Privacy policy

This is an English translation for your convenience. The German version is legally binding.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) is:

Mag. Stefan Scheurer
Rehkogl 16
4822 Bad Goisern am Hallstättersee, Austria
Phone: +43 690 1002 36 18
Email: start@no-sycophancy.com

A data protection officer is not required by law and has not been appointed.

2. Principles

I only process personal data insofar as this is necessary to provide the website, to answer your enquiries and to carry out our collaboration, or if you have given your consent. As a psychotherapist I am subject to the statutory duty of confidentiality under the Psychotherapy Act. Health data within the meaning of Art. 9 GDPR are processed exclusively in the context of treatment or coaching and only via suitable, encrypted systems, not via this website.

You are under no legal or contractual obligation to provide me with personal data. Without details such as your name and contact information, however, I cannot arrange an appointment with you. You do not have to provide any data to visit this website.

An agency supports me in operating and developing this website and with online advertising. It has access to the web space and to the reports in Google Analytics and Google Ads and is contractually bound by my instructions as a processor under Art. 28 GDPR.

3. Hosting and server log files

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The servers are located in Germany. A data processing agreement under Art. 28 GDPR has been concluded with IONOS.

When you access the website, the server automatically processes information transmitted by your browser: IP address, date and time of access, page accessed, amount of data transferred, browser type and version, operating system and referrer URL. These data are not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and stable operation of the website. IONOS only stores IP addresses in the log files in anonymised form. The log files are deleted after eight weeks at the latest.

4. Cookies, consent and audience measurement

This website works fully without cookies. I only use tools for audience measurement (Google Analytics) and for measuring the success of ads (Google Ads) if you consent in the cookie banner. Without your consent, no connection to Google is established, and you suffer no disadvantages.

Cookie banner and your choice

On your first visit, a banner asks whether you consent to the category “Statistics” (Google Analytics) and the category “Marketing” (measurement of Google Ads). You can accept both, reject both or choose individually. Only after your consent is the Google Tag Manager loaded.

I store your choice and the selected light or dark mode in your browser’s local storage (localStorage), not in a cookie and not on my server. This is technically necessary so that your decision is respected the next time you visit a page (§ 165(3) Austrian Telecommunications Act 2021, TKG 2021; Art. 6(1)(c) and (f) GDPR). I ask again after twelve months.

Withdrawal: Via the “Cookie settings” link in the footer of every page, you can change or withdraw your consent at any time. On withdrawal, Google’s cookies on this website are deleted. Withdrawal does not affect the lawfulness of processing carried out up to that point (Art. 7(3) GDPR). You can also delete or block cookies in your browser at any time.

The legal basis for Google Tag Manager, Google Analytics and Google Ads is your consent under Art. 6(1)(a) GDPR and, for storing and reading information on your device, § 165(3) TKG 2021.

Google Tag Manager

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The Tag Manager is a tool that integrates the Google services listed below into this website. It does not set any cookies itself and does not analyse any data. When it loads, your IP address and technical browser information are transmitted to Google.

Google Analytics 4 (category “Statistics”)

With your consent, I use Google Analytics 4 to understand how this website is used and to improve it. The following is recorded: pages accessed and time spent (including whether you spend a total of two minutes actively on the website), scroll depth, whether the appointment booking area is displayed, start and progress of the video on the home page, clicks on “Choose a time”, phone, email, WhatsApp, LinkedIn and Xing, use of the light/dark switch, access to the thank-you page after an appointment booking, the referring page (referrer), date and time, device and browser type, screen size, language setting and approximate location (country, region). Google Analytics assigns a random identifier to your browser for this purpose.

