Legal
PRIVACY POLICY
Effective date: 29 October 2026
1. Controller
SHEFORMS GmbH Katharinenstr. 14 10711 Berlin Germany
Email: hello@sheforms.de
2. General Information
We process personal data of our users only to the extent necessary to provide a functional website and our content and services. Processing is carried out in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Our content and programmes are also offered internationally via our English-language website, including to users in the United Kingdom and the United States. As SHEFORMS is established in Germany, we process the personal data of all users, regardless of their country of residence, in accordance with the GDPR as a uniform standard of protection. Where additional national data protection rules apply to users outside the EU (e.g. the UK GDPR), these remain unaffected.
As our services are also offered to users in Switzerland, the Swiss Federal Act on Data Protection (FADP, in effect since 1 September 2023) applies in addition where relevant. Where the FADP applies, the information provided below also serves as the privacy notice under the FADP. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern, https://www.edoeb.admin.ch.
3. Hosting
Our website is provided for us by Braunsberger Media Digital, Ubjergvej 14, 6270 Tønder, Denmark. Technically, it runs on the Lovable platform of Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA (European entity: Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden). Lovable uses further service providers for servers and storage.
In the process, access data is processed (e.g., IP address, date and time of access, data volume transferred, referring URL), see Section 4. The videos that play directly on our website (e.g., the videos at the top of our pages) are delivered the same way.
As Lovable is headquartered in the USA, a transfer of data to the USA cannot be ruled out. Such transfers are based on EU Standard Contractual Clauses.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and efficient website provision).
4. Access Data and Server Log Files
Each time our website is accessed, the following data is automatically collected:
• IP address of the requesting device
• Date and time of access
• Name and URL of the page accessed
• Data volume transferred
• Browser type and version
• Operating system
• Referring URL
This data is used exclusively to ensure trouble-free operation and to improve our website. It is not attributed to individual persons.
Legal basis: Art. 6(1)(f) GDPR. Retention period: Log files are deleted as soon as they are no longer required for these purposes.
5. Contact
When you contact us by email or contact form, the data you provide (name, email address, message content) is stored to process your inquiry.
Our contact form is provided via HighLevel (LeadConnector) (for the provider and data transfer to the USA, see Section 8). The information you enter is stored there and accessed by us to answer your inquiry. The form is only loaded once you actively request it or have consented to marketing cookies (for details, see Section 8). Alternatively, you can always reach us by email at hello@sheforms.de.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in processing inquiries). Retention period: Until the inquiry is fully resolved, then deleted unless statutory retention obligations apply.
6. Customer Account and Contract Performance
When purchasing a Program, we process:
• Name, email address
• Purchase date, Program purchased
• Login credentials for the members platform
• Payment information (processed by the payment provider, not stored by us)
Our order pages and our members platform (members.fit-with-sally.com) are operated via HighLevel (LeadConnector) (for the provider and data transfer to the USA, see Section 8).
Legal basis: Art. 6(1)(b) GDPR (contract performance). Retention period: For the duration of the contractual relationship and beyond in accordance with statutory retention periods (commercial and tax law: up to 10 years).
7. Payment Processing
Payment is processed by:
Stripe Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland Privacy policy: https://stripe.com/privacy
PayPal PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg Privacy policy: https://www.paypal.com/webapps/mpp/ua/privacy-full
SHEFORMS does not receive complete payment data (e.g., credit card numbers). This data remains exclusively with the payment provider.
Legal basis: Art. 6(1)(b) GDPR (contract performance).
8. Email Marketing / Newsletter
If you subscribe to our newsletter, we process your email address and, if provided, your first name to send you information about our Programs, content, and offers.
Subscription uses the double opt-in procedure: after signing up, you receive an email with a confirmation link, and you are only added to our list once you confirm. We log subscription and unsubscription events as proof of consent.
Emails are sent via:
HighLevel (LeadConnector) HighLevel Inc., 400 North Saint Paul St., Suite 920, Dallas, TX 75201, USA Privacy policy: https://www.gohighlevel.com/privacy-policy
This provider is based in the USA. Data transfer is based on the EU-US Data Privacy Framework, under which the provider is certified; EU Standard Contractual Clauses apply in addition.
Loading of forms: Our sign-up and contact forms are loaded directly from HighLevel’s servers. In the process, HighLevel stores information in your browser (local storage) to recognise form views and sessions, loads fonts from Google (Google Ireland Limited) and uses the Turnstile service of Cloudflare, Inc., USA, to protect against spam. Your IP address is transmitted to these providers. We therefore only load the forms if you have consented to marketing cookies via our cookie banner or request a form yourself by clicking the button shown in its place (“Sign Up Now” or “Open Contact Form”). The sign-up window that opens after a short time on some pages only appears with your consent to marketing cookies.
