Privacy

1. Controller

Responsible in the sense of the General Data Protection Regulation (GDPR) is: Anh Son Le as a sole trader, acting under Shinzen Dojo Berlin, Neheimer Str. 2, 13507 Berlin. Telephone: +49 176 67053575, Email: info@shinzen-dojo.de

2. Hosting & Platform

This website is operated on Base44. Wix processes in particular CMS content, trial training registrations and membership applications. Contact inquiries, cancellations, revocations and technical data for the creation and sending of application and contract copies are processed in Base44. The personal form and document data are not intended as publicly accessible website content.

The productive Base44 app currently uses the USA data region. Setting the EU as the default region for new apps does not automatically move the existing productive app to the EU. For transmission and processing outside the European Economic Area, the information on service providers and transmission mechanisms described in Section 14 applies.

For this processing, Wix and Base44 are used as platform service providers. You can find their publicly provided terms for data processing at Wix Data Processing Agreement and Base44 Data Processing Agreement. Information about email delivery and other recipients is provided in sections 12 and 14.

3. Collected data and purposes

We process the following personal data:

Trial training registration and internal processing: Salutation, first and last name, email address, telephone number, selected group and preferred date as well as consent with version and timestamp. To process the request, we can additionally save processing status, planned follow-up appointments, internal factual notes, documented contact activities and the time of the last contact. As far as you have consented to statistics or marketing, technically recorded origin and campaign information (e.g., referrer, landing page and UTM parameters) can also be assigned to the request. Purpose: processing, appointment organization, tracking of the request and internal evaluation of the request channels. Legal basis: depending on processing Art. 6 Para. 1 lit. a, b or f GDPR.

Membership applications and contract documents: We process in particular name, email address, date of birth, address, telephone number, selected contract type, duration, fee, declarations on application and digital signature. For minors, the data of the training child is separated from the data of the legal guardian: The legal guardian submits the application as the contracting party and person liable for payment for the child's training. The data serves the assignment, verification, initiation of the contract and execution of the membership (Art. 6 Para. 1 lit. b GDPR for the contracting party); the required participant data of the child serves the organization and execution of their training (Art. 6 Para. 1 lit. f GDPR, legitimate interest in a secure and clearly assigned training organization).

PDF copies and dispatch receipts: For document creation and delivery, an image of the application data, signature and PDF components, document versions as well as dispatch status, timestamps and technical message identifiers can additionally be stored in Base44. The application copy is sent to the specified email address of the applicant or the legal guardian and additionally to info@shinzen-dojo.de. If both addresses are identical, only one mail is sent. The application copy does not confirm an accepted contract. After personal review, Anh Son Le can manually approve an unaltered application. The resulting acceptance confirmation and final contract PDF are sent to the applicant or legal guardian as well as an identical dojo copy to info@shinzen-dojo.de. If the recipient addresses are identical, only one mail is sent. The approval and the associated document and dispatch receipts are logged in a private Wix storage; PDF components are additionally saved privately in Base44. The legal basis for application processing is Art. 6 Para. 1 lit. b GDPR; technical dispatch and integrity proofs additionally serve our legitimate interest in traceable, secure document delivery (Art. 6 Para. 1 lit. f GDPR). For new membership processes, additional private archive copies are created in Google Drive; details are in Section 12.

Contact form: Name, email address, if applicable telephone number, subject and message are saved as a private request in Base44 and transmitted internally via email for processing. An error in the notification mail does not eliminate the stored input. Legal basis is Art. 6 Para. 1 lit. b GDPR for contract-related inquiries, otherwise Art. 6 Para. 1 lit. f GDPR (legitimate interest in answering your inquiry).

Cancellation and revocation: We process the name and email address of the declaring person, contract reference or contract description, if applicable the child's name, type and content of the declaration as well as any desired date or reason provided. Please provide only the information necessary for assignment; in particular, no bank details or health details are required. The private input in Base44 receives a receipt number, a server-side entry time and a technical integrity proof. A text receipt is made available for download and sent via email to the specified address; dispatch status and message identifier document the delivery. No public search in member data takes place. The receipt does not trigger an automatic decision on contract end or payment changes. Legal basis: Art. 6 Para. 1 lit. b GDPR for processing and Art. 6 Para. 1 lit. f GDPR for secure assignment, receipt and delivery proofs.

Event registrations: Registration for events takes place via the registration function or an external ticket provider.

Shinzen Insider Newsletter: Email address, optionally selected areas of interest and the registration, confirmation, cancellation and dispatch receipts described in Section 13. Purpose: voluntary newsletter subscription and traceable confirmation process. Legal basis for subscription: Art. 6 Para. 1 lit. a GDPR (consent), revocable at any time.

