Privacy Policy

As of: September 8, 2026

1. Privacy Policy at a Glance

This information provides a simple overview of what happens to your personal data when you visit this website or use our consulting services. Personal data is any data that can be used to personally identify you. You can find detailed information in the following sections.

Who is responsible?
Data processing on this website is carried out by MPU Guru UG (limited liability). You can find the contact information in Section 2. The respective partner company is responsible for consultations at partner locations; see Section 7.

How do we collect your data?
Some of your data is collected when you provide it to us, for example, via the contact form or during a consultation. Other data is collected automatically or with your consent when you visit the website through our IT systems, primarily technical data such as your browser, operating system, or the time you accessed the page.

What do we use your data for?
We use your data to ensure the website functions properly, to process your inquiry, to evaluate our advertising, and to provide our consulting services. Since we offer psychological MPU preparation, we also process special categories of personal data—in particular, health data as defined in Article 9 of the GDPR—with your explicit consent.

What are your rights?
You have the right at any time to access, correct, delete, restrict the processing of, and request data portability regarding your personal data, as well as the right to object and to file a complaint with a supervisory authority. You may revoke any consent you have given at any time with future effect. For details, see Section 5.

2. Data Controller

MPU Guru UG (limited liability)
Represented by Managing Director Patrick Hoffstiepel
Kemnader Str. 334, 44797 Bochum
Phone: 0176 32827631
Email: kontakt@deinmpuguru.de
Court of Registration: Bochum Local Court, HRB 21825
Value-Added Tax (VAT) Identification Number: DE360585252

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

3. Hosting and technical infrastructure

This website consists of several technical components hosted by two different providers.

Website deployment (Vercel)

The website is hosted on the platform of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The pages are predominantly pre-built as static pages; individual server functions are executed by Vercel in the Frankfurt am Main region. Vercel processes technically necessary data with each page view—specifically the IP address, time of access, page viewed, user agent, and referrer—and stores this data in access and operational logs, which are typically automatically deleted within a few days.

The legal basis is Article 6(1)(f) of the GDPR, our legitimate interest in the secure, fast, and efficient provision of the online service. A data processing agreement pursuant to Article 28 of the GDPR is in place. Processing in the U.S. is possible; Vercel is certified under the EU-U.S. Data Privacy Framework, and the EU Commission’s Standard Contractual Clauses apply in addition.

Content management system, inquiries, and usage data (Hetzner)

Our content management system, which delivers content, images, and videos, as well as the system that receives and stores inquiries submitted via our forms and usage data, are hosted on servers operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. Processing takes place exclusively in data centers in Germany. When images and videos are retrieved and when inquiries are transmitted, these servers process your IP address in access logs.

The legal basis is Article 6(1)(b) of the GDPR for inquiries; otherwise, Article 6(1)(f) of the GDPR applies. A data processing agreement pursuant to Article 28 of the GDPR is in place.

4. General Information and Required Disclosures

Legal Basis for Data Processing

If you have consented to the processing of your data, we process your personal data based on Article 6(1)(a) of the GDPR; for special categories of data, we also process it based on Article 9(2)(a) of the GDPR. If your data is necessary for the performance of a contract or for the implementation of precontractual measures, we process it based on Article 6(1)(b) of the GDPR. Processing may also be based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR. If you have consented to the storage of cookies or access to information on your device, processing is additionally based on Section 25(1) of the TDDDG.

Health Data in Counseling

MPU preparation is not possible without the processing of health data and other special categories of personal data as defined in Article 9 of the GDPR, such as information regarding alcohol or Drug use, traffic violations, or your mental state. We base this processing on your explicit consent under Article 9(2)(a) of the GDPR, which you provide when entering into the contract.

Please note: Withdrawing this consent may result in our inability to continue the counseling services, either in part or in full, because we would then lack the legal basis for the substantive work. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.

Disclosure to third parties based on a power of attorney

As part of your MPU preparation, it may be necessary for us to communicate with third parties, such as driver’s license offices, assessment centers, laboratories for Proof of abstinence, or attorneys. We will only transfer your personal data—including health data—to these entities if you have granted us a separate power of attorney and a waiver of confidentiality (Article 6(1)(a) in conjunction with Article 9(2)(a) of the GDPR). Without this authorization, we will not disclose any data to authorities or experts.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption.

