1. CONTROLLER

 

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

 

Leah Haller

trading as Leah Luna

Kurze Str. 13

30629 Hannover-Misburg-Anderten

Germany

 

Email: connect@itsleahluna.com

Phone: +49 176 81702815

 

Website: itsleahluna.com

 

2. GENERAL INFORMATION

 

I take the protection of your personal data seriously.

 

This Privacy Policy explains what personal data is collected when you visit this website, contact me, submit a form, purchase a product or service, participate in SoulSync or otherwise interact with my services, and how that information is processed.

 

Personal data means any information relating to an identified or identifiable natural person.

 

Personal data is processed in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the Telecommunications Digital Services Data Protection Act (TDDDG), and other applicable data protection laws.

 

3. DATA PROCESSED WHEN YOU VISIT THIS WEBSITE

 

When you access this website, technical information may automatically be processed in order to provide and secure the website.

 

This may include:

 

IP address

 

Date and time of access

 

Pages and files accessed

 

Browser type and version

 

Operating system

 

Referring website

 

Device information

 

Technical log and security information

 

The processing of technically necessary information is carried out on the basis of Art. 6(1)(f) GDPR, where applicable, based on the legitimate interest in providing a secure, functional and reliable website.

 

Where processing is necessary to take steps at your request before entering into a contract or to perform a contract, Art. 6(1)(b) GDPR applies.

 

4. WEBSITE HOSTING AND WIX

 

This website is created and hosted using services provided by Wix.com.

 

Wix may process personal data on my behalf in connection with hosting, website functionality, security, forms, customer management and other services used on this website.

 

Depending on the services used and technical infrastructure, data may be processed in countries outside Germany and the European Economic Area.

 

Where personal data is transferred internationally, such transfers are carried out subject to the applicable requirements of the GDPR and appropriate safeguards where required.

 

Further information about Wix’s processing of personal data can be found in Wix’s own Privacy Policy.

 

Wix acts as a data processor for certain processing carried out on behalf of website owners. Wix maintains a Data Processing Agreement governing such processing.

 

The legal basis for using Wix for the operation and security of this website is generally Art. 6(1)(f) GDPR and, where processing is necessary for the performance of a contract or pre-contractual measures, Art. 6(1)(b) GDPR.

 

Where processing requires consent, Art. 6(1)(a) GDPR applies.

 

Wix states that it operates servers in multiple locations and that transfers outside the EEA are conducted in accordance with applicable data-protection requirements.  

 

5. CONTACTING ME

 

If you contact me by email, telephone, a website contact form or another communication channel, I may process the information you provide in order to respond to your enquiry.

 

This may include:

 

Your name

 

Email address

 

Telephone number

 

Message content

 

Information about the service you are interested in

 

Other information you voluntarily provide

 

Where your enquiry relates to entering into or performing a contract, the legal basis is Art. 6(1)(b) GDPR.

 

For other general enquiries, processing may be based on Art. 6(1)(f) GDPR, based on my legitimate interest in communicating with people who contact my business.

 

6. SOULSYNC APPLICATIONS, BOOKINGS AND PARTICIPATION

 

When you apply for, purchase, book or participate in SoulSync or another mentorship, course, DJ-related service or programme, I may process information necessary to administer and provide that service.

 

This may include:

 

Name

 

Email address

 

Telephone number

 

Billing information

 

Booking and payment status

 

Programme participation information

 

Communication relating to the programme

 

Information voluntarily provided in forms or applications

 

Information required to organise mentoring sessions, course access or programme delivery

 

The primary legal basis for this processing is Art. 6(1)(b) GDPR because the processing is necessary to take steps prior to entering into a contract and/or to perform the contract with you.

 

Where information is processed because of a legal obligation, Art. 6(1)(c) GDPR applies.

 

7. PAYMENTS AND STRIPE

 

Payments for SoulSync and other products or services may be processed using Stripe.

 

When you make a payment, payment-related personal data is transmitted to and processed by Stripe as necessary to process the transaction and provide related payment services.

 

Depending on the transaction, this may include:

 

Name

 

Email address

 

Billing information

 

Payment method information

 

Transaction information

 

Payment status

 

Technical and fraud-prevention information

 

I do not need to receive your complete card details in order for Stripe to process your card payment.

 

Where Stripe is used to process payments necessary for a purchase or contract, the relevant processing is based primarily on Art. 6(1)(b) GDPR.

 

Additional processing may be necessary to comply with legal obligations under Art. 6(1)(c) GDPR or for legitimate interests such as payment security and fraud prevention under Art. 6(1)(f) GDPR, as applicable.

 

Stripe separately explains the personal information it processes, its purposes and applicable legal bases in its privacy documentation.  

 

8. PAYMENT PLANS AND FUTURE PAYMENTS

 

If you choose a payment plan, information necessary to administer the payment plan may be stored and processed for the duration of the payment arrangement.

 

Where you have expressly agreed to recurring or future payments, the payment method associated with your purchase may be used by the payment provider to process the agreed future instalments.

 

The payment schedule, amounts and applicable payment terms are disclosed as part of the purchase and contractual process.

 

The legal basis for processing personal data necessary to administer an agreed payment plan is Art. 6(1)(b) GDPR.

