Privacy Policy
1. Introduction and contact details of the controller
We are pleased about your interest in our offering. Below we inform you about how we handle your personal data when you use our website, our shop, our community and our social-media profiles. Personal data is all data by which you can be personally identified.
The controller responsible for data processing within the meaning of the GDPR is L&L Holding GmbH, Am Friedrich 9, 52074 Aachen, Germany, Phone: +49 241 77298, Email: admin@profbenstoem.com.
2. Visiting our website (server log files)
When you use our website for information purposes only, we collect only the data your browser transmits to the server (“server log files”): the website visited, date and time of access, amount of data sent, the source/referrer, the browser used, the operating system used, and your IP address (where applicable in anonymised form). Processing is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the stability and functionality of our website. We reserve the right to check the log files subsequently if there are concrete indications of unlawful use.
2.1 Hosting (Cloudflare). This website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages and content delivery network). When you access our website, your browser transmits the data described above to Cloudflare’s servers, which are located in the EU and worldwide. Processing is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in a secure, fast and reliable delivery of our website. We have concluded a data processing agreement with the provider. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework.
2.2 Web analytics (Cloudflare Web Analytics). We use Cloudflare Web Analytics, a privacy-friendly analytics service provided by Cloudflare, Inc. (address above). The service does not use cookies, does not store identifiers on your device and does not track you across websites; it processes aggregated data such as page views, referrer, country, browser and device type. Processing is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in understanding how our website is used.
3. Cookies and local storage
Our website currently does not use cookies and does not load any third-party tracking or advertising services. One technically necessary entry is stored in your browser’s local storage: when the free-template popup is shown, we store the time it was displayed so that it is not shown again within seven days. This storage is strictly necessary for the function you requested and is carried out pursuant to § 25 (2) TDDDG and Art. 6 (1) (f) GDPR; no personal data is transmitted to us. You can delete this entry at any time in your browser settings.
Should we introduce cookies or services requiring consent (e.g. advertising pixels) in the future, we will obtain your prior consent via a consent tool and update this policy accordingly.
4. Contact
When you contact us (e.g. via contact form or email), the personal data you provide is stored and used solely to respond to your request and for the associated technical administration. The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR; if your contact aims at a contract, additionally Art. 6 (1) (b) GDPR. Your data is deleted once the matter has been conclusively dealt with, provided no statutory retention obligations apply. Messages submitted via our contact form are transmitted to and stored in our email marketing and CRM system Klaviyo (see section 6.3) and answered from hello@profbenstoem.com.
5. Customer account and registration
If you create a customer account or register, we collect and process the data required for this (as shown in the relevant input form) pursuant to Art. 6 (1) (b) GDPR. Where a double opt-in is used, your registration is only complete once you confirm it via the link in a confirmation email. You can delete your account at any time by contacting the controller; your data is then deleted, provided all contracts have been fully processed, no statutory retention periods apply and we have no legitimate interest in continued storage.
6. Newsletter and email marketing
6.1 Newsletter sign-up (double opt-in). If you sign up for our email newsletter, request one of our free templates or guides, or join a waitlist via a form on our website, we regularly send you information about academic writing and our offers. The only mandatory information is your email address; further data is voluntary and used to address you personally. We use the double opt-in procedure: you receive the newsletter only after confirming your consent via a verification link (Art. 6 (1) (a) GDPR). We store the IP address used and the date and time of registration to be able to trace possible misuse. You can unsubscribe at any time via the link in the newsletter or by message to the controller. Every form on our website that collects your email address states this purpose next to the submit button and links to this Privacy Policy.
6.2 Newsletter to existing customers. If you provided your email address when purchasing goods or services, we reserve the right to send you offers for similar goods or services by email. We do not need separate consent pursuant to § 7 (3) UWG; processing is based on our legitimate interest in personalised direct advertising pursuant to Art. 6 (1) (f) GDPR. You may object at any time with effect for the future.
