Privacy Policy

1 · In brief

This policy describes which personal data we process, why we do so, and how long we keep it. It applies to our website, our offerings and our communication with you. This English version is provided for convenience only. If there is any discrepancy, the German version prevails.

We work on a topic very few people talk about openly. That is why we have set up our systems so that as little data as possible is created and as few parties as possible learn that you are with us. The service providers that are nevertheless involved are listed under each service below.

This policy addresses you informally, as we do across the whole website. Legally, this changes nothing.

As of: September 22, 2026

2 · Controller

The controller responsible for processing your data is:

Bernd Fuchs
Mentrevo e.U.
FN 687493 w, Handelsgericht Wien
Börsegasse 10/3
1010 Vienna, Austria
Email: info@paruresistraining.com
Phone: +43 681 205 897 28

We operate publicly under the name Paruresis Training Academy. This is a brand; the company is Mentrevo e.U.

Legal notice: paruresistraining.com/impressum

We are not required to appoint a data protection officer. For privacy questions, write directly to info@paruresistraining.com.

3 · Health data

This section comes first on purpose, as it is the most important.

Paruresis is a health matter. If you book a workshop, schedule a call or buy a product from us, that fact alone allows conclusions about your health. Such data is specially protected under Art. 9 GDPR. This applies even if you tell us nothing else about yourself.

Our legal basis

We process this data based on your explicit consent under Art. 9(2)(a) GDPR. You give this consent via a separate checkbox during registration or checkout, apart from all other checkboxes. You can withdraw it at any time with effect for the future, informally by email to info@paruresistraining.com. This does not affect the lawfulness of processing carried out before the withdrawal.

What we do to keep data to a minimum

We do not ask for diagnoses or require medical certificates.
Our pre-workshop questionnaires do not collect health-related information. What is needed for preparation, we discuss in the personal preliminary call.
Whatever you choose to share in conversation or during exercises at the workshop is not documented or stored. Personal worksheets stay with you.
None of our emails has the word “Paruresis” in the subject line. Anyone who sees the message on a lock screen or in a shared inbox cannot tell what it is about.
There is no list of participants. We only share your contact details with other participants if you expressly agree.
We do not send advertising platforms any information about which specific offering you viewed or booked. We only measure that a purchase took place, without naming the product. We do not build audiences from visitors to specific pages and do not send customer lists to advertising platforms.

What you should know

Some of the services we use belong to companies outside the EU or have a parent company or subprocessors there. This applies in particular to our website, our email infrastructure and video calls. Where this is the case, it is stated for the respective service. A solution entirely free of such providers is not available to a business of our size.

4 · Overview of processing

Types of data processed

Master data: full name, address, customer number
Contact data: email address, phone number
Contract data: booked service, date, order number, term
Payment data: invoices, payment status, payment method
Content data: texts you write to us, form responses
Usage data: pages viewed, time on page, device type, search terms on our website
Meta and log data: IP address, timestamp, browser details
Health-related data within the meaning of Section 3

Data subjects

Visitors to our website
Participants in workshops, calls and training
Buyers of our digital products
People who write to us or subscribe to our newsletter
Business partners and providers

Purposes

Performing our contracts and preparing contracts
Communication and responding to inquiries
Providing the website and its features
Securing our systems and fending off automated attacks
Complying with legal obligations, especially under tax law
Audience measurement and improving our offerings
Advertising and measuring its effectiveness, where you have consented

5 · Legal bases

Consent, Art. 6(1)(a) GDPR. You have agreed to processing for a specific purpose.
Contract and pre-contractual measures, Art. 6(1)(b) GDPR. Processing is necessary to perform a contract with you or to prepare one at your request.
Legal obligation, Art. 6(1)(c) GDPR. Above all, retention obligations under tax law.
Legitimate interests, Art. 6(1)(f) GDPR. For example, the secure operation of our systems or preventing misuse.
Explicit consent for health data, Art. 9(2)(a) GDPR. See Section 3.

Besides the GDPR, the Austrian Data Protection Act (Datenschutzgesetz, DSG) applies. It contains supplementary rules, among others on the right of access, the processing of special categories of personal data, and transfers.

