Blog
ENRU
Legal

Privacy Policy

This policy explains which personal data this website collects, why, on what legal basis, who else receives it and what rights you have. I have tried to write it in plain language. If anything is unclear, please write to me.

1. Who is responsible

The controller for this website within the meaning of the EU General Data Protection Regulation (GDPR) is:

  • — (Victoria)
  • —, Germany
  • Email: —
  • Phone: —

I run this website as a private person. Where this policy says "I" or "me", it means Victoria as the controller. For users in Russia, I am the operator of personal data within the meaning of Federal Law No. 152-FZ (see section 10).

2. What data I process and why

I only collect what is needed for each of the purposes below. You can read the website without telling me anything about yourself. I do not make decisions about you based solely on automated processing (Art. 22 GDPR).

2.1 Visiting the website (server logs)

When you open a page, your browser automatically sends technical information to the server, such as your IP address, the date and time of the request, the page requested, the page you came from, and your browser and operating system. The hosting provider (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany) processes this information to deliver the website and keeps it in server logs for a short period to find errors and prevent misuse. Fonts are loaded from this website's own server; no requests are sent to Google Fonts.

Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is a stable and secure website.

2.2 Built-in visitor statistics (no cookies)

To understand which notes are helpful and how people find the site, the website counts visits with its own simple statistics tool. It records the pages viewed, the website you came from (referrer), campaign tags in the link (UTM parameters), device type, browser, browser language and time zone.

No cookies are used and nothing is stored on your device for this purpose. Your IP address is not stored. To count unique visitors, the server creates a one-way code (hash) from a secret value, the current date, your IP address and your browser string. Because the date is part of it, the code changes every day, so a visitor cannot be recognised or followed from one day to the next. The statistics are kept for 25 months.

Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is to understand, in a privacy-friendly way, how the website is used and to improve it. As nothing is stored on your device for this purpose, § 25 TDDDG (the German rule on consent for cookies and similar technologies) does not apply. You can object to this processing at any time (see section 8).

2.3 Booking a call

When you book a free call, I collect your name, email address, the language of the call (Russian or English), your time zone, the date and time you choose and, if you wish to give them, your child's age and a short description of what you would like to talk about. I also store the status of the booking (for example confirmed, moved or cancelled) and the date and time of your consent.

Your name, email address, call language and time zone are needed to arrange the call. Your child's age and the topic are optional; they only help me prepare.

I use this data to arrange, prepare and hold the call, to send you confirmation and reminder emails and to let you move or cancel the appointment.

Legal basis: Art. 6(1)(b) GDPR (handling your request for a call). For any information about your child's health in the topic field: your explicit consent, Art. 9(2)(a) GDPR (see section 3).

2.4 Emails about your booking

After booking, you receive a confirmation and reminders by email. They contain a calendar file (.ics) and a personal, secret link with which you can move or cancel the call. Please do not forward this link, because anyone who has it can change your booking. The emails are sent through the service Resend (see section 4).

Legal basis: Art. 6(1)(b) GDPR.

2.5 The video call

The call takes place on a third-party video platform that I choose, for example Zoom, Google Meet or Yandex Telemost. I send you the link by email. When you join, the platform provider processes data such as your displayed name, IP address, device information and the sound and picture of the call. This happens under the provider's own privacy terms, which I recommend you read. Calls are not recorded.

Legal basis: Art. 6(1)(b) GDPR.

2.6 Notifications to me via Telegram

When someone books or cancels a call or creates an account, I receive a short message in my Telegram messenger so that I can react quickly. For a booking, it contains the name, email address, time and language of the call, the child's age and the beginning of the topic text, if these were given. For a new account, it contains the name and email address. Telegram (Telegram Messenger Inc. / Telegram FZ-LLC) processes these messages as the provider of my messenger.

Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in organising appointments reliably. Where the topic text contains health information, this is covered by your explicit consent (Art. 9(2)(a) GDPR).

2.7 Account

An account is optional. You do not need one to read the notes or to book a call. If you create one, I store your name, email address, your password (only as a salted scrypt hash, so the password itself cannot be read, not even by me), your preferred language, whether you want to receive the newsletter, and the date and time of your consent.

To keep you logged in, the website sets the cookie vika_session (strictly necessary, httpOnly, valid for 30 days or until you log out).

