Privacy notice

This is a translation for your convenience. The German version is legally binding.

1. Controller and scope

Nicole Bader, midwife
Lechstr. 16, 72768 Reutlingen, Germany
Phone: 0151 55916564
Email: hebamme.nicole.bader@outlook.de

This notice describes the processing of personal data on www.nicolebaderhebamme.com and when you contact me through the channels offered there.

2. Public content pages

The public content pages contain no embedded tracking or analytics tools and the website code itself sets no cookies. Fonts are served with the website; no external font service is embedded. Your browser calculates the position of the sun and moon using your device’s clock, without querying an external service for this purpose. Hosting-related processing described below still takes place. Additional information about the administration area appears in section 8.

3. Cloudflare hosting

The website is provided through Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. On a page request, Cloudflare processes information including your IP address, technical request and browser details, and the time of access. This serves the delivery, stability and security of the website; the legal basis is Art. 6(1)(f) GDPR.

Cloudflare processes data through its international network, including outside the EU. According to its privacy information, Cloudflare relies on the EU-US Data Privacy Framework for transfers from the EU to the United States and standard contractual clauses for other international transfers. Information about these safeguards and service providers is available in Cloudflare’s privacy policy.

Retention of technical data depends on its purpose, including service provision, investigating security incidents and legal obligations. Cloudflare describes these criteria in the “Data retention” section of its privacy policy. There is no blanket promise to delete all hosting data after ten minutes.

Cloudflare publishes its processing terms in its Data Processing Addendum. Section 6.1 of the Self-Serve Subscription Agreement incorporates this addendum for the personal-data processing described there. The subprocessor list identifies service providers and processing locations. This does not mean that storage takes place exclusively in Germany or Europe.

4. Contact and review forms

The contact form collects your name, email address and message, and optionally your phone number, location, due date or child’s birthday, and callback preference. I process these details to answer your enquiry and, where applicable, prepare care (Art. 6(1)(b) GDPR). Even an enquiry to a midwife may contain health data. You give explicit consent to processing such data through the checkbox (Art. 9(2)(a) together with Art. 6(1)(a) GDPR). Please provide only what is needed for initial contact; we discuss detailed health information in person.

The review form collects your preferred display name, review text, star rating and optionally an email address for questions. Processing and subsequent publication are based on your consent (Art. 6(1)(a) GDPR), additionally Art. 9(2)(a) GDPR for health data. Submission does not automatically publish the review. The email address is not published. Further information about published reviews appears in section 7.

On submission, the information is sent to a Cloudflare Pages Function for validation and forwarding. The function sends the message through Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) to my Outlook email inbox. Resend processes the message, including the submitted form data, and technical delivery information. Microsoft, as the receiving mailbox provider, also processes the delivered email. The form function does not create a separate message or review database.

Resend stores customer data in the United States. Choosing a European sending region does not change the storage location. Its Data Processing Addendum describes processing terms and international transfers. It includes standard contractual clauses; Resend also identifies the EU-US Data Privacy Framework. Information about service providers appears in its subprocessor list.

Resend states that email and log data are retained for 30 days on its Free, Pro and Scale plans; Enterprise retention depends on the applicable agreement. It states a separate seven-day retention period for backups. Retention of a delivered message in my mailbox is separate and depends on the purpose of handling the enquiry and legal obligations, as described in section 5. See Resend’s GDPR information for its processing and retention details.

You may withdraw consent at any time with effect for the future using the contact details above. Without the required information and consent, the respective form cannot send your message. You may use the direct contact options instead. If sending fails, your entries initially remain in the open form so you can correct them or send them yourself through another contact channel.

5. Direct contact

When you contact me by phone, email or WhatsApp, I process your contact details and message to respond to your enquiry and, where applicable, prepare care (Art. 6(1)(b) GDPR). Other enquiries are handled on the basis of my legitimate interest in responding (Art. 6(1)(f) GDPR). Health data is subject to additional requirements under Art. 9 GDPR. Please do not send detailed health information through general contact channels; we discuss medical details in person and as part of the appropriate care arrangements.

The Outlook email address shown uses a Microsoft service. Email contents and technical delivery information are also processed by the email provider. Information about Microsoft’s processing is available in its privacy statement.

The WhatsApp buttons are links. Clicking opens WhatsApp, after which the service provider also processes data under its own privacy terms. The provider for users in the European Economic Area is WhatsApp Ireland Limited. See the WhatsApp privacy policy. You can also reach me by phone or email.

Contact information is retained only as long as needed to handle the enquiry, provide subsequent care or meet statutory retention obligations. Treatment documentation and initial contact enquiries may be subject to different retention requirements.

6. MidiAid and Google

“Check availability” is a simple link to my MidiAid profile. Google links lead to my business profile or Google’s review function. These services are not embedded as automatically loading maps or availability displays on the public content pages. A connection to a linked service starts only when you open its link. Its own privacy information then also applies.

7. Published reviews

Reviews on the website contain the approved display name, text and star rating. Reuse and publication are based on the person’s consent (Art. 6(1)(a) GDPR); where health data is disclosed, explicit consent under Art. 9(2)(a) GDPR is required. A review being publicly visible on Google does not by itself replace this consent.

Published content is processed in the website repository on GitHub and in Cloudflare deployments. Earlier content may remain in version history and older deployments. A withdrawal or erasure request must therefore address these stored versions as well as the visible page. Please use the contact address above for this purpose. Indefinite publication after a valid withdrawal is not intended. Evidence of consent may be retained where necessary to comply with legal obligations or defend legal claims.

Information about GitHub and its international processing is available in the GitHub privacy statement.

GitHub describes processing in the United States and other countries where it or its service providers operate. For international transfers, GitHub identifies safeguards including standard contractual clauses and the EU-US Data Privacy Framework. Its published processing terms appear in the GitHub Data Protection Agreement, and providers appear in the subprocessor list. The Data Protection Agreement forms part of the applicable GitHub Customer Agreement; this notice does not promise processing exclusively within Europe.

8. Administration area

The /admin/ area is intended only for authorised website editing. It uses Sveltia CMS and GitHub sign-in. Unlike simply visiting the content pages, this may store authentication information in browser storage and connect to GitHub and external providers of CMS files and fonts. The purpose is authentication, access control and website maintenance (Art. 6(1)(f) GDPR). Sign-in should be used only on a trusted device and ended after editing.

9. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing before withdrawal. Please use the contact details above.

You may also complain to a data protection supervisory authority, particularly the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

10. Changes

This notice will be adapted to the actual processing when the website or its services change.