Privacy Policy

Last updated: August 2026

This website is deliberately designed to be technically lean. We do not use marketing or cross-site tracking services. Personal data is processed only where necessary to provide, secure and manage the protected tutorial area.

1. Controller

Thomas Buhl
Am Dachsbau 59
13503 Berlin
Germany

Phone: +49 30 39821419
Email: info@remstim.com
Website: my.remstim.com

2. Purpose of This Website

At my.remstim.com, we provide purchasers of our video tutorials with access to a protected member area.

The website is used in particular for:

  • managing access rights,
  • providing personal access links,
  • authentication without a conventional customer password,
  • providing protected tutorial pages,
  • delivering purchased video content,
  • technically protecting the member area against unauthorised access.

3. Hosting and Server Log Files

This website is hosted by:

Mittwald CM Service GmbH & Co. KG
Königsberger Straße 4–6
32339 Espelkamp
Germany

When the website is accessed, the web server processes technical access data required for operation. This may include in particular:

  • IP address,
  • date and time of access,
  • page or file requested,
  • referrer,
  • browser and operating system,
  • amount of data transferred,
  • HTTP status code.

The processing is carried out to provide the website securely and reliably, to diagnose errors and to protect against misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of the website.

Retention Period

Mittwald currently applies the following retention periods in particular:

  • access logs are anonymised and stored for 60 days,
  • error logs are deleted after 7 days.

We have entered into a data processing agreement with Mittwald pursuant to Article 28 GDPR.

4. Purchaser Data and Access Rights

After a tutorial has been purchased, we process the data required to provide access.

This includes in particular:

  • email address,
  • internal user account,
  • purchased tutorial or access entitlement,
  • status of the access entitlement,
  • dates and times on which access is granted, amended or revoked.

The internal user account is used solely for the technical management of identity and access rights. A conventional customer password login is not provided.

The legal basis is Article 6(1)(b) GDPR.

5. CopeCart

Sales and payment processing are handled through CopeCart.

For German transactions, the relevant provider is in particular:

CopeCart GmbH
Rosenstraße 2
10178 Berlin
Germany

CopeCart provides order and payment processing.

Following relevant order and payment events, our access system automatically receives the information required to manage access rights.

This may include in particular:

  • purchaser email address,
  • product reference,
  • order or transaction reference,
  • payment status,
  • refund,
  • reversal or chargeback.

These data are used to create, update or block the corresponding tutorial access right automatically.

The legal basis is Article 6(1)(b) GDPR. To the extent that data are processed to secure and document automated access decisions, the processing is additionally based on Article 6(1)(f) GDPR.

CopeCart’s own privacy policy applies to the independent processing carried out on the CopeCart platform.

6. Personal Access Links (“Magic Links”)

Access to the protected tutorial area is provided without a conventional password through personal, time-limited access links.

When an access link is requested, we may process in particular:

  • email address,
  • technical entitlement information,
  • a cryptographically secured access token,
  • creation and expiry time,
  • technical information used to limit misuse.

The access link is used exclusively to provide secure authentication for the purchased member area.

The legal basis is Article 6(1)(b) GDPR.

Security measures against abusive or automated access attempts are additionally based on Article 6(1)(f) GDPR.

7. Rate Limiting and Protection Against Misuse

To limit automated or abusive access requests, our access system uses technical rate limits.

The following data may be processed in particular:

  • derived or hashed email characteristics,
  • IP-related technical characteristics,
  • combinations of email- and IP-related characteristics,
  • number and timing of access requests.

This information is used exclusively for security purposes.

It is not used for advertising, profiling or marketing purposes.

The legal basis is Article 6(1)(f) GDPR.

8. Sessions in the Member Area

After successful authentication, a time-limited session is created.

This session is required so that users can navigate within the member area and access the content assigned to them without having to authenticate again on every page.

The processing is used exclusively for:

  • authentication,
  • access control,
  • security,
  • delivery of purchased content.

The legal basis is Article 6(1)(b) GDPR.

Where information must be stored on or read from the user’s device for this purpose, this is done only to the extent technically necessary to provide the protected service expressly requested by the user.

9. Bunny Stream / Video Hosting

We use Bunny Stream to provide videos within the protected member area.

The provider and processor is:

BunnyWay, informacijske storitve d.o.o.
Dunajska cesta 165
1000 Ljubljana
Slovenia

We have entered into a data processing agreement with BunnyWay pursuant to Article 28 GDPR.

The agreement expressly provides for the processing of user information required for the provision, security, optimisation, control and troubleshooting of the service. The types of data listed in the agreement include network connection data, IP addresses, user-agent information and referrer information.

Data Processed

When a video is loaded and played, a connection is established to servers operated by bunny.net.

The following data may be processed in particular:

  • IP address or anonymised IP address,
  • user agent,
  • browser and device information,
  • referrer,
  • player and video resources requested,
  • access times,
  • video or player ID,
  • playback and performance information,
  • buffering and error information,
  • watch-time or playback metrics.

Our technical audit did not identify marketing or tracking cookies, Local Storage, Session Storage, IndexedDB or cross-site tracking by the Bunny player in use.

Data-Minimised Configuration

In our current Bunny Stream configuration, the following optional functions are disabled in particular:

  • video heatmaps,
  • saving resumable playback positions,
  • advertising or VAST,
  • content tagging,
  • automatic transcription,
  • Smart AI functions,
  • log forwarding,
  • permanent storage of raw logs.

IP anonymisation is enabled.

The video data are stored in the Frankfurt storage region.

