PRIVACY POLICY
MySkillcation – Staudacher & Köttel GbR
Schellingstr. 116, 80798 Munich, Germany
Email: info@myskillcation.com
Authorized representatives: Kevin Köttel, Luisa Staudacher
Last updated: February 2025
1. Data Controller
The controller responsible for the processing of personal data is:
MySkillcation – Staudacher & Köttel GbR
Schellingstr. 116
80798 Munich
Germany
Email: info@myskillcation.com
2. General Information on Data Processing
We take the protection of personal data very seriously.
We process personal data only to the extent necessary to:
operate our website,
organize and conduct our events,
process payments,
communicate with users,
or improve our services.
Legal bases: Art. 6 para. 1 lit. a, b, f GDPR.
We do not carry out any automated decision-making or profiling within the meaning of Art. 22 GDPR.
3. Hosting and Technical Operations (Wix.com Ltd.)
Our website is hosted by Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv, Israel.
Wix processes data on servers located in:
EU
Israel (recognized level of data protection, EU Commission decision)
USA (via Standard Contractual Clauses)
A data processing agreement exists.
Purpose: technical operation of the website, security, performance.
Legal basis: Art. 6 para. 1 lit. f GDPR.
NOTE: Wix provides us with anonymized statistics (e.g., number of page views, geographic origin). We do not conduct any personal data analysis.
More information: https://www.wix.com/about/privacy
4. Server Log Files
When you visit our website, technical data is automatically collected:
IP address
Browser type and version
Date and time of access
Referrer URL
Operating system used
Purpose: operation, security, error analysis.
Legal basis: Art. 6 para. 1 lit. f GDPR.
5. Cookies
Our website uses technically necessary cookies and, with your consent, marketing cookies.
The following cookies are set:
TECHNICALLY NECESSARY COOKIES:
svSession (Wix): Session management, Duration: End of session
hs (Wix): Security token, Duration: End of session
XSRF-TOKEN (Wix): Protection against Cross-Site Request Forgery, Duration: End of session
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the technical operation of the website)
MARKETING COOKIES (only with consent):
_fbp (Meta): Used by Meta (Facebook/Instagram) to deliver and measure advertisements. Duration: 90 days.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent)
You can manage or withdraw your cookie consent at any time via the cookie banner on our website. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
5a. Meta Pixel (Facebook/Instagram)
With your consent, we use the Meta Pixel provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.
The Meta Pixel is a code snippet that enables us to:
measure the effectiveness of our advertising campaigns on Instagram and Facebook,
track conversions (e.g. completed bookings),
show relevant ads to users who have visited our website (retargeting),
create so-called Lookalike Audiences of users with similar interests.
DATA PROCESSED:
When the Meta Pixel is active, Meta collects the following data:
Pages visited on our website
Actions taken (e.g. booking completed)
IP address (anonymised by Meta)
Browser and device information
Meta user ID (if logged into Facebook/Instagram)
DATA TRANSFER:
Data is transferred to Meta Platforms Inc., USA. The transfer is based on Standard Contractual Clauses pursuant to Art. 46 para. 2 lit. c GDPR.
LEGAL BASIS: Art. 6 para. 1 lit. a GDPR (consent)
The Meta Pixel is only activated after you have given your explicit consent via our cookie banner. If you select "Necessary only", the Pixel will not be loaded.
WITHDRAWAL:
You can withdraw your consent at any time by clicking "Necessary only" in our cookie banner on any page of our website. The Pixel will then no longer be loaded on future page visits.
More information on Meta's data processing: https://www.facebook.com/privacy/policy/
6. Payment Processing via Stripe
For payments, we use Stripe Payments Europe Ltd., Dublin, Ireland.
Data processed:
Name
Email address
Billing details
Payment and transaction data
Credit card data (if applicable)
Technical metadata
Data transfer to the USA is possible (Standard Contractual Clauses).
Legal basis: Art. 6 para. 1 lit. b GDPR (contract fulfillment).
More information: https://stripe.com/privacy
7. Event Delivery by Contracted Instructors
We are the organizers of the offered skillcations and workshops. For practical delivery, we contract qualified trainers/instructors.
DATA SHARED WITH INSTRUCTORS:
To deliver the event you have booked, we share the following data with the respective instructor:
Names of participants
Contact details (email, phone number if applicable)
Booking details (date, booked package)
Special requirements or preferences (e.g., prior knowledge, dietary preferences, health restrictions)
LEGAL CLASSIFICATION:
The instructors act as data processors within the meaning of Art. 28 GDPR.
We have a data processing agreement with each instructor that:
defines the scope of data processing
ensures GDPR compliance
stipulates deletion obligations after the event
defines technical and organizational measures
Instructors may only use your data for event delivery and not for their own purposes.
Legal basis: Art. 6 para. 1 lit. b GDPR (contract fulfillment)
SPECIAL CATEGORIES OF PERSONAL DATA:
If you provide us with health-related information (e.g., allergies, physical limitations), we process this exclusively to ensure the safe delivery of the event.
Legal basis: Art. 9 para. 2 lit. a GDPR (explicit consent)
We only share this data with the instructor if necessary for safe event delivery.
8. Photo and Video Recordings at Events
Photo and video recordings may be taken at our events for marketing and documentation purposes.
CONSENT:
The creation and publication of recordings is only done with your explicit consent, which you can provide during the booking process.
