1. Introduction and contact details of the controller
We are pleased about your interest in our offering. Below we inform you about how we handle your personal data when you use our website, our shop, our community and our social-media profiles. Personal data is all data by which you can be personally identified.
The controller responsible for data processing within the meaning of the GDPR is L&L Holding GmbH, Am Friedrich 9, 52074 Aachen, Germany, Phone: +49 241 77298, Email: admin@profbenstoem.com.

2. Visiting our website (server log files)
When you use our website for information purposes only, we collect only the data your browser transmits to the server (“server log files”): the website visited, date and time of access, amount of data sent, the source/referrer, the browser used, the operating system used, and your IP address (where applicable in anonymised form). Processing is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the stability and functionality of our website. We reserve the right to check the log files subsequently if there are concrete indications of unlawful use.

3. Cookies and consent management
To make visiting our website attractive and to enable certain functions, we use cookies — small text files stored on your device — some of which are deleted when you close your browser (“session cookies”) and some of which remain (“persistent cookies”). Where personal data is processed by cookies, the legal basis is Art. 6 (1) (b) GDPR (performance of contract), Art. 6 (1) (a) GDPR (consent) or Art. 6 (1) (f) GDPR (legitimate interest in functionality and a user-friendly site).
This website uses a cookie consent tool to obtain effective consent for cookies and cookie-based applications requiring consent. Services requiring consent are only loaded once you have given the relevant consent by ticking the corresponding boxes. The tool sets technically necessary cookies to store your preferences; where personal data (e.g. IP address) is processed for this purpose, the legal basis is Art. 6 (1) (f) GDPR and Art. 6 (1) (c) GDPR. You can set your browser to refuse cookies; functionality may then be limited.

4. Contact
When you contact us (e.g. via contact form or email), the personal data you provide is stored and used solely to respond to your request and for the associated technical administration. The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR; if your contact aims at a contract, additionally Art. 6 (1) (b) GDPR. Your data is deleted once the matter has been conclusively dealt with, provided no statutory retention obligations apply.

5. Customer account and registration
If you create a customer account or register, we collect and process the data required for this (as shown in the relevant input form) pursuant to Art. 6 (1) (b) GDPR. Where a double opt-in is used, your registration is only complete once you confirm it via the link in a confirmation email. You can delete your account at any time by contacting the controller; your data is then deleted, provided all contracts have been fully processed, no statutory retention periods apply and we have no legitimate interest in continued storage.

6. Newsletter and email marketing
6.1 Newsletter sign-up (double opt-in)
If you sign up for our email newsletter, we regularly send you information about our offers. The only mandatory information is your email address; further data is voluntary and used to address you personally. We use the double opt-in procedure: you receive the newsletter only after confirming your consent via a verification link (Art. 6 (1) (a) GDPR). We store the IP address used and the date and time of registration to be able to trace possible misuse. You can unsubscribe at any time via the link in the newsletter or by message to the controller.

6.2 Newsletter to existing customers
If you provided your email address when purchasing goods or services, we reserve the right to send you offers for similar goods or services by email. We do not need separate consent pursuant to § 7 (3) UWG; processing is based on our legitimate interest in personalised direct advertising pursuant to Art. 6 (1) (f) GDPR. You may object at any time with effect for the future.

6.3 Klaviyo
Our email newsletters and promotional emails are sent via Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA. On the basis of our legitimate interest in effective, user-friendly email marketing, we pass on the data you provide on registration pursuant to Art. 6 (1) (f) GDPR. Subject to your consent (Art. 6 (1) (a) GDPR), the provider carries out a statistical evaluation of campaigns using tracking pixels (open rates, interactions; device information such as time, IP address, browser, operating system). You can withdraw consent to email tracking at any time. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

7. Order processing and payment
7.1 To the extent necessary for contract processing for delivery and payment, we pass on the personal data we collect pursuant to Art. 6 (1) (b) GDPR to the commissioned payment service provider. Where we owe you updates for digital products, we process your contact data to inform you within our statutory information obligations pursuant to Art. 6 (1) (c) GDPR.

