Privacy Policy

1. Data Controller

The controller responsible for the processing of personal data on this website within the meaning of the GDPR is:

Nader Hamamreh-Unger – NU The Lean Coach
Eichenweg 3
71729 Erdmannhausen
Germany
E-mail: nader.unger@lean-coach.one
Phone: +49 176 23125944

2. General Notes & Your Rights

We take the protection of your personal data very seriously and treat your personal data confidentially in accordance with statutory data-protection regulations (GDPR, BDSG) and this privacy policy.

Use of our website is generally possible without providing personal data. Insofar as personal data is collected on our pages, this is always done on a voluntary basis.

You have the right at any time to access, rectification, deletion, restriction of processing, withdrawal of consent, data portability, and to lodge a complaint with a supervisory authority. Section 10 sets these out in detail.

3. Data Collection When Visiting the Website (Server Log Files)

When you access this website, the hosting provider automatically records information in so-called server log files that your browser transmits:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address (anonymised)

This data is not merged with other data sources. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in the technical provision and security of the website). The IP address is shortened and anonymised at the point of collection, so that it can no longer be attributed to you. Log files are retained for eight weeks and are then deleted automatically.

Hosting provider: IONOS SE, Elgendorfer Strasse 57, 56410 Montabaur, Germany. We have concluded a data processing agreement with the hosting provider pursuant to Art. 28 GDPR.

4. Contact via E-mail

If you contact us by e-mail, your information (e-mail address, name, message) will be stored to process the inquiry. Legal basis: Art. 6 (1) lit. b GDPR (pre-contractual measures) or Art. 6 (1) lit. f GDPR (legitimate interest in responding).

We will not pass on this data without your consent. Deletion takes place as soon as the inquiry has been processed and no statutory retention obligations preclude it.

5. Appointment Booking and Online Meeting

To arrange and hold initial calls we use two services: the booking tool Cal for scheduling and Microsoft Teams for the call itself. The purpose of the processing is automated scheduling, calendar synchronisation and holding the online meeting.

Appointment booking via Cal (app.cal.eu)

The provider is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. The provider has appointed a representative in the European Union pursuant to Art. 27 GDPR, reachable at legal+eu@cal.com. We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR.

The booking widget is not embedded automatically. Loading this page establishes no connection to Cal and transmits no data there. In place of the calendar you first see only a notice describing what happens when you open it. The booking widget is loaded only once you press the “Open calendar” button.

From that moment, technically necessary data (IP address, browser type, timestamp) and the booking data you provide voluntarily (name, e-mail address, optionally phone number, appointment) are transmitted to the provider. The provider may then store or read information on your device.

According to the provider, the infrastructure of the EU instance app.cal.eu is operated within the European Union. As Cal.com, Inc. is established in the USA, access from the United States cannot be entirely ruled out. No Standard Contractual Clauses and no EU-U.S. Data Privacy Framework certification are in place for such access. The USA does not offer a level of data protection equivalent to European law; in particular, US authorities may under certain conditions access data without effective legal remedies being available to you.

Legal bases: Loading the booking widget, and any storing or reading of information on your device, take place on the basis of your consent under Art. 6 (1) lit. a GDPR in conjunction with § 25 (1) TDDDG, given by pressing the button. Processing of the booking data takes place on the basis of Art. 6 (1) lit. b GDPR (pre-contractual measures). Any transfer to the USA is based on your explicit consent under Art. 49 (1) lit. a GDPR, given in awareness of the risks described above.

Your consent is voluntary. You may leave the calendar unused and arrange an appointment informally by e-mail or telephone instead; the contact details are in section 1.

Privacy policy of the provider: https://cal.com/privacy.

Online meeting via Microsoft Teams

Initial calls are usually held via Microsoft Teams. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. We have concluded a data processing agreement with Microsoft pursuant to Art. 28 GDPR.

The data required for participation is processed: name or display name, e-mail address, connection and metadata (IP address, device and browser information, start and end of the session) as well as the video, audio and, where applicable, chat content transmitted during the call. Recordings are made only with your prior explicit consent.

Legal bases: Holding the online meeting takes place on the basis of Art. 6 (1) lit. b GDPR (pre-contractual measures). Insofar as you take part voluntarily or consent to a recording, processing is additionally based on Art. 6 (1) lit. a GDPR.

A transfer to the USA cannot be entirely ruled out when using Microsoft services. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework; transfers to certified organisations in the USA are therefore covered by an adequacy decision of the European Commission under Art. 45 GDPR. In addition, Microsoft has incorporated the European Commission’s Standard Contractual Clauses into its contractual terms (Art. 46 (2) lit. c GDPR).

Privacy policy of Microsoft: privacy.microsoft.com.

Withdrawal and retention

You may withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR); the lawfulness of processing carried out until withdrawal remains unaffected. An informal message to the contact details in section 1 is sufficient. Independently of this, consent for the booking widget applies only to the respective page visit.

Retention: We process appointment and meeting data only for as long as is necessary to hold and follow up the initial call. It is then deleted unless statutory retention obligations apply. Independently of this, you may request deletion at any time. Storage within the providers’ systems is governed by their privacy policies.

6. Web Analytics with Plausible

This website uses Plausible Analytics, a privacy-friendly web analytics service. Provider: Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia (EU). Plausible uses no cookies and does not store personal data; IP addresses are not stored permanently and are only used in anonymised, truncated form to count unique visits on the same day.

Only aggregated usage data is collected (pages viewed, referrer, device type, country). Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in audience measurement). Plausible privacy policy: https://plausible.io/privacy.

7. External Content and Fonts

The fonts, icons and stylesheets used on this website are served entirely from our own server. We embed no content delivery networks, no Google Fonts and no external icon libraries. Simply opening a page therefore creates no connection to any third party and transmits no IP address to one.

Simply loading a page causes your browser to contact exactly one external service: the analytics measurement (section 6). The booking widget (section 5) is loaded only after your explicit click; without that click no connection to it exists.

8. Cookies and Local Storage

This website sets no cookies of its own and stores nothing in your browser's local storage. The German and English versions are separate pages, so there is no language preference to remember.

The booking window described in section 5 may set cookies of its own once it has been loaded and you interact with it. That is outside our control; please refer to the provider's privacy policy linked there.

For this reason this website does not require a cookie consent dialogue: no information is stored on or read from your device that is not strictly necessary for the operation of the site. The only service that could do so is the booking window described in section 5 — and it is loaded only after your explicit click.

9. SSL/TLS Encryption

This website is delivered over an SSL/TLS-encrypted connection. The encryption protects the data you transmit to us from being read by third parties. You can tell that the connection is encrypted by the https:// prefix before the address in your browser's address bar.

10. Your Rights as a Data Subject

You have the following rights vis-à-vis the controller:

• Access to stored data (Art. 15 GDPR)
• Rectification of incorrect data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an informal e-mail to nader.unger@lean-coach.one is sufficient.

Right to lodge a complaint: You have the right to lodge a complaint with a data-protection supervisory authority about the processing of your personal data. A list of authorities is available at www.bfdi.bund.de.

11. Updates & Changes

This privacy policy is dated 9 August 2026. Due to the further development of our website or changes in legal requirements, it may be necessary to amend this policy. The current version is always available on this page.