Privacy Policy for By Bé

Effective Date: 13.10.2026

Information on the processing of your data pursuant to Art. 13 and Art. 14 of the General Data Protection Regulation (GDPR)

Welcome to By Bé: Just rewrite the rules of midlife. (Blog). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Blog. This policy complies with German and EU law, including the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

1. General Information

Below we would like to inform you about how we use and store personal data. If you make use of certain services (e.g., subscribe to our newsletter or send us an email), personal data may be collected. We comply with the applicable European data protection regulations.

2. Controller and Contact for Data Protection Questions

The controller responsible for this Blog is:

Benvinda Herzog
c/o IP-Management #12428
Ludwig-Erhard-Straße 18
20459 Hamburg
Germany
Email: bybe-blog@pm.me
Phone: +49 40 696328495

3. Data Processing in Connection with Our Online Presence

3.1 Presence on Social Media (Instagram)

For the information we publish, we use the platform and services of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). If you decide to use our Meta pages, you do so at your own responsibility. This applies in particular to the use of interactive features (e.g., commenting or rating). We have no influence on the nature and scope of the data that Meta collects and processes. In principle, when you use our Meta pages, the IP address assigned to your device is transmitted to Meta. According to Meta, this IP address is anonymized (for IP addresses from Germany) and deleted after 90 days. Meta also stores information about your device, which is used to provide us with statistical information about our pages.

The legal basis for this processing is Art. 6(1)(f) GDPR (our legitimate interest in communicating with our audience and optimizing our offering). Data collected in this context is processed by Meta and may be transferred to countries outside the European Union. Information on data transfers to third countries by Meta can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum

Further information on data protection at Meta and how you can object to processing or manage or delete your information can be found here: https://privacycenter.instagram.com/policy/

If you are logged in to Meta services, a cookie with your identifier is stored on your device, allowing Meta to track that you have visited our page and how you used it. If you wish to avoid this, you can log out of Meta, deactivate the “stay logged in” function, and delete the cookies on your device.

To the extent that we process personal data exclusively ourselves (e.g., when you contact us via Instagram), the legal bases are Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR.

3.2 Use of Payment Service Providers

Currently, we do not use any payment service providers. Should this change in the future, we will inform you transparently and ensure that your personal data is protected in accordance with applicable data protection regulations.

4. Data Processing When Using Our Website

When you access our Blog, your internet browser automatically transmits the following data to our web server for technical reasons:

IP address
Date and time of the server request
URL of the retrieved file
Volume of data transferred
Operating system
Browser type and version
Name of the internet service provider
Website from which our Blog was accessed
Page visited on our Blog

The collection and use of this data serves to enable the delivery and operation of our Blog, as well as the security of our IT systems and technical administration. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in the provision and security of our Blog).

Contact Form

If you use our contact form, your details will be used exclusively for handling your inquiry and carrying out any services you have requested. We only collect and process further personal data if you use certain services and we need your data for this purpose, or if you have given us your express consent. The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

Essential Cookies and Services

Essential cookies are required to ensure the basic functions of our Blog. The processing is carried out on the basis of our legitimate interest in the basic provision of our Blog (Art. 6(1)(f) GDPR). Without these cookies, our Blog cannot function. These cookies can only be deactivated in your browser settings.

Cookie Management Tool (CookieYes)

This Blog uses CookieYes, a cookie consent technology from CookieYes Ltd., 20-22 Wenlock Road, London, N1 7GU, United Kingdom, to obtain the legally required consents for the use of cookies. When you enter our Blog, a CookieYes cookie is stored in your browser, in which the consents you have given, or their revocation, are stored. This data is not transmitted to the provider. The storage and processing are based on our legitimate interest in complying with legal requirements (Art. 6(1)(f) GDPR) and on a legal obligation (Art. 6(1)(c) GDPR). No personal data is transferred to third countries. Further information: https://www.cookieyes.com/privacy-policy/

5. Non-Essential Cookies and Services

Google Analytics

This Blog uses Google Analytics, a web analytics service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies that are stored on your device and enable an analysis of your use of the Blog. The information generated is usually transmitted to a Google server in the USA and stored there. We have activated IP anonymization: your IP address is truncated by Google within the EU/EEA beforehand; only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.

On our behalf, Google uses this information to evaluate the use of the Blog, to compile reports on Blog activities, and to provide us with related services. You can prevent the storage of cookies via your browser settings; however, you may then not be able to use all functions of our Blog. The processing is carried out on the basis of our legitimate interest in optimizing our Blog and our offerings (Art. 6(1)(f) GDPR) or on the basis of your consent by accepting cookies in our cookie banner (Art. 6(1)(a) GDPR).

Further information: https://support.google.com/analytics/answer/6004245

6. Third-Party Services and Plugins

Wordfence Security

We use the Wordfence Security plugin, provided by Defiant, Inc., USA, to protect our Blog against security threats and attacks. As part of its use, personal data such as IP addresses, device information, and security logs may be processed. This data may also be transmitted to the Wordfence threat database (including servers in the USA) for the purpose of detecting and blocking attacks. The processing is carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR in ensuring the security of our Blog. You have the right to object to this processing. Further information: https://www.wordfence.com/privacy-policy/

WPForms (Contact Forms)

We use WPForms (provided by WPForms / Awesome Motive, Inc., USA) to create forms for interacting with our visitors. When using our contact form, personal data such as contact details, feedback, and inquiries may be processed in order to handle your request. The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. Further information: https://wpforms.com/privacy/

WP Mail SMTP

To ensure the reliable delivery of emails (e.g., from our contact form), we use the WP Mail SMTP plugin, which sends emails via a third-party email service provider ([name of your email service provider, e.g., Brevo/SendGrid]). The provider acts as a data processor on our behalf on the basis of a data processing agreement. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in the reliable delivery of our emails).

