Privacy policy

1. Controller

The controller responsible for data processing on this website is:

Marple Ocean Collective Pte. Ltd.
133 New Bridge Road, #10-03, Chinatown Point
Singapore 059413
Singapore

Represented by the directors Milea Gerdes and Anthony Fernandez Jr.
Email: support@mileagerdes.com
Phone: +971 58 599 7638

Our offer is aimed at people in the European Union, so the General Data Protection Regulation (GDPR, Art. 3(2)) applies to us. As a company in Singapore we also comply with the Personal Data Protection Act 2012.

EU representative (Art. 27 GDPR):
Mr Kian Nicolas Gerdes
Kaspersweg 39a
26131 Oldenburg
Germany
Email: compliance@kestro.de

We have appointed him as our representative in the European Union. You and the supervisory authorities can contact him with any question about the processing of personal data, in addition to us or instead of us.

2. The key points

• We use no analytics, tracking or advertising services on our own pages, with two exceptions. The Calendly calendar on the booking page only loads after you click, and then sets Calendly cookies, including for Calendly's own purposes (section 4). Orders run through ablefy; for cookies and tracking in the shop, ablefy's privacy policy applies (section 5).
• If German is not your browser's preferred language, we show you the English version. For this our host reads the language setting that your browser sends with every request; nothing is stored. If you switch the language yourself using “DE · EN”, we remember your choice in a cookie called “lang” (value “de” or “en”, valid for one year). Its only purpose is to show you the language you chose (Section 25(2) no. 2 TDDDG), and you can delete it in your browser at any time.
• We serve fonts, scripts, images and videos ourselves. While you read the site, your browser contacts no third-party servers.
• Other providers only come in when you load the calendar on the booking page (Calendly) or click a buy button (ablefy).
• You sign up for our newsletter with your email address and confirm the sign-up by email. You get our free PDFs (“Instagram Growth Guide”, “Steal my Strategy” and “The Hook Guide”) for free, and signing up for the newsletter is what you give in return. You can unsubscribe at any time (section 6).

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. On every request Vercel processes technically necessary connection data in server log files:

• IP address
• date and time of access
• requested page or file and amount of data transferred
• referrer URL, meaning the page you came from
• browser and operating system

Without this data the site cannot be delivered or protected against attacks. The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). Vercel processes the data on our behalf (Art. 28 GDPR) and deletes log data automatically after a short time.

The forms for the newsletter and the free PDFs, the confirmation of your sign-up, the download and unsubscribing run through a server function at Vercel. This function runs in the Frankfurt am Main region, Germany. Vercel processes your email address, your IP address and what you enter in the form on our behalf (Art. 28 GDPR). Section 6 explains what we store.

Vercel is certified under the EU-US Data Privacy Framework, so the European Commission's adequacy decision covers the transfer to the USA (Art. 45 GDPR). Standard contractual clauses apply in addition (Art. 46 GDPR).

4. Booking with Calendly

You book the free call through a calendar from Calendly LLC (USA) on our "Book a free call" page. The calendar only loads when you click "Load calendar" there. Until then, your browser does not connect to Calendly.

By clicking, you consent to the calendar being loaded. Your browser then connects to Calendly, and Calendly receives your IP address and details about your browser and device. Calendly also stores information on your device and reads it, for example in cookies. This serves the booking itself, but also Calendly's own purposes: inside the calendar, Calendly loads its own services, which our check found to include payment, analytics and marketing services (Stripe, Segment, Braze, Sprig and the Meta Pixel). Calendly may show its own cookie notice in the calendar, where you can allow or refuse Calendly's optional cookies.

The legal basis for loading the calendar and accessing your device is your consent (Section 25(1) TDDDG, German Telecommunications Digital Services Data Protection Act; Art. 6(1)(a) GDPR). We do not store your choice; on every visit the calendar only loads after a new click. You can withdraw your consent at any time with effect for the future: stop loading the calendar and delete Calendly's cookies in your browser. You can also arrange a call without Calendly by emailing support@mileagerdes.com.

When you book an appointment, Calendly also processes:

• your name and email address
• the time you choose and your time zone
• anything you add voluntarily in the booking form

We use this data only to prepare and hold the call. The legal basis for the booking is Art. 6(1)(b) GDPR, because you arrange a conversation with us at your request.

