We want you to feel safe with us therefore we strictly comply with the legal provisions for the processing of your data and would like to provide you with details concerning the data we collect and use on this page. This Privacy Policy provides you with details of how we collect and process your personal data through your use of this Website www.kobidoberlin.de (the “Website“), including any content, functionality and services offered on or through this Website. We reserve the right to modify this Privacy Policy at any time, so please review it frequently. It was last updated on June 25th 2025. If we make changes to this Policy, we will notify you here that it has been updated, so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we use and/or disclose it. By providing us with your data, you warrant to us that you are over 18 years of age.

Visitors and any users of the Website are referred to as “user”, “you” and “your” and the Company is referred to as “we,” “us,” and “our.”  The Company processes personal data as a Controller as defined by the European Union’s General Data Protection Regulation (GDPR). Accessing this Website constitutes a use of the website and an acceptance of our Privacy Policy. Please read the Privacy Policy carefully before you start to use the Website. 

1. Data controller

Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member states of the European Union and other provisions related to data protection is:

Marta Lutomska 

Email: kobidoberlin@gmail.com

Website: www.kobidoberlin.de

Should you object to the collection, processing and use of your personal data in part or full, you can send your objection by the above email. 

2. Processed data 

We must collect certain information to operate, provide, improve, understand, customise, support, and market our services. The types of information we receive and collect depend on how you use our services.

2.1. Contact using our Contact Form, Email, Instagram, or WhatsApp

Processed data:

First and last name

Email address

Messages that are sent to us

Phone Number (if you contact us by WhatsApp)

Instagram Account Name (if you contact us on Instagram)

The processing of personal data serves to facilitate contact, prevent misuse of the contact form and ensure the safety of our information technology systems. The legal basis for the processing of the data is your consent, (Art. 6 (1)(a) GDPR). Insofar as data processing is necessary for executing a contract, Art. 6 (1)(b) GDPR shall serve as the permissive standard for data processing.

Your messages and our replies are stored for a period of three years for the purpose of proving the provision of proper information.

You acknowledge that the respective provider might receive personal data (including communication metadata) that might be processed at servers located in countries outside of the EU (e.g. USA) that do not guarantee the same level of data protection as that practised in the EU. Additional information is described in the privacy policies of the respective messengers. The sender has no detailed knowledge about or influence on the respective providers.

2.2. Scheduling an appointment 

If you use our appointment scheduling software, we process this data for the purposes of communicating with you and arranging appointments. Processed data:

Name

Email address

Other information that you shared with us

Our booking system is hosted on the Calendly.com platform. Your data may be stored through Calendy.com’s data storage, databases and their general applications. They store your data on secure servers behind a firewall. The legal basis for this processing is your consent, (Art. 6 (1)(a) GDPR). 

2.3. Purchasing services and performing the contract

We may process your data, such as name, email address, address, telephone and other relevant data as related to purchases of our massage services.   The legal basis for processing is the performance of a contract between us, Art. 6 (1)(b) GDPR. 

As part of our client intake process, we collect certain personal and health-related data to ensure the safe and appropriate delivery of massage services, including information about possible contraindications, medical conditions, allergies, and treatment preferences. This information is provided voluntarily and processed only with your explicit consent in accordance with Article 9(2)(a) of the GDPR.

The data is stored digitally on secure, password-protected systems. Intake forms are retained for a period of 3 years following your last appointment, unless a longer retention period is required by legal or professional obligations. You have the right to withdraw your consent at any time and may request access to, correction of, or deletion of your data by contacting us at kobidoberlin@gmail.com. Please note that in some cases, we may be required to retain certain data for regulatory or tax purposes.

From time to time you may be asked to provide feedback or a testimonial. Your responses will be processed on the grounds of legitimate interests, which in this case are to provide a high level of treatments. Testimonials may be published on our Website only with your consent.

2.4.  Marketing Data and Newsletter

If you sign up for the Newsletter, a confirmation email will be sent to the e-mail address registered in the double opt-in procedure. This confirmation email is used to prove whether the owner of the e-mail address as the data subject is authorized to receive the newsletter. During the registration for the newsletter, we also store the IP address of the computer system assigned by the Internet service provider (ISP) and used by the data subject at the time of the registration, as well as the date and time of the registration. The collection of this data is necessary in order to understand the (possible) misuse of the e-mail address of a data subject at a later date, and it therefore serves the aim of the legal protection of the controller. 

The technical service provider Squarespace, Inc. is our processor for sending newsletters. The legal basis for sending the newsletter is your consent in accordance with Art. 6 (1)(a) GDPR. 

By registering, you also consent to your data being processed in the USA in accordance with Article 49 Paragraph 1 Sentence 1 Letter a GDPR. The USA is assessed by the European Court of Justice as a country with an inadequate level of data protection according to EU standards. In particular, there is a risk that your data may be processed by US authorities for control and monitoring purposes, possibly even without any legal remedy. 

