This Privacy Policy explains how personal data is processed when you use the Plan Save Shine website and related online services.
1. Controller
The controller responsible for the processing of personal data on this website is:
Controller:
Plan Save Shine — Jade Boinot
Trading / public-facing name:
Plan Save Shine
Address:
Birkholzweg 45, 60433 Frankfurt am Main, Germany
Email:
contact@boinot-finances.com
Telephone:
+49 1575 6046732
2. General principles and legal bases
Personal data is processed only where a legal basis applies.
Depending on the purpose, the relevant legal basis may include:
- Article 6(1)(a) GDPR — consent;
- Article 6(1)(b) GDPR — processing necessary to perform a contract or take steps at your request before entering into a contract;
- Article 6(1)(c) GDPR — compliance with a legal obligation;
- Article 6(1)(f) GDPR — legitimate interests, provided those interests are not overridden by your rights and freedoms.
Where consent is used, it can be withdrawn at any time for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Where the website stores information on or accesses information from your device, the requirements of § 25 TDDDG also apply. Non-essential technologies generally require consent; technologies that are strictly necessary to provide a service expressly requested by the user may fall within the statutory exception.
3. Personal data obtained from other sources
If personal data is obtained from a source other than directly from you, the additional transparency requirements of Article 14 GDPR may apply.
Where another controller, such as a regulated product provider, supplies or receives data within a separate client relationship, its own privacy information may also apply.
4. Hosting and server logs
When you access the website, the hosting infrastructure may automatically process technical information required to deliver and secure the website.
This may include:
- IP address;
- date and time of access;
- requested URL / file;
- referrer URL;
- browser type and version;
- operating system;
- device information;
- HTTP status code;
- amount of data transferred;
- technical security information.
Purpose:
Delivery, stability, troubleshooting and security of the website.
Legal basis:
Article 6(1)(f) GDPR — legitimate interests in securely and reliably operating the website, where applicable.
5. Contact requests
If you contact Plan Save Shine through a contact form, email, telephone or another communication channel, the information you provide is processed to understand and respond to your request.
This can include:
- name;
- email address;
- telephone number, if provided;
- preferred language;
- city or region, if provided;
- selected topic;
- message content;
- metadata relating to the communication;
- additional information you voluntarily provide.
Please do not send passwords, login details, full account numbers, identity-document numbers or other unnecessary sensitive information in an initial contact message.
Purpose
- responding to general enquiries;
- assessing whether Plan Save Shine can assist with a financial request;
- taking pre-contractual steps at your request where applicable;
- routing a request to the appropriate contact or professional where appropriate.
Legal basis
For enquiries relating to a possible service or contractual relationship: Article 6(1)(b) GDPR, where applicable.
Retention
Information may be retained for longer where this is necessary to comply with legal obligations or establish, exercise or defend legal claims.
6. Financial-service enquiries and client data
A general website enquiry is not the same as entering into a regulated financial-advisory relationship.
If a financial-services relationship begins, additional personal data may be required to assess the client's situation and comply with professional, contractual or legal obligations.
Depending on the service, this may include financial, insurance, employment, pension, household or identification information.
Exact contracting entity for financial services:
Plan Save Shine — Jade Boinot.
The privacy information required for a regulated client relationship may be provided through additional documents where another controller or professional relationship becomes involved.
7. The Shine Club
The Shine Club is planned as a free community layer of Plan Save Shine.
If you register as a Shiner, the website may process personal data required to create, maintain and administer your access.
8. Shine Library and restricted resources
The public Shine Library may contain resources available without registration and resources reserved for Shiners.
Purpose:
Providing the requested resource and managing access.
9. Sunday Shine / newsletter
If Plan Save Shine operates Sunday Shine or another email newsletter, subscription should be separate from general contact or community consent.
Purpose:
Sending the newsletter and related communications you have requested.
Legal basis:
Article 6(1)(a) GDPR — consent.
Electronic direct marketing must also comply with § 7 UWG. In particular, advertising by electronic mail generally requires prior express consent unless the statutory existing-customer conditions are met.
Unsubscribing from marketing communications does not automatically delete data that must be retained for another lawful purpose.
10. Workshops and events
If you register for a Plan Save Shine workshop, webinar or event, personal data may be processed to administer the registration and event.
This may include:
- name;
- email address;
- registration status;
- language;
- event selected;
- payment information where applicable;
- information voluntarily provided with the registration.
Purpose:
Registration, event administration, delivery, participant communication and payment processing where applicable.
Photos, video or testimonials from an event must not be used for marketing merely because someone registered for the event. A separate legal basis must apply.
11. Payments
Where the website accepts payment for workshops, resources or services:
Data processed directly by payment provider:
Not applicable. Plan Save Shine offers no user accounts, no login and no online payment. The Shine Club is a free mailing list: joining requires an email address and nothing more.
Legal basis:
Article 6(1)(b) GDPR for payment processing necessary to perform a contract, and Article 6(1)(c) GDPR where processing is required for accounting or tax obligations.
Retention period for accounting records:
Not applicable. Plan Save Shine offers no user accounts, no login and no online payment. The Shine Club is a free mailing list: joining requires an email address and nothing more.