6.3 Klaviyo. Our email newsletters and promotional emails are sent via Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA. The data you provide on registration is transmitted to the provider on the basis of your consent pursuant to Art. 6 (1) (a) GDPR (newsletter, templates, waitlists) or, for existing customers, pursuant to Art. 6 (1) (f) GDPR (see 6.2). Subject to your consent (Art. 6 (1) (a) GDPR), the provider carries out a statistical evaluation of campaigns using tracking pixels. We have concluded a data processing agreement with the provider. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework.
7. Order processing and payment
7.1 To the extent necessary for contract processing for delivery and payment, we pass on the personal data we collect pursuant to Art. 6 (1) (b) GDPR to the commissioned payment service provider. Where we owe you updates for digital products, we process your contact data to inform you within our statutory information obligations pursuant to Art. 6 (1) (c) GDPR.
7.2 Thrivecart (checkout). We process orders via the e-commerce checkout platform provided by ThriveCart, LLC. When you place an order, the data required for the order (e.g. name, email address, billing data and order details) is processed via this platform to conclude and perform the contract. The legal basis is Art. 6 (1) (b) GDPR and our legitimate interest in efficient order processing pursuant to Art. 6 (1) (f) GDPR. For the transfer of data to the USA, the provider relies on the European Commission’s standard contractual clauses.
7.2a Circle (subscription checkout). Subscriptions (in particular the Membership) are concluded and billed via the checkout of our community platform Circle (CircleCo, Inc., see section 8). When you purchase a subscription, the data required for the order (name, email address, billing data and subscription details) is processed via this platform; card payments are processed by Stripe (see 7.4). The legal basis is Art. 6 (1) (b) GDPR.
7.3 PayPal. Where you select a PayPal payment method, payment is processed via PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The data required for payment processing is transmitted to PayPal pursuant to Art. 6 (1) (b) GDPR.
7.4 Stripe. Where you select a card or other Stripe-based payment method, payment is processed via Stripe Payments Europe, Limited, North Wall Quay, Dublin 1, Ireland (data may also be transmitted to Stripe, Inc., USA). The data required for payment processing is transmitted to Stripe pursuant to Art. 6 (1) (b) GDPR. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework.
7.5 Electronic cancellation for continuing obligations. Consumers who have entered into paid continuing obligations (e.g. subscriptions) can cancel via an electronic button in accordance with the applicable notice periods. The collection and transmission of the data required for this is carried out pursuant to Art. 6 (1) (b) GDPR and Art. 6 (1) (c) GDPR.
8. Community platform (Circle)
8.1 Membership and content. We provide our community (The Campus and subscription spaces) via the platform Circle, provided by CircleCo, Inc., 228 Park Ave S, PMB 52933, New York, NY 10003, USA. When you use the community, the data required to set up and operate your membership (e.g. name, email address, profile data and the content you post, including comments) is processed. The legal basis is Art. 6 (1) (b) GDPR and our legitimate interest in operating the community pursuant to Art. 6 (1) (f) GDPR. For the transfer of data to the USA, the provider relies on the European Commission’s standard contractual clauses.
8.2 AI assistant on the Circle platform. On the Circle platform we provide an AI-based assistant that answers members’ questions about our content and offering. Your text input is processed to handle and answer your request automatically. Processing is based on our legitimate interest in effective, automated support pursuant to Art. 6 (1) (f) GDPR, and, where necessary to perform a contract, Art. 6 (1) (b) GDPR. Processing of your input to train or further develop the underlying AI models is contractually excluded.
9. Artificial intelligence (AI Twin and AI processing)
9.1 AI Twin (Delphi). As part of certain paid products (for the access period stated in the product description), we provide an “AI Twin” – an AI-based academic guide trained on Prof. Benstoem’s methodology – operated via the Delphi platform, provided by Delphi AI, Inc., 850 Montgomery St, Suite 350, San Francisco, CA 94133, USA. Information you provide when using the AI Twin is processed to deliver this service; processing of your input to train or further develop the provider’s general AI models is contractually excluded. Where personal data is processed, the legal basis is Art. 6 (1) (b) GDPR and our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The underlying language model is provided by Anthropic (Anthropic Ireland Limited, Dublin, Ireland; data may also be transmitted to Anthropic PBC, USA).
