top of page

Privacy Policy

1. General Information

This Privacy Policy explains how the personal data of visitors to www.dr-apak.com is collected, processed and stored.

Data processing activities comply with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

​

2. Data Controller

The person responsible for processing your personal data is:

Dr. Meral Apak

Email: info@dr-apak.com

Address: Cunostr. 58A, 14193 Berlin, Germany

​

3. Personal Data Collected and Its Purposes

The following types of data may be collected through this website:

  • Contact details: first name, surname, email address and telephone number. Purpose: communicating with you and processing appointment enquiries.

  • Your postal address is used for invoicing services.

  • Payment information: Fees for services may be paid in cash, by bank transfer or via PayPal. This website does not accept online payments. I process the payment information needed to match payments to the relevant service and invoice and to fulfil accounting obligations. Depending on the payment method, this may include your name, the payment amount and date, the payment reference, the invoice or transaction number, and any bank account or PayPal account details made available to me in connection with the transaction. Processing is based on Article 6(1)(b) GDPR insofar as it is necessary to perform the contract, and on Article 6(1)(c) GDPR to comply with statutory record-keeping and retention obligations. Please do not include health information or details of your sessions in the payment reference.

  • Usage data and cookies: IP address, browser type and date of access. Purpose: improving website functionality, maintaining security and improving the user experience.

​

4. Legal Bases

Data processing is based on:

  • Article 6(1)(a) GDPR: consent.

  • Article 6(1)(b) GDPR: entering into and performing a contract.

  • Article 6(1)(c) GDPR: compliance with legal obligations.

  • Article 6(1)(f) GDPR: legitimate interests, such as website security and spam prevention.

​

5. Sharing with Third Parties

Personal data is shared with third parties only in the following circumstances:

  • Banks and PayPal: When payment is made by bank transfer or via PayPal, the banks involved or PayPal process the personal data necessary to carry out the transaction. Their privacy notices explain the processing activities for which they are independently responsible. PayPal’s service provider in the European Union is PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Further information: PayPal Privacy Statement.

  • With competent authorities where required by law or a judicial request.

​

6. Cookies

This website uses cookies to improve the user experience.

You can block or delete cookies through your browser settings. Doing so may limit some website functions.

​

7. Retention Periods

Data is retained only for as long as required for the purposes for which it is processed.

To meet commercial and tax obligations, invoice and transaction data may be retained for the statutory period of 6–10 years.

​

8. Your Rights

You have the right to:

  • Request access to your personal data.

  • Request correction of inaccurate data.

  • Request deletion of data or restriction of processing.

  • Request data portability.

  • Withdraw consent previously given.

  • Lodge a complaint with a supervisory authority, such as the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

​

9. Security Measures

Technical and organisational security measures are in place to protect personal data against unauthorised access and misuse.

​

10. External Links

This website may contain links to third-party websites. Their privacy policies are not covered by this policy.

​

11. Hosting

This website is hosted by Wix.com Ltd., Tel Aviv, Israel. Wix processes technical data, such as IP addresses and access data, on my behalf. A data processing agreement is in place with Wix, and Israel is covered by an adequacy decision of the European Commission. The legal basis is Article 6(1)(f) GDPR.

​

12. Contact Form

When you send an enquiry through the contact form, your details—name, email address, optional telephone number and message—are stored so that I can respond. The legal basis is Article 6(1)(b) GDPR. If you provide health data, processing is based on your explicit consent under Article 9(2)(a) GDPR.

The data is processed on the servers of my website provider, Wix.com Ltd. (see Hosting). I delete your information once your enquiry has been resolved, unless statutory retention obligations require otherwise. You may withdraw your consent at any time with effect for the future.

​

13. Contact via WhatsApp

You can contact me through WhatsApp. The service provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

When you write through WhatsApp, WhatsApp processes your telephone number, messages and metadata. Message content is end-to-end encrypted; metadata may also be processed in the United States. The parent company, Meta Platforms, Inc., is certified under the EU–US Data Privacy Framework.

Use of WhatsApp is optional. The legal basis is Article 6(1)(b) GDPR. Please do not share health information through WhatsApp; use the contact form or discuss it in person instead.

WhatsApp privacy information: https://www.whatsapp.com/legal/privacy-policy-eea

​

14. Online Sessions (Zoom)

I hold online sessions via Zoom. The service provider is Zoom Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA.

According to Zoom’s privacy statement, when you join a session Zoom processes participant information such as your display name and, if provided, your email address, device information such as your IP address, and usage information such as the times you join and leave. Audio and video are transmitted via Zoom during the session.

Data may also be processed in the United States. Zoom is listed as an active participant in the EU–U.S. Data Privacy Framework.

Ordinary therapy sessions are not audio- or video-recorded.

The legal basis for using Zoom is Article 6(1)(b) GDPR, as Zoom is needed to hold the online session you have chosen. If you prefer not to use Zoom, in-person sessions in Berlin are available.

Zoom privacy information: https://www.zoom.com/en/trust/privacy/privacy-statement/

​

15. Changes

This Privacy Policy may be updated from time to time. Changes take effect when published on the website.

bottom of page