Technical data: Server log files by hoster/Wix (IP address, browser, time). Purpose: technical operation and security. Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest).

4. Cookies and local storage

We use technically necessary local storage as well as – only after your consent – optional services for statistics, marketing and external media. On your first visit, you can agree to all optional categories via "OK" or make an individual selection or reject all optional categories via "Settings". Without active consent, statistics, marketing and external media remain deactivated.

You can change or revoke your selection at any time via "Cookie settings" in the footer. A revocation applies to the future.

Consent setting: Your consent decision (statistics, marketing and external media each yes/no) is stored with version, timestamp and a technical consent ID (UUID) for traceability in your browser's local storage. Purpose: compliance and verification of your selection. Legal basis: Art. 6 Para. 1 lit. f GDPR for the technically necessary storage of the consent decision.

Wix Visitor Token: Temporary token for loading CMS content. Automatically deleted after a short time.

5. Web analysis with Google Analytics 4

This website uses Google Analytics 4 (GA4), a web analysis service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) or Google LLC (Mountain View, California, USA) — hereinafter "Google". GA4 is used for reach measurement and analysis of user behavior in order to make our website more user-friendly.

Legal basis: Processing is based on your consent in accordance with Art. 6(1)(a) GDPR. Consent is obtained via our consent banner and can be withdrawn at any time via the cookie settings (Art. 7(3) GDPR).

Technical consent management: GA4 is managed via Google Tag Manager and is only loaded if the 'Statistics' category has been consented to. Consent Mode v2 is set to 'denied' by default before the Tag Manager is loaded; signals are updated accordingly upon selection.

Server-side GA4 processing path: A dedicated Google Tag Manager server container (GTM-KS882TZ) is also configured as a Google Cloud endpoint in the Google Tag for GA4. The published server configuration includes a GA4 reception client and a GA4 tag for forwarding events to Google Analytics. This processing path is used for the website analysis described above. Visitor IP anonymisation is activated in the GA4 server tag: it is replaced by a placeholder for event forwarding. The server continues to process the IP during technical reception; rough location details such as country and region may be retained in the analysis.

Scope of data processing: When consent is granted, GA4 may process information including a pseudonymised client ID, pages visited, interactions, source of origin (referrer), device data, and an approximate location.

Data transfer: Google may also process data outside the EU. Where necessary, transfers are based on the provider's data protection safeguards provided for this purpose.

Withdrawal: You can withdraw your consent for the future at any time via our cookie settings.

Further information: You can find Google's privacy policy at policies.google.com/privacy.

Withdrawal during a site visit: Upon withdrawal, consent signals are set to 'denied'. Google tags that have already been loaded may still transmit a completion event with denied consent signals. After reloading the website without statistics consent, GA4 is not loaded.

6. Google Tag Manager

We use Google Tag Manager (GTM) from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (Mountain View, California, USA) to centrally manage analytics and marketing tags.

Functionality: The published GTM container currently includes Google Analytics 4, Google Ads, Meta Pixel, and Contentsquare, among others. It controls which tags are executed on the website.

Consent management: Before Google Tag Manager is loaded, analytics_storage, ad_storage, ad_user_data and ad_personalization are set to 'denied' by default. The container is only loaded once at least 'Statistics' or 'Marketing' has been enabled. Thereafter, the signals are updated according to the selection. Statistics and marketing tags must additionally respect the appropriate consent requirement within the GTM. In the event of a subsequent withdrawal, the affected signals are set back to 'denied'.

Protected pages: The optional GTM container is not loaded on the digital membership application, cancellation and withdrawal pages, or administrative and login pages. When switching between these pages and the other website pages, a new page document is loaded so that analysis and marketing tags already started are not carried over into the protected form or administrative views. Your saved cookie selection is retained. The newsletter confirmation and unsubscription pages are also included as protected pages without an optional GTM container.

Legal basis: Insofar as optional analysis or marketing services are loaded via GTM, this is done on the basis of your consent in accordance with Art. 6(1)(a) GDPR. Consent can be withdrawn at any time via the cookie settings.

Data transfer: Google may also process data in the USA. Where necessary, the provider's data protection safeguards for this purpose apply.

Further information: You can find Google's privacy policy at policies.google.com/privacy.

7. Google Ads (Conversion Tracking & Remarketing)

We use Google Ads from Google Ireland Limited or Google LLC to measure ad conversions. The published Google Tag Manager container currently contains, among other things, the Google Ads ID AW-714690873 as well as a conversion for the trial training thank-you page.