However, bunny.net operates a global content delivery network. Technical processing through server locations outside the European Union or European Economic Area therefore cannot be completely excluded during video delivery.

The Bunny data processing agreement expressly states that, due to the global nature of the service, bunny.net may process data worldwide and that the customer may technically restrict the network locations used.

Legal Basis

The video player is used exclusively to provide the tutorial purchased by the user.

Processing required for video delivery and playback is therefore based on Article 6(1)(b) GDPR.

To the extent that technical data are processed to ensure security, stability, error diagnosis and reliable service delivery, the processing is additionally based on Article 6(1)(f) GDPR.

Our legitimate interest lies in the secure, stable and technically reliable provision of the protected video service.

Under the current technical configuration, the service is not used for advertising, profiling or cross-site tracking purposes.

10. Email Delivery

For the delivery of personal access links and technically required messages, we use the email infrastructure of our hosting provider Mittwald CM Service GmbH & Co. KG.

Email delivery is technically connected to WordPress through the WP Mail SMTP plugin. Messages are sent through the SMTP server provided by Mittwald.

The following data are processed in particular:

  • recipient email address,
  • sender address,
  • content of the message,
  • time of sending,
  • technical delivery and transmission information.

The processing is carried out to provide and manage access to the purchased content and is based on Article 6(1)(b) GDPR.

To the extent that technical log data are processed to ensure secure and reliable delivery, the processing is additionally based on Article 6(1)(f) GDPR.

Mittwald currently states a retention period of four weeks for mail-server logs.

11. Contact

If you contact us by email or telephone, we process the information you provide in order to handle your request and communicate with you.

Depending on the nature of the request, the processing is based on:

  • Article 6(1)(b) GDPR for pre-contractual or contractual matters,
  • Article 6(1)(f) GDPR for other legitimate enquiries.

Where statutory retention obligations apply, processing is based on Article 6(1)(c) GDPR.

12. Cookies and Similar Technologies

We currently do not use marketing or cross-site tracking cookies on my.remstim.com.

The technical audit also did not identify marketing or tracking cookies or corresponding browser storage mechanisms in connection with the Bunny Stream player in use.

Technically necessary session mechanisms may be used within the protected member area where required for authentication, security and provision of the purchased service.

These mechanisms are not used for advertising or tracking purposes.

Based on the current technical configuration, we do not use marketing or tracking technologies requiring consent.

13. No Audience Measurement or Marketing Tracking

We currently do not use independent services on my.remstim.com for:

  • personalised advertising,
  • retargeting,
  • social media tracking,
  • cross-site tracking,
  • marketing profiles,
  • Google Analytics,
  • Meta Pixel,
  • or comparable marketing technologies.

Performance and playback information technically processed by Bunny Stream is used for service delivery and technical video quality.

14. Recipients of Personal Data

Personal data are disclosed or made accessible only where necessary for the purposes described above.

Recipients may include in particular:

  • Mittwald as hosting and email infrastructure provider,
  • BunnyWay as video hosting and CDN processor,
  • CopeCart in connection with sales and payment processing,
  • public authorities or other recipients where disclosure is required by law.

Where required, we enter into data processing agreements pursuant to Article 28 GDPR with processors.

15. Transfers to Third Countries

We prefer services and configurations in which personal data are processed within the European Union or European Economic Area.

However, where global technical infrastructures such as content delivery networks are used, processing outside the EU or EEA cannot always be completely excluded.

Where personal data are processed in third countries, this is done only in accordance with Articles 44 et seq. GDPR and the applicable contractual and statutory safeguards.

16. Retention Period

Personal data are stored only for as long as necessary for the respective purpose or for as long as statutory retention obligations apply.

In particular:

  • purchaser and access data are generally processed for as long as access to the purchased tutorial must be managed,
  • Magic Link and session data are stored only for the technically necessary period,
  • security and audit information may be retained for a limited period where necessary to document access-right changes or prevent misuse,
  • Mittwald access logs: anonymised, 60 days,
  • Mittwald error logs: 7 days,
  • Mittwald mail-server logs: four weeks.

Statutory commercial and tax retention obligations remain unaffected.

17. Data Security

We implement appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other unlawful processing.

These measures include in particular:

  • encrypted HTTPS connections,
  • time-limited Magic Links,
  • time-limited sessions,
  • limits on parallel sessions,
  • server-side entitlement checks,
  • rate limiting,
  • signed interface communication,
  • logged access-right changes,
  • protected video tokens,
  • domain restrictions for the video player.

Absolute security of data transmission over the internet cannot be technically guaranteed.

18. Rights of Data Subjects

Subject to the applicable legal requirements, you have in particular the right to:

  • access under Article 15 GDPR,
  • rectification under Article 16 GDPR,
  • erasure under Article 17 GDPR,
  • restriction of processing under Article 18 GDPR,
  • data portability under Article 20 GDPR,
  • object to processing based on Article 6(1)(e) or (f) GDPR under Article 21 GDPR.

Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

To exercise your rights, please contact:

info@remstim.com

19. Right to Lodge a Complaint

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority.

For Berlin, the relevant authority is in particular:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Germany

Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de

20. Automated Decision-Making and Profiling

No automated decision-making within the meaning of Article 22 GDPR and no profiling for advertising or marketing purposes takes place on my.remstim.com.

Automated technical access decisions are based exclusively on objective contractual and entitlement conditions, for example:

  • existing access entitlement,
  • product assignment,
  • refund,
  • reversal,
  • chargeback.

21. Changes to This Privacy Policy

We may amend this Privacy Policy if technical processes, service providers or legal requirements change.

The current version published on this website applies.