Privacy
1. Data controller
Lea Sarbandi-Kaiser, psychological counselling.
Ludwigsburger Straße 5
33659 Bielefeld
Germany
Lea@sarbandi-kaiser.de
2. Hosting this website
This website is hosted by STRATO. When you visit the website, STRATO processes technical connection data, particularly your IP address, to provide and secure the website. According to STRATO, IP addresses are stored for no more than seven days to detect and prevent attacks. A data processing agreement is in place with STRATO. Hosting and securing the website may rely on Article 6(1)(f) GDPR; the legitimate interest is secure and functional operation.
STRATO also logs technical access data, particularly the time of access, requested files and browser information. Access logs are made available for the preceding six weeks; according to STRATO, IP addresses or hostnames in these logs are anonymised. I do not personally analyse the visitor statistics provided by STRATO.
The SiteLock Scan service included in STRATO hosting is used to check the security of the website. STRATO lists SiteLock, LLC in the United States as a subprocessor for this service and provides for EU Standard Contractual Clauses for any transfers of personal data.
3. Contact form
When you use the contact form, I process your email address, the selected enquiry topic, and any name and message you choose to provide in order to respond to your enquiry. Your information is transmitted to the website hosted by STRATO over an encrypted HTTPS connection. Your enquiry is then sent to lea@sarbandi-kaiser.de via the configured Microsoft email service.
Technical safeguards limit abusive and repeated submissions. Please do not include sensitive counselling information in your initial enquiry.
Enquiries are deleted once they have been fully dealt with and the data is no longer needed. Statutory retention obligations and any retention necessary for the establishment, exercise or defence of legal claims remain unaffected.
I use Microsoft 365 Business Basic for email communication and to send contact form enquiries. Microsoft processes your email address and the information you provide so that I can receive and respond to your enquiry.
The provider is Microsoft Ireland Operations Limited.
Processing on my behalf is governed by the Microsoft Products and Services Data Protection Addendum. In providing the services, personal data may also be processed outside the European Economic Area, particularly in the United States. Microsoft provides, in particular, for the European Commission’s Standard Contractual Clauses for such transfers.
To protect against abusive and duplicate submissions, the contact form stores pseudonymised technical identifiers, timestamps and the sending status. The message text is not stored in plain text in this protective data store. Entries are taken into account for one hour to limit requests and for 24 hours to detect duplicate submissions. Expired entries are removed the next time the data store is saved as part of a subsequent form request.
4. Contact enquiries
I process enquiries about arranging counselling on the basis of Article 6(1)(b) GDPR. I handle other contact enquiries on the basis of Article 6(1)(f) GDPR; my legitimate interest is to respond to incoming enquiries. Technical safeguards against misuse of the contact form serve my legitimate interest in operating a secure and reliable website.
Appointments are arranged personally by email.
5. Fonts, cookies and analytics
Fonts and portraits are served with the website. This website contains no embedded third-party videos, analytics scripts or advertising trackers, and does not itself set cookies.
After you close the cookie notice, only the acknowledgement timestamp is saved under the key lea-privacy-notice-v1 in your browser’s local storage. This setting lasts for 180 days and is not sent to me. It contains no form entries or counselling content. You can reopen the notice using the “Cookie notice” link in the footer.
6. Your rights
Subject to statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent with effect for the future. You may object to processing based on legitimate interests for reasons relating to your particular situation.
You may lodge a complaint with a data protection supervisory authority, particularly where you normally live, work or where the alleged infringement occurred.
For North Rhine-Westphalia: the State Commissioner for Data Protection and Freedom of Information (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf; www.ldi.nrw.de; poststelle@ldi.nrw.de.
7. Legal basis
Relevant provisions include Articles 6, 9, 13 and 15–21 of the General Data Protection Regulation.