6 · Security

We take technical and organizational measures appropriate to the risk. These include:

Encrypted transmission via TLS, recognizable by the https in the address bar.
Two-factor authentication for all accounts through which personal data can be accessed.
Access only for people who need it for their tasks. The business is run by one person.
Separation of private and business communication.
Protection of our forms against automated input, see Section 13.
Privacy-friendly default settings where the systems we use allow it.
Defined procedures for access requests, erasure and data breaches.

7 · Recipients of your data

We share data when necessary to provide our service, when there is a legal obligation, or when you have consented. Recipients are mainly:

Providers of our technical infrastructure, i.e. website, email, calendar, file storage and video calls
Payment providers
Tax advisors, as part of bookkeeping
Authorities, where we are legally obliged

We do not sell data. We do not pass customer data such as names, email addresses or orders to third parties for their advertising purposes. How we use advertising platforms is described in Section 23.

We have data processing agreements under Art. 28 GDPR with all service providers who process data on our behalf.

8 · Transfers to third countries

Some of our service providers process data outside the European Economic Area or have subprocessors there. This applies in particular to the USA and Israel.

The European Commission has adopted an adequacy decision for Israel. For transfers to the USA, we rely on the EU-US Data Privacy Framework where the respective provider is certified under it, and additionally on the European Commission’s Standard Contractual Clauses. Together, these are meant to ensure protection continues even if the legal situation changes.

For each service, we state the basis we rely on. A list of companies certified under the Data Privacy Framework is available at dataprivacyframework.gov

9 · Retention and erasure

We delete data once the purpose no longer applies and no legal obligation prevents it. If you withdraw consent, we delete the data based on it.

If several periods apply to the same data, the longest applies.

Key retention periods

7 years for tax-relevant records, in particular invoices and accounting vouchers. The basis is § 132 BAO and §§ 190 to 212 UGB. The period starts at the end of the calendar year.
3 years for data we need to defend or assert claims. The basis is the limitation period under § 1489 ABGB.
30 days for server log files.
3 years for unsubscribed newsletter addresses, solely as proof of prior consent.
Until the end of the workshop for notes from the preliminary call.
Until withdrawal for everything based on consent.

For ongoing contracts, periods only begin when the contractual relationship ends.

10 · Your rights

Under Art. 15 to 21 GDPR, you have the following rights:

Access. You can find out whether and which data we process about you, and request a copy.
Rectification. We must correct inaccurate data and complete incomplete data.
Erasure. You can request erasure unless a retention obligation prevents it.
Restriction. Instead of deleting, we can restrict processing.
Data portability. You receive the data you provided to us in a common format.
Objection. You can object to processing based on legitimate interests on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons.
Withdrawal of consent. At any time, with effect for the future.

An informal email to info@paruresistraining.com is enough for all of these rights.

If you believe we are violating data protection law, you can file a complaint with the data protection authority:

Austrian Data Protection Authority
Barichgasse 40-42, 1030 Vienna
dsb@dsb.gv.at
dsb.gv.at

We do not make automated individual decisions or carry out profiling within the meaning of Art. 22 GDPR.

11 · Website and hosting

Our website runs on the Wix platform. When you visit it, Wix processes on our behalf the data technically needed to deliver the page to your browser.

Server logs

Each visit automatically logs data: the page viewed, date and time, amount of data transferred, browser type and version, operating system, the previously visited page, and the IP address. We use this data to ensure operation and fend off attacks. It is deleted after 30 days at the latest.

Languages

Our website may be offered in several languages. The selected language is stored technically so it is kept on your next visit.

Provider: Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel. Purpose: operating the website, security. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in secure operation. Third country: Israel, adequacy decision of the European Commission; subprocessors in the USA among others, based on Standard Contractual Clauses. Data processing agreement: de.wix.com/about/privacy-dpa-users

Domain and DNS

Our domain is registered with OVH. When you visit the website, the domain name is resolved via OVH’s name servers.

Provider: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. Legal basis: Art. 6(1)(f) GDPR

Email and file storage

Our business email runs on Google Workspace. This involves processing sender and recipient addresses, message content and technical delivery information. The same account holds our file storage in Google Drive, where we keep working documents.

To protect against spoofed senders, we use SPF, DKIM and DMARC. We receive automated reports containing the IP addresses of sending servers. We analyze these reports for technical purposes only.