Google Analytics 4 only uses the IP address to determine the approximate location and does not store it. Granular location and device data, Google signals, ad personalisation and the sharing of data with Google for its own purposes are deactivated. I do not link the data to names, email addresses or booking data, only evaluate it in aggregated form and do not create profiles of individual visitors. Which pages are accessed is also recorded, for example the page on stress and burnout. I do not use this to draw conclusions about individual people or their health. Entries, information about your health and booking content are not recorded. Follow-up appointments of existing clients are not measured: no data is transmitted to Google on the confirmation page for follow-up appointments or when clicking on the follow-up booking. Event and user-level data are deleted after two months; after that, only aggregated statistics remain.

Google processes these data as my processor. A data processing agreement under Art. 28 GDPR has been concluded with Google (Google Ads Data Processing Terms).

Google Ads conversion tracking (category “Marketing”)

I run ads on Google. With your consent, I measure whether a click on one of my ads leads to an appointment booking. If you come to this website via a Google ad, Google stores an identifier of this click in a cookie. If you then click on “Choose a time” or are redirected to the thank-you page after a confirmed booking, your browser transmits this event to Google together with the click identifier, the address and title of the page accessed, your IP address and browser information (including to the servers google.com, googleadservices.com and doubleclick.net). Google may also set or read cookies on these domains of its own, in partitioned form, i.e. only in connection with this website.

In Google Ads I only see the number of these events, not who booked. Your name, email address, phone number, appointment or the reason for your booking are not transmitted to Google. I do not use personalised advertising or remarketing and do not build audiences from visits to this website. Because Google Analytics is linked to my Google Ads account, Google Analytics may, with your consent to “Marketing”, additionally transmit data to Google’s advertising services (e.g. stats.g.doubleclick.net); these transmissions are flagged as “no personalised advertising”. For processing in the context of Google Ads, Google is partly an independent controller (Google Ads Controller-Controller Data Protection Terms).

Overview: cookies and local storage

nosyco-consent	localStorage, this website · stores your choice in the cookie banner · 12 months · necessary
nosyco-mode	localStorage, this website · stores the light or dark mode · until you delete it in your browser · necessary
nosyco-conv-kennenlernen	sessionStorage, this website · prevents a booking from being counted twice when the thank-you page is reloaded · until the tab is closed · only with consent (Statistics or Marketing)
nosyco-aktiv, nosyco-2min	sessionStorage, this website · counts the active time on the website in order to record a visit of two minutes or more once · until the tab is closed · only with consent (Statistics or Marketing)
_ga, _ga_DSEJCD1GV1	Cookies, Google Analytics · random identifier to distinguish visits · up to 2 years (some browsers limit this to 400 days) · Statistics
_gcl_au, _gcl_aw	Cookies, Google Ads · identifier to match ad click and booking · 90 days · Marketing
_gcl_ls	localStorage, Google Ads · backup copy of the click identifier · 90 days · Marketing
Cookies on google.com, googleadservices.com, doubleclick.net	partitioned cookies from Google · matching ad click and booking, abuse protection · duration set by Google · Marketing

Transfer to the USA

Google may also transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the EU Commission (Art. 45 GDPR). In addition, Google has agreed to the EU Commission’s standard contractual clauses. Google’s privacy information: policies.google.com/privacy and business.safety.google/privacy.

No automated decision-making, including profiling, under Art. 22 GDPR takes place. Videos from external providers (section 7) and appointment booking (section 6) are governed independently of the cookie banner.

5. Fonts

The fonts used (Inter, Instrument Serif) are served locally from my server. No connection is made to Google Fonts or other font providers.

6. Appointment booking and collaboration (Nextcloud)

For appointment booking and for our collaboration (video sessions and chat via Nextcloud Talk, appointment management, document exchange, invoices), I use a dedicated Nextcloud at cloud.no-sycophancy.com. It is operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. The booking is not embedded in this website: the Nextcloud booking page only opens when you click on “Choose a time”. Until then, no data is transmitted to the Nextcloud.

