Privacy Policy
Last updated: 30 September 2026
1. Who is responsible for your data?
Dr. David Hipp
Fredericiastraße 31
14059 Berlin, Germany
Email: drdavidhipp@gmail.com
This notice explains how I process personal data when you visit this website, contact me or join an online meeting with me.
2. Visiting this website
This website is hosted by Squarespace Ireland Limited, Ireland. When you visit, Squarespace processes technical information such as your IP address, browser and device information, pages requested and access times to deliver the website, maintain security and provide basic traffic statistics.
The legal basis is Article 6(1)(f) GDPR. My legitimate interests are operating a reliable, secure website and understanding its overall use. Squarespace's optional analytics cookies are restricted and its detailed visitor activity log is disabled. Cookies or similar technologies that are strictly necessary to provide a service you request may still be used, as permitted by Section 25(2) TDDDG.
3. Contacting me
When you contact me through the form or by email, I process your name, email address, message and other information you provide to respond and discuss working together. Form submissions are stored in Squarespace and delivered to my Google Workspace mailbox.
For inquiries about entering into or performing a contract with you, the legal basis is Article 6(1)(b) GDPR. For other inquiries, including contact on behalf of an organization, it is Article 6(1)(f) GDPR: my legitimate interest in responding and maintaining professional communication.
Providing information is voluntary, but I need the mandatory form fields to receive and answer your inquiry through the form. Please give only a brief outline and avoid including sensitive personal information.
I use Google Workspace, provided by Google Cloud EMEA Limited, Ireland, for professional email, appointment coordination and online meetings.
4. Online meetings
I use Google Meet for individual and group calls. It processes your name and email address where supplied, IP address, device and connection information, meeting details, and audio, video, chat or screen content you share. Other participants can see or hear what you share.
The legal basis is Article 6(1)(b) GDPR for arranging or providing services to you, or Article 6(1)(f) GDPR for other professional meetings. My legitimate interest is effective remote communication. Connection data is necessary to participate through Meet; using your camera or sharing additional content is optional.
Meetings are not recorded by default. I record only with every participant's prior, freely given, explicit consent (Article 6(1)(a) GDPR). Before recording, I explain the purpose, who will have access and the retention period. Publication, for example as a podcast, requires separate explicit consent covering that use. You may withdraw consent during the call or by contacting me. I do not use automated transcription or AI meeting notes.
5. Providers and international processing
Squarespace and Google process data on my behalf under data-processing agreements and use service providers to deliver their services. Google's agreement is incorporated into the applicable Workspace terms. They also process certain service and technical data for their own purposes, as explained in the Squarespace and Google privacy policies.
Processing may take place outside the European Economic Area, including in the United States. Covered transfers to certified US entities rely on the EU–US Data Privacy Framework adequacy decision; other transfers use safeguards where required, including European Commission Standard Contractual Clauses. Details are in Squarespace's data-processing agreement and Google's transfer information. You may also contact me to obtain information about, or a copy of, the applicable safeguards.
6. How long I keep data
I delete inquiries and meeting-related correspondence when the matter and necessary follow-up are complete, unless the records remain necessary for ongoing client work, legal retention duties or legal claims. This includes copies I control in Squarespace and Google Workspace.
Legally required business records are kept for the applicable statutory periods (Article 6(1)(c) GDPR); records needed for legal claims are kept until the relevant limitation period or proceedings end (Article 6(1)(f) GDPR).
Recordings are kept for the period explained before consent. If consent is withdrawn, I stop consent-based use and delete the recording unless a legal obligation requires retention. Providers retain technical and meeting metadata according to service-operation, security and legal requirements, as described in their linked terms and privacy information.
7. Your rights
Subject to the applicable legal conditions, you can request access, correction, deletion, restriction of processing and data portability. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.
Where I rely on legitimate interests, you may object to processing on grounds relating to your particular situation. I will stop that processing unless there are compelling overriding grounds or it is necessary for legal claims.
Contact me at drdavidhipp@gmail.com to exercise your rights. You may also complain to a data protection supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information.