Privacy Policy — spiritual-activity.org and the "ISA – Spiritual Activity" app

Last updated: 1 August 2026

This notice applies to our website, to registration for our courses, and to our app. Depending on what you do, only part of it may be relevant to you.

Controller

Leben im Denken e.V., Stäudach 46, 72074 Tübingen

Board: Andreas Schmitt, David Martin, Ludger Scharlipp, Elvira Kraus

Stuttgart Local Court (Amtsgericht Stuttgart), register no. VR 725573

Data protection inquiries: info@spiritual-activity.org

No data protection officer has been appointed, as the requirements of Section 38 of the German Federal Data Protection Act (BDSG) are not met.

Our principle

We collect as little data as possible. Neither our website nor our app uses analytics or tracking tools. The app contains no advertising identifier, no analytics tool, and sends no crash reports to third parties. Your course usage behavior is not analyzed.

Our server is located in Germany and operated by Hetzner Online GmbH. It hosts your participation data, the course content, and everything you enter in the app.

A · Visiting the website

The website is hosted by IONOS SE in Germany. Server log files record the IP address, date and time, page requested, browser, and operating system. This is technically necessary to deliver the website and serves operational security. The logs are kept for a maximum of 14 days and then deleted. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR).

We do not use cookies on our regular pages. The exception is the payment step in the course shop — see Section B below.

Our forms let you send us a message, register for an event, or order posters and postcards free of charge. We process the information you provide and use it solely for the relevant purpose. The data is stored on our own server in Germany. We delete inquiries once they have been finally processed, and at the latest after one year; material orders one year after dispatch; and event registrations six months after the event.

Our forms are protected against automated submissions. For this we use Cloudflare Turnstile (Cloudflare, Inc., USA). When you submit a form, a technical verification token is sent to Cloudflare. General visitor traffic to this website is not routed through Cloudflare. The transfer to the USA is based on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

Our reply and confirmation emails are sent via the info@spiritual-activity.org mailbox hosted by Microsoft (Microsoft Ireland Operations Limited, Ireland). The email content is stored in data centers in Germany. Transmission to the interface is encrypted. To the extent that, in individual cases, access by the U.S. parent company cannot be ruled out, such access is based on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Messages sent are logged to verify delivery and for troubleshooting; the log contains the recipient, subject, and content of the message, is stored in the website's database, and is automatically deleted after 14 days. Legal basis: legitimate interest in reliable delivery (Art. 6(1)(f) GDPR).

One difference from our other pages: our course shop is embedded on the registration pages. As soon as you open this section, content from the shop provider is loaded and your IP address is transmitted to it.

The following applies to the newsletter: we manage it using our own application on our server, sign-up follows a confirmation procedure, the form is protected by ALTCHA (altcha.org), and emails are technically dispatched via Brevo (Sendinblue SAS, France). You can unsubscribe at any time via the link included in every email. Legal basis: your consent (Art. 6(1)(a) GDPR).

B · Registering for a course

Your registration

Registration takes place through our course shop, operated by Ecwid, Inc. (Lightspeed Group, USA). There you provide your name, email address, mailing address, desired course, and language, and optionally a message. Ecwid is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses apply in addition.

The shop is not technically available for joint registrations for two people or for registrations in Russian. We record these via our own form on our server. Before the course begins, we transfer the information into our participant management system and delete the collection list one year after registration.

Your registration is then transferred automatically into our participant management system on our server. Any temporary data stored during this process is deleted after 14 days.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Payment

You can pay by invoice (within Germany only), by credit card via Stripe, or via PayPal.

As soon as you reach the payment step in the order process, content from the payment providers is loaded directly into the page — for card payments from Stripe (Stripe Payments Europe Ltd., Ireland, with involvement of Stripe, Inc., USA), and for PayPal from PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. These companies receive your IP address as well as technical information about your device and browser. Stripe also stores a cookie on your device and evaluates device characteristics to detect fraudulent payments. This processing is necessary for the payment to be completed and secured.

You enter your payment details directly with the respective provider — we do not receive them. Credit card or bank access details are never stored by us. The providers' own privacy notices apply in addition. Standard Contractual Clauses apply to transfers to the USA.