Consent management: Google Ads is assigned to the 'Marketing' category. The GTM container is only loaded after at least one tracking category has been enabled; Google Ads tags may only be executed with marketing consent. The signals ad_storage, ad_user_data and ad_personalization are set to 'denied' beforehand.

Legal basis: Processing is based on your consent in accordance with Art. 6(1)(a) GDPR. Consent can be withdrawn at any time via the cookie settings.

Scope of data processing: When consent is granted, information such as click and conversion data, cookie or device identifiers, and technical information can be processed.

Further information: You can find Google's privacy policy at policies.google.com/privacy.

8. Meta Pixel (via Google Tag Manager)

In the published Google Tag Manager container, a Meta Pixel with the Pixel ID 419230182038856 is currently configured. The container includes a PageView event and a CompleteRegistration event for the trial training thank-you page, among others.

Consent management: The Meta Pixel is assigned to the 'Marketing' category and may only be executed after consent to 'Marketing'. Without marketing consent, the service remains blocked.

The additional server-side forwarding to Meta via the Conversions API has been paused since 12 October 2026. The Meta Pixel described above in the browser remains bound to marketing consent.

Legal basis: Art. 6(1)(a) GDPR (consent). Consent can be withdrawn at any time via the cookie settings.

Further information on data protection at Meta can be found at facebook.com/privacy/policy.

9. Contentsquare (via Google Tag Manager)

A Contentsquare tag is currently configured in the published Google Tag Manager container. Contentsquare can be used to analyse the usage and interaction with the website.

Consent management: Contentsquare is assigned to the 'Marketing' category and may only be executed after consent to 'Marketing'. Without marketing consent, the service remains blocked.

Legal basis: Art. 6(1)(a) GDPR (consent). Consent can be withdrawn at any time via the cookie settings.

Further information on data protection at Contentsquare can be found at contentsquare.com/privacy-policy/.

10. Microsoft Clarity (currently not directly integrated)

No direct Microsoft Clarity integration is currently implemented in the website code. Should Clarity be used for behavioural analysis in the future, the service will only be activated after consent to the 'Statistics' category, and this privacy policy will be updated accordingly before productive use.

Further information on data protection at Microsoft Clarity can be found at clarity.microsoft.com/privacy.

11. OpenAI Ads Pixel (via Google Tag Manager)

If an OpenAI Ads Pixel is configured in the published Google Tag Manager container, it is used to measure conversions for our trial training registration.

Consent management: The OpenAI Ads Pixel is assigned to the 'Marketing' category. If this service is actively used in the published GTM container, it—including associated conversion events—may only be executed after consent to 'Marketing'.

Legal basis: Art. 6(1)(a) GDPR (consent). Consent can be withdrawn at any time via the cookie settings.

Provider: OpenAI, L.L.C. (USA). Insofar as data is transferred to the USA, this is based on the data protection guarantees provided for this purpose (EU Standard Contractual Clauses). Storage duration and further details: to be verified based on the current OpenAI privacy policy.

Further information on data protection at OpenAI can be found at openai.com/privacy.

12. Communication with members (WhatsApp Business & Google Workspace)

We use WhatsApp Business and Google Workspace to communicate with members and interested parties. These tools are not loaded via the website but are operated by us separately.

WhatsApp Business: We use the WhatsApp Business app from Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) for communication with members (e.g., training times, organisational arrangements). When you write to us via WhatsApp, Meta processes your phone number, name, and chat content. Meta is independently responsible for data processing in the context of WhatsApp (separate privacy policy: whatsapp.com/legal/privacy-policy). Legal basis: Art. 6(1)(b) GDPR (contract fulfilment) or Art. 6(1)(a) GDPR (consent) if you wish to communicate via WhatsApp.

Google Workspace / Gmail: For email communication, internal notifications, and sending application copies and receipts, we use Google Workspace with Gmail. The names, email addresses, message content, and attachments required for the respective message are processed; application copies may also include participant and contract data contained in the document. Calendars and contacts are used for internal organisation. Legal basis: Art. 6(1)(b) GDPR for contract-related communication, otherwise Art. 6(1)(f) GDPR (legitimate interest in reliable communication and administration). Google provides a Data Processing Addendum bereit.