 

9. COURSE AND MENTORSHIP ACCESS

 

Personal data may be processed where necessary to create, manage and administer access to SoulSync course materials, mentorship sessions, communications and other programme resources.

 

This may include your name, email address, account or access information, programme status and information concerning your participation.

 

Processing necessary to provide the programme is based on Art. 6(1)(b) GDPR.

 

10. EMAIL COMMUNICATIONS

 

Transactional and service-related emails may be sent where necessary to administer purchases, bookings, programmes or other contractual relationships.

 

These communications may include payment confirmations, programme information, scheduling information, access information and important service updates.

 

Such communications are generally processed under Art. 6(1)(b) GDPR where necessary to perform a contract.

 

If separate promotional or marketing emails are sent on the basis of your consent, the processing is based on Art. 6(1)(a) GDPR.

 

Where marketing relies on another legally permitted basis, the applicable legal requirements will be observed.

 

Where consent is the legal basis, you may withdraw that consent at any time with effect for the future.

 

11. COOKIES AND SIMILAR TECHNOLOGIES

 

This website may use cookies and similar technologies.

 

Some technologies are technically necessary for the operation, security and functionality of the website.

 

Other technologies, such as analytics or marketing technologies, may only be activated where permitted by law and, where required, after you have provided consent through the cookie consent mechanism.

 

Under §25 TDDDG, storing information on or accessing information from a user’s device generally requires consent unless the storage or access is strictly necessary for providing a service expressly requested by the user or falls within another statutory exception.  

 

Where consent is required for the processing of personal data, the legal basis is Art. 6(1)(a) GDPR.

 

You may withdraw or modify your consent through the cookie settings available on this website.

 

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

 

Wix itself uses cookies for website functionality and related purposes, and additional Wix apps or third-party integrations can place additional cookies.  

 

12. THIRD-PARTY SERVICES

 

Where third-party services are integrated into this website or used to provide services to customers, those providers may process personal data as necessary to provide their respective services.

 

The specific processing depends on which functions you use and which services are active on the website.

 

Where consent is legally required before a third-party service or non-essential technology is activated, that service should only be activated after the relevant consent has been provided.

 

Third-party providers may operate under their own privacy policies and may, depending on the provider, process information outside the European Economic Area.

 

13. INTERNATIONAL DATA TRANSFERS

 

Some service providers used for this website or business may process personal data outside Germany or the European Economic Area.

 

Where personal data is transferred to a third country, the transfer will only take place where permitted under Chapter V of the GDPR.

 

Depending on the recipient and destination country, this may include an adequacy decision of the European Commission, appropriate safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism.

 

Information concerning applicable safeguards may be requested using the contact details provided above.

 

14. DATA RETENTION

 

Personal data is retained only for as long as necessary for the purposes for which it was collected or where continued storage is required by law.

 

Contract, payment, invoice and business records may therefore be retained for applicable statutory retention periods.

 

Once the relevant purpose and any statutory retention requirements cease to apply, personal data will generally be deleted or anonymised unless there is another lawful basis for continued processing.

 

15. LEGAL BASES FOR PROCESSING

 

Depending on the circumstances, personal data may be processed on one or more of the following legal bases:

 

Art. 6(1)(a) GDPR – consent

 

Art. 6(1)(b) GDPR – performance of a contract or steps taken prior to entering into a contract

 

Art. 6(1)(c) GDPR – compliance with a legal obligation

 

Art. 6(1)(f) GDPR – legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms

 

16. YOUR DATA PROTECTION RIGHTS

 

Under the GDPR, you may have the right to:

 

Request access to your personal data

 

Request correction of inaccurate personal data

 

Request deletion of your personal data

 

Request restriction of processing

 

Object to certain processing

 

Receive certain personal data in a portable format

 

Withdraw consent at any time where processing is based on consent

 

Lodge a complaint with a competent data protection supervisory authority

 

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

 

These rights arise in particular under Articles 15–21 GDPR and are subject to the conditions and exceptions contained in the GDPR. Article 13 also requires individuals to be informed about these rights.  

 

To exercise your data protection rights, contact:

 

connect@itsleahluna.com

 

17. RIGHT TO OBJECT

 

Where personal data is processed on the basis of legitimate interests under Art. 6(1)(f) GDPR, you have the right, under the conditions of Art. 21 GDPR, to object to the processing of your personal data on grounds relating to your particular situation.

 

Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing purposes.

 

18. RIGHT TO WITHDRAW CONSENT

 

Where processing is based on your consent under Art. 6(1)(a) GDPR, you may withdraw your consent at any time with effect for the future.

 

The withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

 

For cookie-related consent, you can use the cookie settings available on the website.

 

19. RIGHT TO LODGE A COMPLAINT

 

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

 

You may in particular contact the supervisory authority responsible for your place of residence, place of work or the place of the alleged infringement.

 

20. SECURITY

 

Appropriate technical and organisational measures are used to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

 

However, no method of transmitting or storing information online can guarantee absolute security.

 

21. CHANGES TO THIS PRIVACY POLICY

 

This Privacy Policy may be updated where necessary to reflect changes to the website, services, third-party providers or applicable legal requirements.

 

The current version will be made available on this website.

 

Last updated: 25 August 2026