Privacy Policy

As of: September 16, 2026

1. Controller and Contact

The controller responsible for the processing of personal data by Nestzeit described below is:

Lea-Sophie Fütterer, Nestzeit
Leegmoor 1
22850 Norderstedt
Germany

These notices concern the Nestzeit website, inquiries and arrangements relating to postpartum care, postpartum abdominal massage and workshops, as well as our communication via WhatsApp Business and Instagram.

2. Provision of the Website and Hosting

This website is operated using Lunelink. The service provider is Lunelink GmbH, Georgsplatz 1, 20099 Hamburg, Germany. Lunelink processes website visits and form inquiries on our behalf. According to the provider information, this is based on the data-processing provisions in Lunelink’s General Terms and Conditions.

When the website is accessed, technically necessary data is processed, in particular the IP address, date and time, requested URL, referring page, browser type and operating system. This serves to deliver the website, ensure its security and remedy technical errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and functional online presence.

Lunelink names Google Cloud EMEA Limited, Ireland, for applications, databases and file storage in EU data centers, as well as Cloudflare, Inc., USA, for delivery and network security. ActiveCampaign, LLC (Postmark), USA, is used for email notifications from the platform. According to Lunelink, technical application logs and browser error messages are deleted after 30 days at the latest. The website is transmitted via HTTPS. Further information on service providers and technical processing: Lunelink’s privacy information, in particular sections 1, 2 and 5.

3. Technical Settings and Visitor Statistics

The platform uses technically necessary cookies to store settings. According to Lunelink, these include i18n_redirected for the language, with a lifespan of one year; country_setting for the country, with a lifespan of 360 days; and Consent Manager entries: cookie_consent_given with a lifespan of 270 days and meta_pixel_enabled with a lifespan of 360 days, in each case potentially supplemented by the website identifier. An entry relating to pixel selection does not mean that an advertising pixel is active on this website.

Where these entries are necessary to provide expressly requested functions or to remember the privacy settings, their storage or retrieval is based on Section 25 (2) No. 2 TDDDG. The associated processing of personal data is carried out pursuant to Art. 6 (1) (f) GDPR in the interest of a functioning website and transparent settings. Where consent is required, Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR apply. Any cookie selection offered can be changed via “Cookies” in the footer.

Lunelink also provides its own visitor statistics without analytics cookies. According to the provider, a daily changing hash value is generated from the IP address, browser identifier, date and website ID using a secret key; the IP address itself is not stored in these statistics. The data collected includes, among other things, page views, entry and exit pages, sources of visits, campaign parameters, country, device and browser category, and events such as a form submission. This must be distinguished from the technical logs described in Section 2. The evaluation is used to assess the use and comprehensibility of our services. The legal basis is Art. 6(1)(f) GDPR. You may object to this processing on grounds relating to your particular situation; to do so, please contact us at the email address stated above. According to the provider, the visitor identifier changes daily. Lunelink does not specify a fixed retention period for the statistics beyond this in its published information; you can request further details from us.

No Meta Pixel is configured in the current settings of the Nestzeit website. Using Instagram or WhatsApp does not automatically activate such an advertising pixel here.

4. Enquiries, contact forms and customer management

When you contact us via a form, by email or by telephone, we process the contact details and content you provide. Depending on your enquiry, this may include your name, email address, telephone number, place of residence, requested service and period, as well as your message. Mandatory information is marked in the respective form. Please provide only the information required for the initial contact.

Form submissions are stored in Lunelink’s contact and case management system and may be communicated to us by email. In addition, the platform processes technical information relating to the submission, including the time, originating page, IP address, browser identification and language. We use the data to respond to your enquiry, coordinate appointments and services, and prepare for or carry out a potential collaboration. For contract-related inquiries, bookings, and arrangements, the legal basis is Art. 6(1)(b) GDPR. We process other inquiries on the basis of Art. 6(1)(f) GDPR; our legitimate interest is to respond appropriately to your message. A non-binding inquiry does not constitute consent to advertising.

For communication via the email address stated above, we use Apple iCloud Mail. For the personal data of individuals in the European Economic Area, Apple identifies Apple Distribution International Limited, Ireland, as the responsible Apple entity. The address, message, and connection data required to send and manage emails are processed for this purpose. Apple also describes processing in the USA and other countries, as well as standard contractual clauses for international transfers. Further information: Apple Privacy Policy.