5. Your Rights

You have the right to access the personal data processed about you (Article 15 of the GDPR), to have inaccurate data corrected (Article 16 of the GDPR), to have your data erased (Article 17 of the GDPR), to restriction of processing (Article 18 of the GDPR), to data portability (Article 20 of the GDPR), and to object to processing based on legitimate interests (Article 21 of the GDPR). You may object at any time, without providing a reason, to the processing of your data for direct marketing purposes.

You may revoke any consent you have given at any time with future effect, without affecting the lawfulness of the processing carried out prior to the revocation. You also have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you (Article 22 of the GDPR).

You have the right to file a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf.

6. Cookies and Consent Management

Cookies

Our website uses cookies and similar technologies, such as your browser’s local storage. Cookies are small text files and do not cause any damage to your device. We use technically necessary cookies based on Article 6(1)(f) of the GDPR and Section 25(2) of the TDDDG. Cookies for statistical, preference, and marketing purposes are set only with your consent (Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG).

Consent management with Cookiebot

Our website uses Cookiebot’s consent technology to obtain and document your consent. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. When you visit the website, a connection is established with Cookiebot’s servers; during this process, your IP address and your consent decision are processed. Cookiebot then stores a cookie in your browser to track the consents you have granted or revoked.

The legal basis is Article 6(1)(c) and (f) of the GDPR. The documentation of consent serves to fulfill our obligation to provide evidence under Article 7(1) of the GDPR. Records of consent are stored for three years from the date of grant or revocation. Processing takes place within the European Union. A data processing agreement pursuant to Article 28 of the GDPR is in place.

You can change or withdraw your consent at any time with future effect by clicking the “Cookie Settings” link in the footer of our website. If you withdraw your consent, we will delete the identifiers for the relevant category that are permanently stored in your browser.

Cookies on this website

The following automatically updated overview lists all cookies and similar technologies used on this website, including the provider, purpose, and duration of storage, as well as your current consent status. You can change your selections here at any time.

7. Contact and Inquiries

Contact form and callback request

If you contact us via the contact form, the “Get Started Now” field, or the callback request in the footer, we’ll process the information you enter there: first name, last name, area code, and phone number; the selected service; and your message in the free-text field. We do not collect an email address; we will contact you by phone.

Along with your request, we transmit technical tracking data that shows us how you arrived at our website: Ad click identifiers (such as gclid or fbclid), campaign parameters, the first page visited, the referring website, the time of the first visit, your consent status, and a location or partner identifier if you arrived via a location page. We use this data to evaluate our advertising and assign your inquiry to the correct location.

Your inquiry is stored on servers operated by Hetzner Online GmbH in Germany (see Section 3). The legal basis is Article 6(1)(b) of the GDPR, because your inquiry serves to initiate a consulting contract. For the transmission of identification data, we rely on Article 6(1)(f) of the GDPR, our legitimate interest in evaluating our advertising measures.

Special categories of personal data: When you submit an inquiry regarding MPU preparation, the selected quote and your message often contain information about alcohol or Drug use, traffic offenses, or your health. These are special categories of personal data under Article 9 of the GDPR. We process this information only with your explicit consent, which you provide when you submit the form (Article 9(2)(a) of the GDPR). You may revoke this consent at any time with future effect. If you’d rather not provide such information in writing, simply leave the message field blank; we’ll discuss everything else over the phone.

We delete inquiries that do not result in a contract six months after the last contact. If a contract is concluded, the retention periods for the counseling documentation (Section 14) apply.

Phone and Email

If you contact us by phone or email, we will store your inquiry—including all personal data contained therein—for processing. We will not share this data without your consent. The legal basis is Article 6(1)(b) of the GDPR for contractual and pre-contractual purposes, or our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

Communication via WhatsApp

The WhatsApp button on our website is a simple link; no WhatsApp script is loaded. If you use WhatsApp to contact us, your phone number, profile information, message content, and metadata will be processed. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland; processing in the U.S. is possible, as Meta is certified under the EU-U.S. Data Privacy Framework.

The legal basis for organizational communication—in particular, scheduling appointments and responding to inquiries—is Article 6(1)(b) of the GDPR; for all other matters, it is Article 6(1)(f) of the GDPR. We do not process health data or other special categories of personal data via WhatsApp. For content-related consultation topics, consultation appointments, email, and phone are available. If you nevertheless send such content, we will use it exclusively to respond to your inquiry and will not include it in the consultation documentation. Please note: Appointment cancellations via WhatsApp are only valid once we have confirmed them to you in writing.

