Privacy Policy

Controller

Controller within the meaning of Art. 4(7) GDPR is:

Entwicklerherz GmbH
Poststraße 2–4
60329 Frankfurt am Main
Germany

E-mail: kontakt@entwicklerherz.de

Commercial register: Amtsgericht Frankfurt am Main, HRB 105176
VAT ID: DE349606977

Purpose and scope

This privacy policy applies to the SchemaCommunity platform (web app), including all subpages, features and related communication channels.

SchemaCommunity is an invitation-based, closed community for schema therapists and trainees. The platform is not intended for patients or non-professionals.

Important notes (anonymisation)

SchemaCommunity is designed for anonymised professional exchange.

Please do not share identifiable patient data or other personal data of third parties in the forum, intervision listings or messages if this could enable identification of individuals.

If users nevertheless upload sensitive content, this may lead to the processing of special categories of personal data (Art. 9 GDPR). Such content is prohibited in the community; we may remove or hide it as part of moderation once we become aware of it.

Data processed (categories)

Depending on how you use SchemaCommunity, we process in particular:

• Account and authentication data: e-mail address, password (stored only as a hash), optional display name, account status.
• Security data: login timestamps, failed login attempts, temporary lockouts after too many failed attempts.
• Session/access data: session token stored in a signed, HTTP-only cookie.
• Profile and directory data: first/last name, country, languages, certification status, professional information (e.g. workplace, website URL, interests, short bio), profile images, privacy/visibility settings.
• Content and metadata:
  • forum (threads, replies, categories, languages, tags, timestamps)
  • intervision listings (title, description, languages, meeting mode, time zone, optional location details)
  • events (title, time range, location type, language(s), organiser, description, registration link)
  • direct messages (1:1) including metadata and read status
  • network/connections (requests/status)
  • institutes and memberships (role/status)
• Reports and moderation data: reported content, reason, review status, moderation decision.
• Communication data: e-mails we send in relation to invitations, password resets or notifications.
• Technical access data (server/logs): e.g. IP address, date/time, requested URL, status codes, user agent, referrer (if transmitted).

Purposes and legal bases

We process personal data for the following purposes and legal bases:

• Provision of the platform and performance of the user relationship (registration, login, profile/directory, forum, intervision, events, messages, notifications).
  Legal basis: Art. 6(1)(b) GDPR.

• Security, stability and abuse prevention (e.g. defence against attacks, detection of unusual login activity, error analysis).
  Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and functionality).

• Moderation and enforcement of community rules (handling reports, hiding/removing content, protecting the community).
  Legal basis: Art. 6(1)(f) GDPR; where applicable Art. 6(1)(c) GDPR for legal obligations.

• Sending transactional e-mails (e.g. invitations, welcome e-mail, password reset, notifications about messages/reports depending on your settings).
  Legal basis: Art. 6(1)(b) GDPR and/or Art. 6(1)(f) GDPR.

Cookies, local storage and similar technologies

SchemaCommunity uses cookies and local browser storage for login, security, language settings and comfort features.

Details are provided in the separate Cookie Policy (document key cookies).

Recipients / service providers

We use technical service providers who may process personal data on our behalf.

In particular:

• Supabase: backend and database access (e.g. storage of account, profile and community data).
• Brevo: sending transactional e-mails (e.g. invitations, password reset, notifications).
• Google Maps (optional): if you enable the map view in the directory, the Google Maps JavaScript API is loaded from maps.googleapis.com. Technical data (e.g. IP address) is transmitted to Google.
• External content: depending on usage, external image resources may be loaded (e.g. images.unsplash.com, covers.openlibrary.org), which transmits technical access data to the respective providers.

International transfers

Depending on the service providers/external content used, data may be transferred to countries outside the EU/EEA. Where required, we rely on appropriate safeguards (e.g. EU Standard Contractual Clauses).

Retention periods

We generally store personal data only as long as necessary for the respective purposes.

• Account data is stored for the duration of the active account.
• Password reset tokens are time-limited; a reset link is valid only for a limited period.
• Content (forum/intervision/events) generally remains available as long as required for community functionality; upon deletion/deactivation we review deletion or anonymisation where technically feasible.
• Technical logs are generally stored only for short periods for IT security and error analysis.

Your rights

Subject to the legal requirements, you have the following rights:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection (Art. 21 GDPR), where processing is based on Art. 6(1)(f) GDPR
• withdrawal of consent (Art. 7(3) GDPR)

To exercise your rights, contact us at kontakt@entwicklerherz.de.

You also have the right to lodge a complaint with a supervisory authority. For us, the competent authority is generally the Hessian Commissioner for Data Protection and Freedom of Information.

Security

We implement technical and organisational measures to protect your data. This includes in particular:

• storing passwords only as hashes
• signed session tokens (HTTP-only cookie)
• security mechanisms against automated/repeated failed logins
• role-based access models for admin functions

Changes

We update this privacy policy if features, laws or processing activities change. The version date is shown at the top of this document.