1. Privacy at a Glance
The protection of your personal data is important to us. Personal data refers to any information that can be used to identify you personally.
This Privacy Policy explains what personal data is processed when you visit this website, contact us, register for a user account, purchase an online seminar, or use the content provided.
2. Data Controller
The entity responsible for data processing on this website is:
Fashionista GmbH
represented by Managing Director Mads Kristensen
Große Str. 85
24937 Flensburg
Germany
Email: office@madskristensen.de
This information currently matches the legal notice you have published.
3. General Information on Data Processing
We process personal data only to the extent necessary to provide a fully functional website, to handle inquiries, to fulfill contracts, to process payments, to set up and manage user accounts, and to provide our online seminars, or where there is another legal basis for doing so.
Depending on the type of processing, this is based in particular on:
Art. 6(1)(a) of the GDPR – Consent,
Art. 6(1)(b) of the GDPR – Performance of a contract or pre-contractual measures,
Art. 6(1)(c) GDPR – Compliance with legal obligations,
Art. 6(1)(f) GDPR – legitimate interests.
4. SSL or TLS Encryption
This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential information.
You can tell that a connection is encrypted, in particular, by the fact that the website address begins with “https://.”
5. Hosting
This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
When you visit the website, the web server may process the following data in particular:
IP address, date and time of access, page or file accessed, referrer URL, browser type and version, operating system used, and other technical information necessary for the operation and security of the website.
Data processing is carried out, in particular, to ensure the secure and uninterrupted operation of the website, based on Article 6(1)(f) of the GDPR.
To the extent that Hetzner processes personal data on our behalf, this is done on the basis of a data processing agreement in accordance with Article 28 of the GDPR. Hetzner itself notes that it offers a corresponding data processing agreement for the processing of personal data by customers.
6. Server Log Files
The web server automatically collects and stores information in what are known as server log files.
This may include, in particular, the IP address, browser type and version, operating system, referrer URL, hostname, pages accessed, and the time of the server request.
This data is needed, in particular, to provide the website from a technical standpoint, to analyze errors, and to detect and defend against attacks or unauthorized access.
The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and technically reliable operation of the website.
7. Cookies and Similar Technologies
Our website uses cookies and similar technologies. Some of these are technically necessary for basic website functions—such as user accounts, login features, or the ordering process—to work properly.
Unless the storage of information on your device or access to it is absolutely necessary, this will generally only take place with your consent.
Section 25 of the TDDDG generally requires consent for the storage of or access to information on the end device; an exception applies, among other things, to technically indispensable processes that are necessary for the provision of an expressly requested digital service.
If consent is required, it can be granted or revoked using the consent management tool on our website.
8. Making Contact
If you contact us by email or through a contact form, we will process the data you provide to handle your inquiry.
This may include, in particular, your name, email address, phone number, and the content of your message.
If the inquiry relates to an existing or potential contractual relationship, the legal basis is Article 6(1)(b) of the GDPR. In other cases, the processing may be based on our legitimate interest in handling inquiries pursuant to Article 6(1)(f) of the GDPR.
The data will be deleted once it is no longer needed to process the inquiry and there are no legal retention requirements that prevent its deletion.
9. User Account and Online Seminars
Paid online seminars can be purchased on our website. To do so, you'll need to set up a personal user account.
As part of the registration and ordering process, we process the following information in particular:
Name, email address, username, and login credentials; company name (if applicable); billing address; order and contract details; information about the online seminar purchased; and information regarding the status of access authorization.
Data is processed for the purposes of setting up and managing the user account, processing the order, and providing the purchased online seminar.
The legal basis is Article 6(1)(b) of the GDPR.
To the extent that certain order and billing data must be retained in accordance with tax or commercial law regulations, such data will continue to be stored pursuant to Article 6(1)(c) of the GDPR.
10. Paid Memberships Pro
For registration, user accounts, the ordering process, and access management for the online seminars, we use Paid Memberships Pro.
During checkout, data required to set up the user account and manage the purchased access is processed. Paid Memberships Pro lists the following information, among others: name, email address, username, and password.
Data processing is carried out for the purpose of fulfilling the contract and providing the purchased online seminar in accordance with Article 6(1)(b) of the GDPR.
User account and membership data are processed and stored as part of our WordPress installation.
Privacy Policy for Paid MembershipsPro
11. Payment Processing via Stripe
We use Stripe.
When an order is placed, the information required to process the payment is transmitted to Stripe or processed directly by Stripe.
This may include, in particular, your name, email address, billing address, payment information, transaction amount, currency, date and time of the transaction, as well as other information necessary for payment processing and fraud prevention.
Processing is carried out, in particular, to process the payment and thereby fulfill the contract in accordance with Article 6(1)(b) of the GDPR. To the extent that legal obligations exist, processing may also be based on Article 6(1)(c) of the GDPR.
For customers in the European Economic Area, Stripe Payments Europe, Limited, and—for certain regulated payment services—Stripe Technology Europe, Limited are the parties involved, in accordance with Stripe’s current terms and conditions.
Stripe may also process data in countries outside the European Economic Area. Stripe cites, among other things, adequacy decisions, EU Standard Contractual Clauses, and—where applicable—the EU-U.S. Data Privacy Framework as transfer mechanisms for this purpose.
