Privacy Policy

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you visit our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data is any data with which you can be personally identified.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Beniamin Kuzin, GBS Method, Monestraße 17, 76669 Bad Schönborn, Germany, Phone: +49 151 53409630, Email: beniamin@gbsmethod.com. The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

2) Data Collection When Visiting Our Website

2.1 When using our website for information purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to the site server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

Our visited website
Date and time at the time of access
Amount of data sent in bytes
Source/reference from which you reached the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are concrete indications of unlawful use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller). You can recognize an encrypted connection by the character string "https://"; and the lock symbol in your browser line.

3) Hosting & Content Delivery Network

Netlify

We use the system of the following provider for hosting our website and displaying the page content: Netlify, Inc., 2325 3rd St #215, San Francisco, USA.

All data collected on our website is processed on the provider's servers.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

4) Cookies

We do not use any cookies on our website that require consent. The web analytics tool Plausible Analytics that we use does not set any cookies and does not process any personal data. For this reason, no cookie consent banner is required. Should we use services in the future that set cookies, we will inform you here and – where necessary – obtain your consent.

5) Contact

5.1 Zeeg (Appointment Booking)

We use the services of the following provider to provide an online appointment booking function: Zeeg GmbH, Friedrichstraße 114A, 10117 Berlin.

For the purpose of scheduling appointments, your first and last name and email address (and, if applicable, your telephone number if a telephone appointment is desired) are collected in accordance with Art. 6 (1) (b) GDPR and transmitted to the provider in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in effective customer management and efficient appointment administration, where they are stored for appointment organization.

After the appointment has taken place or the agreed appointment period has expired, your data will be deleted by the provider.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

5.2 General Contact

When you contact us (e.g. via contact form or email), personal data is processed exclusively for the purpose of processing and responding to your inquiry and only to the extent necessary for this purpose.

The legal basis for the processing of this data is our legitimate interest in responding to your inquiry in accordance with Art. 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided that there are no statutory retention obligations to the contrary.

5.3 Contact via Telegram

In addition to contacting us by email or via our contact form, we offer the option of contacting us via the messaging service Telegram.

Provider: Telegram Messenger Inc., based in Dubai, United Arab Emirates.

Data processed: Your Telegram username, your name (if you provide it), the content of your message, the time of the message, technical metadata (e.g. device information).

Purpose: Processing and responding to your inquiry, communication with interested parties and participants.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in responding to your inquiry). If your contact is aimed at concluding a contract, the additional legal basis is Art. 6 (1) (b) GDPR.

Data transfer to third countries: Telegram processes data outside the EU. There is no adequacy decision of the EU Commission for the transfer to the United Arab Emirates. Telegram relies on standard contractual clauses (SCCs) as a transfer mechanism.

Note: Telegram does not offer end-to-end encryption for normal chats. Message content is stored on Telegram's servers. Please do not send us any sensitive data (e.g. ID copies, payment data) via Telegram.

Storage duration: Your data will be deleted as soon as your inquiry has been conclusively processed and there are no statutory retention obligations to the contrary.

6) Data Processing for Contract Processing

6.1 Payment Service Providers

To process the contract, we work with the payment service providers listed below. Certain personal data is transmitted to these providers in accordance with the following information.

6.1.1 Stripe

If you select a payment method offered via the payment service "Stripe", payment processing is carried out by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter "Stripe").

To process your payment, the payment data you provide during the ordering process (including name, address, bank and card information, currency and transaction number) as well as information about the content of your order are transmitted to Stripe in accordance with Art. 6 (1) (b) GDPR. Your data is passed on in this case exclusively for the purpose of payment processing and only insofar as it is necessary for this purpose.

For data transfers to the USA, Stripe has joined the EU-US Data Privacy Framework. In addition, Stripe uses standard contractual clauses (SCCs) pursuant to Art. 46 (2) and (3) GDPR. A data processing agreement (DPA) with Stripe is automatically part of the terms of use and is deemed concluded upon use of the service.

6.1.2 PayPal

If you select a payment method offered via the payment service "PayPal", payment processing is carried out by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If you select a payment method for which you pay in advance, the payment data you provide during the ordering process (including name, address, bank and card information, currency and transaction number) as well as information about the content of your order are transmitted to PayPal in accordance with Art. 6 (1) (b) GDPR.

If you select a payment method for which we pay in advance, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, if applicable data on an alternative means of payment). In order to safeguard our legitimate interest in determining your ability to pay, this data is transmitted to PayPal for the purpose of a credit check in accordance with Art. 6 (1) (f) GDPR.

PayPal also transfers personal data outside the EEA. For these transfers, PayPal relies on standard contractual clauses (SCCs) and Binding Corporate Rules (BCRs) approved by the competent supervisory authorities.