Private application and contract filing / Google Drive: For new membership processes, we additionally save the already sent application copy and, after manual approval, the final contract copy in a private folder of our Google Workspace account. The PDFs contain the respective participant, legal guardian, and contract details, as well as the signature contained in the document. Additionally, we store the process reference, document version, and technical transmission and integrity proofs. The filing serves the documentation and administration of the contractual relationship as well as the securing of necessary evidence. Processing is carried out on the legal bases mentioned in Section 3; the storage duration is governed by Section 15. Public disclosure of these documents is not intended. The information on service providers and international transfers in Section 14 also applies to this filing.

Communication channels: WhatsApp is voluntary. For the online forms described, we use the email address you provide for the respective confirmations and documents. If you wish for a different process, you can contact us by phone or by post. An email to our Dojo is also processed via Google Workspace.

13. Shinzen Insider Newsletter

You can voluntarily subscribe to our editorial newsletter with selected articles, event tips, training tips, and Dojo updates via the 'Shinzen Insider' registration form. For new registrations, we use a confirmation process: you provide consent in the form, receive a confirmation email, and confirm your registration via the link contained therein on the website. Only after this confirmation is the registration considered for newsletter distribution. The confirmation link is valid for 48 hours.

Data collected and evidence: We process your email address and optionally selected areas of interest, as well as the source of registration, time of registration and confirmation, status, and, where applicable, time of unsubscription. For verification purposes, the version and a technical hash value of the consent text, as well as technical process and transmission identifiers, are stored. The secrets of the confirmation and unsubscription links are stored in the private archive only as hash values. The new registration itself does not collect an additional IP address as proof of consent; technical platform log data is described in Section 3.

Processing and service providers: The process is handled via Base44. The new registration, confirmation, and unsubscription records are held in a private Wix archive. The confirmation email is sent via our Google Workspace account using Gmail. In doing so, your email provider also processes the message. The information on service providers and international data transfers in Sections 2, 12, and 14 also applies here.

Purpose and legal basis: Registration and newsletter distribution are based on your consent in accordance with Art. 6(1)(a) GDPR. The records serve to document consent and ensure secure processing. Insofar as records are still required after an unsubscription, they are kept only to fulfil relevant evidentiary requirements or to assert, exercise, or defend legal claims.

Withdrawal: You can withdraw your consent at any time with effect for the future via the unsubscription link or by email to info@shinzen-dojo.de. An unsubscribed registration is no longer considered for newsletter distribution. Unsubscription does not require registration for a user account. The legality of the processing prior to withdrawal remains unaffected.

Storage duration: Your address will be used for newsletter receipt until withdrawal. Unconfirmed or unsubscribed processes may not be used as newsletter recipients. Further retention of necessary records is determined by their purpose and the actually applicable obligations; they are subsequently deleted. The 48-hour link validity is not an automatic deletion period for the record.

Protected link pages: No optional analysis or marketing tags are loaded on the confirmation and cancellation pages. Existing addresses are not automatically treated as confirmed new registrations or contacted again through the introduction of this process. We do not sell your email address and do not use it for third-party advertising purposes.

13a. Free training plan and optional PDF dispatch

You can create the training plan without an account and download it as a PDF. The plan data is processed in the open browser tab for this purpose and is not transmitted to the Dojo during creation and download.

If you would also like to receive the plan via email, we require your email address; first name and surname are optional. You confirm the address via an email with a link valid for 30 minutes and a button on the website. When you return to the open plan, the PDF is automatically sent to the confirmed address. Leave the tab open for this. This is not linked to a newsletter registration or an invitation to a trial training session.

The PDF contains the information entered for your plan, such as age, gender, height, weight, fitness level, training goals and days of the week, as well as any information regarding restrictions, allergies and nutrition. To the extent that health information is derived from this, we also process this exclusively with your express consent for the requested dispatch. The basis for this is Art. 6 (1) (a) and, where health data are concerned, Art. 9 (2) (a) GDPR.

Base44, Wix and Google Workspace with Gmail are used for confirmation and delivery. Email address, optional names, as well as technical request, consent, confirmation and dispatch logs are stored in a private Wix folder. The PDF is temporarily processed via Base44 when sent, but is not additionally archived as a plan file in Wix, Base44 or Google Drive. The sent message and its attachment may remain stored in the Gmail sent folder as well as with the recipient's email provider. The information on service providers and international data transfers in sections 2, 12 and 14 applies accordingly.

The validity of the confirmation link is not a deletion period for dispatch logs or email copies. These are only stored for as long as they are required for processing and necessary proof; they are subsequently to be deleted, provided there are no opposing storage obligations or outstanding claims. An automatic deletion is not activated by this process. You can revoke your consent at any time for the future at info@shinzen-dojo.de and exercise your rights under section 16. You manage copies already delivered to your inbox there yourself.

