Last updated: 31 October 2026
We keep this simple: we collect only what we need to run the school, we do not use analytics or advertising trackers, and we never sell your data.
Dr. Heike Bielek, Da Vinci School, Friedrich-Stoltze-Str. 14, 65824 Schwalbach am Taunus, Germany · [email protected]
When you visit davincischool.net or learn.davincischool.net, the server automatically processes technical data your browser sends: IP address, date and time, page requested, browser and operating system. This is needed to deliver the pages and to keep them secure (Art. 6 (1) (f) GDPR). Server log files are deleted after a short period.
Hosting: our server is operated by Contabo GmbH in Germany.
Cloudflare: our website is delivered through Cloudflare, Inc. (USA), which protects it against attacks and makes it faster. Cloudflare processes your IP address and technical connection data for this purpose. Cloudflare is certified under the EU–US Data Privacy Framework (Art. 6 (1) (f) GDPR; Art. 45 GDPR).
We do not use tracking or advertising cookies, so we do not ask for cookie consent. We only use what the website needs to work:
dvs_ref, 60 days): if you arrive through an ambassador's link, we remember their code so you receive their discount at checkout and they receive their commission.Legal basis: § 25 (2) TDDDG and Art. 6 (1) (b) and (f) GDPR.
Our pages use the fonts "Outfit" and "Cormorant Garamond" from Google Fonts, provided by Google Ireland Ltd. When a page loads, your browser connects to Google's servers, which receive your IP address. We use this for a consistent appearance (Art. 6 (1) (f) GDPR). Google is certified under the EU–US Data Privacy Framework.
Course and website videos are embedded from YouTube (Google Ireland Ltd.) in privacy-enhanced mode (youtube-nocookie.com): YouTube only receives data once you open or start a video. Preview images may be loaded from YouTube's servers.
When you write to us via the contact form or by email, we use your name, email address and message to answer you (Art. 6 (1) (b) and (f) GDPR). Messages are delivered to us by email and kept only as long as needed for the conversation.
If you sign up for our newsletter, we store your email address (and name, if given) to send you news about courses and events (Art. 6 (1) (a) GDPR, your consent). Every email contains an unsubscribe link, and you can withdraw your consent at any time; we then delete your address from the list.
When you book a course or event, we process your name, email address, the course booked and the payment status to carry out the contract (Art. 6 (1) (b) GDPR). Payments are handled by Stripe Payments Europe Ltd. (Ireland); we never see or store your full card details. Stripe may process data in the USA and is certified under the EU–US Data Privacy Framework. We keep booking and invoice records as required by German tax law (usually 6–10 years).
Books are sold through Payhip (Payhip Ltd., UK); when you buy a book there, Payhip's privacy policy applies.
Live courses and Dialogues take place on Zoom (Zoom Communications, Inc., USA). We send you the meeting link by email. When you join, Zoom processes your name as shown, your device data and, if you switch them on, your video and audio (Art. 6 (1) (b) GDPR). Zoom is certified under the EU–US Data Privacy Framework. We tell you in advance if a session is recorded.
For your account on learn.davincischool.net we store your name, email address, password (encrypted, never readable by us), your purchases and your course progress (Art. 6 (1) (b) GDPR).
Teachers, ambassadors and fellows can add a photo, a short bio, links and answers to profile questions. This information is shown publicly on our website only when you enter it yourself, and you can change or delete it at any time in your profile (Art. 6 (1) (a) GDPR).
If you are an ambassador, we store your referral code, the purchases made with it and the commission due to you, and — if you give them — your payout details, which we keep encrypted (Art. 6 (1) (b) GDPR). Commission payouts may be made through Stripe Connect; Stripe then verifies your identity and handles your bank details directly.
Booking confirmations, Zoom links, password resets and similar messages are sent from our own mail server.
You have the right to access, correct and delete your data, to restrict its processing, to data portability, and to object to processing based on legitimate interests (Art. 15–21 GDPR). You can withdraw any consent at any time with effect for the future. Just write to [email protected].
You also have the right to complain to a data protection authority, for example the one responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden (datenschutz.hessen.de).
We update this policy when our website or services change. The current version is always on this page.