Privacy Policy

# Privacy Policy

The protection of your personal data is a priority for us. This Privacy Policy informs you in accordance with Articles 12, 13, and 14 of the General Data Protection Regulation (GDPR) regarding the collection and processing of personal data when using our platform https://8hope.com.

### 1. Data Controller and Contact
**Data Controller pursuant to Art. 4 No. 7 GDPR:**  
[FULL COMPANY NAME / FULL NAME]  
[LEGAL FORM]  
[STREET AND HOUSE NUMBER]  
[POSTAL CODE AND CITY, GERMANY]  
Email: [PRIVACY-EMAIL-ADDRESS]  
Website: https://8hope.com  

*(Note: Provide Data Protection Officer details if designated; otherwise state: "A Data Protection Officer has not been appointed as statutory thresholds are not met.")*

### 2. Categories of Processed Data and Purposes
* **Account and Profile Data (Art. 6 (1) (b) GDPR):** Full name, email address, telephone number, address, account credentials processed to manage user and expert profiles.
* **Booking and Consultation Data (Art. 6 (1) (b) GDPR):** Appointment schedules, session durations, booked practitioners, service confirmation records.
* **Payment Metadata (Art. 6 (1) (b) and (f) GDPR):** Transaction ID, payment status, settlement and payout details. *(Full credit card information is processed exclusively by PCI-DSS certified payment processors).*
* **Technical Logs and Server Files (Art. 6 (1) (f) GDPR):** IP addresses, access timestamps, browser specifications collected to ensure platform stability, security, and fraud prevention.
* **Communications Data (Art. 6 (1) (b) and (f) GDPR):** In-platform messaging, Q&A logs, dispute records, and customer support inquiries.
* **Health-Related Data (Art. 9 (2) (a) GDPR):** Information regarding physical or mental well-being voluntarily provided during pre-assessments or consultations is processed strictly on the basis of your **explicit consent**, which may be revoked at any time.

### 3. Data Sharing and Processors
Personal data is shared only to the extent necessary for contractual performance or statutory compliance with verified Data Processors (Art. 28 GDPR):
* **Hosting Providers:** Cloud and database infrastructure located within high-security environments.
* **Video Communication Infrastructure:** Live sessions are conducted via secure, encrypted real-time protocols. Video/audio feeds are not recorded without separate, explicit consent.
* **Payment Gateways:** Regulated payment and payout providers (e.g., Stripe, WorldFirst) handling monetary transactions under strict regulatory compliance.
* **Transactional Email/Notification Providers:** Systems dispatching appointment updates and security notices.

### 4. Transfers to Third Countries
Where data is transferred to countries outside the European Union (EU) or European Economic Area (EEA), such transfers are governed by adequacy decisions of the European Commission or EU Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR.

### 5. Retention Periods
We retain personal data only as long as necessary to fulfill the operational purposes or comply with statutory retention requirements (particularly commercial and tax retention duties under §§ 257 HGB, 147 AO requiring 6 to 10 years). Thereafter, data is deleted or anonymized.

### 6. Your Rights under the GDPR
You have the following statutory rights regarding your personal data:
* **Right of Access (Art. 15 GDPR)**
* **Right to Rectification (Art. 16 GDPR)**
* **Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)**
* **Right to Restriction of Processing (Art. 18 GDPR)**
* **Right to Data Portability (Art. 20 GDPR)**
* **Right to Object (Art. 21 GDPR):** Right to object at any time to data processing based on legitimate interests (Art. 6 (1) (f) GDPR).
* **Right to Withdraw Consent (Art. 7 (3) GDPR)** with effect for the future.

### 7. Right to Lodge a Complaint
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. The competent authority for our registered office is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

**Version:** 30.08.2026 | Version: 2026-08-30-v1