When you subscribe to the newsletter, your behaviour in our newsletter is recorded (tracking the opening of emails and clicks on links). As soon as you open, and/or click on a newsletter, pseudonymised data will be saved. In this case, we are using the data for the optimization of our website contents and offers. By subscribing to our newsletter, you agree to this procedure.

You can unsubscribe from our newsletter at any time; the link to do so is at the end of every newsletter. As soon as you have unsubscribed from the newsletter, you will no longer receive any offers from us. Your personal data will not be reused and are blocked immediately. Your data will be saved for another 3 years before it will be deleted. Legal basis for saving the data is our entitled interest of proving that the delivery of emails happened with your consent in order to ward off potential claims.

3. Automatically Collected Information / Cookies

A cookie is a small text file that is stored on your computer or mobile device when you visit a website with your browser. We use cookies to operate and provide our services, for example, to provide our web-based services, improve your user experience, analyse how our services are used. Information gathered through cookies and server logs may include the date and time of visits, the pages viewed, time spent at our Website, and the websites visited just before and just after our own, as well as your IP address. Cookies required for technical reasons are automatically collected. You cannot deactivate these; they do not process any personal data. Data processing according to Art. 6 para. 1 (f) GDPR is justified by our interest in providing smooth operation of the Internet offering. 

4. Third-party use of cookies

Some content or applications on the Website are served by third parties. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our Website. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. We do not control these third-party tracking technologies or how they may be used. You acknowledge that the respective provider might receive personal data (including communication metadata) that might be processed at servers located in countries outside of the EU (e.g. USA) that do not guarantee the same level of data protection as that practised in the EU. Additional information is described in the above privacy policies of the respective messengers. The sender has no detailed knowledge about or influence on the respective providers. If you have any questions, you should contact the responsible provider directly.

5. Legal Basis for the processing

Art. 6 para. 1 (a) GDPR serves as the legal basis for the processing operations of our company for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the fulfilment of a contract to which the data subject is a party (as is the case, for example, with processing operations which are necessary for the provision of another service or consideration), the processing is based on Art. 6 para. 1 (b) GDPR.

The same applies to processing operations that are necessary for the implementation of pre-contractual measures, such as in cases of inquiries about our products or services. If our company is subject to a legal obligation which makes the processing of personal data necessary the processing is based on Art. 6 para. 1 (c) GDPR.

We collect, use, retain and share your information when it is necessary from our point of view: to comply with any applicable law or regulation, legal process or government request to enforce our terms and conditions and applicable policies to detect, investigate, prevent and combat fraud and other illegal activities, security issues or technical problems.

6. Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements. We do not use automatic decision-making or profiling.

7. Data security

We employ commercially reasonable methods to ensure the security of the information you provide to us and the information we collect automatically. This includes using standard security protocols and working only with reputable third-party vendors. Some of the information you may enter on our Website may be transmitted securely via a secure medium known as Secure Sockets Layer, or SSL.  

8. Your rights 

In accordance with the GDPR and other applicable laws, you have the right to access, rectify, transfer or delete your information and the right to restrict or object to certain processing of your data. This also includes the right to object to our processing of your data for direct marketing purposes.

Revocation and Opposition Rights

"Regardless of the explanations above, you may object to the use of your information at any time and revoke any consent to the use of your information at any time.” Here, the right of objection under Art. 21 para. 1 and 2 GDPR applies to the processing of your data in connection with the direct advertisement if this is performed based on a balance of interests.

If you revoke your consent to data processing or object to the use of the data, this does not affect the lawfulness of the data processing until the time of the revocation.

Legal basis: Right of withdrawal (Art. 7 para. 3 GDPR ‘Conditions for consent’), Right to object (Art. 21 GDPR ‘Right of opposition)

Right to Rectification, Deletion, Blocking and Restriction

Furthermore, you have the right to rectify, block or delete the data which are collected and stored by us at any time. We expressly point out that there may be legal obligations or practical considerations to further store data. In this case, the data can only be blocked.

Legal basis: Right to data rectification (Art. 16 GDPR ‘Right to rectification’), Right to erasure (Art. 17 GDPR ‘Right to be forgotten’), Right to restriction (Art. 18 GDPR ‘Right to restriction of processing)

Right to Data Transferability and Complaining to a Supervisory Authority

If you suspect that the processing of your data violates data protection law or that your data protection claims have otherwise been violated in any way, you can complain with the responsible supervisory authority.

Legal basis: Right to data transferability (Art. 20 GDPR ‘Right to Data Transferability’) Right to appeal to a supervisory authority (Art. 77 GDPR ‘Right to Data Portability’)

Right to Information

You have the right to know which data we store about you (right to information).

Please note that we may require proof from you in the event of a request for information that has not been made in writing, proving your identity.

Legal basis: Right to information (Art. 15 GDPR ‘Right of access of the data subject’)

If you have any questions or want to object to the collection, processing and use of your personal data in part or full, you can send your objection by email to: kobidoberlin@gmail.com.