LEGAL
PRIVACY POLICY
Protecting your personal data matters to us. Below we inform you in accordance with Art. 13 GDPR about how we process data on this website.
1. Controller
The controller for data processing on this website is:
Zenctuary GmbH Managing Director: Shervin Zamani Alai Boxhagener Straße 96, 10245 Berlin Email: info@zenctuary.de
2. General information on data processing
We generally process personal data of our users only where this is necessary to provide a functioning website as well as our content and services. Processing takes place with the user's consent or, where a legal permission applies, without separate consent, in particular on the basis of Art. 6 (1) GDPR.
3. Provision of the website and server log files
When you access our website, our hosting/website builder provider automatically records information in server log files that your browser transmits automatically (e.g. IP address, date and time of the request, browser type, operating system, referrer URL). This data cannot be attributed to specific individuals and is used exclusively for the secure and error-free operation of the website (Art. 6 (1) (f) GDPR – legitimate interest).
Our website is built with Lovable and provided via its hosting infrastructure. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.
4. Cookies and consent
Our website uses cookies. Technically necessary cookies are used on the basis of Art. 6 (1) (f) GDPR. Cookies that are not strictly necessary (e.g. for analytics/statistics) are only set with your prior consent pursuant to Art. 6 (1) (a) GDPR in conjunction with Sec. 25 TTDSG. You can withdraw this consent at any time with future effect, e.g. via our cookie consent tool or your browser settings.
5. Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to and stored on a Google server; transmission to servers in the USA cannot be excluded.
It is only used if you have previously consented via our cookie banner (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time, for example by deleting the relevant cookie in your browser settings or by using the Google opt-out browser add-on.
Where personal data is transferred to the USA, Google states that it relies on the EU-U.S. Data Privacy Framework or the EU Commission's standard contractual clauses.
6. Contact form
If you send us enquiries via the contact form on our website, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual/contractual enquiry) or Art. 6 (1) (f) GDPR (legitimate interest in handling enquiries). We do not pass on this data without your consent.
7. Appointment booking via Eversport
For online booking (e.g. ice bath, sauna and infrared sessions) we embed the booking widget of the provider Eversport. When you book, the data you enter (including name, contact details, booked appointment) is transmitted to and processed by Eversport in order to carry out and manage the booking. The legal basis is Art. 6 (1) (b) GDPR (performance/initiation of a contract).
Where required, a data processing agreement pursuant to Art. 28 GDPR is in place with Eversport. For details on data processing by Eversport, please refer to Eversport's privacy policy.
8. Payment processing via Eversport
Payment for bookings, classes and memberships is processed via the payment function integrated into the Eversport booking system. The data required for payment (including name, amount, payment method, transaction data) is transmitted to Eversport or the payment service provider used by Eversport. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR (statutory retention obligations, e.g. Sec. 147 AO).
9. Health data (ice bath, sauna and infrared sessions)
Before taking part in ice bath, sauna or infrared sessions we ask you for information about your state of health or any pre-existing conditions as well as an emergency contact. This is health data and therefore a special category of personal data within the meaning of Art. 9 GDPR.
We process this data solely to assess your suitability for the respective application, to carry it out safely and to react correctly in an emergency. The legal basis is your explicit consent pursuant to Art. 9 (2) (a) GDPR in conjunction with Art. 6 (1) (a) GDPR. You can withdraw this consent at any time with future effect.
Only trained staff have access to this data; in an emergency the data may be passed on to emergency services or doctors. The data is deleted once the purpose no longer applies, at the latest 12 months after collection, unless statutory retention obligations apply.
10. Newsletter (Mailchimp)
If you sign up for our newsletter, we use the service Mailchimp provided by The Rocket Science Group, LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA. Your email address and, where applicable, your name are stored and used to send the newsletter. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR.
As Mailchimp processes data in the USA, the transfer takes place on the basis of appropriate safeguards (e.g. EU standard contractual clauses or certification under the EU-U.S. Data Privacy Framework, where used by Mailchimp). You can withdraw your consent at any time via the unsubscribe link in every newsletter email or by contacting us.
11. Recipients of data / processors
Within the processing described above, we pass on data to the following categories of recipients where necessary for the respective purpose: hosting provider (Lovable), booking and payment provider (Eversport), newsletter provider (Mailchimp), web analytics provider (Google), tax advisors and — in a medical emergency — emergency services/doctors. Data processing agreements pursuant to Art. 28 GDPR are in place with all service providers processing data on our behalf where required.
12. Transfers to third countries
When using Google Analytics and Mailchimp, personal data may be transferred to the USA (third country). According to their own statements, these providers rely on appropriate safeguards (e.g. EU standard contractual clauses or certification under the EU-U.S. Data Privacy Framework).
13. Storage period
We store personal data only for as long as necessary for the respective purposes or as long as statutory retention periods apply (e.g. commercial and tax retention periods of up to 10 years for invoice data). Afterwards the data is deleted routinely.
14. Rights of data subjects
Within the scope of the applicable statutory provisions, you have the right at any time to:
- Access to the personal data we store about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of the data we store about you (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing (Art. 21 GDPR)
15. Withdrawal of your consent to data processing
Many data processing operations are only possible with your explicit consent (e.g. newsletter, analytics cookies, health questionnaires). You can withdraw consent already given at any time. The lawfulness of the processing carried out up to the withdrawal remains unaffected.
16. Right to complain to the competent supervisory authority
In the event of breaches of data protection law, you have the right to complain to the competent supervisory authority. The competent authority is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit Friedrichstr. 219, 10969 Berlin, Germany
17. Data security
We use appropriate technical and organisational measures (e.g. SSL/TLS encryption of data transmission, access restrictions, encrypted storage) to protect your data against accidental or intentional manipulation, loss, destruction or unauthorised access.
18. Validity and changes to this privacy policy
This privacy policy is currently valid (as of July 2026). Further development of our website and services or changed legal or regulatory requirements may make it necessary to amend this privacy policy.
YOUR RIGHTS
REQUEST ACCESS OR DELETION
You can find out at any time what data we store about you, have it corrected or deleted. We handle your request within one month. For security we may ask you to confirm your identity — for example via the email address registered with us.
Prefer email? Write to info@zenctuary.de · Zenctuary GmbH, Boxhagener Straße 96, 10245 Berlin