In your account you can download your data as a JSON file and delete your account at any time.

Legal basis: Art. 6(1)(b) GDPR (providing the account you asked for). The session cookie is strictly necessary within the meaning of § 25(2) No. 2 TDDDG.

2.8 Newsletter ("Victoria's notes")

If you sign up to receive my notes by email, I store your email address, your name if you give it, your language and the dates and times of sign-up and confirmation. I use double opt-in: the notes only start arriving after you click the confirmation link in the first email. Every email contains an unsubscribe link, and you can withdraw your consent at any time.

Legal basis: your consent, Art. 6(1)(a) GDPR. I keep a record of your consent so that I can prove it, Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

2.9 Writing to me

If you write to me by email, I use your email address and the content of your message to reply.

Legal basis: Art. 6(1)(f) GDPR (my legitimate interest in answering your request) or, if your message concerns a booking, Art. 6(1)(b) GDPR.

2.10 Optional analytics (only with your consent)

Only if you click "Accept" in the cookie banner does the website also load Google Analytics 4, Yandex Metrica and the VK Ads pixel. Details are in section 6 and in the Cookie Policy.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.

3. Information about your child's health

In the optional topic field, you may tell me about your child, for example about a diagnosis, development or health. Such information belongs to the special categories of personal data under Art. 9 GDPR. I process it only on the basis of your explicit consent, which you give by ticking the consent checkbox (Art. 9(2)(a) GDPR), and only to prepare for our call.

This information is stored in the website's database, and its beginning is included in the Telegram notification to me (section 2.6). It is not used for any other purpose and is not shared with anyone except the technical service providers named in section 4.

Information about your child is information about another person. Please share it only if you are the child's parent or legal guardian, and only as much as you feel comfortable with. The field is optional: you can also tell me everything during the call. You can withdraw your consent at any time (section 9), and I will then delete this information.

4. Who receives your data

I do not sell your data. Data is only passed on to the following service providers, and only as far as needed:

  • Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Stores the website and its database on my behalf (processor, Art. 28 GDPR).
  • Email delivery: Resend, Inc., USA. Sends booking emails and the newsletter on my behalf (processor, Art. 28 GDPR).
  • Telegram: Telegram Messenger Inc. / Telegram FZ-LLC. Delivers notifications about bookings and new accounts to me (section 2.6).
  • Video platform: the provider of the platform used for the call (for example Zoom, Google Meet or Yandex Telemost), when you join the call (section 2.5).
  • Analytics providers, only with your consent: Google Ireland Limited (Ireland) and Google LLC (USA); Yandex LLC (ООО «Яндекс», Russia); VK (ООО «ВК», Russia).

I may also disclose data to public authorities if I am legally obliged to do so.

5. Transfers outside the EU

  • USA (Resend, Google): for data sent to the USA, the EU-US Data Privacy Framework applies where the recipient is certified under it (adequacy decision of the European Commission, Art. 45 GDPR). Otherwise, the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
  • Russia (Yandex Metrica, VK Ads pixel): there is no EU adequacy decision for Russia, and data processed there may be accessible to Russian authorities under conditions that do not meet EU standards. Analytics data is sent to Russia only if you click "Accept" in the cookie banner. By doing so, you also consent to this transfer (Art. 49(1)(a) GDPR).
  • Video platform: if the provider of the platform is based outside the EU (for example Zoom and Google in the USA, Yandex in Russia), your data is processed there under the provider's terms when you join the call. If you have concerns about a platform, please write to me before the call.
  • Telegram: Telegram may process data outside the EU/EEA, including in countries for which there is no EU adequacy decision.
  • Hosting: where the data is stored depends on the hosting provider (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany). If it is stored outside the EU/EEA, the transfer takes place on the basis of an adequacy decision or appropriate safeguards under Art. 44 et seq. GDPR.

6. Cookies and analytics in brief

  • Strictly necessary (no consent needed): the cookie vika_lang remembers your language (1 year); the cookie vika_session keeps you logged in (30 days, only if you log in); the local storage entry vika_consent stores your choice from the cookie banner.
  • Built-in statistics: no cookies (section 2.2).
  • Optional, only after "Accept": Google Analytics 4 (IP addresses anonymised), Yandex Metrica (which may include Webvisor session recording, if enabled) and the VK Ads pixel. If you choose "Only necessary", none of them is loaded.

