Privacy Policy — spiritual-activity.org and the "ISA - Spiritual Activity" app

As of: 1 September 2026

This policy applies to our website, to registration for our courses and to our app. Depending on what you do, only part of it will apply to you.

Controller

Leben im Denken e.V., Stäudach 46, 72074 Tübingen, Germany

Board: Andreas Schmitt, David Martin, Ludger Scharlipp, Elvira Kraus

Local Court (Amtsgericht) Stuttgart, VR 725573

Data protection enquiries: info@spiritual-activity.org

No data protection officer has been appointed, as the requirements of Section 38 BDSG (German Federal Data Protection Act) are not met.

Our principle

We collect as little as possible. Neither our website nor our app uses analytics or tracking tools. The app contains no advertising ID, no analytics tool and no crash reporting to third parties. Your course activity is not analysed.

Our server is located in Germany and is operated by Hetzner Online GmbH. This is where your participation data, the course content and everything you enter in the app are stored.

A · Visiting the website

The website is hosted by IONOS SE in Germany. Log files store the IP address, time, page accessed, browser and operating system. This is technically necessary to deliver the website and serves operational security. The logs are kept for a maximum of 14 days and then deleted. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR).

We do not set any cookies on our regular pages. The one exception is the payment step in the course shop — see section B.

Using our forms, you can send us a message, sign up for an event or order posters and postcards free of charge. We process the information you provide and use it exclusively for the respective purpose. The data is stored on our own server in Germany. We delete enquiries once they have been fully dealt with, at the latest after one year; material orders one year after dispatch; and event sign-ups six months after the event.

Our forms are protected against automated submissions. For this we use Cloudflare Turnstile (Cloudflare, Inc., USA). When you submit a form, a technical verification token is transmitted to Cloudflare. Visitor traffic to this website is not routed through Cloudflare. The transfer to the USA is based on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

Our reply and confirmation emails are sent via the mailbox info@spiritual-activity.org at Microsoft (Microsoft Ireland Operations Limited, Ireland). Email content is stored in data centres in Germany. Transmission to the interface is encrypted. Insofar as access by the US parent company cannot be ruled out in individual cases, such access is based on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Sent messages are logged for delivery monitoring and troubleshooting; the log contains the recipient, subject and content of the message, is stored in the website database and is automatically deleted after 14 days. Legal basis: legitimate interest in reliable delivery (Art. 6(1)(f) GDPR).

One difference from our other pages: our course shop is embedded on the registration pages. As soon as you open this area, content from the shop provider is loaded and your IP address is transmitted to them.

Regarding the newsletter: we manage it with our own application on our server, sign-up uses a double opt-in procedure, the form is protected by ALTCHA (altcha.org), and technical delivery is handled by Brevo (Sendinblue SAS, France). You can unsubscribe at any time via the link in every email. Legal basis: your consent (Art. 6(1)(a) GDPR).

B · Registering for a course

Your registration

Registration takes place via our course shop, operated by Ecwid, Inc. (Lightspeed Group, USA). There you provide your name, email address, postal address, the desired course and language, and optionally a message. Ecwid is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses apply in addition.

The shop is not technically available for registrations for two people or for registrations in Russian. We record these via our own form on our server. Before the course begins, we transfer the details to our participant management system and delete the collection list one year after registration.

Your registration is then automatically transferred to our participant management system on our server. We delete temporary data from this process after 14 days.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Payment

You can pay by invoice (within Germany only), by credit card via Stripe, or via PayPal.

As soon as you reach the payment step in the checkout, content from the payment providers is loaded directly into the page — for card payments from Stripe (Stripe Payments Europe Ltd., Ireland, with involvement of Stripe, Inc., USA), for PayPal from PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. These companies receive your IP address as well as technical information about your device and browser. Stripe stores a cookie on your device and analyses device characteristics in order to detect fraudulent payments. This processing is necessary for the payment to be completed and secured.

You enter your payment details directly with the respective provider — we do not receive them. Credit card or bank login details are never stored by us. The privacy notices of the providers apply in addition. Transfers to the USA are covered by Standard Contractual Clauses.

If you pay by invoice, our bank learns your name and bank details. No credit check is carried out.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR), and additionally legitimate interest for fraud detection (Art. 6(1)(f) GDPR). Storage on your device is strictly necessary for the payment process you have requested (Section 25(2) No. 2 TDDDG, German Telecommunications Digital Services Data Protection Act).

Course-related emails

We send confirmations, organisational information and conference reminders via Brevo (France). If you have also subscribed to our newsletter, your address is kept there as well.

Retention

We keep registrations and the associated master data for ten years. We are obliged to do so under commercial and tax law. This also applies if you delete your app account.

C · Conferences

Our course conferences take place via Zoom (Zoom Communications, Inc., USA; for users in the European Economic Area Zoom Video Communications B.V., Netherlands). When you take part, Zoom processes your display name, your email address, technical connection data, and video and audio while your camera or microphone is switched on. The transfer to the USA is based on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Zoom's privacy notices apply in addition.

We record the conferences and make the recordings available in the app to the participants of the respective course year. Only the lecture is recorded. Participants' video tiles are not visible in the recording. Contributions from participants may be audible in the recordings, depending on the course. If automatic captioning is used, Zoom additionally processes spoken contributions to generate subtitles and translations.

