Welche Daten, und warum
- Email address (you provide it when you register) — to log in (email plus password, and reset-password links) and to send subscription and renewal notices.
- A password hash (never the password itself) — to check logins.
- Billing country (returned by Paddle after payment) — to apply the right tax. It does not decide which language of the course you can watch.
- Subscription and purchase records (from Paddle) — to decide what you can watch.
- Watch history (created as you use the service) — for the continue-watching feature.
- Referral codes (URL parameters when you arrive via a dealer link) — to calculate dealer commission.
- Comments and tickets you submit — to show other members and to answer you.
- If you subscribe to practice-reminder email: the address, language, time of consent and IP at that moment — to prove the consent exists.
Wir erheben nicht: das Passwort im Klartext, Kartendaten (Paddle verarbeitet sie; wir sehen sie nie) und keine Gesundheitsdaten.
Rechtsgrundlagen (Art. 6 DSGVO)
- Providing the service you bought: contract (Art. 6(1)(b)).
- Transactional email (login, renewal reminders, invoices, purchase confirmation): contract.
- Keeping accounts and tax records: legal obligation (Art. 6(1)(c)).
- Marketing email: your consent (Art. 6(1)(a)), which you can withdraw at any time.
- Showing comments you wrote: your consent (Art. 6(1)(a)).
- Moderating comments: legitimate interests (Art. 6(1)(f)) — to keep false claims about disease and results off the site.
- Dealer attribution: legitimate interests (Art. 6(1)(f)) — to calculate commission we owe dealers. You may object.
Cookies
We use only two cookies. One is an httpOnly session cookie that keeps you logged in; without it login cannot work. The other stores the interface language you chose on the home page, as a language code only (for example de), so you do not have to choose again; you can change it on any page. Both are strictly necessary, so we do not ask for consent.
We do not use tracking, advertising or third-party analytics cookies. Dealer attribution does not use cookies either — the referral code travels in the URL, or is the discount code you actually used.
Auftragsverarbeiter und Speicherort
- Paddle — payments, tax, invoices.
- Supabase — database, stored in the EU (Frankfurt, eu-central-1).
- Bunny — video delivery, stored in the EU (Frankfurt).
- Render — the website, in the EU (Frankfurt).
- Resend — transactional email, EU region (Ireland).
- MailerLite — practice-reminder and similar marketing mail, data centres in Germany and the Netherlands. Only if you subscribed to those emails.
Each processor is bound by a data-processing agreement (Supabase's DPA takes effect with its terms). Where a transfer outside the EU is needed, we rely on Standard Contractual Clauses.
Speicherdauer
Kontodaten bleiben, solange das Konto besteht. Nach Löschung gibt es 30 Tage, um ein Versehen rückgängig zu machen; danach Löschung, soweit das Recht nichts anderes verlangt. Buchhaltungsunterlagen werden 10 Jahre ab Ende des betreffenden Jahres aufbewahrt.
Ihre Rechte
Sie können Ihre Daten auskunftsweise erhalten, berichtigen oder löschen, die Verarbeitung einschränken oder ihr widersprechen und eine übertragbare Kopie verlangen. Schreiben Sie an service@hxfdaoyin.com. Wir antworten innerhalb von 30 Tagen.
Wir sind außerhalb der EU niedergelassen und bestellen einen Vertreter in der EU nach Art. 27 DSGVO. Bis die Bestellung hier steht, senden Sie solche Anfragen an service@hxfdaoyin.com. Danach erscheinen Name und Kontaktdaten des Vertreters in diesem Abschnitt.
Der Betreiber kann wechseln. Wir benachrichtigen Sie dann per E-Mail.
