Privacy Policy

Datenschutz

This English version is provided for information only. The German version (Datenschutzerklärung) is legally binding.

As of October 2026

1. Controller

Picaroon UG (haftungsbeschränkt)
Schellingstraße 94, 80798 Munich, Germany
Managing Director: Rebecca Gischel
Email:

No data protection officer has been appointed, as we do not consider this legally required.

2. Overview

We process personal data only as far as necessary to operate this website, to carry out appointments and sessions, to invoice and to communicate with you, or where you have consented. The legal bases are stated for each processing activity. In particular:

  • Art. 6(1)(a) GDPR – consent
  • Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures (booking, session, invoice)
  • Art. 6(1)(c) GDPR – legal obligation (e.g. tax record keeping)
  • Art. 6(1)(f) GDPR – legitimate interests (e.g. security, reach measurement)
  • Art. 9(2)(a) GDPR – explicit consent for special categories of data (e.g. health information)

3. Hosting and server log files

This website and the associated booking and administration system are hosted by STRATO AG, Pascalstraße 10, 10587 Berlin, Germany (data centre in Germany). A data processing agreement is in place with STRATO.

When you visit the website, general information is collected automatically (server log files): browser type, operating system, page visited, date and time, referrer URL and IP address. Purpose: delivering the website, ensuring operation and defending against attacks.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).
Retention: only for a short time according to STRATO’s settings, then automatically deleted.

4. Contact (contact form, email)

If you contact us via the contact form or by email, we process the data you provide (name, email address, desired service, location, your message) to handle your enquiry and to communicate with you. When you submit the contact form, we additionally store the source (where you came from), the device type and an approximate origin (city/country, derived from the truncated IP address, see section 11) to understand which information channels work.
Legal basis: Art. 6(1)(b) GDPR (initiating a contract) or (f) (answering general enquiries).
Retention: Enquiries without a contract are deleted no later than six months after processing is completed. If a contract is concluded, the periods in section 14 apply.

Our emails are sent and received via STRATO’s email service. Note: Email transmission may be unencrypted. Share sensitive content (e.g. health data) only if you are aware of this.

5. Booking, sessions and client management

5.1 What data do we process?
When you book via our booking system, we process: salutation, first and last name, email address, chosen service, appointment, payment method, the message you voluntarily enter, the time of booking, your confirmation of the terms and conditions and your chosen language. As part of our work together we keep a client file with appointments, payment status, invoices, email history and notes by the managing director on sessions and conversations. If you send us photos or sketches (e.g. family trees), we store them in the client file.

5.2 Purposes and legal bases

  • Performance of the contract, appointment management, reminders, preparation and delivery of sessions: Art. 6(1)(b) GDPR.
  • Invoicing, bookkeeping, tax record keeping: Art. 6(1)(c) GDPR.
  • Security and protection against misuse (e.g. limiting automated bookings): Art. 6(1)(f) GDPR.

5.3 Obligation to provide data
Name and email address are required for the booking, as we could not otherwise send you the confirmation and invoice. All other information (in particular your message) is voluntary. We do not need any information about you, your health or your concern in advance.

5.4 Special categories of personal data
If you voluntarily tell us anything about your health, your well-being, grief or religious and philosophical beliefs (Art. 9 GDPR), we process this solely to prepare and carry out your session and to document our work together. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you give by voluntarily sharing the information. You may withdraw this consent at any time with effect for the future (contact: see section 1); processing that has already taken place remains unaffected. We do not pass such information on to third parties unless unavoidable for performing the contract (e.g. storage in the systems named below).

5.5 Recipients
Your data is processed in the systems and by the service providers named in sections 6 to 9.

6. Calendar and video sessions (Google)

We use Google Calendar to manage appointments and Google Meet for online sessions (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for services in the USA: Google LLC). When you book, a calendar entry is created with your name, email address and message; for online appointments a Meet link is created. To determine free appointments, the booking system queries the busy times of the provider’s calendars via the Google Calendar interface (time slots only, not the content of private appointments).
Legal basis: Art. 6(1)(b) GDPR (appointment management and performance), for online sessions additionally (f) (efficient organisation).
A data processing agreement is in place with Google. Where data may be transferred to the USA, Google relies on the EU-US Data Privacy Framework or the EU Commission’s standard contractual clauses.
Note: If you take part in a Meet session, Google processes technical data (e.g. IP address, device information) under its own privacy policy. The session is not recorded.