Please note: emails are not consistently end-to-end encrypted on the internet. We cannot take responsibility for the transmission path between your provider and our server. If you want to tell us something confidential, you can call us instead.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(b) and (f) GDPR. Third country: Data Privacy Framework, Standard Contractual Clauses

12 · Cookies and consent

Cookies are small files stored on your device and read back later. Some are necessary for the website to work at all, for example to keep your cart or your login. Others serve statistics or advertising.

We set essential cookies based on our legitimate interest under Art. 6(1)(f) GDPR. Without them, the website does not work.
We set all other cookies only after you have consented, Art. 6(1)(a) GDPR.

You can change or withdraw your choice at any time by clicking the round shield icon at the bottom left. It appears on this page and in the Cookie Policy. You can reach both pages from anywhere via the footer. The icon opens the cookie settings.

The banner distinguishes four categories: Essential, Functional, Analytics and Marketing. What falls into which category is listed at paruresistraining.com/cookies

On your first visit, we ask you via a consent banner. Your choice is stored so that we do not ask again and can prove your consent. What is stored is a pseudonymous identifier, the time, the scope of your consent, and technical details about your browser and device.

Unless we state otherwise, you can assume cookies are stored for up to two years. You can also delete or block cookies in your browser settings. Parts of the website will then no longer work.

Provider of the consent tool: Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, used via the “Usercentrics for Wix” app. Purpose: obtaining, managing, documenting and withdrawing consent. Legal basis: Art. 6(1)(c) GDPR for the obligation to provide proof, Art. 6(1)(f) GDPR for operation

13 · Contacting us

If you reach us via the contact form, by email or by phone, we process your details to respond to your request. Besides your message, the contact form asks for an email address and the topic of your request.

The same applies to the withdrawal form at paruresistraining.com/widerruf. There you automatically receive a confirmation of receipt with the date and time of your declaration.

Messages sent via our website arrive in the website platform’s inbox and are also delivered to our business Gmail account so we can reply from there.

We keep the correspondence while your request is ongoing and beyond that for as long as retention obligations apply or claims could arise from it.

We do not offer live chat. We also do not accept inquiries via Facebook, Instagram or WhatsApp.

Protection against automated input

Our forms are protected against automated filling by Google reCAPTCHA. Google analyzes, among other things, your IP address, time spent on the page and your mouse or typing movements to detect whether the input comes from a human. Without this protection, our forms would be open to spam and misuse.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(b) GDPR for responding to inquiries, Art. 6(1)(f) GDPR for reCAPTCHA and secure operation. Third country: Data Privacy Framework

14 · Appointments and video calls

You can book an appointment online for intro calls and preliminary calls. We process your name, your email address, the requested time and, if you fill in the field, what the call is about.

Booking runs via Wix Bookings or an appointment schedule in Google Calendar. The appointment is entered in our calendar, and you receive a confirmation email and a calendar invitation.

We hold calls by video via Google Meet or by phone. You decide whether to turn on your camera. We do not record calls or create transcripts.

Our notes from a preliminary call are limited to what is needed for preparation. These notes are kept in our Google Drive file storage and deleted after the workshop.

Provider: Wix.com Ltd. and Google Ireland Limited. Legal basis: Art. 6(1)(b) GDPR, additionally Art. 9(2)(a) GDPR for the health context. Third country: Israel with adequacy decision, USA via Data Privacy Framework and Standard Contractual Clauses

15 · Workshops and events

For workshop registration, we process first name, last name, email address, address, phone number, date of birth and gender, as well as booking and payment details. We use them to organize the event, send the ticket and organizational information, and issue the invoice. We need the phone number for the personal preliminary call. The date of birth serves to confirm you are of legal age. We need your gender because some exercises take place in separate restrooms and we assign the exercise groups accordingly.

In the registration form, you confirm via three separate checkboxes that you have read the Privacy Policy and consent to processing including the health context, that you accept the Terms of Participation, and that you have taken note of the liability notice.

The workshop page embeds a map showing the venue. See Section 24.

Confidentiality during the workshop

No list of participants is handed out. Photo, video and audio recordings by participants are not permitted. Recordings by us are made only with prior, separate and voluntary consent; participation does not depend on it.