6.1.3 Klarna

If you select a payment method offered via the payment service "Klarna", payment processing is carried out by Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden.

If you select a payment method for which Klarna pays in advance (e.g. invoice or installment purchase or direct debit), you will be asked during the ordering process to provide certain personal data. In order to safeguard our legitimate interest in determining the ability of our customers to pay, this data is transmitted to Klarna for the purpose of a credit check in accordance with Art. 6 (1) (f) GDPR. Before granting a loan, Klarna carries out a credit check, during which your data may be passed on to credit agencies. For the decision within the scope of the application check, in addition to internal provider criteria, identity and credit information from credit agencies may be included in accordance with Art. 6 (1) (f) GDPR.

The credit information may contain probability values (so-called score values). If score values are included in the result of the credit information, they are based on a scientifically recognized mathematical-statistical procedure.

You may object to this processing of your data at any time by sending a message to us or to Klarna. However, Klarna may remain entitled to process your personal data if this is necessary for proper payment processing in accordance with the contract.

6.1.4 Apple Pay

If you choose the payment method "Apple Pay" of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment processing takes place via the "Apple Pay" function of your device operated with iOS, watchOS or macOS by charging a payment card stored with "Apple Pay".

For the purpose of payment processing, the information you provide during the ordering process together with the information about your order is transmitted to Apple in encrypted form. If personal data is processed in the transfers described, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6 (1) (b) GDPR.

Apple may transfer data to the USA. Apple ensures that international data transfers only take place to countries that guarantee an adequate level of protection or provide suitable guarantees within the meaning of applicable law.

Further information on data protection with Apple Pay can be found at: https://support.apple.com/de-de/HT203027

6.1.5 Google Pay

If you choose the payment method "Google Pay" of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), payment processing takes place via the "Google Pay" application of your mobile device.

For the purpose of payment processing, the information you provide during the ordering process together with the information about your order is transmitted to Google. If personal data is processed in the transfers described, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6 (1) (b) GDPR.

For data transfers to the USA, Google has joined the EU-US Data Privacy Framework.

Further information on data protection with Google Pay can be found at: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&;ldt=privacynotice&ldl=de

6.1.6 SEPA Direct Debit

If you select the SEPA direct debit payment method, your payment data (IBAN, name of the account holder) as well as information about the content of your order are transmitted to the respective participating credit institution in accordance with Art. 6 (1) (b) GDPR. The transfer takes place exclusively for the purpose of payment processing.

6.2 Course-Related Communication via Slack

For course-related communication with our participants, we use the service Slack. The provider is Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland.

Data processed: Name, email address, message content (including homework and files), technical usage data.

Purpose: Organization of the course, provision of materials, direct communication between instructor and participants.

Legal basis: Art. 6 (1) (b) GDPR (contract fulfillment).

Data transfer to third countries: Slack also processes data in the USA. The transfer is based on the EU standard contractual clauses (SCCs) and the EU-US Data Privacy Framework. A data processing agreement (DPA) has been concluded.

Storage duration: Messages are stored for the duration of the course and up to 6 months after the course ends, unless statutory retention obligations exist.

6.3 Course-Related Communication via Telegram

For course-related communication with our participants, we also use the service Telegram (private groups). The provider is Telegram Messenger Inc., based in Dubai, United Arab Emirates.

The use of Telegram as a course communication tool is exclusively for participants who have booked a course with us. Participation in the private cohort groups is voluntary. Participants who do not wish to use a group can still reach us by email or via the contact form.

Data processed: Name, telephone number (if provided by the participant), message content, technical usage data.

Purpose: Organization of the course, provision of materials, direct communication between instructor and participants.

Legal basis: Art. 6 (1) (b) GDPR (contract fulfillment).

Note: Telegram does not offer end-to-end encryption for normal chats and groups. Message content is stored on Telegram's servers.

6.4 Contact via Slack

In addition to contacting us by email, contact form or Telegram, we offer the option of contacting us via the service Slack.

Provider: Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland.

Data processed: Name, email address, message content, technical usage data.

Purpose: Course-related communication, provision of materials, direct communication between instructor and participants.

Legal basis: Art. 6 (1) (b) GDPR (contract fulfillment) for course participants; Art. 6 (1) (f) GDPR (legitimate interest in responding to inquiries) for interested parties.

Storage duration: Messages are stored for the duration of the course and up to 6 months after the course ends. Inquiries from interested parties are deleted as soon as the matter has been conclusively processed.

7) Web Analytics Services

Plausible Analytics

This website uses "Plausible", a web analytics tool from Plausible Insights OÜ, Västriku tn 2, 50403, Tartu, Estonia.