We do not synchronize our address book with third-party contact information. Message histories are deleted no later than twelve months after the last contact.

Shared with partner locations

Some of our locations are operated by legally independent partner companies (franchisees). If you submit a request via a partner’s location page or select a partner location, we will forward your request—including the information you provided and your contact details—to that partner company so that it can contact you and provide advice. In this case, the consulting agreement is entered into with the partner company. The partner processes your data for the purpose of providing consulting services under its own responsibility and will inform you separately about data protection in the context of its consulting services.

The legal basis for data sharing is Article 6(1)(b) of the GDPR; for special categories of data, your consent is required under Article 9(2)(a) of the GDPR. You can see which locations are operated by partners in the location overview. Sections 8 and 9 of this statement describe the consulting services and payment processing for contracts with MPU Guru UG.

8. Appointment scheduling, consultation, and contract signing

Appointment scheduling via Calendly and Google Calendar

For appointment bookings, we use Calendly by Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA. To book an appointment, you enter the requested information and your preferred date. The legal basis is Article 6(1)(b) of the GDPR for pre-contractual measures; otherwise, Article 6(1)(f) of the GDPR applies. We base the transfer of data to the U.S. on the EU Commission’s Standard Contractual Clauses; Calendly is also certified under the EU-U.S. Data Privacy Framework. A data processing agreement is in place.

For internal appointment scheduling, we use Google Calendar provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Booked appointments are transferred to our calendar. The legal basis is Article 6(1)(f) of the GDPR. Google also processes data in the U.S.; Google is certified under the EU-U.S. Data Privacy Framework.

Video consultation via Google Meet

We conduct online counseling sessions via Google Meet, provided by Google Ireland Limited. The data processed includes name, email address, IP address, connection and metadata, video and audio transmission, and, where applicable, chat content. The legal basis is Article 6(1)(b) of the GDPR for the performance of the consulting contract. To the extent that health data or other special categories of personal data are disclosed during the conversation, processing is additionally based on your separately provided consent pursuant to Article 9(2)(a) of the GDPR.

Data processing in the U.S. is possible; Google is certified under the EU-U.S. Data Privacy Framework, and the Standard Contractual Clauses under the Google Workspace Data Processing Agreement pursuant to Article 28 of the GDPR also apply. Conversations are not recorded.

Transcription of counseling sessions

For documentation and quality assurance purposes, we may use the transcription feature built into Google Meet. It is activated only if our counselor asks you at the beginning of the session and you give your consent. The spoken word is converted into text in real time; audio and video data are processed only briefly for this purpose and are not stored. Only the text transcript is stored in our Google Workspace account.

The transcript contains health data and other special categories of personal data pursuant to Article 9 of the GDPR. The legal basis is Article 6(1)(a) in conjunction with Article 9(2)(a) of the GDPR. The consultation can be conducted in full even without a transcript; you may withdraw your consent at any time with future effect. Access to the transcripts is restricted exclusively to the staff members handling your case. The content is not used to train AI models. Text transcripts are deleted no later than the end of the contract, or after a maximum of 18 months.

Contract execution and certificate via PandaDoc

To finalize the consulting contract and issue your certificate of participation, we use PandaDoc from PandaDoc, Inc., 3739 Balboa St. #1049, San Francisco, CA 94121, USA. PandaDoc provides you with the document for electronic signature and records the signing process. The following data is processed: name, email address, document content, IP address, timestamp, and signature metadata. The legal basis is Article 6(1)(b) of the GDPR. Data is transferred to the U.S. based on the European Commission’s Standard Contractual Clauses, which form part of the data processing agreement pursuant to Article 28 of the GDPR. The proof of signature is retained for as long as the underlying contract is in effect, or for eight years in accordance with Section 147(3) of the German Fiscal Code (AO).

9. Payment Processing and Credit Check

Stripe

We process online payments through Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Payment options include credit card, PayPal, and Klarna; alternatively, you can pay via bank transfer to the account specified on the invoice. Stripe processes the data required for payment as a payment service provider. The legal basis is Article 6(1)(b) of the GDPR, as well as our legitimate interest in a secure and efficient payment process under Article 6(1)(f) of the GDPR. Stripe may transfer data to the United States; this transfer is based on the EU Commission’s Standard Contractual Clauses. Details: stripe.com/de/privacy.

