Privacy Policy

This is a courtesy English translation. The German version is the legally binding original.

When you use our website, we process personal data relating to you, which is why we are obliged under Art. 13 GDPR to inform you of certain circumstances of this processing. We are pleased to fulfil this obligation with this privacy policy:

A. Explanations

For the sake of better transparency, we first explain general terms relating to the processing of personal data. The specific information obligations under Art. 13 GDPR are fulfilled under section B.

I. Personal data

Personal data is any data that can be personally attributed to you, e.g. name, address, email address, user behaviour.

II. Data processing agreement (DPA)

If personal data is processed by a provider on our behalf, a data processing agreement is required under Art. 28 GDPR. This is a contract mandated by data protection law that ensures the provider processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

III. Withdrawal

If you have given consent for data processing under Art. 6(1)(a) GDPR, Section 25(1) TDDDG, or Art. 9(2)(a) GDPR, you may withdraw that consent at any time vis-à-vis the controller, Art. 7(3) GDPR. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

IV. EU-US Data Privacy Framework

This is an agreement on data exchange between the European Union and the United States of America. It ensures the rights of data subjects whose data is processed in the USA. There is an adequacy decision by the European Commission within the meaning of Art. 45 GDPR, according to which an adequate level of protection has been established. Providers can undergo self-certification. If certified, the data transfer to that US provider is covered by the adequacy decision.

B. Information pursuant to Art. 13 GDPR

I. Controller and data protection officer

1. Controller

The controller within the meaning of Art. 4(7), 26 GDPR is

GymEdge GmbH

Hamburger Allee 140d

19063 Schwerin

represented by managing director Anna-Lena Haltermann, at the same address

Phone: 0172 9150669

Email: schwerin@gymedge.de

(see our legal notice).

2. Data protection officer

We have appointed a data protection officer, who can be reached at:

SecData GmbH

Rohrteichstraße 35a

33602 Bielefeld

represented by managing director Dr. Christoph Franke, at the same address

SecData GmbH

Data Protection Officer: Julian Schwerdfeger,

Rohrteichstraße 35a, 33602 Bielefeld

Phone: 0521/557519-333

Email: info@secdata.gmbh

or one of our postal addresses marked "the data protection officer".

II. Your rights

You have the following rights against the controller under I.1. regarding the personal data concerning you:

- Right to access,

- Right to rectification or erasure,

- Right to restriction of processing,

- Right to object to processing,

- Right to data portability.

You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data.

The competent supervisory authority can be reached at:

Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern (State Commissioner for Data Protection and Freedom of Information Mecklenburg-Vorpommern)

Schloss Schwerin

Lennéstraße 1

19053 Schwerin

Phone: +49 385 59494 0

Email: info@datenschutz-mv.de

III. Information pursuant to Art. 13(1)(c)-(f) and (2) GDPR

For the sake of better transparency, we fulfil these information obligations as we describe each specific processing activity.

1. Provision of the website (hosting) and log files

We host the content of our website with the following provider:

Hetzner Online GmbH

Industriestraße 25, 91710 Gunzenhausen

represented by managing directors Martin Hetzner, Stephan Konvickova, and Günther Müller, at the same address

Phone: +49 (0)9831 505-0

When you visit our website, the provider records various log files including your IP address. Details can be found in the provider's privacy policy: https://www.hetzner.com/de/legal/privacy-policy/.

Use of this provider is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable possible presentation of our website. Where corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the padlock symbol in your browser bar. When SSL or TLS encryption is active, the data you transmit to us cannot be read by third parties.

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

1. Browser type and version

2. Operating system used

3. Referrer URL

4. Host name of the accessing device

5. Time of the server request

6. IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website — for this, server log files must be collected.

2. Contact form and getting in touch

When you contact us by email or via a contact form, the data you provide (first name, last name, email address, phone number, and your message) is stored by us in order to answer your questions. We delete the data arising in this context, if the enquiry is assigned to a contract, after the periods applicable to the contract term, or otherwise once storage is no longer required, or we restrict processing where statutory retention obligations exist. Depending on the nature of the enquiry, the legal basis is our legitimate interest in responding to your enquiry quickly and effectively under Art. 6(1)(f) GDPR, or the implementation of pre-contractual measures under Art. 6(1)(b) GDPR. Where the enquiry can be assigned to an existing contract, the legal basis is contract performance under Art. 6(1)(b) GDPR.