12. Analytics and audience measurement
The website uses Google Analytics 4, provided by Google Ireland Limited, to measure its audience: number of visits, pages viewed and how visitors navigate the website.
Legal basis:
Article 6(1)(a) GDPR and § 25(1) TDDDG — consent. Google Analytics is only activated after you accept it in the consent banner. Before that, or if you reject it, no request is sent to Google.
Settings:
IP anonymisation is enabled. Google signals and ad personalisation are disabled: the data is not used for advertising or remarketing.
Cookies:
Google Analytics sets the cookies listed in the Cookie Policy. You can withdraw your consent at any time with the “Cookie settings” link at the bottom of every page.
Third-country transfers:
Data collected by Google Analytics may be processed by Google outside the European Economic Area, including in the United States.
13. Cookies, local storage and similar technologies
The website may use cookies, local storage or similar technologies.
Strictly necessary technologies
Technologies that are strictly necessary to provide a digital service expressly requested by the user may be used without consent where the requirements of § 25(2) TDDDG are met.
Non-essential technologies
Access to or storage of information on a user's device for non-essential purposes generally requires prior consent under § 25(1) TDDDG.
Consent storage:
A consent banner is displayed because the website uses Google Analytics 4, which sets cookies. Nothing is loaded before you choose: no request reaches Google until analytics is accepted, and no answer counts as a refusal.
Each cookie and storage item used by the website, with its purpose and duration, is listed in the Cookie Policy.
14. Embedded media and external services
The website may embed or link to external services such as video, maps, social platforms, scheduling tools or forms.
Third-country transfers:
Yes. The website is hosted by Cloudflare, Inc. (United States), and the contact form's anti-spam verification uses Cloudflare Turnstile. Transfers rely on the European Commission's Standard Contractual Clauses.
15. Appointment scheduling
If the website offers direct appointment booking:
Purpose:
Scheduling and administering the requested appointment.
16. Social media
Plan Save Shine may maintain profiles on external social networks.
When you visit an external social-media platform, that platform processes data under its own responsibility and privacy terms.
17. Recipients and processors
Personal data may be disclosed to processors, service providers or other recipients where this is necessary and legally permitted.
Potential categories include:
- hosting and infrastructure providers;
- email providers;
- form / CRM providers;
- authentication or member-management providers;
- newsletter providers;
- analytics providers;
- payment providers;
- event and video-conferencing providers;
- professional advisers;
- financial product providers or regulated partners where a client relationship requires this;
- public authorities where disclosure is legally required.
Recipients and processors:
Cloudflare, Inc. — website hosting and anti-spam verification. o2switch (France) — mail processing for the contact form. Google Ireland Limited / Google LLC is used for audience measurement (Google Analytics 4), and only after your consent. No advertising or profiling provider is used.
Where a service provider processes personal data on behalf of the controller, an appropriate data processing agreement must be in place where required by Article 28 GDPR.
18. International data transfers
Personal data is only transferred outside the European Economic Area where a lawful transfer mechanism applies.
Additional safeguards:
Standard Contractual Clauses with the hosting provider, transport encryption on every connection, and data minimisation — the site collects only what the contact form asks for.
19. Retention and deletion
Personal data is retained only for as long as necessary for the relevant purpose or required by law.
When a retention obligation expires and no other lawful basis remains, the data is deleted or anonymised.
20. Security
Plan Save Shine and its service providers must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Relevant measures:
All connections are served over HTTPS with transport encryption enforced. The website stores your consent choice in the browser's local storage — not a cookie, because setting a tracker to remember a refusal of trackers would be self-defeating. Google Analytics sets its own cookies, but only once you have accepted it. Access to the content management system requires an authenticated account. Specific implementation details are not published.
Security check:
Verified at launch: HTTPS enforced on every page. Before consent, the only third-party request is the anti-spam verification on the contact page. Once analytics is accepted, Google Analytics is loaded and sets its own cookies; declining leaves the site free of cookies and of any request to Google.
No method of transmission or storage can be guaranteed to be completely risk-free.
21. Is providing personal data required?
Whether personal data is required depends on the service.
22. Your data-protection rights
Subject to the conditions of the GDPR, you may have the right to:
- request access to your personal data — Article 15 GDPR;
- request correction of inaccurate data — Article 16 GDPR;
- request deletion of personal data — Article 17 GDPR;
- request restriction of processing — Article 18 GDPR;
- receive certain data in a portable format — Article 20 GDPR;
- object to processing based on legitimate interests — Article 21 GDPR;
- object at any time to processing for direct marketing;
- withdraw consent at any time for the future where processing is based on consent;
- lodge a complaint with a competent supervisory authority.
To exercise your rights, contact the controller using the details in section 1.
Identity verification may be requested where reasonably necessary to protect personal data against unauthorised disclosure.
23. Right to lodge a complaint
You have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your personal data infringes applicable data-protection law.
24. Special categories of personal data
The website’s contact form does not ask for health data or other special categories of personal data.
Financial or insurance advice may sometimes involve information that reveals health-related or other sensitive circumstances.
25. Children
Minimum age / age policy for The Shine Club and website accounts:
The Shine Club is intended for adults. No account is created and no age verification is carried out, since joining requires only an email address.
26. Changes to this Privacy Policy
This Privacy Policy is updated when the website, service providers or processing activities change.