It anonymously records and evaluates interactions of randomly selected individual visitors with the website in order to collect information about site usage (such as visitor numbers, page views, bounce rates and dwell time).

Plausible does not set any cookies, does not collect any personal data and does not store any IP addresses. All data is processed exclusively on servers in the EU (Germany). There is no transfer to third countries. An independent legal review confirms that Plausible can be used without cookie consent and does not fall within the scope of GDPR personal data.

If personal data is processed in individual cases, the processing is based on our legitimate interest in the statistical evaluation of usage behavior for optimization purposes in accordance with Art. 6 (1) (f) GDPR.

8) Page Functionalities

8.1 Video Conferences (Zoom)

For conducting online meetings, video conferences and/or webinars, we use the provider Zoom Video Communications Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA.

The provider processes various data, whereby the scope of the processed data depends on which data you provide before or during participation in an online meeting, video conference or webinar. Your data as a communication participant is processed and stored on the provider's servers. This may include in particular your login data (name, email address, telephone number (optional) and password) and session data (topic, participant IP address, device information, description (optional)). In addition, image and sound contributions of participants as well as voice input in chats may be processed.

For the processing of personal data that is necessary for the fulfillment of a contract with you, Art. 6 (1) (b) GDPR serves as the legal basis. If you have given us consent to process your data, the processing is based on Art. 6 (1) (a) GDPR. Otherwise, the legal basis for data processing in the context of conducting online meetings, video conferences or webinars is our legitimate interest pursuant to Art. 6 (1) (f) GDPR in the effective implementation of the online lesson.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework.

8.2 Automation (Make.com)

We use the services of the following provider for the integration and synchronization of databases and web applications: Celonis, Inc., One World Trade Center, 87th Floor, New York, NY, 10007, USA.

Our processing operations are automated and various workflows are established in order to efficiently manage and execute internal processes in our processing system. If personal data is also processed in this context, this is done in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in optimizing our internal organization.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework.

8.3 Automation (n8n)

This website uses the services of the following provider for the integration and synchronization of databases and web applications: n8n GmbH, Novalisstr. 10, 10115 Berlin.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

9) Social Media Presence

We maintain publicly accessible profiles on social networks in order to provide information about our courses and content. When you visit these profiles, personal data is processed by the respective providers. We have no influence on the type and scope of the data processed by the providers.

9.1 Instagram

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Data processed: Usage data, interaction data (e.g. likes, comments, shares), profile data, device information, IP address.

Purpose: Reach measurement, interaction with users, advertising our courses.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in presenting our offer and communicating with interested parties).

Joint responsibility: When operating our Instagram page, there is joint responsibility pursuant to Art. 26 GDPR with Meta Platforms Ireland Limited. The essential contents of the agreement on joint responsibility can be found in Meta's privacy policy.

Data transfer to third countries: Meta also processes data in the USA. The transfer is based on the EU-US Data Privacy Framework and the standard contractual clauses.

Further information: https://help.instagram.com/519522125107875

9.2 YouTube

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Data processed: Usage data, interaction data (e.g. subscriptions, likes, comments), device information, IP address.

Purpose: Provision of video content, reach measurement, interaction with users.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in presenting our offer).

Data transfer to third countries: Google also processes data in the USA. Google LLC is certified as a US company under the EU-US Data Privacy Framework. An adequacy decision of the European Commission is in place.

Further information: https://policies.google.com/privacy

9.3 TikTok

Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

Data processed: Usage data, interaction data (e.g. likes, comments, shares), profile data, device information, IP address, possibly location data.

Purpose: Provision of short videos, reach measurement, interaction with users.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in presenting our offer).

Data transfer to third countries: TikTok also transfers personal data to companies in Singapore, the USA and China. For these transfers, TikTok relies on standard contractual clauses (SCCs). There is no adequacy decision for China. The Irish Data Protection Authority (DPC) has found that TikTok violated the GDPR because remote access by Chinese group companies to personal data of EEA users was not sufficiently disclosed.

Further information: https://www.tiktok.com/legal/page/eea/privacy-policy/de

9.4 Telegram (Public Channel)

Provider: Telegram Messenger Inc., based in Dubai, United Arab Emirates.

Data processed: Usage data, interaction data, message content, device information, IP address.

Purpose: Provision of content, communication with interested parties, advertising our courses.

Legal basis: Art. 6 (1) (a) GDPR (consent by subscribing to the channel).

