Last updated: 01.07.2026
This Privacy Policy explains how Maria Luisa Engels collects, uses, stores, and protects personal data when you visit this website, purchase a course, subscribe to the newsletter, contact us, or otherwise interact with our services.
This Privacy Policy is intended to comply with the General Data Protection Regulation (GDPR) and applicable German data protection law.
The controller for the processing of personal data within the meaning of the GDPR is:
Maria Luisa Engels
Königsteiner Straße 85
65812 Bad Soden am Taunus
Hessen
Germany
Email: [email protected]
Website: www.marialuisaengels.com
There is no separate data protection officer appointed, because there is currently no legal obligation to appoint one based on the present structure of the business.
Personal data means any information relating to an identified or identifiable natural person.
Personal data is processed only to the extent necessary to operate the website, provide the courses and related services, process payments, manage customer relationships, send newsletters where consent has been given, comply with legal obligations, and protect the security and integrity of the business.
Processing may take place on the basis of:
Article 6(1)(a) GDPR, where consent has been given.
Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or to take steps prior to entering into a contract.
Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation.
Article 6(1)(f) GDPR, where processing is necessary for legitimate interests, provided these are not overridden by the data subject’s interests or fundamental rights.
When you visit the website, certain information may be processed automatically by the hosting and website systems. This may include:
IP address.
Date and time of access.
Browser type and browser version.
Operating system.
Referrer URL.
Pages visited.
Device and technical usage data.
This processing is necessary to make the website available, ensure stability and security, detect misuse, and troubleshoot technical issues.
The legal basis is Article 6(1)(f) GDPR, based on the legitimate interest in the secure and functional operation of the website.
If you contact us by email, form, or otherwise, the information you provide may be processed to handle your request, respond to your inquiry, and document communication where necessary.
This may include:
Name.
Email address.
Telephone number, if provided.
Message contents.
Any other information you choose to share.
The legal basis is Article 6(1)(b) GDPR where the request relates to a potential or existing contract, and Article 6(1)(f) GDPR for general inquiries and communication management.
When you purchase a self-paced online course, personal data is processed to complete the transaction, create your customer account, provide access to the purchased course, send login credentials, and manage customer support and administration.
This may include:
Name.
Billing details.
Email address.
Purchase information.
Course enrollment data.
Login credentials and account information.
Transaction identifiers and payment status.
Payments are processed through Stripe. Payment card and similar payment data are processed by Stripe as payment service provider. Stripe also provides invoicing and may use fraud prevention and risk scoring features in connection with transactions.
The legal basis for this processing is Article 6(1)(b) GDPR for contract performance and Article 6(1)(c) GDPR where invoice and tax documentation is legally required.
Course access and customer account administration are handled through HighLevel / GoHighLevel as the platform used for CRM, funnels, forms, course delivery, account management, and related automations.
The legal basis is Article 6(1)(b) GDPR.
Customer and lead data may be managed in HighLevel / GoHighLevel for CRM purposes, customer administration, forms, funnels, email communication, course access, segmentation, tagging, and automations.
If you subscribe to the newsletter, your email address and related subscription data are processed to send you newsletters and marketing emails. Newsletter subscriptions are sent only on the basis of your consent.
The legal basis is Article 6(1)(a) GDPR.
Newsletter registration may be documented using a double opt-in procedure and related log data, including timestamp and IP address, to demonstrate consent where necessary.
Newsletter emails may include open and click tracking. This is used to measure the performance of email campaigns, improve communications, and organize segmentation and follow-up processes.
The legal basis is your consent under Article 6(1)(a) GDPR.
You can withdraw your consent at any time by using the unsubscribe link in any newsletter or by contacting us directly.
This website uses Cookiebot as a consent management platform to manage cookie consent and record user consent decisions. Cookiebot can log and document consent choices in order to demonstrate compliance with GDPR consent requirements.
Cookie categories used on the website may include:
Strictly necessary cookies.
Analytics cookies, where enabled based on consent.
Marketing cookies, where enabled based on consent.
Non-essential cookies, including marketing and analytics cookies, are not loaded before the user has provided consent through the consent banner, according to the current website configuration.
Users can change or withdraw consent at any time through the consent tools available on the website.
The legal basis for necessary cookies is Article 6(1)(f) GDPR or other applicable law where strictly necessary for operation.
The legal basis for non-essential cookies is Article 6(1)(a) GDPR based on consent.
