1. Controller and Contact

The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data in connection with this website, the AI workshops (including the Agentic Engineering Workshop and the Agentic Everything Hackathon), and the offerings “LYF – Lead Yourself First” (LYF Accelerator, LYF Membership, LYF Plus, hereinafter “LYF”) is:

Daniel Hauck, Friedhofstr. 21, 71577 Großerlach, Germany, Email: dh@hauck.io, Phone: +49 176 30400873

No data protection officer has been appointed, as there is no legal requirement to do so (the number of people involved in data processing is below the statutory threshold of 20 persons, Section 38 of the German Federal Data Protection Act – BDSG). For data protection inquiries, please contact the email address above.

2. General Information on Data Processing

Personal data means any information relating to an identified or identifiable natural person. We generally process our users’ personal data only to the extent necessary to provide our website and our offerings, content, and services, or where another legal basis applies (consent, a legal obligation, or a legitimate interest).

3. Data Collected When Visiting the Website

When you access our website, our hosting provider automatically collects information transmitted by your browser to our server (server log files):

  • page visited
  • date and time of access
  • amount of data transferred
  • referring page (referrer URL)
  • browser and operating system used
  • IP address (possibly anonymized)

Processing is carried out under Art. 6(1)(f) GDPR, based on our legitimate interest in the stability and security of our website. The data is automatically deleted after 30 days, unless specific indications of unlawful use require further storage for evidentiary purposes.

Data transmission on our website is additionally protected using current SSL/TLS technology to secure your data as effectively as possible against unauthorized access. You can recognize an encrypted connection by the string “https://” in your browser’s address bar.

4. Hosting

Our website and the backend of the LYF app are hosted by:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

All data collected through the use of our website and the LYF app is stored and processed on Hetzner’s servers, located in Germany. We have concluded a data processing agreement (DPA) with Hetzner under Art. 28 GDPR. No transfer to a third country takes place as part of this hosting.

5. Image Hosting (AWS)

To display images on our website, including in blog posts, we use the storage service Amazon S3 provided by Amazon Web Services (AWS). Provider: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (a subsidiary of Amazon.com, Inc., USA). Images are stored on servers in AWS's data center in Frankfurt am Main, Germany (region eu-central-1), and delivered from there.

We have concluded a data processing agreement (DPA) with AWS under Art. 28 GDPR. Since storage takes place exclusively in the European data center, no transfer to a third country generally occurs; however, a theoretical possibility of access by the US parent company under US law cannot be fully excluded. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in reliably and efficiently displaying image content on our website.

6. Data Transfers to Third Countries

Some of the service providers we use are based outside the EU/EEA or transfer data there, in particular to the United States. In these cases, we ensure an adequate level of data protection – either based on an adequacy decision of the European Commission (e.g., the EU-US Data Privacy Framework, Art. 45 GDPR) or on EU Standard Contractual Clauses (Art. 46 GDPR). Further details are provided below for each relevant service.

7. Cookies

Our website does not use any cookies that would require consent. The analytics software Matomo that we use (see Section 10) runs in a cookieless configuration. Only if you opt out of analytics using the form described in Section 10 is a single cookie stored in your browser, to remember that choice. A cookie consent banner is therefore not required.

8. YouTube Videos

Our website, including blog posts, may include videos hosted on YouTube. To protect your data as effectively as possible, these videos are not automatically played or connected to YouTube when the page loads. Instead, only a preview image is initially displayed; a connection to YouTube/Google is only established once you actively click on the video to play it.
Only upon this click is data (including your IP address) transmitted to YouTube LLC / Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (potentially involving Google LLC, USA), and YouTube/Google may set cookies at that point. The legal basis in this case is your consent (Art. 6(1)(a) GDPR), which you give by actively clicking on the video. Where applicable, data transfers to the USA take place under the EU-US Data Privacy Framework or other appropriate safeguards (see Section 6). For further information, please see Google's privacy policy: https://policies.google.com/privacy

9. Amazon Affiliate Program (Affiliate Links)

Our website participates in the Amazon Affiliate Program (Amazon Associates). Individual links on our website, for example to recommended books, are so-called affiliate links that lead to Amazon and are tagged with an identifier. Using this identifier, Amazon can recognize that you were referred via our website and may grant us a commission if you make a purchase on Amazon through that link. This results in no additional cost to you.

