Privacy policy

Controller

The controller responsible for data processing on this website is:

Jonas Przysucha, teho Studio

Orionstr. 6, 12435 Berlin, Germany

Email: info@teho-studio.com

Phone: +49 178 6004858

This policy is written to comply with the EU GDPR and, for visitors from the United Kingdom, the UK GDPR and the Data Protection Act 2018.

The short version

This website is deliberately built to collect as little data as possible. It sets no cookies and loads no analytics or advertising scripts from third-party servers when you open a page. For anonymous audience measurement we use Vercel Web Analytics (see below). You may give optional consent to measure enquiries after an ad click in the contact form.

The only data processed is what your browser transmits for technical reasons when you open the site, plus the information you provide through our forms, by email or by phone.

Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you open the site, the host automatically processes information your browser transmits (server log files):

• IP address of the requesting device
• date and time of access
• requested page or file
• amount of data transferred and status code
• referrer URL, browser type and operating system

Legal basis and retention of log files

The legal basis is Art. 6(1)(f) GDPR (and the equivalent provision of the UK GDPR): our legitimate interest in operating the website reliably, delivering it to you and defending against attacks. This data is not merged with other data sources or used for advertising.

Log files are deleted automatically after a short period. A data processing agreement pursuant to Art. 28 GDPR is in place with the host. As the host is based in the USA, personal data may be transferred to the USA; such transfers are safeguarded by appropriate guarantees within the meaning of Art. 44 et seq. GDPR.

Audience measurement with Vercel Web Analytics

To understand which pages are used, we use Vercel Web Analytics from the host named above. The script is served from our own domain and sets no cookies. It records the page viewed, referrer, approximate location (country), browser, operating system and device type, as well as individual interactions such as opening the job check or submitting a form, without their contents.

Visitors are not recognised across days or websites: instead of a persistent identifier, a hash is derived from the request and discarded after 24 hours. The legal basis is Art. 6(1)(f) GDPR (and the equivalent provision of the UK GDPR): our legitimate interest in improving our services using anonymous usage statistics.

Fonts

The fonts used on this site are bundled at build time and served from our own server. No connection to Google or other font providers is established when you open the site, and no personal data is transferred to third parties in the process.

Contacting us by email or phone

If you contact us by email or phone, we process the data you provide - in particular your name, email address, phone number and the content of your enquiry - solely to handle your request.

The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in answering enquiries.

We delete this data as soon as it is no longer needed to handle your request and no statutory retention obligations apply.

Public business and profile review forms

When you use our public review forms, we process the details you enter about your business, area, website or Google profile, request, advertising and typical job value, together with your name, email address and any optional contact details or message. We also store the selected language, the form entry page and the submission time. If you reach us through a ChatGPT ad and submit the contact form, we also store the campaign and ad variant identifiers with your enquiry to identify its source. We use no cookies or analytics service for this.

We use these details to review your request personally and prepare a possible proposal. The legal basis is Art. 6(1)(b) GDPR for steps taken at your request before entering a contract. The assessment is personal; no offer decision is made solely by automated processing.

The details are stored with Upstash when the data store is available. Resend sends us a notification regardless. If the data store is unavailable, the enquiry remains in that notification. The service-provider and international-transfer information in the onboarding section below also applies here. We delete the data when it is no longer needed to handle the request or work together, unless statutory retention obligations apply.

Signing up for the free Teho App beta

When you sign up as a beta tester at /en/app or /app, we process your name, email address, phone number and website so we can contact you personally, learn about what you offer and discuss taking part in the free beta. We also store the time of your sign-up, the consent wording and its version, the page language, the sign-up status and the delivery status of the emails. Signing up does not subscribe you to the yoga newsletter.

We process these details and contact you on the basis of your consent under Article 6(1)(a) GDPR and UK GDPR. You can withdraw your consent at any time by emailing info@teho-studio.com; processing carried out before you withdraw remains lawful. We delete the details once they are no longer needed to prepare or run the beta, unless statutory retention obligations apply.

The sign-up is stored with Upstash. Resend sends you a confirmation and sends us a notification with your contact details. The information about these providers and possible international transfers in the onboarding section applies here too. To prevent abusive sign-ups, we store a hash of the IP address for up to one hour to limit registration attempts.