7.2 Thrivecart (checkout)
We process orders via the e-commerce checkout platform provided by ThriveCart, LLC. When you place an order, the data required for the order (e.g. name, email address, billing data and order details) is processed via this platform to conclude and perform the contract. The legal basis is Art. 6 (1) (b) GDPR and our legitimate interest in efficient order processing pursuant to Art. 6 (1) (f) GDPR. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For the transfer of data to the USA, the provider relies on the European Commission’s standard contractual clauses, which are intended to ensure compliance with the European level of data protection.

7.3 PayPal
Where you select a PayPal payment method, payment is processed via PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The data required for payment processing is transmitted to PayPal pursuant to Art. 6 (1) (b) GDPR.

7.4 Stripe
Where you select a card or other Stripe-based payment method, payment is processed via Stripe Payments Europe, Limited, North Wall Quay, Dublin 1, Ireland (data may also be transmitted to Stripe, Inc., USA). The data required for payment processing is transmitted to Stripe pursuant to Art. 6 (1) (b) GDPR. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

7.5 Electronic cancellation for continuing obligations
Consumers who have entered into paid continuing obligations (e.g. subscriptions) can cancel via an electronic button in accordance with the applicable notice periods. The collection and transmission of the data required for this is carried out pursuant to Art. 6 (1) (b) GDPR and Art. 6 (1) (c) GDPR (we are legally obliged to provide an electronic cancellation option).

8. Community platform (Circle)
8.1 Membership and content
We provide our community (Free Campus and subscription spaces) via the platform Circle, provided by CircleCo, Inc., 228 Park Ave S, PMB 52933, New York, NY 10003, USA. When you use the community, the data required to set up and operate your membership (e.g. name, email address, profile data and the content you post, including comments) is processed. The legal basis is Art. 6 (1) (b) GDPR (performance of the membership/subscription contract) and our legitimate interest in operating the community pursuant to Art. 6 (1) (f) GDPR. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For the transfer of data to the USA, the provider relies on the European Commission’s standard contractual clauses, which are intended to ensure compliance with the European level of data protection.

8.2 AI assistant on the Circle platform
On the Circle platform we provide an AI-based assistant that answers members’ questions about our content and offering. Your text input is processed to handle and answer your request automatically. Processing is based on our legitimate interest in effective, automated support pursuant to Art. 6 (1) (f) GDPR, and, where necessary to perform a contract, Art. 6 (1) (b) GDPR. Processing of your input to train or further develop the underlying AI models is contractually excluded. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For the transfer of data to the USA, the provider relies on the European Commission’s standard contractual clauses, which are intended to ensure compliance with the European level of data protection.

9. Artificial intelligence (AI Twin and AI processing)
9.1 AI Twin (Delphi)
As part of the paid subscription, we provide an “AI Twin” — an AI-based academic mentor trained on Prof. Benstoem’s methodology — operated via the Delphi platform, provided by Delphi AI, Inc., 850 Montgomery St, Suite 350, San Francisco, CA 94133, USA. Information you provide when using the AI Twin is processed to deliver this service; processing of your input to train or further develop the provider’s general AI models is contractually excluded. Where personal data is processed, the legal basis is Art. 6 (1) (b) GDPR and our legitimate interest in providing an effective service pursuant to Art. 6 (1) (f) GDPR. According to information available to us, the underlying language model is provided by Anthropic (Anthropic Ireland Limited, Dublin, Ireland; data may also be transmitted to Anthropic PBC, USA). We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For the transfer of data to the USA, the provider relies on the European Commission’s standard contractual clauses, which are intended to ensure compliance with the European level of data protection.

9.2 Anthropic (AI processing for service delivery)
To deliver our services we also use AI software provided by Anthropic Ireland Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (data may also be transmitted to Anthropic PBC, USA). Information provided within a contractual relationship may be fed into the software to organise, analyse, evaluate or prepare it for the provision of our service. Processing of input to train or further develop the provider’s AI models is contractually excluded. Where personal data is processed, the legal basis is our legitimate interest in the efficient provision of our services pursuant to Art. 6 (1) (f) GDPR. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For the transfer of data to the USA, the provider relies on the European Commission’s standard contractual clauses, which are intended to ensure compliance with the European level of data protection.