Clicking on such a link takes you directly to Amazon's website (Amazon Europe Core S.à r.l., 38 Avenue John F. Kennedy, L-1855 Luxembourg, or other Amazon group companies). We have no knowledge of or influence over which personal data Amazon collects in this context or how it is processed; Amazon's own privacy policy applies exclusively.

The mere presence of such links on our own website does not itself set any cookies or transmit data to Amazon; this only occurs once you click through to Amazon's website yourself.

10. Web Analytics (Matomo)

We use the analytics software Matomo to statistically evaluate visitor behavior on our website. Matomo is self-hosted on our own servers at Hetzner (see Section 4). Matomo sets no cookies while tracking, and IP addresses are anonymized before storage (the last digits are masked), so that identification of individual users is not possible.

Processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in the statistical evaluation of website usage to improve our offering. Data is not shared with third parties.

If your browser sends a Do Not Track signal, we respect it and your visit is not recorded.

You can also object to the statistical evaluation at any time (Art. 21 GDPR) using the opt-out form at the bottom of this page. If you opt out, an opt-out cookie is stored in your browser and Matomo no longer records your visits. The cookie is set only at your request. If you delete your cookies, repeat the opt-out.

11. Contacting Us

If you contact us by email, we store your details (including your email address, name if provided, and the content of your message) to process your inquiry.

Our business email correspondence runs through Google (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, potentially involving Google LLC, USA). The legal basis is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). We have concluded a DPA with Google under Art. 28 GDPR; where applicable, data transfers to the USA take place under the EU-US Data Privacy Framework (see Section 5).

Your data will be deleted once it is no longer needed to process your inquiry, and no later than 6 months, unless further storage is required (e.g., in connection with an agreement that has been concluded).

12. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about our offerings (LYF and Agentic Engineering) as well as new content on our website. The newsletter is directed at anyone interested, regardless of whether you are already a customer.

We use the double opt-in procedure: you will only receive the newsletter after you have expressly confirmed your subscription via a confirmation link. The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time via the unsubscribe link in every newsletter email.

We use the service Brevo SAS, 8 rue de Londres, 75009 Paris, France, to send our newsletters. We have concluded a DPA with Brevo under Art. 28 GDPR. Brevo is based in the EU; to our knowledge, no transfer to third countries takes place.

13. LYF: User Account and App Usage

13.1 User Account

When you book the LYF Accelerator, LYF Membership, or LYF Plus, we create a user account for you. We process your name, email address, the offering booked, and, if you provide it, your mobile number. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

13.2 Completion Status and Journal

In the app, you record each day whether you completed the four non-negotiables (done/not done). We can see this status for all offerings. We use it

  • for anonymous statistics on the use and improvement of the app,
  • in the Accelerator and in Plus, to reach out to you if you have not logged anything for a while,
  • in the Membership, to send you a WhatsApp reminder after a longer period of inactivity, if you have provided your mobile number.

We cannot see the content of your journal. It is only transmitted if you actively release a specific entry.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and, for statistics and Membership reminders, Art. 6(1)(f) GDPR (legitimate interest in a functioning, improving app and in supporting participants in using it). You can object to reminders at any time, e.g., with a short message.

13.3 AI-Assisted Feedback (Claude via OpenRouter)

If you release a journal entry for AI feedback, its content is sent to the Claude language model (Anthropic), which we access through OpenRouter, Inc., USA. OpenRouter forwards the request to Anthropic and returns the response. The data is not used to train AI models.

We have concluded a data processing agreement with OpenRouter under Art. 28 GDPR. Data transfers to the USA are based on EU Standard Contractual Clauses (Art. 46 GDPR) or, where applicable, the EU-US Data Privacy Framework (see Section 6).