You are generally not required to provide us with personal data. However, without contact details through which you can be reached, we cannot respond; without the information required to provide an agreed service, it may be impossible to perform that service.

5. Particularly Sensitive Information and Insurance Check

Information about pregnancy, childbirth, symptoms, or treatments may constitute specially protected health data under Art. 9 GDPR. Please do not send diagnoses, medical records, or detailed health information via the website forms, Instagram, or WhatsApp. For an initial inquiry, your request and the relevant organizational details are sufficient. If health information is required for a specific support arrangement or the insurance reimbursement check, we will clarify separately, before collecting it for that specific purpose, the purpose, the appropriate means of transmission, the recipients and the required legal basis. Where explicit consent is required, it will be obtained separately; a standard contact inquiry or having read this privacy policy does not replace it. Art. 6 para. 1 lit. b GDPR alone is not sufficient as an exception to the protection of special categories of data.

Documents will not be forwarded to a health insurance fund solely on the basis of a website inquiry. Any required disclosure will be agreed with you separately and requires a valid legal basis.

6. WhatsApp Business for Inquiries and Arrangements

You may voluntarily use WhatsApp Business to contact us and make organizational arrangements. The provider in the European Economic Area is WhatsApp Ireland Limited, Ireland. In this context, we process your telephone number, and, where applicable, your profile name and profile picture, as well as the content and times of our communications. For contract-related inquiries and arrangements, the legal basis is Art. 6 para. 1 lit. b GDPR; for other matters, it is Art. 6 para. 1 lit. f GDPR, based on our interest in responding to your message.

In addition, WhatsApp processes device, connection and usage data under its own terms, including IP addresses and communications metadata, for example. WhatsApp is independently responsible for its own processing purposes; supplementary business data processing terms apply to certain processing carried out on behalf of others. Processing by affiliated companies, particularly in the USA, is possible. End-to-end encryption of personal messages does not protect against every processing of metadata and does not replace protection of the devices involved. Additional risks may arise from contact uploads, backups, and other activated features. This notice does not guarantee that all data is processed exclusively in Europe.

WhatsApp is not required to use our services. Alternatively, you can reach us via the contact form or by email. Please observe Section 5 when providing sensitive information.

Further information: WhatsApp Privacy Policy for the EEA, Privacy Notice for the Business App, and Business Data Transfer Addendum.

7. Planned advertising via WhatsApp

If we send information about Nestzeit services, workshops, or promotions via WhatsApp in the future, this will be done only with your prior, separate, and voluntary consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with the requirements of Section 7 UWG. An inquiry, booking, or previous WhatsApp conversation does not, by itself, constitute consent to advertising.

The data required for sending advertising and documenting consent will be processed, in particular your telephone number, the content and time of your consent, and any subsequent withdrawal. The specific advertising you will receive will be stated when consent is given. Consent is not a prerequisite for receiving care or participating in a workshop. You can withdraw your consent at any time with effect for the future, for example by sending “STOP” in the WhatsApp chat or by e-mail to lea71446@icloud.com. You will then receive no further WhatsApp advertising from us. The lawfulness of processing carried out before the withdrawal remains unaffected. Necessary organisational messages relating to an existing agreement are independent of this.

Evidence may be retained to the extent necessary for legal defence; Art. 6 para. 1 lit. f GDPR applies for this purpose. Information blocking further advertising, limited to what is necessary, may be retained to honour the withdrawal. No e-mail newsletter is currently offered.

8. Instagram

We use Instagram to present Nestzeit and communicate with interested parties. The provider for users in the European Economic Area is Meta Platforms Ireland Limited, Ireland. When you visit our profile, comment on posts or send messages, we may process the profile information visible to us, your content and your interactions. Public posts and comments may also be seen by other people.

Our presence and general communications are based on Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in providing information about our services and engaging with interested parties. We process contract-related messages pursuant to Art. 6 para. 1 lit. b GDPR.

Meta also processes platform, usage and device data for its own purposes, in particular personalised content, advertising, security and analysis. Cookies and similar technologies may be used, data may be linked to a Meta account, and data may be processed in third countries. Meta’s legal bases and information apply to these processes. Where Instagram provides us with aggregated reach and interaction statistics, we use them to assess our posts; this does not automatically give us access to all of the underlying personal usage data. Where joint controllership exists for specific statistical processing pursuant to Art. 26 GDPR, it concerns the data collection and analysis carried out for that purpose, not all of Meta’s processing activities in general. You can assert rights relating to data that only Meta can attribute to you directly with Meta; you may also contact us.