After the successful PDF dispatch, info@shinzen-dojo.de receives an internal dispatch confirmation with your email address, the voluntarily provided names, the time of dispatch and a technical transaction reference. This message contains no training plan and no training or health data. It serves for the processing and traceability of the dispatch you requested.

Only if you agree to the category 'Statistics' in the cookie settings can a confirmed PDF dispatch be counted as a training_plan_pdf_sent event in Google Analytics 4. For this purpose, our Base44 backend transmits a pseudonymous browser identifier and technical event data via Google Analytics' European collection endpoint. Names, email address, plan contents, health data, confirmation link and private transaction reference are not transmitted as event data. No Google Analytics script is loaded on the personal plan page for this purpose. This single server-side measurement path uses the Google Measurement Protocol; the remaining website events described in section 5 continue to use the GTM processing path described there. The information on GA4 in section 5 applies; statistics consent can be revoked at any time via the cookie settings.

14. Transfer to third parties

For the operation and handling of your requests, the necessary data is processed via Wix, Base44 and Google Workspace with Gmail and Google Drive. PDF copies are sent to the provided address of the applicant or legal guardian and as a Dojo copy to info@shinzen-dojo.de. Contact requests are transmitted internally to the Dojo; termination and withdrawal receipts are sent to the provided email address. In this process, the respective recipient's email provider also processes the message and any attachments. For external events, the specified ticket providers may be added.

Optionally used analysis, marketing and media services are described in the respective sections and are controlled according to your consent. There is no sale of your personal data.

The platform and communication providers used may also process data outside the European Economic Area. Their published data protection and data processing terms describe the subcontractors and transfer mechanisms used, in particular adequacy decisions and, where necessary, EU standard contractual clauses. You can request information and copies of the guarantees relevant for a specific transfer at info@shinzen-dojo.de.

15. Storage duration

Trial training registrations, including associated processing data such as status, follow-up appointments, internal subject-related notes and documented contact history, are generally deleted 12 months after the last contact, provided no membership has been established and no statutory retention obligations prevent this. Membership data is stored for the duration of the contract plus statutory retention periods.

Contact requests are stored for processing and necessary proof. Application data, copies of applications and contracts as well as termination and withdrawal receipts are required for as long as they are necessary for processing, the contractual relationship, the fulfilment of relevant statutory retention obligations or the assertion, exercise or defence of legal claims. The purpose, document type, end of contract or process and applicable deadline are decisive; not every data record is subject to the same statutory retention period.

Technical PDF and dispatch copies are checked separately from the relevant contract archive for their continued necessity. A short validity of an access token is not a deletion period for the associated application or PDF. The current retention check does not delete data automatically. Before deletion, the completeness of the required proof, outstanding claims and any backup or retention obligations must be taken into account; this also applies to email copies.

16. Your rights (data subject rights)

You have the following rights. To exercise them, please contact info@shinzen-dojo.de:

Access to the data processed about you (Art. 15 GDPR)

Rectification of incorrect data (Art. 16 GDPR)

Erasure of your data (Art. 17 GDPR)

Restriction of processing (Art. 18 GDPR)

Data portability (Art. 20 GDPR)

Objection to the processing (Art. 21 GDPR)

Revocation of consent given (Art. 7 (3) GDPR)

17. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with the responsible supervisory authority – for Berlin, the Berlin Commissioner for Data Protection and Freedom of Information (Friedrichstr. 219, 10969 Berlin).

18. External media and embedded content

We embed content from external providers on individual pages. This includes in particular Google Maps, OpenStreetMap, ReviewForest as well as any YouTube or Vimeo videos in blog posts.

This content is only loaded if you agree to the category 'External media' in the cookie settings. Before this, only a placeholder is displayed and no connection to the respective third-party provider is established.

When loading external content, your IP address as well as browser and device information can be transmitted to the respective provider for technical reasons. Depending on the provider, further cookies or comparable technologies may be used.

Legal basis: Art. 6 (1) (a) GDPR (consent). You can revoke your consent at any time via the cookie settings with effect for the future.

Google Maps: The provider is Google Ireland Limited or Google LLC. Maps are only loaded after consent.

OpenStreetMap: Map tiles are loaded via the infrastructure of the OpenStreetMap project. Here, too, the IP address is technically transmitted to the tile server upon retrieval.

ReviewForest: The external ReviewForest widget on our sustainability page is only loaded after consent.

YouTube/Vimeo: Embedded videos in editorial content are only loaded after consent.

19. Amendments to this privacy policy

We may amend this privacy policy to take into account legal requirements or to reflect changes in our services. The current version is available on this page.