10. Tracking and analytics
10.1 Meta Pixel
On our website we use the “Meta Pixel” of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. With your consent, the pixel allows the behaviour of site visitors to be tracked after they have clicked on or seen a Meta (Facebook/Instagram) advertisement, in order to evaluate the effectiveness of our advertisements and to display interest-based advertising. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR, given via the cookie consent tool and revocable at any time. Data may also be transferred to Meta Platforms Inc., USA. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

10.2 Google Analytics
On our website we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse how visitors use the website (e.g. pages visited, time on page, approximate location from a shortened IP address) in order to evaluate website usage and improve our offering. Processing takes place only with your consent pursuant to Art. 6 (1) (a) GDPR, given via the cookie consent tool and revocable at any time. Data may also be transferred to Google LLC, USA. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.
11. Our presence on social media
We maintain publicly accessible profiles on social networks. When you interact with our profiles, the respective network processes your personal data on its own responsibility. We have no influence on the extent, location or duration of this processing. Please consider carefully which data you share with us via social media; to avoid such processing, you can contact us by other means (see Imprint).

11.1 Facebook
Our Facebook profile is operated via Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Insofar as data you transmit via Facebook is also or exclusively processed by Meta (e.g. insights data), Meta and we are joint controllers pursuant to Art. 26 GDPR on the basis of the joint-controller agreement (https://www.facebook.com/legal/terms/page_controller_addendum) and, for certain Facebook Business Tools, https://www.facebook.com/legal/controller_addendum. Further information: https://de-de.facebook.com/policy.php. Insofar as we process the data ourselves, the legal basis is our legitimate interest in communicating with you pursuant to Art. 6 (1) (f) GDPR.

11.2 Instagram
Our Instagram profile is part of the Meta group (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). Insofar as data is processed by Meta, Meta and we are joint controllers. Further information: https://help.instagram.com/help/instagram/519522125107875/. Insofar as we process the data ourselves, the legal basis is Art. 6 (1) (f) GDPR.

11.3 ManyChat (automated messaging)
For conversations on social media we use an automated chat system provided by ManyChat Inc., 8605 Santa Monica Blvd. #64372, West Hollywood, CA 90069, USA. When you contact us via a social medium, your input is transmitted to the provider to handle and answer your request automatically. Processing is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in effective support management. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

12. Other services
12.1 Zoom (online meetings, video calls, webinars)
For online meetings, video conferences and webinars we use Zoom Video Communications Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA. The provider processes registration data (name, email address, optional phone number and password) and session data (topic, participant IP address, device information, optional description), and may process audio/video contributions and chat input. The legal basis is Art. 6 (1) (b) GDPR, Art. 6 (1) (a) GDPR where consent is given, and otherwise Art. 6 (1) (f) GDPR. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

12.2 Zapier (workflow automation)
We use Zapier Inc., 548 Market St #62411, San Francisco, California 94104, USA, to integrate and synchronise applications and automate workflows. Where personal data is processed, this is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in optimising our internal organisation. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has self-certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

13. Rights of the data subject
You have the following rights regarding the processing of your personal data:
• Right of access (Art. 15 GDPR);
• Right to rectification (Art. 16 GDPR);
• Right to erasure (Art. 17 GDPR);
• Right to restriction of processing (Art. 18 GDPR);
• Right to notification (Art. 19 GDPR);
• Right to data portability (Art. 20 GDPR);
• Right to withdraw consent given (Art. 7 (3) GDPR);
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Right to object
IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.
IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO SUCH PROCESSING. IF YOU OBJECT, WE WILL STOP PROCESSING YOUR DATA FOR DIRECT MARKETING PURPOSES.

14. Duration of storage
We store personal data in accordance with the respective legal basis, the purpose of processing and any statutory retention periods. Data processed on the basis of consent (Art. 6 (1) (a) GDPR) is stored until you withdraw your consent. Data subject to statutory retention periods is deleted after those periods expire, provided it is no longer required. Data processed under Art. 6 (1) (f) GDPR is stored until you exercise your right to object, unless we can demonstrate compelling legitimate grounds. Otherwise, data is deleted when it is no longer necessary for the purposes for which it was collected.

Last updated: 31 May 2026

Privacy Policy

profbenstoem.com · L&L Holding GmbH