You can change your choice at any time via "Cookie settings" in the footer. The full list is in the Cookie Policy.

7. How long I keep data

  • Bookings: up to 3 years after the call, for my records. If you ask, I delete them earlier, unless the law requires me to keep them.
  • Telegram notifications: no longer than the related booking or account.
  • Account: until you delete your account.
  • Newsletter: until you unsubscribe or withdraw your consent. The record of your consent (dates of sign-up, confirmation and unsubscribing) is kept for as long as I may need to prove it.
  • Emails you send me: as long as needed to deal with your request.
  • Built-in statistics: 25 months.
  • Server logs: a short period only.
  • Optional analytics: according to the cookie durations in the Cookie Policy and the providers' own retention rules.

8. Your rights

Under the GDPR you have the right to:

  • access your data and receive a copy (Art. 15);
  • have incorrect data corrected (Art. 16);
  • have your data deleted (Art. 17);
  • have the processing restricted (Art. 18);
  • receive your data in a common, machine-readable format (Art. 20); in your account you can download it as a JSON file;
  • object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21), for example the built-in statistics;
  • withdraw any consent at any time with effect for the future (Art. 7(3));
  • lodge a complaint with a data protection supervisory authority (Art. 77). The authority responsible for me is —. You can also contact the authority in the country where you live or work.

To use your rights, simply write to —. I may ask you to confirm your identity. I will reply without undue delay and within one month at the latest.

9. Withdrawing your consent

Where I process data on the basis of your consent (health information in the topic field, the newsletter, optional analytics and, for users in Russia, the consent under 152-FZ), you can withdraw it at any time, free of charge and as easily as you gave it:

  • newsletter: the unsubscribe link in any email, or the setting in your account;
  • optional analytics: "Cookie settings" in the footer;
  • everything else: an email to —.

Withdrawal does not affect the lawfulness of the processing carried out before it. If you withdraw your consent for a booking before the call, I may not be able to hold the call.

10. Users in Russia: Federal Law No. 152-FZ

If you live in Russia, Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" may also apply to the processing of your data. In this respect:

  • I am the operator of your personal data; my details are in section 1.
  • I process your data on the basis of your consent, which you give by ticking the checkbox on the website. The full text is in the Consent to personal data processing. The consent is given freely, of your own will and in your own interest, and must be specific, informed, conscious and unambiguous.
  • Information about your child's health belongs to the special categories of personal data (Art. 10 of Law No. 152-FZ). It is processed only with your consent and only to prepare the call.
  • Cross-border transfer: your data is processed outside the Russian Federation. I am located in Germany, the data is stored with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, emails are sent via Resend (USA) and notifications via Telegram. Not all of these countries, in particular the USA, provide protection of personal data equivalent to Russian law. By giving your consent, you agree to this transfer. If you accept them, data from Yandex Metrica and the VK Ads pixel is processed by these companies in Russia.
  • Under Art. 14 of Law No. 152-FZ, you have the right to receive information about the processing of your personal data, to demand that it be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose, and to withdraw your consent at any time. You can also appeal against my actions or inaction to Roskomnadzor (the Federal Service for Supervision of Communications, Information Technology and Mass Communications) or to a court.
  • I respond to requests within 10 working days of receipt. This period can be extended by up to 5 working days if I tell you the reasons. After you withdraw your consent, I stop the processing and destroy the data within 30 days, unless the law allows me to continue processing on other grounds.

11. Children

This website and the calls are intended for adults, mainly parents and carers. Children and young people under 18 should not create an account, sign up for the newsletter or book a call.

12. Security

I take reasonable technical and organisational measures to protect your data. For example, passwords are stored only as salted scrypt hashes, the session cookie cannot be read by scripts on the page (httpOnly), and the links for managing a booking are secret and personal. Please note, however, that no transmission over the internet is completely secure.

13. Changes to this policy

I update this policy when the website or the law changes. The current version is always available on this page. If you have an account or receive the newsletter, I will inform you about important changes by email.

14. Contact

For any questions about your data, write to — or by post to —, —, Germany.

Last updated: 11 October 2026