Legal basis for loading the forms: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (consent).
Legal basis: Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time, e.g., via the unsubscribe link in each email or by contacting hello@sheforms.de.
9. Consent Management: Cookiebot
To manage your consent, we use Cookiebot by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark.
When you access our website, a connection is established to Cookiebot’s servers in order to display the cookie banner and store your choice. In the process, your IP address (in shortened form), the date and time of your consent, your choice, browser information and the URL accessed are processed. Your choice is stored in a cookie named “CookieConsent” in your browser so that we do not have to ask you again on every page. This cookie is deleted after 12 months unless you delete it yourself beforehand. The data is processed within the EU.
Cookiebot privacy policy: https://www.cookiebot.com/en/privacy-policy/
Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to demonstrate your consent) and § 25(2) no. 2 TDDDG.
10. Cookies and Similar Technologies
Cookies are small text files stored in your browser. Your browser’s local storage works in a similar way. We distinguish between the following categories:
a) Necessary Cookies
These cookies are required to operate the website, e.g., to store your cookie choice or your language preference. They cannot be deselected.
Legal basis: § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.
b) Preference, Statistics and Marketing Cookies
These cookies, as well as external content that uses such technologies (e.g., our forms, see Section 8, and our Google reviews, see Section 11), are only loaded once you have consented.
Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
Changing or withdrawing your consent: You can change or withdraw your choice at any time with effect for the future, via the “Cookie Settings” link in the footer of every page or directly in the overview below. There you will also find all cookies used, with provider, purpose and retention period.
11. Embedded Content
a) Videos (Vimeo)
We embed videos from Vimeo (Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA). The videos are only loaded once you have consented to marketing cookies in our cookie banner or request a single video yourself by clicking its play button or the “Play Video” button. Only then does your browser connect to Vimeo’s servers, transmitting your IP address among other data. Data may be transferred to the USA; transfer is based on EU Standard Contractual Clauses.
Vimeo privacy policy: https://vimeo.com/privacy
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (consent via our cookie banner).
b) Google Reviews (Elfsight)
On our Reviews page, we display reviews from our Google Business Profile. For this purpose, we use a widget by Elfsight, SL, C. de la Constitució 17, AD700 Escaldes-Engordany, Andorra. The widget is only loaded once you have consented to statistics or marketing cookies in our cookie banner. Your browser then connects to Elfsight’s servers, transmitting, among other data, your IP address, operating system and browser type; according to Elfsight, this data is stored for 7 days. Elfsight sets the cookie “elfsight_viewed_recently” to count views. Profile pictures of reviewers are loaded from Google’s servers in the process. The European Commission has issued an adequacy decision for Andorra.
Elfsight privacy policy: https://elfsight.com/privacy-policy/
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (consent via our cookie banner).
12. WhatsApp Community
Participation in our WhatsApp community is voluntary. When joining, your phone number and WhatsApp profile name are processed. WhatsApp is operated by Meta Platforms Ireland Limited.
Legal basis: Art. 6(1)(a) GDPR (consent). WhatsApp privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea
13. Your Rights
Under the GDPR, you have the following rights:
• Access (Art. 15 GDPR): You may request information about your stored data.
• Rectification (Art. 16 GDPR): You may request the correction of inaccurate data.
• Erasure (Art. 17 GDPR): You may request the deletion of your data, provided no statutory retention obligations apply.
• Restriction of processing (Art. 18 GDPR): You may request the restriction of processing of your data.
• Data portability (Art. 20 GDPR): You may request your data in a structured, commonly used format.
• Objection (Art. 21 GDPR): You may object to the processing of your data based on Art. 6(1)(f) GDPR at any time.
• Withdrawal of consent (Art. 7(3) GDPR): You may withdraw consent at any time with effect for the future.
To exercise your rights, please contact: hello@sheforms.de.
14. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for SHEFORMS is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI) Alt-Moabit 59-61, 10555 Berlin, Germany https://www.datenschutz-berlin.de
Irrespective of this, you may also contact the supervisory authority in your country of residence. For users in Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde, DSB), Barichgasse 40-42, 1030 Vienna, https://www.dsb.gv.at.
For users in the United Kingdom, the competent authority is the Information Commissioner’s Office (ICO): https://ico.org.uk.
For users in Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC): https://www.edoeb.admin.ch.
15. Updates to This Privacy Policy
This Privacy Policy is currently valid as of 29 October 2026.
Due to further development of our website or changes in legal requirements, updates may become necessary. The current version of this Privacy Policy can be accessed on this page at any time.