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by releasing the individual entry. If an entry contains information about your health or other special categories of personal data, your consent expressly covers this as well (Art. 9(2)(a) GDPR). Do not release such entries if you do not want this. You can withdraw consent for future entries at any time by not releasing them.

13.4 Push Notifications

We send push notifications for the daily prompt at 9:00 a.m. For this, we use Apple Push Notification Service (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) on iOS and Firebase Cloud Messaging (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, potentially involving Google LLC, USA) on Android. A device-specific identifier (push token) is processed. The legal basis is Art. 6(1)(b) GDPR. Any transfer to the USA is based on the EU-US Data Privacy Framework (see Section 6). You can turn off push notifications at any time in your device settings.

13.5 Confidentiality and Support Access

We treat all personal information from our work together as confidential (Sections A5 and C8 of our Terms). For support and troubleshooting, we may temporarily access your user account. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in functioning support).

13.6 Retention Period

Your data is stored for the duration of your agreement. If you book Membership or Plus after the Accelerator, it is retained. 30 days after your last agreement ends, we delete app access and stored data, unless statutory retention obligations apply.

14. LYF: Health-Related Information

We do not ask for information about your health. If you share such information with us on your own initiative (e.g., in the individual call, in a group call, or via WhatsApp), it constitutes a special category of personal data (Art. 9 GDPR). We use it only as far as necessary to respond to it, e.g., to assess whether LYF is right for you. The legal basis is your express consent (Art. 9(2)(a) GDPR), which you give by voluntarily sharing it. We do not pass the information on and delete written messages once they are no longer needed, at the latest at the end of the period in Section 13.6. You may withdraw your consent at any time with effect for the future. For AI feedback, see Section 13.3.

15. LYF: Waitlists

For offerings that cannot be booked yet or that have a fixed start date (e.g., the LYF Accelerator), you can join a waitlist without obligation. We process your name, email address, and, if provided, your message (e.g., which offering you are interested in) in a dedicated database hosted at Hetzner (see Section 4).

The purpose is to notify you once registration opens. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request). Joining a waitlist does not entitle you to a spot.

Your data is deleted once you have booked, when you unsubscribe, or at the latest 12 months after the last notification if you have not responded to it.

16. LYF: Appointment Scheduling

To book a free introductory call for any offering, and the individual call in the LYF Accelerator, we use the following services:

Google Calendar

Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. We process your name, email address, and, where provided, phone number to schedule the appointment. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in efficient appointment management). Data is deleted after the appointment takes place. We have concluded a DPA with Google under Art. 28 GDPR; data transfers to the USA take place under the EU-US Data Privacy Framework (see Section 5).

Fantastical

Flexibits, Inc., 223 Wall Street #238, Huntington, NY 11743, USA.

We process your name, email address, and, where provided, phone number to schedule the appointment. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in efficient appointment management). Data is deleted after the appointment takes place.

We have concluded a DPA with Flexibits under Art. 28 GDPR; data transfers to the USA take place on the basis of EU Standard Contractual Clauses.

17. Video Calls (Zoom, Google Meet)

We hold individual calls, group calls, introductory calls, and remote workshops via Zoom (Zoom Communications, Inc., 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA) or Google Meet (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). We process your name or display name, email address, video and audio data, in-call chat messages, and technical data (e.g., IP address, device data). In group calls, other participants can see and hear you if you turn on your camera and microphone.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures). We have concluded data processing agreements with Zoom and Google under Art. 28 GDPR; transfers to the USA are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses (see Section 6). Group calls are not recorded.

18. Communication via WhatsApp

In the LYF Accelerator and LYF Plus, you can message us via WhatsApp, and we reach out to you there, e.g., after a longer period of inactivity. In the Membership, we use WhatsApp only for reminders if you have provided your mobile number (see Section 13.2). Providing your mobile number is voluntary.