3. Processing of data from your devices

In addition to the data mentioned above, when you use our website we use technical tools for various functions, in particular cookies, which may be stored on your device. When you first visit our website, and at any time thereafter, you can choose whether to allow the setting of cookies in general or which individual additional functions you wish to select. Changes can be made in your browser settings or via our consent manager. Below we first describe cookies from a technical perspective before going into more detail on your individual options, describing both technically necessary cookies and cookies you may voluntarily select or deselect.

Cookies are text files or pieces of information in a database that are stored on your hard drive and associated with the browser you use, allowing certain information to flow to the party that sets the cookie. Cookies cannot execute programs or transmit viruses to your computer; they primarily serve to make the internet offering faster and more user-friendly. This website uses the following types of cookies, whose function and legal basis we explain below: Transient cookies: These, in particular session cookies, are automatically deleted when you close your browser or log out. They contain a so-called session ID. This allows different requests from your browser to be assigned to the shared session, and your device can be recognised when you return to our website.

Persistent cookies: These are automatically deleted after a predefined period, which varies depending on the cookie. You can view the cookies set and their duration in your browser settings at any time and delete cookies manually.

Other technologies: These functions are not based on cookies but on similar technical mechanisms, such as flash cookies, HTML5 objects, or an analysis of your browser settings. The result is the same in that we can use the techniques described below. Here too, of course, you can consent or object.

Mandatory functions technically necessary to display the website: The technical structure of the website requires us to use techniques, in particular cookies. Without these techniques our website cannot be displayed (fully correctly) or the support functions could not be made possible. These are generally transient cookies that are deleted at the end of your website visit, at the latest when you close your browser. You cannot opt out of these cookies if you wish to use our website. The individual cookies are shown in the consent manager.

Optional cookies subject to your consent: We only set various cookies with your consent, which you can select on your first visit to our website via the so-called cookie consent tool. These functions are only activated if you consent and can, in particular, help us analyse and improve visits to our website, make it easier for you to use across different browsers or devices, recognise you on a return visit, or serve advertising (possibly also to tailor advertising to interests, measure ad effectiveness, or show interest-based advertising). The legal basis for this processing is Art. 6(1) sentence 1(a) GDPR, Section 25(1) TDDDG.

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out until withdrawal.

The functions we use, which you can individually select and withdraw again via the consent manager, are described below.

a. Consent tool

To obtain and manage your consent to data processing, we use our own, self-operated consent tool. It runs exclusively in your browser. No data is transmitted to third parties or to servers outside this website.

Your selection (which categories of cookies or functions you allow), the time of your selection, and a version identifier are stored locally on your device (in your browser's so-called "local storage"). Personal data such as your IP address is not processed or transmitted in this process.

Your selection remains stored until you change or withdraw it via the consent manager, or clear your browser's local storage. You can adjust or withdraw your settings at any time via the "Cookie settings" link in the footer of the website.

The legal basis for this processing is our legal obligation to document consent given (Art. 7(1) GDPR) pursuant to Art. 6(1)(c) GDPR.

b. Google reCAPTCHA

To protect your enquiries submitted via web form, we use the reCAPTCHA service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. This confirmation serves to distinguish whether an input was made by a human or fraudulently by automated, machine processing (e.g. bots). To carry out this check, the following data is transmitted to the provider:

- IP address of the website visitor

- Date

- a complete screenshot of the browser window

- Referrer URL (the address of the page the visitor came from)

- Browser plugins

- Information about the operating system (Windows, Linux, iOS)

- Cookies such as other Google cookies from the last 6 months, as well as NID cookies, which are suitable for creating user profiles

- and settings of the user's device (e.g. language settings, location, browser, etc.).

Your IP address is shortened by the provider within the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a server of the provider in the USA and shortened there.