You can switch off your camera and microphone at any time and can also take part under a name of your choice.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for holding the conferences; legitimate interest (Art. 6(1)(f) GDPR) for providing the lecture recording to those who could not attend live.

Group photos: Occasionally we would like to take a group photo of the conference view for our website or our publications. We announce this in advance during the conference and wait a moment. Anyone who does not wish to be in the photo switches off their camera — they will then not be visible. We do not take such photos without this prior announcement.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by leaving your camera on after our announcement. You can withdraw it at any time with effect for the future; write to us at info@spiritual-activity.org. We cannot recall publications that have already been printed.

D · Using the app and the web version

The course content is available to you via our app and via its web version in the browser. Both access the same data on our server; the following information applies to both. When using the browser version, the server logs described under A are also generated. In some cases we also send recordings via a personal access link by email; the same applies to video delivery as described below.

Sign-in

You sign in with your email address and receive a six-digit code that is valid for ten minutes. There is no password. The code is sent via Brevo.

Your session remains active for 180 days from last use; after that you sign in again. To protect your access against being shared, we keep track of which devices you are signed in on.

Course content and videos

Texts, images and exercise cards are delivered by our own server. The conference recordings are hosted by Bunny.net (BunnyWay d.o.o., Slovenia) and are delivered from there directly to your device. Bunny receives your IP address — as soon as you open the conference area, because the preview image already comes from there. Content is delivered from Europe and North America; Standard Contractual Clauses apply to transfers outside the EU. This applies equally if you view the content in the browser or via an access link sent to you.

Bunny keeps anonymous playback statistics (such as playback duration and stream quality). These statistics are not linked to any person and do not store any identifier on your device.

The video player stores your playback settings and icon graphics in its own storage area. This information contains no identifier and is not affected by signing out or deleting your account; you can remove it via your browser settings.

What remains on your device

The following is stored: your session, a device ID, your name and email address, your language selection, downloaded course content, your personal notes on the exercise cards and the read status of news items.

In the iOS and Android versions of the app, this information is stored in the app's protected storage area. In the web version, it is stored in your browser's local storage, not in cookies; this is subject to the same protection as other data from this website in your browser, and you can delete it via your browser settings. Consent is not required for this, as the storage is strictly necessary for the service you have requested (Section 25(2) No. 2 TDDDG).

When you sign out, course content and your email address are removed; the device ID, your language selection and a technical value that limits the number of code requests remain. When you delete your account, the device ID is also removed.

Your notes are also stored on our server so that they are available on multiple devices. No one but you can see them.

When using the browser version, session, language selection and display settings are instead stored in your browser's local storage. You can delete them via your browser settings.

In the iOS and Android versions of the app, this information is stored in the app's protected storage area. When using the browser version, it is stored in your browser's local storage, which is subject to the same protection as other data from this website in your browser. You can delete it via your browser settings. Consent is not required for this, as the storage is strictly necessary for the service you have requested (Section 25(2) No. 2 TDDDG).

Participant list

In the app you can see who else is taking part in your current course — shown are the first name, the first letter of the surname, city and country. This display is switched off by default. It only becomes visible if you expressly consent, and you can withdraw your consent at any time in the settings. Your details are visible exclusively to participants of the same course, not to previous course years and not publicly. If you consent to the couchsurfing section, your details are additionally accessible to all persons who belong to our community (former and current participants, members of the association Leben im Denken e.V., friends).

We record when and in which version you gave or withdrew your consent. This serves solely as proof.

Legal basis: your consent (Art. 6(1)(a) GDPR).

App Store and Play Store

Downloading and updating the app is handled by Apple and Google. These companies process data under their own responsibility, over which we have no influence. We ourselves do not receive any personal data from them.

If you delete your account

You can delete your account at any time in the app under Personal settings → Delete account. If you no longer have the app installed, write to us at info@spiritual-activity.org from the address with which your account was created; we will then delete it within 30 days and confirm the deletion to you. The entire process is described in detail at https://spiritual-activity.org/en/konto-loeschen/.

Your registration and your master data remain in our participant management system for as long as the statutory retention period of ten years applies. In addition, a non-reversible hash of your email address, which does not contain your address in plain text, is retained indefinitely. It prevents a new account from being created silently with the same address. If you would like to take part in a course again later, write to us — we will then release the address again. Records of when and in which version you consented to or objected to a display are also retained.

Your newsletter subscription is not affected by this — it is based on separate consent. You can unsubscribe via the link in every newsletter email.

We back up our database daily so that nothing is lost in the event of a technical failure. Deleted data may persist in these backups for up to twelve months, and longer in individual event-specific backups. The backups are only accessed in the event of a restore.

Your rights

You can request information about your data, have it corrected or deleted, restrict processing, receive your data in a portable format and object to processing based on legitimate interest. You can withdraw consent at any time with effect for the future. Write to us at info@spiritual-activity.org.

How to delete your app account specifically is described at https://spiritual-activity.org/en/konto-loeschen/ .

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Changes

We will update this policy if the processing described changes. The German version is authoritative; the English and Spanish versions are provided for ease of understanding.