The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a company of Meta Platforms, Inc., USA. Message content is end-to-end encrypted. However, WhatsApp processes metadata (e.g., phone number, time, device data) under its own responsibility and possibly in the USA; such transfers are based on the EU-US Data Privacy Framework. More information: https://www.whatsapp.com/legal/privacy-policy-eea

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or, for Membership reminders, Art. 6(1)(f) GDPR (see Section 13.2). If you prefer not to use WhatsApp, you can reach us by email at any time. We delete chat histories at the latest at the end of the period in Section 13.6.

19. Recording of Individual Sessions (LYF)

We record individual sessions (the call before Day 1 in the Accelerator and separately booked individual sessions) only if you expressly consent beforehand. The purpose is to be able to refer back to the goals and focus areas agreed in the call during your program. The recording (video and audio) is stored locally on Daniel Hauck’s computer, is accessible only to Daniel Hauck, and is not shared with third parties.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time; the recording will then be deleted without delay. Otherwise, we delete it 30 days after your last LYF agreement ends.

20. Withdrawal and Cancellation via the Website

If you withdraw from or cancel an agreement using the “Withdraw from contract” button or the cancellation button on our website, we process your name, email address, details of the agreement concerned, and the date and time of your declaration. The purpose is processing and confirming receipt. The legal basis is Art. 6(1)(c) GDPR (legal obligation under Sections 312k and 356a BGB). We retain this data as evidence until the end of the standard three-year limitation period, counted from the end of the year of your declaration.

21. LYF: Payment Processing

For payment processing, we use the payment provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. We process the data required for payment processing (including name, payment data, transaction data). The legal basis is Art. 6(1)(b) GDPR (performance of a contract). We have concluded a DPA with Stripe under Art. 28 GDPR. Further information: https://stripe.com/privacy

22. AI Workshops: Inquiries, Proposals, Delivery

If you inquire about an AI workshop by email or via a free introductory call (e.g., the Agentic Engineering Workshop or the Agentic Everything Hackathon), we process the data you provide (company name and address, contact person’s name, email address, phone number) to prepare a proposal and carry out the engagement. For certificates of attendance, we process participants’ names. Communication takes place via the services described in Sections 11, 16, and 17.

During the workshop, participants work in the customer’s own systems. We do not receive our own access and do not store copies of code or data. We only see them when participants share their screen.

For internal documentation, proposals, and invoicing, we use:

Google Docs: Google Ireland Limited / Google LLC (see Section 11, same data processing agreement and transfer basis).

Notion: Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, USA. We have concluded a data processing agreement with Notion under Art. 28 GDPR; transfers to the USA are based on EU Standard Contractual Clauses.

Lexware Office: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany. We have concluded a data processing agreement with Haufe-Lexware under Art. 28 GDPR.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract); for data of participants who are not themselves a contracting party, Art. 6(1)(f) GDPR (legitimate interest in performing the agreement concluded with their employer). Data is deleted once it is no longer required, taking into account statutory retention obligations (in particular Section 147 AO and Section 257 HGB: up to 10 years).

23. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

  • Right of access under Art. 15 GDPR
  • Right to rectification under Art. 16 GDPR
  • Right to erasure under Art. 17 GDPR
  • Right to restriction of processing under Art. 18 GDPR
  • Right to data portability under Art. 20 GDPR
  • Right to object to processing under Art. 21 GDPR
  • Right to withdraw consent under Art. 7(3) GDPR
  • Right to lodge a complaint with a supervisory authority under Art. 77 GDPR

To exercise these rights, an informal message to the contact address given in Section 1 is sufficient.

Right to object: Where we process your data based on a balancing of interests (Art. 6(1)(f) GDPR), you may object to that processing for reasons arising from your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to assert, exercise, or defend legal claims.

24. Retention Period, Generally

Unless a more specific retention period is stated elsewhere in this policy, we store personal data only for as long as necessary for the relevant processing purpose, or for as long as statutory retention periods apply (in particular commercial- and tax-law retention obligations of up to 10 years, Sections 147 AO and 257 HGB).

Last updated: 10/2026

Analytics opt-out