If you pay by invoice, our bank learns your name and bank details. No credit check is carried out.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for fraud detection, additionally legitimate interest (Art. 6(1)(f) GDPR). Storage on your device is strictly necessary for the payment process you requested (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

Emails relating to the course

We send confirmations, organizational notices, and reminders about conference sessions via Brevo (France). If you have also subscribed to our newsletter, your address is also managed there.

Retention

We retain registrations and the associated master data for ten years. We are obligated to do so under German commercial and tax law. This also applies if you delete your access to the app.

C · Conferences

Our course conferences take place via Zoom (Zoom Communications, Inc., USA; for users in the European Economic Area, Zoom Video Communications B.V., Netherlands). When you take part, Zoom processes your displayed name, your email address, technical connection data, and audio and video for as long as your camera or microphone is switched on. The transfer to the USA is based on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Zoom's own privacy notices apply in addition.

We record the conferences and make the recordings available in the app to participants of the respective course year. Only the presentation itself is recorded. Participants' video tiles are not visible in the recording. Depending on the course, participants' spoken contributions may be audible in the recordings.

You can switch off your camera and microphone at any time and may also take part under a name of your own choosing.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for conducting the sessions; legitimate interest (Art. 6(1)(f) GDPR) for providing the recorded presentation to those who could not attend live.

D · Using the app

Signing in to the app

You sign in with your email address and receive a six-digit code that is valid for ten minutes. There is no password. The code is sent via Brevo.

Your session remains active for 180 days from your last use; after that, you need to sign in again. To help protect your access against unauthorized sharing, we keep a record of which devices you are signed in on.

Course content and videos

Text, images, and practice cards are delivered by our own server. Conference recordings are hosted with Bunny.net (BunnyWay d.o.o., Slovenia) and are streamed directly to your device from there. Bunny receives your IP address in the process — even just opening the conference area triggers this, because the thumbnail preview is already loaded from there. Content is delivered from Europe and North America; Standard Contractual Clauses apply to transfers outside the EU.

Bunny maintains anonymous playback statistics (such as watch duration and stream quality). This statistic is not linked to any individual and does not store any re-identification marker on your device. The video player only remembers your quality setting.

What stays on your device

The app stores the following on your device: your session, a device identifier, your language selection, downloaded course content, your personal notes on the practice cards, and your reading progress for the news items. This information is kept in the app's protected storage area on your device.

Your notes are additionally stored on our server so that they are available across multiple devices. No one but you can see them.

Participant list

In the app, you can see who else is taking part in your current course — the first name, the first letter of the last name, city, and country are displayed. This display is switched off by default. It only becomes visible if you explicitly consent, and you can withdraw that consent at any time in the settings. Your information is visible only to fellow participants of the same course, not to earlier course years and not publicly. If you also consent to the Couchsurfing area, your information additionally becomes accessible to everyone who belongs to our community (past and current participants, members of the Leben im Denken e.V. association, and friends).

We document when and in which version you gave or withdrew your consent. This serves solely as evidence.

Rechtsgrundlage: Ihre Einwilligung (Art. 6 Abs. 1 lit. a DSGVO).

App Store and Play Store

Delivery and updating of the app are handled by Apple and Google. In doing so, these companies process data under their own responsibility, which we have no influence over. We ourselves do not receive any personal data from them.

When you delete your access

You can delete your access in the app at any time, under Personal Settings → Delete account. If you no longer have the app installed, write to us at info@spiritual-activity.org from the address your access was created with. We then delete your user account, your notes, your language settings, your device information, and all open sessions along with the content on your device.

Your registration and your master data remain on file in our participant management system for as long as the statutory retention period of ten years applies. A record also remains that prevents a new access from being created with the same email address. If you want to take part in a course again later, write to us — we will then free up the address again.

Your newsletter subscription is not affected by this — it rests on a separate consent. You can unsubscribe at any time via the link in every newsletter email.

We back up our database daily so that nothing is lost in the event of a technical failure. Deleted data may persist in these backups for up to twelve months, and longer in individual backups made for a specific occasion. The backups are accessed only when a restore is needed.

Your rights

You can request information about your data, have it corrected or deleted, restrict its processing, receive it in a portable format, or object to processing based on legitimate interest. You can withdraw any consent you have given at any time for the future. Write to us at info@spiritual-activity.org.

You can also file a complaint with a supervisory authority. The competent authority for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

Changes

We adapt this notice whenever the processing activities described here change. The German version is authoritative; the English and Spanish versions are provided for convenience.