You can participate in the event without providing this consent. Declining has no impact on your booking.
Before the event begins, you will be reminded about planned recordings and can object at any time.
PURPOSES OF USE:
Marketing and advertising for MySkillcation
Presentation of our events
Social media content
Marketing materials
PUBLICATION CHANNELS:
Website (myskillcation.com)
Social Media (Instagram, YouTube, TikTok, Facebook, LinkedIn)
Marketing materials (flyers, presentations, newsletters)
DURATION:
The consent is valid indefinitely but can be withdrawn at any time.
WITHDRAWAL:
You can withdraw your consent at any time without giving reasons by:
Email to info@myskillcation.com with subject "Revoke image rights"
Personal notification on-site during the event
After withdrawal, already published recordings will be removed as soon as possible. The withdrawal does not affect the lawfulness of processing prior to withdrawal.
NO DISCLOSURE TO THIRD PARTIES:
Your recordings will not be sold to third parties or used for purposes other than those stated above.
Legal basis:
Art. 6 para. 1 lit. a GDPR (consent)
Art. 9 para. 2 lit. a GDPR (special categories of personal data for recognizable faces/biometric features)
9. Contact Forms & Communication
When you contact us via form or email, your data is stored.
Legal bases:
Art. 6 para. 1 lit. a GDPR (consent)
Art. 6 para. 1 lit. f GDPR (legitimate interest in communication)
Data will not be shared without your consent.
10. Email Communication
a) TRANSACTIONAL EMAILS (without separate consent)
We send the following emails for contract fulfillment:
Booking confirmations
Payment confirmations
Important information about your booked event
Reminders about upcoming events
Legal basis: Art. 6 para. 1 lit. b GDPR (contract fulfillment)
b) MARKETING EMAILS (only with consent)
If you voluntarily sign up for:
Newsletter with news and offers
Waiting lists for upcoming skillcations
Pre-launch information about new events
we process your email address and name based on your consent.
Double opt-in procedure: After registration, you will receive a confirmation email. You will only be added to the mailing list after clicking the confirmation link.
Legal basis: Art. 6 para. 1 lit. a GDPR
WITHDRAWAL:
You can withdraw your consent at any time by:
Clicking the unsubscribe link in any marketing email
Sending an email to info@myskillcation.com with subject "Unsubscribe newsletter"
The withdrawal does not affect the lawfulness of processing prior to withdrawal.
11. User Account
If users create an account, we process:
Name
Login credentials
Usage behavior
Course progress
Legal basis: Art. 6 para. 1 lit. b GDPR.
12. Social Media Links
By clicking external links (Instagram, YouTube, TikTok, etc.), users leave our website. Data processing is then governed by the respective provider.
13. Hotel Recommendations ("Basecamp")
NON-BINDING RECOMMENDATIONS:
On our website, we recommend a hotel near the event location ("Basecamp") to help you plan your arrival.
This recommendation is:
purely informative and non-binding
not part of our event offering
a separate service that you book independently
EXTERNAL BOOKING:
When you click on the link to the recommended hotel:
you leave our website
you are directed to the hotel's website
you enter into an independent contract directly with the hotel
data processing is governed by the hotel's privacy policy
We are not a contracting party to your hotel booking and have no knowledge of it.
NOT A LINKED TRAVEL ARRANGEMENT:
The hotel recommendation does not constitute a "linked travel arrangement" within the meaning of § 651w BGB (German Civil Code), because:
there is no contractual relationship between us and the hotel
we currently do not receive any commission or brokerage fee
the booking is completely independent of our event
DATA TRANSFER:
When you book a hotel via the link, your personal data is transmitted directly to the hotel. We have no access to this data and are not involved in the booking.
Please refer to the privacy policy of the respective hotel.
Legal basis for providing the link:
Art. 6 para. 1 lit. f GDPR (legitimate interest in user service)
14. Rights of Data Subjects
Data subjects have the following rights:
Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction (Art. 18 GDPR)
Objection (Art. 21 GDPR)
Data portability (Art. 20 GDPR)
Complaint to a supervisory authority (Art. 77 GDPR)
To exercise these rights, please contact:
info@myskillcation.com
Competent supervisory authority:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach, Germany
poststelle@lda.bayern.de
https://www.lda.bayern.de
15. Data Retention Periods
We store personal data only as long as necessary:
BOOKING DATA:
10 years from contract conclusion (tax law retention obligation pursuant to § 147 AO, § 257 HGB)
PAYMENT DATA (Stripe):
10 years (tax law retention obligation)
CONTACT FORM INQUIRIES:
6 months after completion of communication, in case of legitimate interest (e.g., evidence) up to 3 years
NEWSLETTER/WAITING LIST:
Until withdrawal of consent
USER ACCOUNT:
Until deletion by the user. After deletion request: 30 days backup retention, then permanently deleted
SERVER LOG FILES:
7 days
TECHNICALLY NECESSARY COOKIES:
Session cookies: until closing the browser
MARKETING COOKIES:
_fbp (Meta Pixel): 90 days
INSTRUCTOR DATA (participant lists with instructors):
No later than 30 days after the event
16. Security
Our website uses SSL/TLS encryption to protect data (recognizable by the lock symbol in the address bar).
Access to databases and systems is password-protected.
Regular security updates are performed.
17. Changes to the Privacy Policy
This privacy policy will be updated when our systems or legal requirements change.