protection of your data: The DPF serves as the primary layer of protection, while the standard contractual clauses provide additional security. Should changes arise within the framework of the DPF, the standard contractual clauses serve as a reliable fallback option. This ensures that your data remains adequately protected even in the event of any political or legal changes.

For each service provider, we inform you whether they are certified under the DPF and whether standard contractual clauses are in place. Further information on the DPF and a list of certified companies can be found on the U.S. Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

For data transfers to other third countries, appropriate safeguards apply, in particular standard contractual clauses, explicit consent, or transfers required by law. For information on transfers to third countries and applicable adequacy decisions, please refer to the European Commission’s website: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

General Information on Data Storage and Deletion

We delete the personal data we process in accordance with legal requirements, as soon as the underlying consents are revoked or there is no longer any legal basis for processing. This applies to cases where the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule apply if legal obligations or specific interests require the data to be retained or archived for a longer period.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal proceedings or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy policy contains additional information on the retention and deletion of data that applies specifically to certain processing operations.

If there are multiple specifications regarding the retention period or deletion deadlines for a particular piece of data, the longest period shall always apply. We process data that is no longer retained for its originally intended purpose, but rather due to legal requirements or other reasons, exclusively for the purposes that justify its retention.

Data Retention and Deletion: The following general periods apply to data retention and archiving under German law:

• 10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, as well as the work instructions and other organizational documents necessary for their understanding (Section 147(1)(1) in conjunction with (3) of the German Fiscal Code (AO), § 14b (1) UStG, § 257 (1) No. 1 in conjunction with (4) HGB).
• 8 years – Accounting documents, such as invoices and expense receipts (Section 147(1)(4) and (4a) in conjunction with (3), first sentence, AO, and Section 257(1)(4) in conjunction with (4) HGB).
• 6 years – Other business documents: received commercial or business letters, copies of sent commercial or business letters, other documents insofar as they are relevant for taxation, e.g., hourly wage slips, payroll sheets, cost calculation documents, price tags, as well as payroll records, provided they are not already accounting documents, and cash register receipts (Section 147(1)(2), (3), and (5) in conjunction with Section 3 of the German Fiscal Code (AO), Section 257(1)(2) and (3) in conjunction with Section 4 of the German Commercial Code (HGB)).
• 3 years - Data required to address potential warranty and damage claims or similar contractual claims and rights, as well as to process related inquiries, based on past business experience and standard industry practices, is stored for the duration of the regular statutory limitation period of three years (Sections 195, 199 BGB) .

Start of the period at the end of the year: If a period does not expressly begin on a specific date and lasts at least one year, it automatically begins at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in which data is stored, the event triggering the time limit is the date on which the termination or other termination of the legal relationship takes effect.

Rights of Data Subjects

Rights of Data Subjects under the GDPR: As a data subject under the GDPR, you are entitled to various rights, which arise in particular from Articles 15 through 21 of the GDPR:

• Right to Object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. If personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw consent:You have the right to withdraw any consent you have given at any time.
• Right of access: You have the right to request confirmation as to whether your personal data is being processed, as well as access to that data, further information, and a copy of the data in accordance with legal requirements.

Payment Methods

In the context of contractual and other legal relationships, due to legal obligations, or otherwise based on our legitimate interests, we offer data subjects efficient and secure payment options and, for this purpose, engage banks, credit institutions, and other service providers (collectively, “payment service providers”). Payment transactions are conducted exclusively via encrypted connections in accordance with the state of the art, ensuring that the data entered is protected from unauthorized access during transmission.

The data processed by the payment service providers includes master data, such as name and address; bank details, such as account numbers or credit card numbers; passwords, TANs, and checksums; as well as information related to the contract, amount, and recipient. This information is required to process the transactions. However, the data entered is processed and stored solely by the payment service providers. This means that we do not receive any account or credit card-related information, but only information confirming or rejecting the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit bureaus. The purpose of this transmission is to verify identity and creditworthiness. For more information, please refer to the Terms and Conditions and Privacy Policy of the payment service providers.

Payment transactions are subject to the terms and conditions and privacy policies of the respective payment service providers, which are available on their respective websites or within the transaction applications. We also refer you to these documents for further information and to exercise your rights of withdrawal, access, and other data subject rights.

• Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); payment data (e.g., bank details, invoices, payment history); contract data (e.g., subject matter of the contract, term, customer category); Usage data (e.g., page views and time spent on site, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
• Data subjects: Service recipients and clients; business and contractual partners. Prospective customers.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations. Business processes and management procedures.
• Retention and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”.
• Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR). Legitimate interests (Art. 6, paragraph 1, page 1, letter f) of the GDPR).

Further information on processing operations, procedures, and services:

• PayPal: Payment services (technical integration of online payment methods) (e.g., PayPal, PayPal Plus, Braintree); Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.paypal.com/de. Privacy Policy: https://www.paypal.com/de/legalhub/paypal/privacy-full.

