Privacy policy

Last updated: October 2026

1. Controller

The controller responsible for processing personal data on this website (coaching.veneissa.com) is:

Margo Veneissa Haschka – VENEISSA. WITHIN
Yokohamastraße 3
20457 Hamburg
Germany

Email: hello@veneissa.com
Phone: +43 677 62476986

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

This website consists of a public part (home page, legal notice, privacy policy, each in English, German and French) and a protected area that only invited persons with a user account can log in to (coaching platform).

This website uses no analytics or tracking tools, no advertising, no social media plugins, no embedded videos or maps, no externally loaded fonts or scripts and no contact form. Personal data is not sold.

3. Hosting and server log files

The website is operated on a server in a data centre in Germany. The technical operator of the server is NDTSS GmbH & Co. KG, Hamburg, acting for me as a processor under Art. 28 GDPR.

Each time the website is accessed, the web server automatically processes the following data transmitted by your browser:

IP address of the requesting device
date and time of access
requested address (URL) and amount of data transferred
HTTP status code
referrer URL (the previously visited page, if transmitted)
browser type and version, operating system (user agent)

This data is technically required to deliver the website and to ensure its security and stability (e.g. defending against attacks, error analysis). The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest lies in the secure and error-free operation of the website. The log files are not combined with other data and are deleted after 14 days at the latest, unless they are needed for longer in an individual case to investigate a security incident.

The connection to the website is encrypted via TLS (recognisable by “https://”).

4. Contact by email or phone

If you contact me by email or phone, I process the data you provide (e.g. name, email address, phone number, content of your enquiry) in order to deal with your request. The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to a contract (e.g. coaching), otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries).

The data is deleted once your enquiry has been fully dealt with, unless statutory retention obligations (e.g. commercial or tax retention periods of up to ten years for business correspondence) apply.

5. Cookies and browser storage

The public pages are available in English, German and French. When you open the home page, the matching language version is shown once, based on the language preference sent by your browser (HTTP header “Accept-Language”). Your location is not determined; no IP geolocation takes place and nothing is stored.

If you choose a language yourself via the language switcher, a cookie vlang containing the code of the chosen language (e.g. en) is set, valid for the websites under veneissa.com, for 12 months. It contains no personal data and serves only to keep your choice. The legal basis is § 25 (2) no. 2 TDDDG (function expressly requested by the user). You can delete the cookie in your browser at any time. No other cookies are set on the public pages. Your browser’s session storage (sessionStorage) merely notes briefly whether the page has already been reloaded automatically once after a website update; this entry contains no personal data and is deleted when the tab is closed.

In the protected area, only technically necessary storage is used:

Name / type	Purpose	Storage period
Cookie `coaching_session`	Keeps you logged in after login (random session token, HTTPS only, not readable by scripts)	until logout, after 12 hours of inactivity, at the latest after 7 days
localStorage (browser storage)	Your settings on this device, e.g. selected microphone, language of the guide, opened menu sections, last opened document, filters	until you delete the entries (e.g. via the browser settings)
sessionStorage	short-lived states of the current session	until the tab is closed

This storage is strictly necessary for the service you have expressly requested (login and use of the platform) to work. The legal basis is § 25 (2) no. 2 TDDDG; subsequent processing is based on Art. 6 (1) (b) GDPR. Consent is not required for this, so no cookie banner is shown.

6. User account and protected area

The protected area is available only to persons for whom I have set up a user account (e.g. clients in the context of coaching). The following is processed:

account data: user name, display name, email address if applicable, role, password (stored only as a secure hash, never in plain text)
login data: session token, time of login and of last activity
log: which actions took place in the account (e.g. login, editing a document), so that changes can be traced
content that you or I create on the platform (e.g. documents, comments, attachments)
technical error reports from your browser (page accessed, browser type, program version), so that I can fix display errors

The legal basis is Art. 6 (1) (b) GDPR (performance of the coaching contract); for the log and error reports Art. 6 (1) (f) GDPR (security and traceability). Where you voluntarily provide information in the coaching that concerns special categories of personal data (e.g. health), I process it only on the basis of your explicit consent (Art. 9 (2) (a) GDPR), which you can withdraw at any time with effect for the future.

The data is stored on the server in Germany named in section 3. Documents can be sent by email at your request; they are sent via the mail server of the same operator.

Account data and content are deleted when the account is no longer needed (at the latest after the end of the collaboration), unless statutory retention obligations apply. Expired sessions automatically become invalid.

7. AI assistant in the protected area (Anthropic)

For my own work (preparing and drafting coaching material) I use an AI assistant in the protected area. This assistant is available only to me or the technical administration, not to clients.

When the assistant is used, the texts entered and, where applicable, content from platform documents needed for the request are transmitted to Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA, and processed there to generate a response. According to Anthropic, it does not use content transmitted via its programming interface (API) to train its models. The transfer to the USA is based on the standard contractual clauses adopted by the EU Commission (Art. 46 (2) (c) GDPR), which form part of Anthropic’s data processing terms.

I do not enter names or other information into the assistant by which clients can be identified, unless this is strictly necessary for the task at hand. Conversations with the assistant are stored on the server in Germany and can be deleted at any time.

Voice input (dictation) is converted into text exclusively locally on the server in Germany; the audio recording is not transmitted to third parties for this purpose. The read-aloud function uses your browser’s speech output; depending on the browser and the selected voice, the browser manufacturer may process the text to be read on its own servers.

The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest lies in efficient preparation of my coaching work.

8. Your rights

You have the right at any time to:

access to your data stored by me (Art. 15 GDPR)
rectification of inaccurate data (Art. 16 GDPR)
erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
withdraw any consent given, with effect for the future (Art. 7 (3) GDPR)

Right to object (Art. 21 GDPR): Where I process data on the basis of Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation.

An informal message to hello@veneissa.com is sufficient for all requests.

9. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI)
Ludwig-Erhard-Straße 22, 7. OG
20459 Hamburg, Germany
https://datenschutz-hamburg.de

10. Obligation to provide data

To visit the public pages you do not have to provide any personal data, apart from the data automatically transmitted for technical reasons (section 3). A user account is required to use the protected area.

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

11. Changes

I adapt this privacy policy when the website or the legal requirements change. The version published here applies. This privacy policy is also available in German and French; in case of discrepancies, the German version prevails.