Privacy policy

1. Controller

The controller responsible for processing personal data on this website is:

2. Hosting and server logs

This website is hosted with IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The server processes the IP address and technical request data to deliver the website and protect its operation.

Our regular access logs contain the time, HTTP method, response status, a predefined page category and response size. They do not record IP addresses, browser identifiers, referrers, query strings or form contents. Technical error logs may contain IP addresses and request details where an error occurs. Server logs are rotated daily and retained for up to eight days, unless specific records must be retained to investigate an incident or fulfil a legal obligation. Access is restricted.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure, reliable operation and troubleshooting. We do not use IONOS WebAnalytics on this website.

3. Cloudflare delivery and security

We use Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as a content delivery and security service. Requests pass through Cloudflare before reaching our server. Cloudflare processes IP addresses, requested URLs and technical connection/browser data to deliver content, detect abusive traffic and protect the website.

The legal basis is Article 6(1)(f) GDPR, based on our interest in secure, available delivery. Cloudflare operates a global network, so processing outside the EU/EEA, including the USA, is possible. Cloudflare describes safeguards including the EU-US Data Privacy Framework and standard contractual clauses. Its own security-log retention is separate from our server-log retention. See Cloudflare's privacy policy for its processing, safeguards and retention criteria.

4. Cookies, browser storage and statistics

The website itself does not store cookies or language preferences in your browser. German and English versions use separate URLs. Operational reports count requests by page category without identifying individual visitors.

If Cloudflare requires a security check, it may use strictly necessary security cookies to distinguish legitimate requests from automated abuse. These serve security rather than advertising. Where necessary for the requested service, terminal storage/access is based on Section 25(2)(2) TDDDG. See Cloudflare's cookie information.

Visitor statistics

No visitor analytics service is currently loaded. Our operational reports use only aggregate request counts from the minimized server logs described above.

5. Contact by email

If you contact us by email, we process your email address, the content of your message and any other information you provide. Email links open your own email application. Processing during newsletter signup is described in section 6.

We process enquiries for pre-contractual measures or performance of a contract on the basis of Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR and our legitimate interest in responding to and documenting the enquiry. Where a legal obligation applies, processing is additionally based on Article 6(1)(c) GDPR.

We delete the data once the enquiry has been fully handled and no statutory retention obligation or legitimate reason for further storage applies.

6. Newsletter

If you subscribe to our newsletter, we use your email address to send news and offers about classes, retreats and events from Belle Balance (Annabelle Proelss). No additional personal details are required to subscribe. The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with Section 7(2)(2) of the German Act Against Unfair Competition (UWG).

We use CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany for signup and delivery. When you submit the form, our server sends your email address, selected language and signup details to CleverReach over an encrypted connection. Your IP address, the time and browser information are processed to document signup. Merely loading our newsletter form does not establish a connection to CleverReach.

To prevent repeated requests and misuse, our server temporarily stores keyed hashes of the email and IP addresses, together with the request time and processing status. These records are deleted automatically within 25 hours. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the signup function against misuse. No newsletter cookies or browser storage are used.

Signup uses double opt-in. After submitting the form, you receive an email containing a confirmation link. Your signup becomes active only after you confirm it. Signup and confirmation details are logged as evidence of consent. Processing this evidence is based on Article 6(1)(f) GDPR and our legitimate interest in demonstrating consent and identifying abusive signups.

You can withdraw your consent at any time with future effect using the unsubscribe link in each newsletter email or by emailing belleproelss@gmail.com. Withdrawal does not affect the lawfulness of processing before withdrawal. After unsubscribing, your address is deactivated for newsletter delivery. We retain evidence of consent and withdrawal only for as long as it is needed to defend or resolve possible legal claims. It is then deleted unless a statutory retention obligation applies.

CleverReach states that recipient data is stored on servers in Germany and the EU. For further information, see CleverReach's privacy notice.

7. Email service

We use Gmail for email communication. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process data contained in emails. Processing by Google LLC in the United States or other third countries cannot be ruled out.

According to Google, transfers to third countries rely in particular on adequacy decisions, including the EU–US Data Privacy Framework, and standard contractual clauses. More information is available in Google's information about data transfers and Google's privacy policy.

8. Instagram link

The website contains a standard link to our Instagram profile. Merely visiting our website does not transfer data to Instagram or Meta. When you select the link, you leave our website and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland processes data under its own responsibility. We have no influence over this processing. See the Instagram privacy policy for further information.

9. Locally hosted fonts

The Karla, Playfair Display and DM Serif Display fonts used on this website are loaded exclusively from our own web server. Visiting the website therefore does not establish a connection to Google Fonts or another font provider.

10. Recipients and storage periods

We disclose personal data only when necessary for the purposes described, required by law or covered by your consent. Recipients may include IONOS as our hosting processor, Cloudflare as our delivery and security provider, CleverReach as newsletter provider, Google as email provider and tax or legal advisers engaged by us.

Unless a specific period is stated in this policy, we store personal data only for as long as necessary for the relevant purpose. Statutory retention obligations, particularly under commercial and tax law, may require longer storage. The data is then deleted or its processing restricted.

11. Your rights

Subject to the statutory requirements, you have the right of access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction of processing under Article 18, data portability under Article 20 and objection under Article 21. You may withdraw consent at any time with future effect under Article 7(3) GDPR.

Where processing is based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.

To exercise your rights, email belleproelss@gmail.com.

You also have the right to lodge a complaint with a data-protection supervisory authority. The authority generally responsible for us is:

12. Requirement to provide data and automated decisions

You are not legally required to provide personal data through this website. To respond to an enquiry or send the newsletter, however, we need at least a valid email address. We do not use automated decision-making, including profiling.

13. Encryption

This website is delivered through encrypted HTTPS connections. This protects data transmitted between your browser and our web server against interception by third parties in line with current technology.

14. Updates to this policy

We update this privacy policy when the website, services used or legal requirements change. The current version is always available on this page.