Yoast SEO

We use Yoast SEO (provided by Yoast B.V., Netherlands) to optimize our content for search engines. The plugin may set technically necessary cookies. [If applicable: Where the optional rank-tracking feature is enabled, anonymized keyword data may be transmitted to the third-party provider Wincher (Sweden) on the basis of Art. 6(1)(f) GDPR.] Further information: https://www.yoast.com/privacy-policy/

Performance and Design Plugins

Performance and design-related plugins used on our Blog (e.g., caching, image optimization, and template plugins) do not process any personal data of our visitors.

7. Disclosure of Data to Third Parties and External Recipients

In certain cases, we are legally obliged to transmit data to a requesting state authority (e.g., within the framework of national legal provisions). The legal basis is Art. 6(1)(c) GDPR. When involving service providers in commissioned data processing, we comply with the data protection provisions pursuant to Art. 28 GDPR and Art. 44 et seq. GDPR (data processing agreements).

Beyond this, we only pass data on to third parties if you have expressly consented, if the transmission is necessary for the provision of a service you have requested, or if the transmission is provided for by law.

In the event of transfers of personal data to countries outside the EU or the EEA, we take all necessary steps to ensure an appropriate level of protection, in particular through the standard contractual clauses (SCCs) approved by the EU Commission and/or the absence of any transfer (e.g., IP anonymization).

8. Use of Data for Communication and Marketing

Surveys and Advertising for Similar Products

To ensure that our service meets your expectations, we may use your email address — which you transmit in connection with an inquiry or use of our free offers — for customer satisfaction surveys. We may also send you email advertising for similar products or services you have used from us in the past, even without prior consent. The legal basis is our legitimate interest in improving our services (Art. 6(1)(f) GDPR). You may object to this at any time by sending a message to the contact details above or by using the unsubscribe link in our newsletter.

Newsletter Registration

If you register for our newsletter, we process the personal data you provide (in particular your email address and, depending on your details, your name or other voluntarily provided information) in order to regularly send you information about our offerings. The processing takes place on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which you give through your active registration.

We use the double opt-in procedure for newsletter registration: after registration, you will receive a confirmation email asking you to confirm your registration by clicking a link. This ensures that no unauthorized third parties can register your email address. The logging of the double opt-in procedure (time of registration and confirmation, IP address) is carried out to fulfill our statutory proof obligations.

You may revoke your consent to the newsletter at any time, e.g., via the unsubscribe link contained in every newsletter. Revocation does not affect the lawfulness of the processing carried out up to that point (Art. 7(3) GDPR).

9. Impressum-Privatschutz (IP-Management)

We use the services of IMPRESSUM-PRIVATSCHUTZ GmbH, Ludwig-Erhard-Str. 18, 20459 Hamburg, for the management of the mail sent to us. This service provider offers a secure and reliable postal address for our project (imprint, privacy policy, withdrawal instructions, and, if applicable, other areas). This represents our legitimate interest within the meaning of Art. 6(1)(f) GDPR. We have concluded a data processing agreement with Impressum-Privatschutz and implement the strict requirements of the German data protection authorities when using this service. Further information: https://impressum-privatschutz.de/datenschutzerklaerung/

10. Children’s Privacy

Our Blog is directed at women over 50 and does not address anyone under the age of 16. We do not knowingly collect personal data from anyone under the age of 16. If you are a parent or guardian and are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from children without the legally required consent, we will take steps to delete that information.

11. Storage Period of Data

We store personal data until you revoke your consent or until the data is no longer necessary for the fulfillment of our legitimate business interests, for the provision of the service you have requested, or until legal retention obligations require otherwise. Where data is processed on the basis of consent, it is deleted after the consent is revoked, unless there are legal grounds for further storage.

12. Data Security

We place great value on the protection of your personal data and have implemented technical and organizational measures (TOMs) to ensure an appropriate level of protection in accordance with legal requirements, in particular the GDPR. These measures serve to ensure the confidentiality, integrity, and availability of the data we process and to protect it against unauthorized access, loss, destruction, or manipulation. The measures are adapted to the state of the art, where necessary, in order to continue to ensure the protection of your data.

13. Your Rights as a Data Subject

Under the GDPR, you have the following rights at any time — free of charge:

Right of access (Art. 15 GDPR): Information about the purposes, scope, origin, and recipients of your stored personal data.
Right to rectification (Art. 16 GDPR): Correction of inaccurate or incomplete data.
Right to erasure (Art. 17 GDPR): Deletion of your personal data, provided the legal conditions are met (“right to be forgotten”).
Right to restriction of processing (Art. 18 GDPR).
Right to data portability (Art. 20 GDPR): Receipt of the personal data you have provided to us in a structured, common, and machine-readable format, or its transfer to another controller.
Right to object (Art. 21 GDPR): You may object at any time to processing based on Art. 6(1)(e) or (f) GDPR. This applies in particular to processing for direct marketing purposes.
Right to withdraw consent (Art. 7(3) GDPR): You may withdraw consent given at any time with effect for the future, e.g., by informal notification by email or in writing to the contact details above. The lawfulness of the processing carried out before withdrawal remains unaffected.
Right to lodge a complaint (Art. 77 GDPR): If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a supervisory authority — for our company, in particular the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Ludwig-Erhard-Str. 22, 20459 Hamburg.

To exercise your rights, please contact us at bybe-blog@pm.me. We will respond within one month, as required by the GDPR.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will notify you of any changes by posting the updated policy on our Blog and updating the “Effective Date” at the top of this page. You are advised to review this policy periodically.

15. Contact

If you have any questions about this Privacy Policy or your rights under the GDPR, please contact us at: