Data Privacy

1. Controller

André Munzinger – Your Next Step
Gronachblick 3, 74589 Satteldorf, Germany
Email: Contact Form

We comply with the GDPR and the Federal Data Protection Act (BDSG).

2. Data We Collect & Why

Contact Forms & Submissions

Name, email, and message content. Stored in a MySQL database on all-inkl.com (Germany) and forwarded to our CRM (Mautic, self-hosted) for follow-up.
Legal basis: Consent (Art. 6 I a) / Legitimate interest (Art. 6 I f).

Appointment Bookings

Processed via TidyCal: name, email, booked time.
Legal basis: Contract performance (Art. 6 I b). Privacy: tidycal.com/privacy

Payments

The Lead Yourself workbook, discovery session bookings, coaching bookings, and the personalised assessment PDF report are all processed through Stripe. Stripe processes card data directly — we never see or store it. Stripe privacy: stripe.com/privacy

Your email (and optionally name). Delivered via Mautic (self-hosted, Germany) via All-inkl SMTP.
Legal basis: Consent (Art. 6 I a). Withdraw anytime via unsubscribe link.

Analytics

Matomo (self-hosted, analytics.andre-munzinger.com) with IP anonymization. No third-party transfers. Only active after you accept cookies.
Legal basis: Consent (Art. 6 I a).

Fonts & Hosting

Fonts are self-hosted — no Google Fonts calls. Hosted by all-inkl.com (Germany). Server logs kept up to 14 days.

Cookies

Managed via Klaro consent manager. Only strictly necessary cookies without consent. Withdraw via "Cookie Settings" in the footer.

3. Storage Periods

Contact form & application submissions: 90 days — unless you opt in to marketing emails, in which case your details are kept until you unsubscribe or object
Newsletter subscriptions: until unsubscribed
Assessment/survey results: name and email deleted after 90 days; anonymized, non-identifying demographic data (industry, company size, etc.) is kept indefinitely for aggregate benchmarking
Field guide downloads: 90 days
360°/Team assessment group sessions: 90 days after the session is closed
Client file-delivery download logs: 90 days
Server logs: 14 days
Consent records: 3 years
GDPR request records: 5 years (documentation obligation)

4. International Transfers

TidyCal and Stripe may process data outside the EU. Protected by standard contractual clauses or adequacy decisions.

5. Security

All transmission is SSL/TLS encrypted (HTTPS)
Storage on servers at all-inkl.com (Germany)
Access by authorized persons only

6. Your Rights & How to Exercise Them

Under GDPR you have the right to access, correct, delete, restrict, receive (portability), or object to the processing of your personal data, and to withdraw consent at any time. Use the form below or our contact form. Response within 30 days guaranteed.

You may also lodge a complaint with the Federal Commissioner for Data Protection (BfDI).

Exercise Your Rights

Submit a Data Request

I will respond within 30 days as required by GDPR Art. 12.

Request Type *

Full Name *

Email Address *

Details (optional)

I confirm I am the person whose data this concerns, and that the email address above is the one used to interact with Your Next Step. *

Max. 3 requests per 24 hours · GDPR Art. 12 response within 30 days

Your Rights at a Glance

🔍

Art. 15 — Access Request a copy of all data we hold about you.

✏️

Art. 16 — Correction Ask us to correct inaccurate data.

🗑️

Art. 17 — Erasure Ask us to delete your data ("right to be forgotten").

⏸️

Art. 18 — Restriction Limit how your data is used while a request is in review.

📦

Art. 20 — Portability Receive your data in a machine-readable format.

🚫

Art. 21 — Objection Object to processing based on legitimate interests.

Supervisory Authority Unsatisfied with my response? Contact the Federal Commissioner for Data Protection (BfDI) or the supervisory authority in your EU member state.