Privacy policy (Datenschutzerklärung)

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:
Amir-Reza Azimi-Tabrizi
Dänenstraße 7
10439 Berlin
Germany
Email: amir@amirazim.com

I am not required to appoint a data protection officer.

2. Summary

This website does not use analytics, advertising or tracking cookies, and it does not build profiles of visitors. Fonts and images are served from this website itself. Personal data is processed only to run the website, to schedule calls, to sell and deliver the Starter Kit, to keep records of enquiries and customers, and to answer messages. The sections below explain each case, the legal basis and how long data is kept.

3. Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you open a page, your browser sends technical data that Vercel processes on my behalf: IP address, date and time of the request, the page requested, referrer, browser and operating system. This is needed to deliver the website securely and to detect and prevent misuse.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, working website). The logs are kept only for a short period and are not combined with other data. Vercel is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision for that framework and on a data processing agreement.

4. Booking a call or session (Cal.com)

The booking calendar on the contact page and the booking page for the Starter Kit session are provided by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. When the calendar loads, your IP address and device data are transmitted to Cal.com, and Cal.com sets cookies that are technically necessary for the calendar to work securely (for example, to prevent automated abuse).

When you book, Cal.com processes the details you enter (name, email address and any notes) and creates the appointment in my Google calendar, with a Google Meet link (see section 7).

Legal basis: Art. 6 (1) (b) GDPR (steps you request before or under a contract) and Art. 6 (1) (f) GDPR (legitimate interest in efficient scheduling); for the technically necessary cookies, § 25 (2) no. 2 TDDDG. Booking data is kept as long as needed for the appointment and follow-up, and deleted when no longer needed, unless retention is required by law. Cal.com relies on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses for transfers to the USA.

5. Buying the Starter Kit (Stripe)

Checkout and payment take place on pages provided by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes your name, email address, billing address, optional company name and tax ID, payment details and transaction data to process the payment, prevent fraud and create your invoice. For some purposes, such as fraud prevention and financial regulation, Stripe acts as an independent controller; see stripe.com/privacy.

After payment, this website asks Stripe to confirm the purchase so that it can show you the download and the booking link, and sends you an email with a link back to that page.

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract) and Art. 6 (1) (c) GDPR (legal obligations under tax and commercial law). Invoices and accounting records are kept for the retention periods required by German tax and commercial law (§ 147 AO, § 257 HGB; currently up to ten years). Stripe may transfer data to the USA; it relies on the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses.

6. Withdrawal from a contract

If you use the withdrawal function on this website, I process your name, the contract details you enter and your email address to handle your withdrawal and to send you a confirmation of receipt by email.

Legal basis: Art. 6 (1) (c) GDPR (legal obligation under §§ 355 and 356a BGB). The records are kept for as long as claims under the contract can be raised and for the statutory retention periods.

7. The working session (Google Meet), email and calendar

The Starter Kit session and calls take place on Google Meet, and I use Google Workspace (Gmail and Google Calendar) for email and appointments. These services are provided by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland, which processes the data on my behalf under a data processing agreement (Art. 28 GDPR). Google processes the data needed to hold the video call (such as name, email address, IP address and, during the call, audio and video), the content of emails and the details of appointments. Sessions are not recorded.

If you email me, I process your message and contact details to answer you. Legal basis: Art. 6 (1) (b) GDPR where your message relates to a contract or a request for one, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering messages). Google may transfer data to the USA and relies on the EU-U.S. Data Privacy Framework and standard contractual clauses.

8. Customer records (Attio)

To keep track of enquiries, bookings and customers, I keep a customer record in the CRM service Attio, provided by Attio Limited, 2nd Floor, 42 St John's Square, London EC1M 4EA, United Kingdom, which processes the data on my behalf under a data processing agreement (Art. 28 GDPR).

The record contains the details you give when you book a call or session or buy the Starter Kit (name, email address, company, role, what you would like from the call, appointment times, and the product, amount and date of a purchase), the company that your email domain belongs to, and the emails and calendar invitations exchanged with me through my business account (amir@amirazim.com).

Legal basis: Art. 6 (1) (b) GDPR (steps you request before or under a contract) and Art. 6 (1) (f) GDPR (legitimate interest in organising enquiries and customer relationships). Records are deleted when they are no longer needed, at the latest 3 years after the last contact, unless statutory retention periods apply. Transfers to the United Kingdom are covered by the European Commission's adequacy decision; where Attio's sub-processors process data in the USA, Attio relies on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

8a. Setup audits, sign-in and voluntary refund reviews (Supabase)

I use Supabase to verify control of your email address and store your purchase reference, verified payment time and amount, applicable guarantee version, sanitized audit observations, stated needs, assessment revisions, refund requests, review decisions, attended session commencement and correction history. Supabase processes this information on my behalf under a data processing agreement. Necessary sign-in cookies keep you authenticated; they are not used for advertising or analytics.

The provider is Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. The portal’s primary project data is stored in Frankfurt, Germany (eu-central-1). Supabase and its subprocessors may also process data outside the European Economic Area to provide the service. Supabase’s data processing addendum includes the European Commission’s Standard Contractual Clauses for transfers where required. You can read the data processing addendum and subprocessor list.

The audit runs locally within the scope you select. Only observations you preview and submit are sent to the portal. Do not submit confidential source files, credentials or unnecessary personal data. The portal applies a versioned checklist to classify the submitted evidence and show category counts. It does not measure performance or decide refunds automatically. I make the final refund decision after reviewing the evidence. Notifications contain a short summary and a protected link rather than the audit evidence.

Legal basis: Art. 6 (1) (b) GDPR for performance of the contract and handling your guarantee request; Art. 6 (1) (f) GDPR for secure sign-in and preventing misuse; Art. 6 (1) (c) GDPR for required transaction records. For necessary sign-in cookies, § 25 (2) no. 2 TDDDG. Sanitized audit evidence is retained for 90 days after assessment, or 90 days after the related refund case is resolved, whichever is later. Required payment, refund and accounting records follow the retention rules in section 5. Private backups follow the same evidence-retention rules.

If the portal is unavailable, email your request and sanitized observations to amir@amirazim.com. I record the original email receipt time when the portal returns. Email processing is described in section 7.

9. Links to other websites

This website links to other services, such as Skool, Substack and LinkedIn. No data is sent to them unless you follow a link; from then on, their own privacy policies apply.

10. Your rights

You have the right to access your personal data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise these rights, email me at the address above.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for me is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, datenschutz-berlin.de.

You are not required to provide personal data to visit this website. Without the data described in sections 4 and 5, however, a booking or purchase is not possible. No automated decision-making or profiling takes place.

11. Changes

I update this policy when the website or the services it uses change. The current version is always available on this page.