The provider is an active participant in the EU-US Data Privacy Framework, which sets out rules for safe data transfer to the USA. In addition, the provider uses standard contractual clauses within the meaning of Art. 46(2), (3) GDPR, which are intended to ensure that data processing is equivalent to European standards. The EU Commission has assessed these clauses in an implementing decision as adequate safeguards for the transfer of personal data to the USA.

The IP address transmitted by your browser as part of reCAPTCHA is not merged with other data from the provider. The provider's separate privacy policy applies to this data. Further information on the provider's privacy policy can be found at: https://policies.google.com/privacy. The legal basis for this processing is our legitimate interest in protecting our website against bot attacks and spam through automated, machine requests within the meaning of Art. 6(1)(f) GDPR.

c. Facebook Pixel

We use the visitor action pixel of the provider Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland to measure conversions of visitors to our website. Conversion measurement allows the behaviour of the site visitor to be tracked after they have been redirected to our website by clicking on a Facebook advertisement. This allows the efficiency of advertising via Facebook to be determined for statistical purposes and market research, which helps optimise future advertising measures.

We have no access to the data collected in this way, so we cannot draw any conclusions about the identity of individual visitors. The provider processes this data and can also establish a connection to your possible user profile with the provider. The provider thus also uses this data for its own advertising purposes. We have no influence over this.

The legal basis for using the Facebook Pixel is our legitimate interest in effective advertising via social media within the meaning of Art. 6(1)(f) GDPR. Where we request your consent, the legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Your consent is freely revocable. The provider also processes your data in the USA. The provider is an active participant in the EU-US Data Privacy Framework, which sets out rules for safe data transfer to the USA. In addition, the provider uses standard contractual clauses within the meaning of Art. 46(2), (3) GDPR, which are intended to ensure that data processing is equivalent to European standards. The EU Commission has assessed these clauses in an implementing decision as adequate safeguards for the transfer of personal data to the USA. Further information from the provider can be found at: https://de-de.facebook.com/privacy/policy/.

d. Google Tag Manager

We use the Tag Manager of the provider Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager helps us embed statistics and analytics tools on our website. The Tag Manager itself does not store cookies and has no analytics functions of its own. The Tag Manager therefore only records your IP address. Google acts as a processor and we have concluded a corresponding contract with Google.

The information generated by the cookie and the (generally shortened) IP addresses regarding your use of this website are generally transmitted to a Google server in the USA and processed there. The provider is an active participant in the EU-US Data Privacy Framework, which sets out rules for safe data transfer to the USA. In addition, the provider uses standard contractual clauses within the meaning of Art. 46(2), (3) GDPR, which are intended to ensure that data processing is equivalent to European standards. The EU Commission has assessed these clauses in an implementing decision as adequate safeguards for the transfer of personal data to the USA. Further information from the provider can be found at: https://policies.google.com/privacy/frameworks?hl=en.

The legal basis is our legitimate interest in the quick and straightforward integration of various analytics and statistics tools under Art. 6(1)(f) GDPR. Where we request your consent, processing is based on Art. 6(1)(a) GDPR. Your consent is freely revocable.

e. Google Ads

We use Google Ads to draw attention to our offerings by means of advertisements. If you reach our website via a Google advert, Google Ads will store a cookie on your device. The legal basis for processing your data is Art. 6(1) sentence 1(a) GDPR, Section 25(1) TDDDG, i.e. this is only embedded with your consent.

Advertising material is delivered by Google via so-called "ad servers". For this, we and other websites use so-called ad server cookies, which can measure certain parameters for success measurement, such as ad impressions or clicks by users. Via the Google Ads cookies stored on our website, we can obtain information about the success of our advertising campaigns. These cookies are not intended to identify you personally. Analytics values typically stored with this cookie include the unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions), and opt-out information (a marker that a user no longer wishes to be addressed).