The roles are split as follows:

• Booking: Calendly processes your booking data on our behalf (Art. 28 GDPR).
• Loading the calendar: We and Calendly are joint controllers for collecting and transmitting your data when the embedded calendar loads (Art. 26 GDPR). You can exercise your rights for this with us and with Calendly.
• Calendly's own purposes: Calendly alone is responsible for what it and the services it loads then process for their own analytics, advertising and payment purposes. We have no control over this. Calendly's privacy policy describes what data this involves.

Calendly is certified under the EU-US Data Privacy Framework, so the European Commission's adequacy decision covers the transfer to the USA (Art. 45 GDPR). We delete booking data once we no longer need it for the call and any collaboration that follows. More on privacy at Calendly: calendly.com/privacy.

5. Purchase through ablefy

We sell the course, the e-book "the feminine body secrets" and 1:1 mentoring through the platform of ablefy GmbH, Potsdamer Straße 125, 10783 Berlin, Germany. ablefy sells them as a reseller: the seller and your contracting party is namotto Universal Brands GmbH & Co. KG, ablefy's merchant company (more on the withdrawal page). The buy buttons on this website, such as "Jetzt sichern" and "Get instant access", take you to our shop there. You do not enter any purchase or payment data on this website itself.

In the shop, ablefy and the payment services connected there collect the data needed for the order, payment, invoice and course access or download, such as name, email address, billing address and payment method. The seller is itself responsible for order, payment, invoicing and tax, not on our behalf. We receive what we need to give you the course, the e-book or the mentoring, such as name, email address and the product bought. We are responsible for this data. The legal bases are performance of the contract (Art. 6(1)(b) GDPR) and statutory retention duties (Art. 6(1)(c) GDPR).

The shop may use its own cookies and analytics or advertising services. We have no influence on this, and our own pages do not load these services. Details, including cookies and consent in the shop, are in the privacy policy in the shop.

If you reach our course landing page through a link with campaign parameters (parameters starting with "utm_", such as utm_source=instagram), we add these parameters to the links to the shop, the homepage and the booking page. This shows us which campaign led to an order. These parameters describe the campaign, not you as a person. We do not pass on identifiers of individual ad clicks, such as gclid, fbclid, msclkid or ttclid.

6. Newsletter

On the page for the e-book "the feminine body secrets" and on the pages for our free PDFs (“Instagram Growth Guide”, “Steal my Strategy” and “The Hook Guide”) you can sign up for our newsletter. In it, Milea Gerdes writes about Instagram and social media, mindset, nutrition and training and tells you about her courses, her mentoring and other offers.

You receive the free PDFs when you sign up for our newsletter. Signing up is what you give in return for the PDF. Without signing up, we cannot send you the PDF this way. You also choose the language of the PDF. If you are signing up for the first time, we send you a second email with the download link only once you have confirmed your sign-up. If you have already confirmed your sign-up and have not unsubscribed, we send you the download link for another PDF directly, without a new confirmation. In that case too we store the request together with the version of the consent text. If an address has already received a PDF, we do not send it again. We also store whether the email with the download link was delivered (as reported by our sending service) and when and how often you downloaded the PDF through the link. This shows us whether the delivery arrived. Providing the PDFs and the proof of delivery are based on the contract for the respective PDF (Art. 6(1)(b) GDPR). You may keep the PDFs after unsubscribing.

To sign up, you enter your email address and tick the newsletter box. We then send you an email with a confirmation link that is valid for seven days (double opt-in). Only when you confirm your sign-up on the linked page do we add you to the newsletter list. If you do not confirm, you receive no further emails from us, and we delete your details after 30 days at the latest.

We store your email address, the language and the page on which you signed up, the version of the consent text, and the date, time and IP address of your sign-up and your confirmation. This lets us prove that you gave your consent. You must be 16 or older to sign up.

We send you the newsletter based on your consent (Art. 6(1)(a) GDPR). The confirmation email and the logging of your consent are based on our duty to prove it (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR) and on our legitimate interest in being able to defend ourselves against claims of unlawful advertising (Art. 6(1)(f) GDPR).

You can withdraw your consent at any time with effect for the future: using the unsubscribe link or button at the end of every newsletter email, the unsubscribe function of your email program, or by emailing support@mileagerdes.com. When you unsubscribe, we remove your address from the mailing list straight away. We keep the record of your consent and your unsubscribing, locked, for three more years from the end of the year in which you unsubscribed and use it for nothing else, because claims and fine proceedings remain possible for that long (Section 195 BGB, Section 31(2) No. 1 OWiG). The legal bases for this are Art. 6(1)(c) and (f) GDPR. After that we delete it automatically.

We do not measure whether you open our emails or click links in them. Our emails contain no tracking pixels and no redirected links.