9.2 Anthropic (AI processing for service delivery). To deliver our services we also use AI software provided by Anthropic Ireland Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (data may also be transmitted to Anthropic PBC, USA). Information provided within a contractual relationship may be fed into the software to organise, analyse, evaluate or prepare it for the provision of our service. Processing of input to train or further develop the provider’s AI models is contractually excluded. Where personal data is processed, the legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR.
10. Tracking and analytics
10.1 Meta Pixel. The following service is only activated once we have obtained your consent via our consent tool; until then, no data is transmitted to the provider. On our website we use the “Meta Pixel” of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. With your consent, the pixel allows the behaviour of site visitors to be tracked after they have clicked on or seen a Meta (Facebook/Instagram) advertisement, in order to evaluate the effectiveness of our advertisements and to display interest-based advertising. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR, revocable at any time. Data may also be transferred to Meta Platforms Inc., USA (EU-US Data Privacy Framework).
11. Our presence on social media
We maintain publicly accessible profiles on social networks. When you interact with our profiles, the respective network processes your personal data on its own responsibility. We have no influence on the extent, location or duration of this processing. Please consider carefully which data you share with us via social media; to avoid such processing, you can contact us by other means (see Imprint).
11.1 Facebook. Our Facebook profile is operated via Meta Platforms Ireland Ltd. Insofar as data you transmit via Facebook is also or exclusively processed by Meta (e.g. insights data), Meta and we are joint controllers pursuant to Art. 26 GDPR. Insofar as we process the data ourselves, the legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR.
11.2 Instagram. Our Instagram profile is part of the Meta group. Insofar as data is processed by Meta, Meta and we are joint controllers. Insofar as we process the data ourselves, the legal basis is Art. 6 (1) (f) GDPR.
11.3 ManyChat (automated messaging). For conversations on social media we use an automated chat system provided by ManyChat Inc., 8605 Santa Monica Blvd. #64372, West Hollywood, CA 90069, USA. When you contact us via a social medium, your input is transmitted to the provider to handle and answer your request automatically. Processing is carried out pursuant to Art. 6 (1) (f) GDPR. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework.
12. Other services
12.1 Zoom (online meetings, video calls, webinars). For online meetings, video conferences and webinars we use Zoom Video Communications Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA. The provider processes registration data and session data, and may process audio/video contributions and chat input. The legal basis is Art. 6 (1) (b) GDPR, Art. 6 (1) (a) GDPR where consent is given, and otherwise Art. 6 (1) (f) GDPR. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework.
12.2 Typeform. On our advisory page we embed a form provided by TYPEFORM S.L., Carrer de Bac de Roda 163, 08018 Barcelona, Spain. When you complete the form, the data you enter is processed by the provider on our behalf to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR and our legitimate interest in an efficient enquiry process pursuant to Art. 6 (1) (f) GDPR. We have concluded a data processing agreement with the provider.
13. Rights of the data subject
You have the following rights regarding the processing of your personal data: right of access (Art. 15 GDPR); right to rectification (Art. 16 GDPR); right to erasure (Art. 17 GDPR); right to restriction of processing (Art. 18 GDPR); right to notification (Art. 19 GDPR); right to data portability (Art. 20 GDPR); right to withdraw consent given (Art. 7 (3) GDPR); and right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
Right to object. If we process your personal data based on our overriding legitimate interest, you have the right to object to this processing at any time, on grounds relating to your particular situation. If we process your personal data for direct marketing purposes, you have the right to object at any time; once you object, we will no longer process your personal data for direct marketing purposes.
14. Duration of storage
We store personal data in accordance with the respective legal basis, the purpose of processing and any statutory retention periods. Data processed on the basis of consent (Art. 6 (1) (a) GDPR) is stored until you withdraw your consent. Data subject to statutory retention periods is deleted after those periods expire, provided it is no longer required. Data processed under Art. 6 (1) (f) GDPR is stored until you exercise your right to object, unless we can demonstrate compelling legitimate grounds. Otherwise, data is deleted when it is no longer necessary for the purposes for which it was collected.
Last updated: 29 September 2026