Removing a business from the Teho App

The Teho App suggests businesses to its users that could be a good fit for what they offer. If you ask at /en/app/opt-out or /app/austragen for your business not to be suggested any more, we process the business name and website, your email address, your optional message, the language and the time of your request.

We use these details to act on your objection, confirm the removal and make sure the business is not suggested again. The legal basis is Article 6(1)(c) together with Article 21 GDPR and UK GDPR, and Article 6(1)(f), our legitimate interest in reliably honouring your request. For this purpose the business domain stays on a suppression list for as long as we run the Teho App; we delete the other details after twelve months at the latest.

The details are stored with Upstash; Resend sends your confirmation and our notification. The information about these providers and possible international transfers in the onboarding section applies here too. To prevent misuse, we use a hash of the IP address for up to one hour to limit requests.

Yoga newsletter

When you subscribe to the yoga newsletter, we store your email address, your selection as a teacher or studio, your optional website, selected language, signup page and the yoga topic label. We use your selection and website to tailor newsletter content to your work and what you offer. We also store the consent wording and its version, the time and method of signup, welcome email delivery and any unsubscribe request. We process these details on the basis of your consent under Article 6(1)(a) GDPR and UK GDPR.

Submitting the form subscribes you directly and you receive a welcome email. No additional email confirmation is required. After that, you receive one article a month. We store the records with Upstash and send emails through Resend. The information about these providers and possible international transfers in the onboarding section applies here too. To prevent abusive signups, we use a hash of the IP address for up to one hour to limit registration attempts.

You can withdraw your consent at any time using the unsubscribe link or by emailing info@teho-studio.com. Any unconfirmed signups from the previous registration process are deleted after 30 days. After you unsubscribe, no further yoga newsletters are sent to you; we keep the signup and unsubscribe record as evidence for no more than twelve months, after which it is automatically deleted.

Optional measurement of ChatGPT ads

If you reach us through a ChatGPT ad, you may voluntarily agree in the contact form to let us report a successfully sent enquiry as a conversion to OpenAI. Only after the enquiry is sent does our server transmit the event type, time, event ID, destination page and ad click reference to OpenAI. Your name, email address and message are not sent to OpenAI. Your enquiry is sent even without consent, and no conversion is reported in that case.

For visits through these ads, we record clicks on the phone and WhatsApp buttons in our own system with the channel, campaign, ad variant and time. A click is only a contact attempt, not proof of a call or sent message. These click records are not reported to OpenAI. The legal basis is Art. 6(1)(f) GDPR, our interest in assessing the contact options used after our ads.

The purpose is to assess how well our ads work. The legal basis is Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time for future processing by emailing us. Data may be transferred to OpenAI in the USA; details on processing and safeguards are in OpenAI's privacy policy.

Onboarding questionnaire

For clients we provide an onboarding questionnaire. It is not publicly accessible and can only be reached via a personal invitation link we send you by email. We process your name, your email address, the answers you give about your project and timestamps of your progress.

The sole purpose is preparing and carrying out our work together. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract).

Answers are stored encrypted with Upstash, Inc.; invitation and summary emails are sent via Resend, Inc. Both providers process the data exclusively on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Where data is transferred to the USA, this is safeguarded by appropriate guarantees within the meaning of Art. 44 et seq. GDPR.

We delete questionnaire data as soon as it is no longer needed for our work together and no statutory retention obligations apply. You can request deletion at any time with an informal message.

Encryption

This website uses SSL/TLS encryption. You can recognise an encrypted connection by the "https://" prefix in your browser's address bar. With encryption active, the data you transmit to us cannot easily be read by third parties.

Please note that transmitting data by email can involve security gaps. Complete protection against third-party access is not possible with email.

Your rights

You have the following rights regarding your personal data at any time:

• access to the data we process (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)

Withdrawal and complaints

You may withdraw any consent you have given at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

You also have the right to lodge a complaint with a supervisory authority. For us, the competent authority is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany. Visitors from the UK may additionally contact the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

For access, deletion or objection requests, an informal message to info@teho-studio.com is sufficient.