Privacy Policy

This is an English translation for your convenience. The legally binding version is the German one at datenschutz.html.

1. Controller

Björn Windorf
Hardgraben 4
90579 Langenzenn, Germany
Email: info@bjoernwindorf.com

2. Hosting

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, acting as a processor. When you open a page, the server records access data: referrer, the page or file requested, browser type and version, operating system, device type, time of access and your IP address. According to IONOS, the IP address is stored in the log files in shortened, anonymised form and is used only for a rough location estimate.

The purpose is the technical delivery and security of the site and anonymised access statistics, on the basis of Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning and comprehensible service). IONOS stores this log data for a maximum of eight weeks and deletes it afterwards. It is not passed to third parties or to countries outside the EU.

3. No cookies, no external fonts, a simple click counter

This site sets no cookies of its own, embeds no analytics or tracking services from other providers, and loads no external fonts. Every asset is served from this server, including the course videos described in section 4.

Counting clicks on the order buttons. The order buttons on the home page do not lead straight to the order form. They first go to a page on this server (kauf.php), which forwards you to the Digistore24 order form at once. On the way, the server adds one to a daily total. It counts which button was pressed (video guide, song guide or bundle) and, if the link carries one, the campaign label described below. Nothing else is counted. Your IP address, your browser details, the time of the click and the page you came from are not stored with the totals. The page kauf.php itself stores none of this. It looks at your browser details only while it forwards you, and only to filter out automated requests from search engines and other bots and to respect the signals described below. Like every request, the forwarding is noted in the server log files with the details listed in section 2, including the page you came from.

Counting the click needs no script. The campaign label reaches the button only through the script described below. Without that script the click is still counted, just without a label. Nothing is stored on your device, no identifier is created, and you are not recognised on a later visit. The totals show how often each button was pressed on a given day. They do not show who pressed it. If your browser sends a Global Privacy Control or Do Not Track signal, your click is not counted. You are still forwarded to the order form.

The purpose is to find out whether visitors who come through my advertising go on to the order form, and which advertisement works. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in knowing whether my advertising and this page work). The daily totals are kept for twelve months. Older totals are deleted whenever a click is counted or I read the totals.

Campaign labels. If you reach this site through an advertisement or a post on social media, the link may carry a short label such as “pinterest”. A script on the home page reads that label from the web address and adds it to the order buttons. When you press one, the label goes with you to the order form through the forwarding described above, so that I can see which advertisement led to a sale. The label describes the advertisement, not you. Nothing is stored on your device, no profile is created, and you are not recognised on a later visit. Without the label everything works in exactly the same way. Digistore24 receives the label as soon as the order form opens, whether or not you order. If you do order, the label is linked to your order. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in knowing which advertising works).

4. Course videos

The course pages contain videos that are served entirely from this server. No video platform and no other third party is involved. Playing a video transmits no data to Google, YouTube or any other provider.

The videos do not load automatically. Opening a course page transfers only a still image. The video file is fetched from the server when you press play. That produces exactly what any other request to this website produces: the access is noted in the server log files, as described in section 2. Nothing is stored on your device.

Until 6 October 2026 these videos were hosted on YouTube and loaded only after you clicked a preview panel. That embedding has been removed entirely, so no consent is required any more.

5. Orders and payment

The products are sold through Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany. Clicking an order button takes you off this website and onto Digistore24's checkout.

Everything you enter there (name, email address, billing address and payment details) is collected and processed by Digistore24 as an independent controller. As the vendor I receive only what is needed to deliver and support the product, normally name and email address. I process those details to deliver and support your purchase on the basis of Art. 6(1)(b) GDPR and delete them once they are no longer needed; statutory retention periods under German tax law (§ 147 AO) remain unaffected. Digistore24's own policy: digistore24.com/page/privacy

Thank-you page. After buying the Video Guide or the Song Guide, Digistore24 sends you back to a thank-you page on this website and adds your order details to its web address: order number, product, your name, your email address and a digital signature. The page uses only the order number and the product. It checks the signature to confirm the order is genuine, and it offers you the other guide at a reduced price for 15 minutes. So that this offer really ends after 15 minutes, even if you reload the page or open it on another device, the server stores a pseudonymised reference to your order number (a value derived from it with a secret key, not the number itself) together with the time you first opened the page. Nothing is stored on your device and no cookies are set. The reference is deleted after twelve months, and every visit to the page clears out references older than that. The reference sits on the web server of IONOS SE, my hosting provider, who processes it on my behalf (section 2). Like every page request, the full web address appears in the server log files (section 2). The legal basis is Art. 6(1)(b) GDPR (your purchase) and Art. 6(1)(f) GDPR (legitimate interest in a time-limited offer that actually ends on time).

6. Contact form and email

You can write to me on the contact page. I process what you enter there: your name, your email address and the text of your message.

These details are not stored on the server and go into no database. The form sends them straight to my mailbox as an email and discards them afterwards. To keep automated submissions out, the form contains a field invisible to humans and checks how much time passed between opening and sending; no additional data about you is collected and no cookies are set.

The legal basis is Art. 6(1)(b) GDPR where your message concerns a contract or steps prior to one, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). I delete your message once it is dealt with and no statutory retention period applies. The same holds if you email me directly.