PayPal

When paying via PayPal, including in installments, your payment information will be transmitted to PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you choose a PayPal financing product, PayPal will conduct its own credit check and is solely responsible for this process. The legal basis is Article 6(1)(b) of the GDPR.

Klarna

If you choose a payment option from Klarna, the transaction will be processed by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For this purpose, we transfer contact and order data to Klarna so that Klarna can verify whether you are eligible for the payment option. The legal basis is Article 6(1)(b) and (f) of the GDPR. Klarna processes the data on its own responsibility. For more information: klarna.com/de/datenschutz.

Credit checks and accounts receivable management (Creditreform)

Credit check prior to signing a contract: If we make an advance payment—for example, in the case of installment payments—we reserve the right to obtain identity and credit checks. For this purpose, we will transmit your name, address, and date of birth to the Verband der Vereine Creditreform e.V., Hellersbergstraße 12, 41460 Neuss. The report may contain probability values based on scientifically recognized mathematical and statistical methods. We use the result exclusively to decide whether to enter into, execute, or terminate the contractual relationship. The legal basis is Article 6(1)(f) of the GDPR. No decision is made solely by automated means within the meaning of Article 22 of the GDPR.

Debt Collection After Default: In the event of a persistent delay in payment, we will forward the data necessary for debt collection—specifically, name, address, contract details, and debt information—to Creditreform. The legal basis for this is Article 6(1)(f) of the GDPR, namely our legitimate interest in enforcing outstanding claims.

10. Analysis and Advertising

All services described in this section are loaded only after you have consented to the respective category in the cookie banner. This is managed via Google Tag Manager, operated by Google Ireland Limited. Tag Manager itself does not set cookies for analytics purposes; however, when the page loads, technical connection data—including the IP address—may be transmitted to Google. Without your consent, it does not trigger any of the following services (Google Consent Mode v2, default setting “declined”).

Google Analytics 4

We use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how our website is used. The service tracks page views as well as the following events: submission of the inquiry form and clicks on phone numbers, email addresses, or WhatsApp buttons. Google Analytics assigns this data to a pseudonymous user ID and can merge sessions across multiple devices. Google truncates the IP address before storing it.

Google Analytics is only loaded if you have consented to the “Statistics” category. The legal basis is Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. A contract for data processing has been entered into with Google. Processing may take place in the U.S.; Google is certified under the EU-U.S. Data Privacy Framework, and the Standard Contractual Clauses apply in addition.

Google Ads: Conversion attribution and remarketing

We run ads on Google Ads. To determine which ads lead to inquiries, we retrospectively match incoming inquiries to ad clicks and provide Google Ads with the results in the form of a list, which Google retrieves from us at regular intervals. The following information is transmitted for each inquiry: the click ID (gclid) assigned by Google when the ad is clicked, the name of the conversion action, the time, a value in euros, and your consent status for “Ad Data” and “Personalized Ads” according to Google Consent Mode. Names, phone numbers, or the content of your inquiry are not transmitted to Google. Inquiries from the last 90 days are taken into account.

We assign inquiries received by phone that do not have a click ID based on their temporal correlation with advertising sessions on our website. This assignment is statistical; only unambiguous cases are reported, while ambiguous cases are discarded. If we do not have a consent value for an inquiry, we report it to Google as unknown.

In addition, our Google Analytics account is linked to Google Ads. Based on the data collected in Google Analytics, we create audiences to retarget visitors to our website on the Google Display Network (remarketing). This only occurs if you have consented to the “Marketing” category.

The legal basis is your consent pursuant to Article 6(1)(a) of the GDPR. The recipient is Google Ireland Limited. Processing in the U.S. is possible; Google is certified under the EU-U.S. Data Privacy Framework, and the Standard Contractual Clauses apply in addition.

Meta Pixel

We use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, to measure the success of our ads on Facebook and Instagram. The pixel sends the “Lead” event to Meta when you submit the inquiry form or click on a phone number, email address, or WhatsApp button, along with technical data such as your IP address, browser information, and the page you visited. The content of your inquiry is not transmitted. Meta may link this data to your Meta account, if you have one.

The Meta Pixel is loaded only if you have consented to the “Marketing” category. The legal basis is Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. We and Meta are jointly responsible for the collection of data on our website and its transmission to Meta (Article 26 of the GDPR). The agreement governing this stipulates that we are responsible for providing information and ensuring compliance with data protection regulations, while Meta exercises the data subjects’ rights regarding the data stored by Meta. Further processing by Meta is carried out under Meta’s sole responsibility. Processing in the U.S. is possible; Meta is certified under the EU-U.S. Data Privacy Framework, and the Standard Contractual Clauses apply in addition. The cookies we set expire after 90 days at the latest.