7. Emails to you (confirmation, reminder, invoice)

In connection with your booking we automatically send you emails: booking confirmation (with calendar file), appointment reminder, invoice as PDF and, where necessary, payment reminders and cancellation notices. Sent via STRATO’s email service. A copy of every outgoing email remains in our outbox.
Legal basis: Art. 6(1)(b) and (c) GDPR.

8. Payment, invoices, accounting

Payments are made by bank transfer or in cash. For invoicing we process your name, invoice data and payment status. Invoices are archived in our system and transmitted monthly to our tax advisor / bookkeeper, with whom a data processing or confidentiality agreement exists. Payments via our bank account are processed by our bank.
Legal basis: Art. 6(1)(b) and (c) GDPR (§§ 14, 14b German VAT Act, § 147 German Fiscal Code, § 257 German Commercial Code).

9. Waiting list, notifications and newsletter

  • Waiting list and notification of new appointments: If you join the waiting list or register for notifications about new appointments, we store your email address (and your name if provided) to inform you. Legal basis: your consent (Art. 6(1)(a) GDPR). Registration uses the double opt-in procedure (confirmation link by email). You can unsubscribe at any time via the link in every email.
  • Newsletter: If you subscribe to our newsletter, we process your email address to send it. Legal basis: consent (Art. 6(1)(a) GDPR), also with double opt-in. Unsubscribe at any time via the link in every email. We store the time of registration, confirmation and unsubscription as proof (Art. 6(1)(c), (f) GDPR).

10. Reviews

The website shows reviews previously posted on Google (name abbreviated). They are retrieved server-side by us; your browser does not connect to Google for this.
Legal basis: Art. 6(1)(f) GDPR.

11. Visit statistics, cookies, location lookup

Own visit statistics. We run our own, self-hosted visit statistics without Google Analytics or comparable external analytics services. We record: page visited, time, traffic source, device type/browser, approximate language and approximate origin (city/country). The IP address is truncated (last octet removed) before any storage and not stored in plain form.

Location lookup. To determine city, country and network operator, the truncated IP address is sent to the services ip-api.com and, as a fallback, ipapi.co, which return this information. Data may be transferred to third countries in the process.

Cookie and local storage. We set a cookie rg_vid (and store the same identifier in your browser’s local storage). It contains a random, anonymous identifier with no personal reference and is used to count returning visitors. Retention in the browser: 2 years; you can delete it at any time in your browser. For website administrators, a cookie rg_exclude may also be set so that their own visits are excluded from the statistics. We do not use any other cookies, in particular no advertising or tracking cookies from third parties.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in anonymous reach measurement).
Retention: Raw data is deleted after 12 months.

12. Further information on the website

  • External links: The website contains links to Instagram, Google Maps and other sites. When you click them, the respective provider’s privacy policy applies. No data is transferred to them before you click.
  • Fonts and images are delivered from our own server.
  • Encryption: The website and the administration system are delivered via HTTPS (TLS).

13. Technical and organisational measures

We protect your data through encrypted transmission (TLS), password-protected access to the administration system (with two-factor option), encryption of stored credentials, access protection of the data directory, regular backups, and logging and monitoring of errors. Only the managing director has access to client data.

14. Retention periods

  • Enquiries without a contract (contact form, email): up to 6 months after processing is completed
  • Client file (appointments, notes, email history, photos): 3 years after the last session, then deletion or anonymisation unless a retention obligation applies
  • Invoices, payment and booking records: 8 years (§ 147 German Fiscal Code, § 257 German Commercial Code), starting at the end of the calendar year
  • Business letters and emails relating to contracts: 6 years (§ 257 German Commercial Code, § 147 German Fiscal Code)
  • Newsletter/notifications: until withdrawal; proof of registration/unsubscription 3 years
  • Visit statistics (raw data): 12 months
  • Server log files: short term, according to STRATO’s settings
  • Calendar entries at Google: until the appointment is deleted

15. Your rights

You have the right at any time to

  • access to your stored data (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR),
  • withdraw consent given, with effect for the future (Art. 7(3) GDPR).

An email to the address in section 1 is sufficient to exercise them. Where statutory retention obligations apply (section 14), the data is blocked instead of deleted.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

17. No automated decision-making

There is no automated decision-making, including profiling, under Art. 22 GDPR.

18. Changes

We update this privacy policy when the legal situation or our processing changes. The current version on this page applies.