Emails about the products. Every email I send about the guides carries an unsubscribe link at the bottom. One click is enough and you will not receive another one. You can also write one line to info@bjoernwindorf.com and I will remove your address. No reason needed.

7. Facebook page

I run the Facebook page “Björn Windorf”. This section covers only that page on Facebook and the ads that appear under its name. This website itself contains no Meta technology: no pixel, no Like button, no embedded posts. It reports nothing back to Meta, and section 3 still applies in full.

Page statistics. When you view the page or its posts, follow it, like something, comment, share, click a button on the page or message me through Messenger, Meta logs this as an event. Meta says such events include the date and time, your country and city (estimated from your IP address or, if you are logged in, taken from your profile), your language, your age and gender group (only if you are logged in), the website you visited before, whether you use a computer or a mobile device, and for logged-in users the Facebook user ID. Meta also says it uses cookies to tell whether you are logged in. Meta sets these cookies on Facebook under its own Cookies Policy. This website does not. Meta uses these events to build aggregated statistics called Page Insights and makes them available to me.

What I can see. I see only these aggregated figures, not the individual events. Meta alone decides which events it logs. I cannot set or change them. Meta itself names one exception: if you have liked the page and set your Page likes to public, I may be able to match your profile picture to that like in the statistics.

Joint responsibility with Meta. For these statistics I am a joint controller together with Meta Platforms Ireland Limited (Art. 26 GDPR). The Court of Justice of the European Union has held that the operator of a Facebook page shares this responsibility (judgment of 5 June 2018, C-210/16). Meta and I have agreed on this in the Page Insights Controller Addendum. Under it, Meta assumes the responsibility for complying with the GDPR obligations for this data, unless the addendum says otherwise. This covers in particular informing you, dealing with requests to exercise your rights, notifying data breaches and keeping the processing secure. Only Meta can implement decisions about the processing of this data. Meta publishes the essence of the agreement in its Information about Page Insights data. This section follows Meta's GDPR documents. If you live outside the EU, Meta's Privacy Policy for your country may name a different Meta company.

Legal basis. For my part, the legal basis is Art. 6(1)(f) GDPR. My legitimate interest is to show my guides where many people already spend their time, to get in touch with people who are interested, and to see in aggregated figures how the page and its posts are received. The legal bases Meta relies on for its own processing are set out in Meta's Privacy Policy under “Legal basis information”.

Messages and comments. When you message the page or comment on one of my posts or ads, I see your name and profile picture as Facebook or Instagram shows them, and the content of your message or comment. I use this to reply to you. Comments are visible to everyone who can see the post or ad. I can reply to, hide or delete comments under my posts. I am responsible for how I use your message or comment. Under the addendum, Meta and I each remain independent controllers for any processing whose purposes and means we do not determine jointly. For my part, the legal basis is Art. 6(1)(b) GDPR where your message concerns a purchase or a question before you buy, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). If we continue by email, section 6 applies. How long Meta keeps messages and comments is set out in Meta's Privacy Policy.

Ads. Ads that I run through Meta under this page's name appear on Facebook and Instagram. I set the countries and an age range, both as fixed settings and not merely as suggestions. I do not select interests, behaviours or life events, and I use no custom or lookalike audiences. Within these settings, Meta decides who sees an ad, under its own Privacy Policy. I do not upload customer lists or email addresses to Meta, and I give Meta no data about you from this website or from your order. I have not set up a Meta pixel or any other connection to Meta in the Digistore24 order form either. For the ads, Meta gives me reports on how many and what kinds of people saw or interacted with an ad, for example by general demographics and interests, and on when and where it was shown. Meta states that it does not share information with advertisers that on its own could be used to identify or contact you, unless you consent. Clicking an ad brings you to this website, where sections 2 and 3 apply. If Meta adds its own identifier to the link, this website does not evaluate it or pass it on. Like any web address, it only appears in the server log files (section 2).

Transfers to the USA. Meta's Privacy Policy states that Meta also processes data outside the EU, including in the USA. For transfers to Meta Platforms, Inc. in the USA, the policy names the EU-U.S. Data Privacy Framework and the European Commission's adequacy decision for it, as far as the products and services named in Meta's certification are concerned. In other cases it names standard contractual clauses approved by the European Commission, or exceptions provided for by law.

Contacts. You can reach me as set out in section 1. Meta's Privacy Policy gives Meta's postal address as Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. You can contact the data protection officer of Meta Platforms Ireland through the form linked in the section of Meta's Privacy Policy on how to contact Meta. The lead supervisory authority for the page statistics is the Irish Data Protection Commission (www.dataprotection.ie).

Your rights towards Meta and me. You can exercise your rights under section 8 against Meta and against me (Art. 26(3) GDPR). For the page statistics it makes sense to go to Meta directly, because I have no access to the data behind them. Meta explains how in its Information about Page Insights data and in your Facebook settings. If you write to me, I will forward your request to Meta without delay and help to answer it. For messages and comments, which I process myself, please write to me. Your right to lodge a complaint under section 8 remains unaffected.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Consent can be withdrawn at any time with future effect.

You also have the right to lodge a complaint with the data protection supervisory authority responsible for your place of residence or for my place of business.

9. Version

Last updated: 6 November 2026