9.5 Communication via Social Media Channels

If you interact with us via social media channels (e.g. through comments, direct messages, mentions or likes), we process the content you transmit (e.g. your username, the content of your message, the time) exclusively for the purpose of communicating with you and responding to your inquiry.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in communicating with interested parties and maintaining our online presence). If your contact is aimed at concluding a contract, the additional legal basis is Art. 6 (1) (b) GDPR.

Data transfer to third countries: The respective platform operators (Meta, Google, TikTok) also process data outside the EU. The transfer is based on the standard contractual clauses and – where applicable – the EU-US Data Privacy Framework.

Storage duration: Your messages and interactions are deleted as soon as your inquiry has been conclusively processed and there are no statutory retention obligations to the contrary. We have no influence on the storage duration of the platform operators.

10) Withdrawal from Contracts

You have the right to withdraw from a contract concluded with us. To declare the withdrawal, we provide you with an electronic withdrawal function (withdrawal button) on our website. You can find this at https://gbsmethod.com/en/withdrawal .

In the context of using the withdrawal button, we process the data you enter (first and last name, email address, contract identification) for the purpose of processing your withdrawal. The legal basis for the processing is Art. 6 (1) (b) GDPR (contract fulfillment). Your data will be deleted as soon as the withdrawal has been conclusively processed and there are no statutory retention obligations to the contrary.

11) Rights of the Data Subject

11.1 The applicable data protection law grants you the following rights vis-à-vis the controller with regard to the processing of your personal data (information and intervention rights), whereby reference is made to the stated legal basis for the respective conditions of exercise:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent given pursuant to Art. 7 (3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

11.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA AS PART OF A BALANCING OF INTERESTS ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ASSERTION, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.

12) Duration of Storage of Personal Data

The duration of the storage of personal data is determined by the respective legal basis, the processing purpose and – if applicable – additionally by the respective statutory retention period (e.g. commercial and tax law retention periods).

When processing personal data on the basis of explicit consent pursuant to Art. 6 (1) (a) GDPR, the data concerned is stored until you withdraw your consent.

If there are statutory retention periods for data that is processed in the context of legal transactions or legal transaction-like obligations on the basis of Art. 6 (1) (b) GDPR, this data is routinely deleted after expiry of the retention periods, provided that it is no longer required for contract fulfillment or contract initiation and/or we no longer have a legitimate interest in further storage.

When processing personal data on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims.

When processing personal data for the purpose of direct advertising on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21 (2) GDPR.

Unless otherwise stated in the other information in this policy on specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Last updated: 24 September 2026

Additions: further services in use

This section supplements the privacy policy above and has not yet been reviewed by a lawyer.

Hosting and contact form (Netlify)

This website is hosted by Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA. When you open a page, Netlify processes server log files (IP address, date and time of the request, page requested, amount of data transferred, referrer, browser type and operating system) in order to deliver the pages, ensure security and defend against attacks. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is the stable and secure operation of the website.

Enquiries sent through the contact form on the company page are transmitted and stored via Netlify Forms. We process your name, email address and message solely to handle your enquiry. Legal bases: Art. 6 (1) (b) GDPR (pre-contractual measures) and Art. 6 (1) (f) GDPR. The data is deleted once your enquiry has been dealt with and no statutory retention obligations apply.

Netlify processes the data as a processor under a data processing agreement. Data is transferred to the USA; the transfer is safeguarded by the EU Commission's standard contractual clauses agreed in that data processing agreement. More: netlify.com/privacy.

Appointment booking (Zeeg)

For consultation calls we use Zeeg, provided by Zeeg GmbH, Friedrichstr. 155, 10117 Berlin, Germany. If you book a slot, Zeeg processes the data you enter (in particular name, email address, chosen time and any message) in order to arrange and confirm the appointment. Legal basis: Art. 6 (1) (b) GDPR. Zeeg acts as a processor and stores the data on servers in Germany. No data is transferred before you click the link and enter your details there.

Withdrawal function (WiderrufButton)

For the electronic withdrawal function pursuant to § 356a BGB we use the WiderrufButton service, provided by Cambium Holding UG (haftungsbeschränkt), Im Haag 107, 66679 Losheim am See, Germany. A script from widerrufbutton.net is loaded on every page for this purpose. If you declare a withdrawal, the provider processes your name, email address, contract details and technical proof data (timestamp, IP address) in order to handle the withdrawal and send the legally required confirmation of receipt. Legal bases: Art. 6 (1) (b) and (c) GDPR. The servers are located in Germany (Frankfurt am Main). According to the provider, no cookies and no trackers are used.

Direct messages via Telegram

If you message us directly via the Telegram link, we process your message and the profile data transmitted by Telegram (username, possibly phone number) in order to answer your enquiry. Legal bases: Art. 6 (1) (b) and (f) GDPR. Telegram also processes data outside the European Union.