By registering, you agree to treat personal or identifying information about other participants confidentially. This obligation continues after the workshop.

Peer contact

At the workshop, we offer to connect participants with each other. This is entirely voluntary and is not asked in the group, but via a paper form that each person fills out privately.

Sharing your first name and email address with the other participants, if you tick this box.
Joining a WhatsApp group for the respective workshop. All other members there can see your phone number. We point this out explicitly before you consent. The operator is WhatsApp Ireland Limited, a Meta group company; its privacy terms apply. You can leave the group yourself at any time.

Without your tick, we do not add you to any group or share your data. We keep the completed forms as long as the group exists and destroy them afterward. You can withdraw your consent informally at any time.

Provider: Wix.com Ltd. for registration; WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland for the group. Legal basis: Art. 6(1)(b) GDPR for registration, Art. 6(1)(a) and Art. 9(2)(a) GDPR for the health context, contact sharing and the group

16 · Digital products and courses

When you buy a workbook, an online course or a training, we process your order, contact and payment data and the details needed to provide it.

For workbooks, you receive a download link by email. For technical reasons, the link is valid for 30 days. For courses and ongoing training, we also store your access status, and for online courses your progress, so you know where you left off.

Provider: Wix.com Ltd. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for retaining invoices

17 · Payment and invoicing

We process payments via Wix Payments. You enter your payment data, in particular card data, directly with the payment service provider. We do not see or store complete card data. We only receive information on whether and when a payment was made, plus the details needed for invoicing.

Credit and debit cards of major brands, Apple Pay and Google Pay are available. If you use Apple Pay or Google Pay, the respective provider also processes your payment data under its own terms.

We create and send invoices automatically by email. They contain your billing details and the booked service. We keep invoices for seven years.

Provider: Wix.com Ltd. or the underlying payment institutions; Apple Distribution International Ltd. and Google Ireland Limited for the respective wallet payments. Legal basis: Art. 6(1)(b) GDPR for processing, Art. 6(1)(c) GDPR for retention

18 · Your account

For bookings, courses and subscriptions, the system creates a customer account. There you can see your orders, bookings, events, subscriptions and programs.

This account is not a profile or a community. There are no public profile pages, no member list and no feature that lets one user find or message another. Each person sees only their own data. This is set up deliberately.

You can have your account deleted at any time. Invoice data is not affected while the tax retention period is running.

Legal basis: Art. 6(1)(b) GDPR

19 · Newsletter

We only send our newsletter with your consent. Your email address is all you need to sign up.

We use the double opt-in procedure: after signing up, you get an email with a confirmation link. You are only subscribed once you click it. We log the sign-up with time and IP address so we can prove your consent.

The newsletter contains information about our offerings, dates and content related to the training.

Anyone who joins the waiting list for workshop dates goes through the same procedure with a confirmation link and receives only messages about new dates.

Measurement

Our newsletters contain a small tracking pixel and links with an identifier. This lets us see whether and when a message was opened and which links were clicked, along with technical details such as browser and operating system. We use this to see which content is read. This measurement is part of your consent. If you do not want it, unsubscribe from the newsletter.

You can unsubscribe at any time; every newsletter contains a link for this. After you unsubscribe, we keep your address for up to three years to prove prior consent and process it solely for that purpose. On request, we delete it immediately.

Provider: Wix.com Ltd. Legal basis: Art. 6(1)(a) GDPR

Promo emails to customers

If you have bought from us, we may email you information about similar offerings of our own. You can object to this at any time free of charge, in any email and by message to info@paruresistraining.com. After an objection, we keep your address on a suppression list so we do not contact you again.

20 · Surveys and feedback

Before and after a workshop, we use short online questionnaires. Both run on Google Forms.

Before the workshop: participation is voluntary. We ask how you heard about us. We do not collect health-related information here.
After the workshop: the questionnaire is anonymous, and we do not collect email addresses. Via a separate checkbox, you can agree that we use some of your statements anonymously on our website. Without this tick, we use nothing. Consent is voluntary, and you can withdraw it informally at any time.