When the booking page is opened, technically necessary data (IP address, browser information) are transmitted to the Nextcloud server. The data you enter when booking (name, email address, selected appointment; for the intro call also your phone number) are processed exclusively in the Nextcloud, not on this website. After your appointment is confirmed, the Nextcloud redirects you to a thank-you page on this website; no booking data is passed on in the process. If you have consented in the cookie banner, accessing the thank-you page is counted as a booking (see section 4).

Legal bases: Art. 6(1)(b) GDPR (initiation and performance of the treatment or coaching contract) and Art. 9(2)(h) GDPR in conjunction with § 4(3) DSG (health care provided by a person subject to a duty of confidentiality).

A data processing agreement under Art. 28 GDPR has been concluded with Hetzner Online GmbH. Transmission is encrypted (TLS). Further information: hetzner.com/de/legal/privacy-policy. Alternatively, you can arrange the initial conversation by email or phone at any time.

7. Videos (YouTube, Vimeo)

Videos hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, USA) may be embedded on this website. The videos are shown only as placeholders and are only loaded when you click on “Load video”. Only then is a connection made to the provider’s servers and your IP address transmitted; the provider may then set its own cookies. I use YouTube’s privacy-enhanced mode (youtube-nocookie.com) and Vimeo’s “Do not track” parameter.

The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by clicking and withdraw by reloading the page. With Vimeo, data may be transferred to the USA; Vimeo is certified under the EU-US Data Privacy Framework. Privacy information: Google, Vimeo. Self-hosted videos (MP4) are loaded directly from my server without third parties.

8. Contact by email or phone

If you contact me by email or phone, I process the data you provide (name, contact details, content of the enquiry) to deal with your request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Please note: unencrypted emails are not secure. For sensitive content, in particular health data, please use the encrypted client portal or a conversation. Enquiries are deleted once they have been dealt with, unless statutory retention obligations apply. If you contact me via WhatsApp, your messages are processed by WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland; metadata may be transferred to Meta in the USA in the process (EU-US Data Privacy Framework). Please use WhatsApp only for organisational matters, not for personal or health-related content.

9. Data in the context of our collaboration

In the context of psychotherapy and coaching, I keep the documentation required by law. In accordance with the Psychotherapy Act, it is kept for at least ten years. Billing data are kept for seven years in accordance with tax law (§ 132 Federal Fiscal Code, BAO). The duty of confidentiality applies without restriction; data are only passed on to third parties (e.g. doctors, insurers) with your express consent or on the basis of a legal obligation.

Documentation in the context of coaching

If you work with me, I document our sessions. For this I may use DokuDachs, a tool that records, transcribes and summarises conversations (provider: Marc Päpper, Cognition Pixels, Stettiner Straße 41, 35410 Hungen, Germany). This only happens with your express consent, which you give at the start of our collaboration in writing or in the chat of our video room (Art. 9(2)(a) GDPR). Without it, I document without recording. The audio data are only processed for transcription and then deleted. Transcripts and summaries are stored encrypted on servers in the EU and are not used to train AI models. A data processing agreement under Art. 28 GDPR has been concluded with the provider. You can withdraw your consent at any time with effect for the future. You will receive all details in writing before our collaboration begins.

10. External links

This website contains links to external websites. When you click on them, the privacy policy of the respective provider applies. External links are marked as opening in a new window or are recognisable by the different domain. This also applies to the links to my LinkedIn and Xing profiles in the footer: these are simple links without embedded plugins; data are only transmitted to the respective provider when you click on them.

11. Data security

This website is transmitted encrypted via TLS (HTTPS). I use technical and organisational measures to protect data against loss, manipulation and unauthorised access.

12. Your rights

You have the following rights against me with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR), unless retention obligations apply
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests (Art. 21 GDPR)
• Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to start@no-sycophancy.com is sufficient.

If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with the supervisory authority. In Austria, this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at. You can also contact the supervisory authority of your country of residence.

13. Changes

I reserve the right to amend this privacy policy if the legal situation or the services used change. The version published on this page applies.

Last updated: October 2026