The cookies set by Google allow Google to recognise your internet browser. If a user visits certain pages of an Ads customer's website and the cookie stored on their computer has not yet expired, Google and the customer can determine that the user clicked on the advert and was redirected to that page. Each Ads customer is assigned a different cookie, so the cookies cannot be tracked across the websites of other Ads customers. Through the integration of Google Ads, Google receives the information that you have accessed the corresponding part of our website or clicked on an advert from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or not logged in, it is possible that the provider may determine and store your IP address.

Due to the marketing tools used, your browser automatically establishes a direct connection with Google's server. We ourselves do not independently collect personal data as part of the advertising measures described; we merely provide Google with the ability to collect data. We only receive statistical evaluations from Google, which show which adverts were clicked how often at which prices. We do not receive any further data from the use of the advertising material, and in particular we cannot identify users from this information.

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out until withdrawal. The easiest way to withdraw is via our consent manager, or via the following options:

1. by an appropriate setting in your browser software; in particular, suppressing third-party cookies means you will not receive adverts from third-party providers;

2. by setting your browser to block cookies from the domain "www.googleadservices.com", www.google.de/settings/ads, whereby this setting is deleted if you clear your cookies;

3. by deactivating interest-based advertising from providers that are part of the "About Ads" self-regulation campaign, via the link www.aboutads.info/choices, whereby this setting is deleted if you clear your cookies;

4. by permanent deactivation in your Firefox, Internet Explorer, or Google Chrome browsers via the link www.google.com/settings/ads/plugin. Please note that in this case you may not be able to use all functions of this offering in full.

The provider also processes data in the USA. The USA is generally considered an unsafe third country. However, the provider is an active participant in the EU-US Data Privacy Framework, which sets out rules for safe data transfer to the USA. In addition, the provider uses standard contractual clauses within the meaning of Art. 46(2), (3) GDPR, which are intended to ensure that data processing is equivalent to European standards. The EU Commission has assessed these clauses in an implementing decision as adequate safeguards for the transfer of personal data to the USA.

Further information on data protection at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, can be found here: www.google.com/intl/en/policies/privacy and services.google.com/sitestats/en.html.

f. Google Analytics

This website uses Google Analytics, a web tracking service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The purpose of our use of this tool is to enable analysis of your user interactions on websites and in apps, and to improve our offering and make it more interesting for you as a user through the statistics and reports obtained.

We record the interactions between you as a website user and our website primarily using cookies, device/browser data, IP addresses, and website or app activities. Google Analytics also records your IP address to ensure the security of the service and to give us, as the website operator, information about which country, region, or location the respective user comes from (so-called "IP location determination"). For your protection, however, we of course use the anonymisation function ("IP masking"), meaning that Google shortens IP addresses by the last octet within the EU/EEA.

The legal basis for collecting and further processing this information (which is retained for a maximum of 14 months) is your consent (Art. 6(1) sentence 1(a) GDPR, Section 25(1) TDDDG). You may withdraw your consent at any time, without affecting the lawfulness of processing carried out until withdrawal. In apps you can reset the advertising ID under the Android or iOS settings. The easiest way to withdraw is via our consent manager, or by installing Google's browser add-on, available via the following link: tools.google.com/dlpage/gaoptout?hl=en/.

Google acts as a processor and we have concluded a corresponding contract with Google. The information generated by the cookie and the (generally shortened) IP addresses regarding your use of this website are generally transmitted to a Google server in the USA and processed there.

In principle, the USA is an unsafe third country within the meaning of Art. 44 GDPR. However, with the EU-US Privacy Framework, there is an adequacy decision by the European Commission within the meaning of Art. 45 GDPR, according to which an adequate level of protection has been established. The provider has subjected itself to self-certification as an active member.

Further information on the scope of Google Analytics is available at marketingplatform.google.com/about/analytics/terms/en/. Information on data processing when using Google Analytics is provided by Google at the following link: support.google.com/analytics/answer/6004245?hl=en/. General information on data processing, which according to Google also applies to Google Analytics, is available in Google's privacy policy at www.google.com/intl/en/policies/privacy/.

g. TikTok Pixel

We use the TikTok Pixel from provider TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok") on our website to measure conversions of visitors to our website. Conversion measurement allows the behaviour of site visitors to be tracked after they have been redirected to our website by clicking on a TikTok advertisement. This allows the efficiency of our advertising on TikTok to be evaluated for statistical purposes and market research, which serves to optimise future advertising measures. In addition, visitors to our website may be shown interest-based advertisements on TikTok.