Provider: Google Ireland Limited. Legal basis: Art. 6(1)(a) GDPR. Third country: Data Privacy Framework, Standard Contractual Clauses

21 · Blog and search

We publish articles on our website. No registration is needed to read them, and no data is processed beyond what is described in Section 11. There is no comment function.

Our website has a search function. Your search terms are processed to display results and may be analyzed in aggregated form so we can see what people search for. This does not allow any conclusions about you personally.

Provider: Wix.com Ltd. Legal basis: Art. 6(1)(f) GDPR

22 · Analytics

We want to know which content is found and read so we can improve the website. For this we use analytics tools.

These tools only run after you have agreed in the consent banner. Without consent, no analysis takes place. You can withdraw your consent at any time.

This creates pseudonymous usage profiles. So we see that someone viewed certain pages, but not who it was. Names or email addresses are not included.

Google Analytics 4. It processes pages viewed, time and duration of use, source of the visit, technical details about device and browser, and an approximate city-level location. IP addresses are not logged for visits from the EU. Usage data is deleted after 14 months.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(a) GDPR. Third country: Data Privacy Framework, Standard Contractual Clauses

Wix Analytics. The platform also creates its own visitor statistics with page views, traffic sources and device types.
Provider: Wix.com Ltd. Legal basis: Art. 6(1)(a) GDPR

Google Search Console. It shows us the search terms for which our pages appear in Google Search. The data is aggregated and does not allow conclusions about individuals.
Provider: Google Ireland Limited. Legal basis: Art. 6(1)(f) GDPR

23 · Ads

We promote our offerings through advertising platforms. Ads may be shown to people presumed to be interested, and we measure whether an ad led to a booking.

This too runs only after you have agreed in the consent banner. Without consent, no ad tag is loaded and no cookie is set.

We receive only aggregated reports from the platforms, no information about individuals. However, if you are logged in to one of these platforms, the provider may link the data to your account there. We have no influence on this.

Google Ads.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(a) GDPR. Third country: Data Privacy Framework, Standard Contractual Clauses

Meta ads for Facebook and Instagram.
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Legal basis: Art. 6(1)(a) GDPR. Third country: Data Privacy Framework, Standard Contractual Clauses

Google Tag Manager. A tool for managing the tags listed above. Tag Manager itself creates no profiles and sets no analytics cookies of its own, but for technical reasons transmits your IP address.
Provider: Google Ireland Limited. Legal basis: Art. 6(1)(a) GDPR

Ways to opt out independently of our banner: youronlinechoices.eu for Europe, optout.aboutads.info across regions.

24 · Embedded content

On some pages, we embed content loaded from other providers. For your browser to display this content, the respective provider receives your IP address. Without it, delivery is technically impossible.

Google Maps. On the workshop page, we show a map with the venue. This processes in particular your IP address and, if you allow it, your device’s location data.
Provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Legal basis: Art. 6(1)(a) GDPR. Third country: Data Privacy Framework

Fonts. The fonts used on our website are served by our website provider from its own servers. No connection to Google is made just to load fonts.

Links to other websites

Our website contains links to other providers’ websites, such as recommended hotels or organizations related to the topic. Once you follow such a link, that provider’s privacy policy applies. We have no influence on their content or data processing.

Referral links

Some of these links are referral links. If you book through them, we receive a commission from the provider. The price stays the same for you. Technically, this means the link contains an identifier the provider uses to attribute the booking to us. What data the provider processes is set out in its privacy policy. We label such links as advertising.

25 · Changes

We update this policy when our processing changes. The current version is always available at paruresistraining.com/datenschutz. If a change requires action from you, such as new consent, we will inform you separately.

26 · Glossary

Personal data: any information relating to an identified or identifiable person. An online identifier such as a cookie can also count.
Processing: any handling of data. This includes collecting, storing, using, disclosing and deleting.
Controller: whoever decides on the purpose and means of processing. Here, that is us.
Processor: a service provider that processes data on our behalf and under our instructions.
Special categories of personal data: data that is specially protected, including health data. See Section 3.
Audience measurement: analysis of how a website is used, usually with pseudonymous identifiers.
Conversion measurement: analysis of whether an ad led to a purchase or booking.
Double opt-in: a procedure in which a newsletter sign-up only takes effect after clicking a confirmation link.
Third country: a country outside the European Economic Area.