Simply visiting this website does not constitute a visit to our Instagram profile. Please do not submit any confidential health information there. Further information and settings options: Instagram Privacy Information and Cookie Policy.

9. Online workshops via Zoom

We use Zoom for our online workshops. The provider is Zoom Communications, Inc., USA. Depending on how you use the service, participation involves processing, in particular, your display name, your e-mail address where applicable, meeting and participation information, IP address and device data, as well as the audio, video and chat content you share. Other participants may see or hear your display name and the content you share in the group meeting.

The purpose is to organise and conduct the booked workshop. The legal basis is Art. 6(1)(b) GDPR. Please limit the information visible about you to what is necessary and do not share confidential health information about yourself or others in a group. You control whether to enable your camera and microphone using the corresponding functions. Recordings, transcriptions, or AI analyses are not authorized by this Privacy Policy. Before any additional use of such functions, separate information and an appropriate legal basis are required; where necessary, consent will be obtained in advance.

Zoom describes processing on our behalf as well as its own processing purposes in connection with providing its services. Processing outside the EU, particularly in the USA, is possible. For international transfers, the provider refers to the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Further information: Zoom Privacy Statement and Zoom information on the GDPR.

10. Recipients and international transfers

Data is only disclosed to persons or service providers where this is necessary for the purposes stated above. These include the providers described above for the website, customer management, and communication. Where legally required, data may be transferred to the competent authorities. Consent to advertising does not permit the unrestricted disclosure of your data.

The international services mentioned may process data outside the EU and the EEA. According to the linked provider information, such transfers may be based on adequacy decisions pursuant to Art. 45 GDPR, in particular the EU-U.S. Data Privacy Framework for appropriately certified US recipients covered by the scope of their certification, as well as Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The applicable safeguard depends on the recipient and the processing activity. This does not constitute a blanket assurance that data will be accessed exclusively from Europe. You may request information from us about the safeguards applicable to a specific transfer and copies of the relevant provisions; the linked provider information also applies.

11. Storage Period

We retain personal data for as long as it is necessary for the respective purpose. Completed inquiries without a subsequent contract are deleted as soon as there are no further questions, legal claims or retention obligations to consider. Contract and care-related data are retained for the performance of the agreement and, where necessary, to safeguard legal claims.

Documents subject to statutory retention requirements remain stored for the applicable period: for example, booking records and invoices generally for eight years, relevant business letters for six years, and certain tax documents for ten years, insofar as the respective obligation applies to us. The periods generally begin at the end of the relevant calendar year; statutory extensions remain reserved. The legal basis is Art. 6(1)(c) GDPR. During storage solely for retention purposes, the data is not used for other purposes.

Section 7 also applies to advertising consents, and Section 2 to technical logs. We have only limited influence over data that WhatsApp, Meta, Apple or Zoom store under their own responsibility; the providers explain their retention rules in their privacy notices.

12. Your Rights

Subject to the statutory requirements, you have the following rights:

Access to your personal data under Art. 15 GDPR.
Rectification of inaccurate data and completion of incomplete data under Art. 16 GDPR.
Erasure pursuant to Art. 17 GDPR and restriction of processing pursuant to Art. 18 GDPR.
Data portability pursuant to Art. 20 GDPR, insofar as the statutory requirements are met.
Withdrawal of consent at any time with effect for the future pursuant to Art. 7(3) GDPR. Processing carried out up to that point remains lawful.
The right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR, in particular at your place of residence, your workplace or the place of the alleged infringement. For non-public bodies in Schleswig-Holstein, the Independent State Centre for Data Protection Schleswig-Holstein is responsible.

Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR pursuant to Art. 21(1) GDPR. You may object at any time, without stating reasons, to processing for the purpose of direct marketing, including profiling related to such marketing; the data will then no longer be processed for this advertising.

A message to lea71446@icloud.com is sufficient for your requests. Please provide only the information we need to assign your request.

13. Changes

If our services or the services we use change, we will update this notice. New processing is not authorised solely by publishing a privacy notice; any required consent and other legal requirements remain necessary.