PRIVACY POLICY

  1. Controller

The controller within the meaning of the GDPR is:

School of Taiji GbR
Nicolas Knipping and Marc Rosca
Tegeler Str. 38
13353 Berlin
Germany

Phone: +49 176 92619720
Email: mail@schooloftaiji.com

  1. General Information on Data Processing

2.1 Scope of Processing of Personal Data

We process our users’ personal data only insofar as necessary to provide a functional website and our content and services. Processing generally takes place only with the user’s consent, or in cases where prior consent cannot be obtained for factual reasons and processing is permitted by statutory provisions.

2.2 Legal Bases for Processing

  • Art. 6 (1) (a) GDPR: Consent
  • Art. 6 (1) (b) GDPR: Performance of a contract and pre-contractual measures
  • Art. 6 (1) (c) GDPR: Compliance with legal obligations
  • Art. 6 (1) (f) GDPR: Legitimate interest

2.3 Storage Duration and Deletion

Personal data will be deleted as soon as the purpose of processing no longer applies, unless statutory retention obligations (e.g. under commercial or tax law, generally 6 or 10 years) require further storage.

  1. Provision of the Website and Server Log Files

When you access our website, our hosting provider automatically collects information transmitted by your browser (server log files):

  • Anonymised IP address of the accessing device
  • Date and time of access
  • Name and URL of the file accessed
  • Volume of data transferred
  • Notification of successful retrieval
  • Browser type and version, operating system
  • Referrer URL (previously visited page)

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the stable and secure operation of our website).

Storage duration: Log files are anonymised or deleted after 7 days at the latest, unless required for investigating attacks.

Hosting provider:
IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany
A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS.

  1. Cookies and Consent Management

We use cookies and similar technologies on our website. Cookies are small text files stored on your device.

4.1 Strictly Necessary Cookies

These cookies are required for the website to function:

  • Login session cookies for the member area
  • Storage of your cookie preferences
  • Storage of your language selection (for multilingual use, see section 5)

Legal basis: Art. 6 (1) (f) GDPR in conjunction with Section 25 (2) No. 2 TDDDG (German Telecommunications-Digital Services Data Protection Act).

4.2 Consent-Based Cookies

All cookies that are not strictly necessary (in particular from embedded services such as Vimeo) are only set with your explicit consent. Legal basis: Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG.

4.3 Real Cookie Banner

To manage your consent, we use the WordPress plugin “Real Cookie Banner” by devowl.io GmbH. The plugin stores your cookie settings locally in your browser and logs your consent in compliance with data protection law (consent log). The data collected (including anonymised IP address, date/time of consent, browser information) is used exclusively as evidence of your consent pursuant to Art. 7 (1) GDPR.

Provider: devowl.io GmbH, Tannet 32a, 94539 Grafling, Germany
Further information: https://devowl.io/de/rechtliches/datenschutzerklaerung/

You can withdraw or adjust your consent at any time via the cookie banner (link in the footer of this page).

  1. Multilingualism (Polylang)

Our website uses the “Polylang” plugin to provide multilingual content. Polylang stores your language selection in a strictly necessary cookie so that the website is displayed in the language you have selected. No personal data is transferred to third parties. Processing takes place exclusively locally on our server.

Provider: WP SYNTEX
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in providing a user-friendly website).

  1. Member Area (Simple Membership Plugin)

For the member area, we use the WordPress plugin “Simple Membership” (smp7 / wp.insider) including the add-on “Simple Membership After Login Redirection”. When you register, we collect the following data:

  • First and last name
  • Email address
  • Self-chosen username and password (stored in encrypted form)
  • Selected membership level
  • Registration date
  • IP address at the time of registration
  • Payment status

Purpose: Provision and administration of paid member access, login functionality, redirection to member-specific areas after login, billing.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

Data retention depends on the specific purpose:
– Login data (username, password, email): Deleted within 30 days after termination of membership.
– Tax-relevant billing data (name, invoice amount, date, payment method): 10 years according to § 147 German Fiscal Code (AO).
– IP addresses at registration/login: 7 days for security reasons, then automatic deletion.

The data is stored on the server of our hosting provider IONOS in Germany and is not passed on to third parties, except to our payment service provider (see section 7).

  1. Payment Processing via PayPal

For membership payments, we use the payment service provider PayPal, integrated via the PayPal payment button of the Simple Membership plugin.

Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

When you click the PayPal payment button, you will be redirected to the PayPal website. The data required for payment processing (e.g. name, email address, payment amount, invoice or order number) is transmitted to PayPal. PayPal processes this data on its own responsibility in accordance with its own privacy policy.

After a successful payment, the payment status is reported back to our website and linked to your member account.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

PayPal Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

  1. Embedding of Vimeo Videos

We embed videos from the provider Vimeo on our website.

Provider: Vimeo LLC, 555 West 18th Street, New York, New York 10011, USA

Vimeo videos are only loaded after you have expressly consented to the use of Vimeo via our cookie banner. No data is transmitted to Vimeo prior to your consent.

After your consent, your browser establishes a connection to Vimeo’s servers. The following data is transferred to Vimeo:

  • IP address
  • Browser information
  • Date and time of access
  • Video viewed
  • If you are logged in to Vimeo: Association with your Vimeo account

Data transfer to the USA: Vimeo is a US-based company. Data is transferred on the basis of the EU-US Data Privacy Framework, under which Vimeo is certified. Further information: https://www.dataprivacyframework.gov/

Legal basis: Art. 6 (1) (a) GDPR (consent).

Vimeo Privacy Policy: https://vimeo.com/privacy

  1. Contact Form (WPForms Lite)

We offer a contact form on our website, implemented using the “WPForms Lite” plugin by WPForms LLC. When you use the form, we collect:

  • Name
  • Email address
  • Your message
  • IP address and timestamp (for spam prevention)

Before submitting the form, you must actively tick a checkbox to give your consent to the processing of your data in accordance with this privacy policy. The form cannot be submitted without this consent.

Purpose: Handling your enquiry.

Legal basis: Art. 6 (1) (a) GDPR (consent) as well as Art. 6 (1) (b) GDPR for pre-contractual enquiries.

Storage duration: Until your enquiry has been finally processed, but no longer than 6 months, unless further retention is required.

The data submitted via the form is stored in our WordPress database on the server of our hosting provider IONOS in Germany.

  1. Links to Instagram

On our website, we link to our Instagram profiles in the team section. These are simple hyperlinks only. No Instagram content is directly embedded on our website, and no data is transferred to Instagram unless you click on the link.

If you click on one of the links, you will be redirected to the Instagram website. From that point onwards, Instagram’s privacy provisions apply (Meta Platforms Ireland Limited).

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
Privacy Policy: https://privacycenter.instagram.com/policy/

  1. Web Fonts (Locally Hosted)

We use the “Ubuntu” font on our website. It is hosted locally on our server, so no connection to external servers (e.g. Google Fonts) is established when the website is accessed. No font-related data is transferred to third parties.

  1. Security (Wordfence)

To protect our website from attacks, we use the security plugin “Wordfence Security” (Free version).

Provider: Defiant Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA

For attack prevention, Wordfence processes IP addresses and access data (failed login attempts, firewall events). Processing takes place locally on our server in Germany. There is no permanent connection to Wordfence cloud services. Data is only exchanged with Defiant’s servers when security definitions (malware signatures, firewall rules) are automatically updated; no visitor-related data is transferred during this process.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in IT security in accordance with Recital 49 GDPR).

Storage duration: IP-based security data is automatically deleted after 30 days at the latest, unless required to investigate a specific security incident.

Privacy Policy: https://www.wordfence.com/help/general-data-protection-regulation/

  1. Backups (UpdraftPlus)

For data backup we use the plugin “UpdraftPlus – Backup/Restore” by TeamUpdraft. Backups are stored on the server of our hosting provider IONOS. The backups contain all website data, including user and member data. They are retained to enable restoration in the event of a failure.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in resilience and availability).

  1. Search Engine Optimisation (Rank Math SEO)

We use the “Rank Math SEO” plugin to optimise our website for search engines. Rank Math does not process any personal data of website visitors in a way that would allow conclusions to be drawn about individual persons. Only metadata of the website itself is processed. No user tracking takes place.

  1. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent (Art. 7 (3) GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, please contact: mail@schooloftaiji.com

Competent supervisory authority for us:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
(Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59-61
10555 Berlin, Germany
https://www.datenschutz-berlin.de

  1. Changes to this Privacy Policy

We reserve the right to amend this privacy policy if legal frameworks or processes within our organisation change. The current version is always available on this page.

Last updated: 9 November 2026