Provision of the Online Service and Web Hosting

We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

• Types of data processed: Usage data (e.g., page views and time spent on site, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved); log data (e.g., log files regarding logins, data retrieval, or access times). Content data (e.g., textual or visual messages and posts, as well as related information such as details regarding authorship or the time of creation).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of our online services and user-friendliness; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)); security measures. Provision of contractual services and fulfillment of contractual obligations.
• Retention and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”.
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures, and services:

• Provision of online services on rented server space: To provide our online services, we use server space, computing capacity, and software which we rent from or otherwise obtain from a relevant server provider (also known as a “web host”); Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
• Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files.” Server log files may include the address and name of the accessed web pages and files, the date and time of access, the amount of data transferred, a notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. The server log files may be used, on the one hand, for security purposes, e.g., to prevent server overload (particularly in the case of malicious attacks, so-called DDoS attacks), and, on the other hand, to ensure server capacity and stability; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been fully resolved.

Contact and Inquiry Management

When contacting us (e.g., by mail, contact form, email, phone, or via social media) as well as within the scope of existing user and business relationships, the information provided by the inquiring individuals is processed to the extent necessary to respond to contact inquiries and any requested actions.

• Types of data processed: Contact data (e.g., postal and email addresses or phone numbers); content data (e.g., textual or visual messages and posts, as well as related information such as details regarding authorship or the time of creation). Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, involved persons).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Communication; organizational and administrative procedures; feedback (e.g., collecting feedback via an online form). Provision of our online services and user-friendliness.
• Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion”.
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Further information on processing operations, procedures, and services:

• Contact form: When you contact us via our contact form, by email, or through other communication channels, we process the personal data provided to us to respond to and handle your inquiry. This generally includes details such as your name, contact information, and, if applicable, additional information provided to us that is necessary for appropriate processing. We use this data exclusively for the stated purpose of establishing contact and communication; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR), Legitimate interests (Art. 6(1)(f) GDPR).

Social Media Presence

We maintain an online presence on social media platforms and, in this context, process user data in order to communicate with users active on those platforms or to provide information about us.

Please note that user data may be processed outside the European Union in this context. This may pose risks for users, as it could, for example, make it more difficult to enforce user rights.

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles can be created based on users’ behavior and the resulting interests. These profiles may in turn be used to display advertisements within and outside the networks that are presumed to correspond to users’ interests. Therefore, cookies are generally stored on users’ computers to record their usage behavior and interests. In addition, data may also be stored in the usage profiles regardless of the devices used by users (especially if they are members of the respective platforms and are logged in there).

For a detailed description of the respective forms of processing and the options for objection (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.

We would also like to point out that requests for information and the exercise of data subject rights are most effectively handled directly with the providers. Only the providers have access to the user data and can take appropriate action and provide information directly. However, if you still need assistance, you can contact us.

• Types of data processed: Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., textual or visual messages and posts, as well as related information such as details regarding authorship or the time of creation); Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing and legitimate interests: Communication; Feedback (e.g., collecting feedback via online form). Public relations.
• Retention and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”.
• Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing activities, procedures, and services:

• Instagram: Social network that allows users to share photos and videos, comment on and like posts, send messages, and follow profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.instagram.com; Privacy Policy: https://privacycenter.instagram.com/policy/. Basis for transfers to third countries: Data Privacy Framework (DPF).

Changes and Updates

We ask that you review the content of our Privacy Policy regularly. We will update the Privacy Policy as soon as changes to our data processing activities make this necessary. We will notify you as soon as the changes require action on your part (e.g., consent) or any other individual notification.

Definitions of Terms

This section provides an overview of the terms used in this Privacy Policy. Where these terms are defined by law, their legal definitions apply. The explanations below are intended primarily to aid understanding.

• Master data: Master data comprises essential information necessary for the identification and management of contractual partners, user accounts, profiles, and similar assignments. This data may include, among other things, personal and demographic details such as names, contact information (addresses, phone numbers, email addresses), dates of birth, and specific identifiers (user IDs). Master data forms the basis for any formal interaction between individuals and services, institutions, or systems by enabling unique identification and communication.
• Content data: Content data encompasses information generated during the creation, editing, and publication of all types of content. This category of data may include text, images, videos, audio files, and other multimedia content published on various platforms and media. Content data is not limited to the actual content itself but also includes metadata that provides information about the content itself, such as tags, descriptions, author information, and publication dates
• Contact information: Contact information is essential data that enables communication with individuals or organizations. It includes, among other things, phone numbers, mailing addresses, and email addresses, as well as communication channels such as social media handles and instant messaging identifiers.
• Meta, communication, and process data: Meta, communication, and process data are categories that contain information about how data is processed, transmitted, and managed. Meta data, also known as data about data, includes information that describes the context, origin, and structure of other data. It may include details on file size, creation date, the author of a document, and change histories. Communication data captures the exchange of information between users across various channels, such as email correspondence, call logs, social media messages, and chat histories, including the individuals involved, timestamps, and transmission methods. Process data describes the processes and procedures within systems or organizations, including workflow documentation, transaction and activity logs, as well as audit logs used to track and verify operations.
• Usage data:Usage data refers to information that tracks how users interact with digital products, services, or platforms. This data encompasses a wide range of information that reveals how users utilize applications, which features they prefer, how long they stay on specific pages, and the paths they take when navigating through an application. Usage data may also include frequency of use, timestamps of activities, IP addresses, device information, and location data. It is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content, and improving products or services. Furthermore, usage data plays a crucial role in identifying trends, preferences, and potential problem areas within digital offerings
• Personal Data: “Personal data” refers to any information relating to an identified or identifiable natural person (hereinafter “data subject”); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie), or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Datenschutz-Generator.de tool by Dr. Thomas Schwenke