This English version is a convenience translation. The German version is legally binding: shirishpandit.com/de/datenschutz/
Here you can find out which personal data is processed when you visit this website, for what purpose, and what rights you have.
1. Controller
Shirish Pandit
Max-Eyth-Str. 16
14195 Berlin
Germany
Phone: +49 174 3453362
Email: shirish@shirishpandit.com
2. Legal bases, retention periods and recipients
I process personal data only where there is a legal basis under Art. 6 GDPR. I state the respective legal basis for each processing activity below.
I store personal data only for as long as necessary for the respective purpose. Afterwards it is deleted, unless statutory retention obligations (e.g. under tax or commercial law) require otherwise.
The only recipients of your data are the service providers named in this policy (hosting and email at Hostinger, and WhatsApp – only if you contact me through it). Data is not passed on for advertising purposes.
3. Hosting and server log files
This website and my mailboxes at shirishpandit.com are hosted by Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus. A data processing agreement (Art. 28 GDPR) is in place with Hostinger.
Each time the website is accessed, the server automatically stores information transmitted by your browser (server log files): IP address, date and time of access, page requested, referrer URL, browser used and operating system. This data is technically necessary to deliver the website and keep it secure, and is not combined with other data. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in the stable and secure operation of the website.
4. SSL/TLS encryption
For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the lock symbol in your browser’s address bar.
5. Cookies and visitor statistics
This website does not set any tracking or marketing cookies. At most, technically necessary cookies are set, e.g. to store your language selection. The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.
Anonymous visitor statistics (Independent Analytics)
To understand which content is used and to improve the website, I use the WordPress plugin Independent Analytics. It runs exclusively on my own web server at Hostinger (see section 3). No cookies are set, and no data is transmitted to the plugin provider or other third parties.
The following is recorded: pages viewed, date and time, referrer URL (the page you come from), browser, operating system, device type, and country or region (derived locally from the IP address). Your IP address is not stored; together with a randomly generated value that changes daily, it is converted into an anonymous identifier (hashed), so that no conclusion can be drawn about your person and you cannot be recognised across several days. The statistics data is automatically deleted after 24 months.
The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in designing and improving this website to meet demand. You can object to this processing at any time (see section 12).
6. Fonts
The fonts used on this website are stored locally on the web server. No connection to servers of Google or other third parties is made when the page loads.
7. Booking request via the contact form
If you send me an appointment request via the form, I process the data you enter: preferred weekdays, time, duration, desired date(s), name, email address and, where applicable, your message. Name and email address are mandatory fields.
I use the data solely to respond to your request and to arrange an appointment with you. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures).
The request is sent by email to my business mailbox at Hostinger (see section 3) and stored there.
Requests that do not result in an appointment are deleted no later than three months after the last contact. Data relating to booked appointments is kept only for as long as necessary to handle them or as required by statutory retention obligations (e.g. tax obligations for invoices).
8. Contact by email or phone
If you contact me by email or phone, I process your details (e.g. name, contact details, content of the enquiry) in order to handle your request. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a booking, and otherwise Art. 6(1)(f) GDPR.
9. Health data
For a safe massage it may be important for me to know about health-related particularities, e.g. injuries, pregnancy or medication. Such information is specially protected health data (Art. 9 GDPR).
I collect it only to the extent necessary for the treatment, and only with your explicit consent (Art. 9(2)(a) GDPR), which you give in writing before the first session. Please do not send such information via the form, email or WhatsApp, but tell me in person.
I keep this information protected, do not pass it on to third parties, and delete it as soon as it is no longer needed, at the latest twelve months after your last appointment. You can withdraw your consent at any time with effect for the future. At the first appointment, I complete a client form with health information together with you. It is kept locked away in paper form and destroyed after 12 months.
10. Contact via WhatsApp
This website has a “WhatsApp” button. It is a simple link: no data is transmitted to WhatsApp and no content is loaded from WhatsApp when the website is accessed. Only when you click the button are you redirected to WhatsApp. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a company of the Meta group.
If you write to me via WhatsApp, WhatsApp and I process your phone number, your WhatsApp profile name and the content of your messages. I use this data only to respond to your request. The legal basis is Art. 6(1)(b) GDPR if a booking is concerned, and otherwise Art. 6(1)(f) GDPR. A transfer to the USA is possible; Meta is certified under the EU-US Data Privacy Framework. Further information: whatsapp.com/legal/privacy-policy-eea.
If you do not wish to use WhatsApp, you can equally reach me by phone, email or via the booking form.
11. Your rights
You have the right at any time to:
- access to your stored data (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
- withdraw a consent you have given, with effect for the future (Art. 7(3) GDPR)
Simply contact me by email for this purpose.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.
12. Right to object (Art. 21 GDPR)
Where I process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation. I will then no longer process your data unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Last updated: October 2026