This website uses Meta Pixel and related Meta advertising functionality for advertising, audience creation, remarketing, and campaign measurement, provided the user has given the required consent through the cookie banner.
This may involve the processing of:
Device and browser information.
Page views and interactions.
Conversion-related events.
Pseudonymous identifiers.
Audience and marketing event data.
This processing is used to measure ad effectiveness, improve campaigns, build custom audiences, and show relevant advertising.
The legal basis is Article 6(1)(a) GDPR based on consent.
Where required by law, users can refuse or withdraw consent for such tracking through the cookie consent mechanism.
Zapier is used to connect certain systems, including transaction-related data flows between Stripe and other business tools, for example to identify which customer purchased which course and to automate internal processes.
Where Zapier processes personal data on behalf of the controller, the legal basis is Article 6(1)(b) GDPR for contract-related workflows and Article 6(1)(f) GDPR for efficient business administration.
Calendly is used for appointment scheduling in areas where booking functionality is offered. If you book an appointment through Calendly, personal data may be processed for scheduling, communication, and meeting organization.
The legal basis is Article 6(1)(b) GDPR where the booking relates to a contractual relationship or pre-contractual measures, and Article 6(1)(f) GDPR for efficient scheduling administration.
We do not share customer data with public AI tools such as ChatGPT for prompt processing, analysis, or model training.
Service providers used in the business may include AI-enabled features within their own platforms. Where such features are used as part of contracted business tools, any related processing is limited to the operational purposes of those services and remains subject to the applicable contractual and privacy arrangements of the provider.
No automated decision-making is carried out that produces legal effects or similarly significant effects within the meaning of Article 22 GDPR, based on the information currently provided.
Personal data may be disclosed to or processed by the following categories of recipients where necessary:
Hosting and website service providers.
Payment processors, including Stripe.
CRM, funnel, course, and email platform providers, including HighLevel / GoHighLevel.
Consent management providers, including Cookiebot.
Advertising providers, including Meta.
Workflow automation providers, including Zapier.
Scheduling providers, including Calendly.
Tax advisors, accounting service providers, banks, and public authorities where legally required.
Personal data is disclosed only where necessary for the stated purposes and on the basis of the applicable legal basis.
Some service providers used by the business may process personal data outside the European Union or the European Economic Area, including in the United States. This applies in particular to providers such as HighLevel / GoHighLevel, and may also apply to Stripe, Meta, Zapier, Calendly, and Cookiebot depending on the technical setup and provider structure.
Where personal data is transferred to third countries, such transfers are made only where an appropriate safeguard exists under Chapter V GDPR, for example:
An adequacy decision of the European Commission, where applicable.
Participation in the EU-U.S. Data Privacy Framework, where applicable.
Standard Contractual Clauses or other legally recognized safeguards, where required.
Further information may be available in the respective privacy notices of the individual providers.
Personal data is stored only for as long as necessary for the relevant purposes, unless longer retention is required by law.
Based on the information currently provided, the following retention logic may apply:
Leads who do not become customers: up to 1 year.
Inactive newsletter subscribers: up to 1 year.
Customer data after the last purchase: up to 2 years for operational purposes.
Accounting, tax, invoice, and legally required business records: for the statutory retention period required by applicable law.
Where legal retention duties apply, deletion is restricted until the expiry of the mandatory retention period.
Under the GDPR, data subjects may have the following rights, subject to the legal requirements:
Right of access under Article 15 GDPR.
Right to rectification under Article 16 GDPR.
Right to erasure under Article 17 GDPR.
Right to restriction of processing under Article 18 GDPR.
Right to data portability under Article 20 GDPR.
Right to object under Article 21 GDPR.
Right to withdraw consent at any time under Article 7(3) GDPR, without affecting the lawfulness of processing based on consent before withdrawal.
Right to lodge a complaint with a supervisory authority under Article 77 GDPR.
If you wish to exercise any of these rights, you can contact: [email protected]
Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time. If you object, your data will no longer be processed for direct marketing purposes.
Appropriate technical and organizational measures are used to protect personal data against unauthorized access, loss, misuse, or unlawful disclosure. However, internet-based transmissions can never be guaranteed to be completely secure.
The services are designed primarily for adults and professionals. Personal data from children is not knowingly collected in violation of applicable law. If it becomes known that personal data has been collected from a child in a way that violates applicable law, appropriate steps will be taken to delete such data.
This Privacy Policy may be updated from time to time to reflect legal, technical, or business changes. The current version published on the website applies.