12. Delivery of online seminars via Bunny Stream
We use Bunny Stream or services from bunny.net.
When a video is accessed or played, technically necessary information may be transmitted to bunny.net. This may include, in particular, the IP address, requested content, technical device and browser information, referrer information, and information regarding the quality of the video stream.
Data processing is carried out to ensure the secure and technically reliable delivery of the video content you have purchased, based on Article 6(1)(b) of the GDPR and, where necessary, Article 6(1)(f) of the GDPR.
Bunny.net states that Bunny Stream does not store any personally identifiable information; to optimize playback, information such as stream quality, errors, and buffering may be processed, and CDN servers may be accessed for performance measurement.
To the extent that bunny.net processes personal data on our behalf, this is done within the framework of data processing on our behalf. Bunny.net provides a Data Processing Agreement (DPA) for this purpose.
Privacy and GDPR Information from bunny.net
13. Multilingualism through Weglot
To make this website available in multiple languages, we use the translation service Weglot, provided by WEGLOT, 7 cité Paradis, 75010 Paris, France.
Weglot processes website content to create and deliver translations. In doing so, original texts and translations are stored in the Weglot infrastructure. Weglot expressly notes that confidential or personal information can be excluded from the translation using CSS selectors.
Technical information may also be processed when using the service.
The purpose of this processing is to make our website available in multiple languages. Unless consent is required, the legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest is to make our content accessible to visitors in different languages.
To the extent that cookies or similar technologies that are not technically necessary are used, their use is based solely on the user’s consent.
Weglot Privacy Policy
Important for your checkout: I would definitely exclude sections containing personal checkout data from translation in Weglot. Weglot itself points out that translated HTML fragments are stored, so sensitive or personal information sections can be excluded.
14. External Links and Social Media
Our website contains links to external sites and social media platforms, particularly YouTube.
Simply viewing a standard external link does not, in and of itself, result in any data being transmitted to the respective provider through that link. Only when you click on the link do you leave our website, at which point the privacy policy of the respective external provider applies.
Your website currently contains several links to the YouTube channel or to YouTube content.
If content from external platforms is embedded directly on our website, data may be transmitted to the respective provider as soon as this content is loaded or activated. If consent is required for this, such content will not be loaded until the appropriate consent has been given.
15. Google Analytics – ONLY IF IT IS ACTUALLY ACTIVE
Please do not copy this section verbatim for the time being.
Your current privacy policy states that Google Analytics, including “demographic features,” is used. We should conduct a technical review to determinewhether Analytics is still actively integrated into the current website.
If Google Analytics is enabled, we need an updated section for this. Non-essential Analytics technologies may not simply be based on Article 6(1)(f) of the GDPR as a blanket rule, as in your old statement; in cases of non-technically necessary access to the end device, consent under Section 25 of the TDDDG is generally required.
16. Retention Period
Unless a more specific retention period is stated in this Privacy Policy, we store personal data only for as long as is necessary for the respective purpose of processing.
If there are statutory retention requirements—particularly for business documents relevant under tax or commercial law—the data in question will be stored for the period required by law.
Once the purpose of processing no longer applies or the statutory retention periods have expired, the data will be deleted, unless another legal basis permits further processing.
17. Recipients of Personal Data
In connection with the operation of our website, personal data may be transferred, in particular, to service providers that we use for hosting, payment processing, technical support, translation, and video streaming.
Depending on the specific use, these include, in particular, Hetzner, Stripe, bunny.net, and Weglot.
To the extent that these service providers act as data processors on our behalf, the processing is carried out on the basis of a contract in accordance with Article 28 of the GDPR.
18. Data Transfers to Third Countries
Some of the service providers we use may process personal data outside the European Union or the European Economic Area.
Such a transfer will take place only to the extent that the legal requirements for it are met, for example, based on an adequacy decision by the European Commission, appropriate safeguards such as EU Standard Contractual Clauses, or another permissible legal basis.
19. Your Rights
In accordance with the statutory requirements, you have the right, in particular, to:
Access to your processed personal data, correction of inaccurate data, deletion of your data, restriction of processing, data portability, and the right to object to certain processing activities.
If processing is based on your consent, you may withdraw that consent at any time with future effect. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.
To exercise your rights, please contact us:
20. Right to Object
To the extent that we process personal data pursuant to Article 6(1)(f) of the GDPR, you have the right, in accordance with Article 21 of the GDPR, to object to such processing on grounds relating to your particular situation.
When personal data is processed for the purpose of direct marketing, you have the right to object at any time.
21. Right to File a Complaint with a Supervisory Authority
You have the right to file a complaint with a data protection supervisory authority.
For companies headquartered in Schleswig-Holstein, the Independent State Center for Data Protection Schleswig-Holstein (ULD) / the State Data Protection Commissioner of Schleswig-Holstein is generally responsible. The ULD expressly confirms its jurisdiction over non-public entities headquartered in Schleswig-Holstein.
Independent State Center for Data Protection in Schleswig-Holstein
22. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy if there are changes to the services we use, our data processing practices, or legal requirements.
As of September 2026