In particular, the following data is processed: IP address, information on browser and device, pages visited, and interaction and conversion events. We have no access to the data collected in this way in a form that allows conclusions about the identity of individual visitors. The provider processes this data and can establish a connection to your possible TikTok user profile and also use the data for its own advertising purposes. We have no influence over this.

The legal basis for using the TikTok Pixel is your consent under Art. 6(1) sentence 1(a) GDPR in conjunction with Section 25(1) TDDDG, i.e. it is only embedded with your consent via our consent manager. Your consent is freely revocable at any time, without affecting the lawfulness of processing carried out until withdrawal. The easiest way to withdraw is via our consent manager.

The provider also processes data in third countries outside the EU/EEA, in particular in the USA and Singapore; processing in further third countries such as China cannot be ruled out. The provider bases the transfer on standard contractual clauses within the meaning of Art. 46(2), (3) GDPR, which are intended to ensure that data processing is equivalent to European standards. We have no influence on the scope, location, and duration of storage, or any onward disclosures by TikTok. Further information from the provider can be found at: https://www.tiktok.com/legal/page/eea/privacy-policy/de.

h. Magicline class schedule widget

On our "Classes" page, we embed the live class schedule widget from provider Magicline GmbH, Raboisen 6, 20095 Hamburg (technically served via the domain courseplan.noexcuse.io) to show you our current group class schedule and allow direct booking via the customer portal. Loading the widget establishes a connection to the provider's servers, which technically transmits your IP address as well as information about your browser and device.

The legal basis for using the widget is your consent pursuant to Art. 6(1) sentence 1(a) GDPR in conjunction with Section 25(1) TDDDG, i.e. it is only embedded after your consent to the "External media" category via our consent manager. Your consent is freely revocable at any time, without affecting the lawfulness of processing carried out based on the consent before its withdrawal. The easiest way to withdraw your consent is via our consent manager.

4. Our presence on social networks

We maintain various profiles on so-called social media platforms. We operate these profiles with the following providers:

- Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, represented by Richard Kelly; https://www.facebook.com/privacy/policy/); Our profile: https://www.instagram.com/gymedge_schwerin/;

- TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, represented by Cormac Keenan, Richard Martin Baillie Waterworth; https://www.tiktok.com/legal/page/eea/privacy-policy/de); Our profile: https://www.tiktok.com/@gymedge_schwerin

We rely on the technical platform and services of these providers for these information services. Please note that you use our social media presences and their functions at your own responsibility. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating). When you visit our profiles, the social media platform providers record, among other things, your IP address and other information present in the form of cookies on your device. This information is used to provide us, as operators of the accounts, with statistical information about interactions with us.

The data collected about you in this context is processed by the platforms and may be transferred to countries outside the European Union, in particular the USA. The providers Meta and Google are active participants in the EU-US Data Privacy Framework, for which the European Commission has established an adequate level of protection within the meaning of Art. 45 GDPR.

We note that the provider TikTok processes data in unsafe third countries such as the USA and China. We have no influence over processing by TikTok. Furthermore, it is not apparent to us to what extent, where, and for how long the data is stored, to what extent TikTok complies with existing deletion obligations, what analyses and linkages are made with the data, and to whom the data is passed on.

We are not aware of how the social media platforms use the data from your visit to our account and interaction with our posts for their own purposes, how long this data is stored, or whether data is passed on to third parties. Data processing may differ depending on whether you are registered and logged in with the social network, or visit the page as a non-registered and/or non-logged-in user. When accessing a post or the account, the IP address assigned to your device is transmitted to the social media platform provider. If you are currently logged in as a user, a cookie on your device can be used to trace how you have moved around the network. Through buttons embedded in websites, the platforms can record your visits to these websites and assign them to your respective profile. Based on this data, content or advertising can be tailored to you. If you wish to avoid this, you should log out or deactivate the "stay logged in" function, delete the cookies present on your device, and restart your browser.