So that nobody can flood other people's inboxes, the server counts requests per IP address and per email address. For this it keeps your IP address, and your email address as a check value (hash) rather than in plain text, only in the working memory of the server instance handling the request. Requests count towards the limit for one hour. The values are deleted when the instance restarts at the latest and are never stored permanently. For the confirmation and unsubscribe links, the server counts only the IP address in the same way. The legal basis for this is our legitimate interest in secure sending (Art. 6(1)(f) GDPR).

We send the emails through the service of Resend, Inc. (USA). Resend receives your email address, the content of the emails and delivery logs and processes them on our behalf (Art. 28 GDPR) in the USA. Standard contractual clauses (Art. 46 GDPR) apply to the transfer. More: resend.com/legal/privacy-policy.

We store the newsletter list and the consent records in a database of Supabase Inc. (USA) on servers in Frankfurt am Main, Germany. Supabase processes the data on our behalf (Art. 28 GDPR). Standard contractual clauses (Art. 46 GDPR) cover any access from the USA.

7. Contact by email or phone

When you write to us or call us, we process your details and your message to answer your request. If it concerns a purchase or a collaboration, the legal basis is Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR). We delete the data once your request is dealt with and no retention duty applies.

Our mailbox support@mileagerdes.com is hosted by ALL-INKL.COM (Neue Medien Münnich, Friedersdorf, Germany). ALL-INKL.COM stores your emails and our replies on our behalf (Art. 28 GDPR).

8. Support via WhatsApp in the mentoring

In the mentoring you can also message us on WhatsApp with questions and to coordinate. This is optional. Anything you would sort out on WhatsApp, you can just as well send us by email to support@mileagerdes.com.

WhatsApp is a service of Meta Platforms Ireland Limited, Ireland. When you message us on WhatsApp, we process your phone number, your profile name and the content of your messages to deliver the mentoring. The legal basis is the mentoring contract (Art. 6(1)(b) GDPR). Meta receives metadata in the process, such as who writes to whom and when, and processes it as an independent controller under WhatsApp's terms of service and privacy policy. Meta also transfers data to the USA in doing so. If we add you to a WhatsApp group, the other members can see your phone number and profile name.

We delete the chats once we no longer need them for the mentoring and no retention duty applies.

9. Our Instagram profile

This website links to our Instagram profile. It is a plain link: your browser only connects to Instagram when you click it.

Instagram is a service of Meta Platforms Ireland Limited, Ireland. When you visit our profile, Meta processes your data under Instagram's privacy policy. From these visits Meta creates statistics that are available to us, as the operator of the profile, in aggregated form. We and Meta are joint controllers for these statistics (Art. 26 GDPR). Meta bears the primary responsibility for the processing. You can exercise your rights, such as access or erasure, most effectively with Meta directly. You can also contact us, and we will pass your request on to Meta.

If you message us on Instagram, we process your message to answer it (section 7 applies accordingly).

10. Recipients and transfers to third countries

Only the service providers named in this policy receive your data, and only as far as the purpose requires. We do not sell data.

Our company is based in Singapore. What you tell us directly, for example by email or through a booking, we also process there. There is no European Commission adequacy decision for Singapore, so we apply the GDPR's standards of protection to all data we receive from you. Milea Gerdes sometimes works from Indonesia and accesses this data from there, for example emails and bookings. The GDPR's standards of protection apply there too.

For Vercel and Calendly in the USA, the EU-US Data Privacy Framework applies; for Resend and Supabase, standard contractual clauses apply. The server function at Vercel runs in Frankfurt am Main, and so does the Supabase database. Our mailbox is hosted by ALL-INKL.COM, a provider in Germany. A technical service provider in Germany looks after the website and the sending of emails on our behalf (Art. 28 GDPR).

11. Retention

We keep personal data only as long as the purpose requires. Statutory retention duties, for example for invoices, take precedence. After that we delete the data or restrict its processing.

12. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR)
• have incorrect data corrected (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process data based on legitimate interests, you can object at any time on grounds relating to your particular situation.

An email to support@mileagerdes.com is enough for any of these.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work.

13. Security, required data, changes

The connection to this website is encrypted with TLS. You can tell by the "https" in the address bar.

You are not obliged to give us any data. Without a name and email address, though, we cannot schedule a call or set up course access, and without an email address we cannot send you the newsletter or the free PDFs. We do not use automated decision-making or profiling under Art. 22 GDPR.

We update this policy when the website or the law changes. The version published here applies.