Smartlook

We use Smartlook from Smartlook.com, s.r.o., Šumavská 524/31, 602 00 Brno, Czech Republic, a Cisco Group company. Smartlook records how visitors interact with our website (mouse movements, clicks, scrolling behavior, page transitions) and uses this data to create session replays and heatmaps, which we use to improve the website’s usability. Input into form fields is not recorded.

Smartlook is only loaded if you have consented to the “Statistics” category. The legal basis is Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. Processing takes place within the European Union; a data processing agreement is in place. Records are automatically deleted after the provider’s retention period, at the latest after twelve months.

11. Maps on the location pages

We display maps on our location pages. To do this, we use two services: Mapbox GL from Mapbox Inc., 740 15th St NW, Washington, DC 20005, USA, as well as an embedded map from the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom.

The maps will not load until you have consented to the “Preferences” category in the cookie banner. Before that, you will see a placeholder in their place with the “Load Map” button, which you can use to give your consent. Without your consent, no connection will be established with Mapbox or OpenStreetMap. When a map is loaded, your browser transmits your IP address, the displayed map section, and information about your browser to the respective provider.

The legal basis is your consent pursuant to Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. Mapbox processes data in the U.S.; the transfer is based on the EU Commission’s Standard Contractual Clauses. For the United Kingdom, there is an adequacy decision by the European Commission. The map of Germany in the location overview and the radius search use our own map image, hosted by us; no connection to third parties is established for this purpose.

12. Tools and Reviews

Abstinence Calculator

The abstinence calculator on this website runs entirely within your browser. The information you enter there is not transmitted to us or to third parties and is not stored. As soon as you leave the page, it is deleted.

Reviews on this website

The customer reviews shown on this website come from our public Google Business Profile, where the authors posted them themselves. We display them with the first name and the first letter of the last name, along with the star rating and review text. The legal basis is Article 6(1)(f) of the GDPR, which covers our legitimate interest in displaying publicly submitted reviews. If you no longer wish for your review to appear here, simply send an email to kontakt@deinmpuguru.de.

13. What We Deliberately Do Not Use

So you can assess which connections are not established when you visit our website:

Fonts: We load fonts from our own server. No connection is established to Google Fonts or other font services.
Videos: We host the videos on this website using our own system. We do not embed content from YouTube, Vimeo, or other video platforms.
Social media: The links to Instagram, Facebook, and TikTok in the footer are simple hyperlinks. We do not use any social media plugins; a connection to these services is only established when you click on a link.
WhatsApp, phone, and email: The corresponding buttons are simply links. No scripts from these providers are loaded.
Location search: The “Next Location” feature uses your browser’s location query only if you explicitly click on it and your browser grants permission. Your coordinates are compared with our location data exclusively within your browser and are not transmitted to us.

14. Retention Period and Data Deletion Policy

Unless a more specific retention period is stated in this privacy policy, we will retain your personal data until the purpose for processing the data no longer applies. The following retention periods apply to the most important categories of data:

Inquiries without a contract: six months after the last contact.
Website usage data without associated requests: 90 days.
Consulting documentation and case files: three years after the end of the calendar year in which the contract expired (standard statute of limitations pursuant to Sections 195, 199 of the German Civil Code (BGB)).
Meeting minutes: no later than the end of the contract, but no later than 18 months.
Participation records: three years after the end of the calendar year in which the contract ended.
Documents regarding the follow-up support guarantee: three years after the end of the calendar year in which the follow-up support was completed or denied.
Proof of consent: three years from the date of issuance or revocation.
Appointment booking data: twelve months after the appointment.
Invoices and accounting documents: eight years in accordance with Section 147(3) of the German Fiscal Code (AO) and Section 257(4) of the German Commercial Code (HGB). Business correspondence: six years; annual financial statements and accounting records: ten years.
Data in receivables management: three years after the end of the calendar year in which the receivable was settled or written off.
Backups: rolling process; files overwritten after 30 days at the latest.

If you submit a valid request for deletion or revoke your consent, your data will be deleted unless we have other legally permissible grounds for retaining it. In this case, the data will be deleted once those grounds no longer apply.

15. Changes to This Privacy Policy

We will update this privacy policy if our services or legal requirements change. The version published on this page is always the current one.