As provider of the information service, we otherwise only process the data from your use of our service that you provide to us and that requires an interaction. If, for example, you ask a question that we can only answer by email, we will store your information in accordance with the general principles of our data processing described in this privacy policy. The legal basis is our legitimate interest in the promotional presentation of our company under Art. 6(1) sentence 1(f) GDPR.

To exercise your data subject rights, you can contact either us or the social media platform provider. Where one party is not responsible for answering, or the information must be obtained from the other party, we or the provider will forward your request to the respective partner. Please contact the social media platform operator directly for questions about profiling and processing of your data when using the website. For questions about the processing of your interaction with us on our page, please write to the contact details given above.

The providers describe in their privacy policies (see links in the table above) what information the social media platform receives and how it is used. There you will also find information on contact options and on advertising settings. Further information on social networks and how you can protect your data can also be found at www.youngdata.de.

5. Online applications

You have the option of applying to us by email at schwerin@gymedge.de. In doing so, we collect your email address and any other personal data you provide, such as first name, last name, phone number, photo, CV, cover letter, or references. The purpose of processing is to handle your application and the subsequent contact.

The legal basis for processing is pre-contractual measures relating to your application under Section 26(1) BDSG in conjunction with Art. 6(1)(b), Art. 88 GDPR.

If no employment relationship is concluded, we process applicant data to safeguard our legitimate interest in defending against legal claims and as evidence within the meaning of Art. 6(1)(f) GDPR.

We delete your applicant data no later than the end of the third year after conclusion of the application process, subject to statutory retention obligations or further processing rights.

6. Booking a trial session and consultation

You have the option to book an appointment for a trial session and consultation via the contact form at https://gymedge.de/en/probetraining. For this, we collect the following personal data: gender, name, first name, date of birth, purpose of contact, email address, phone number, and your preferred appointment time. Optionally you can provide your address and country. We will then contact you by phone or email to confirm the appointment and send you further information about our offering. We delete the data arising in this context, if the enquiry is assigned to a contract, after the periods applicable to the contract term, or otherwise once storage is no longer required, or we restrict processing where statutory retention obligations exist. Should no contract be concluded, the data collected in this way is regularly deleted after the standard three-year limitation period. The legal basis is the implementation of pre-contractual measures under Art. 6(1)(b) GDPR.

If you book a trial session via our website, your above-mentioned data is entered into our management software Magicline for the purpose of appointment and customer management. The provider of this software solution is Magicline GmbH, Raboisen 6, 20095 Hamburg. The provider acts as a processor. We have concluded a corresponding agreement with the provider.

7. Becoming a member

You have the option of signing up for a membership at our fitness studio via our website using the contact form at https://gymedge.de/en/mitglied-werden. To process the conclusion of the contract, you are required to provide your personal data (gender, name, address, account holder, IBAN, email address, date of birth, phone number, address, training start date, contract start date) via a contact form, which we need in order to perform the contractual relationship. The legal basis is contract performance under Art. 6(1)(b) GDPR.

For payment, you can grant us a SEPA direct debit mandate. We pass your payment data on to our house bank for payment processing. The legal basis for this is contract performance under Art. 6(1) sentence 1(b) GDPR.

We are obliged under commercial and tax law requirements to store your address, payment, and order data for ten years. This follows, among other things, from Section 147(3) of the German Fiscal Code (Abgabenordnung) and Section 257(4) of the German Commercial Code (HGB).

If you take out a membership via our website, your above-mentioned data is entered into our management software Magicline for the purpose of member administration. The provider of this software solution is Magicline GmbH, Raboisen 6, 20095 Hamburg. The provider acts as a processor. We have concluded a corresponding agreement with the provider.

8. Cancellation button

When you contact us via the contact form accessible through the "cancel now" button, the data you provide (first name, last name, date of birth, membership number, cancellation date, reason for cancellation, and any additional information) is stored by us in order to process your cancellation. We delete the data arising in this context, if the enquiry is assigned to a contract, three years after the end of the relevant membership contract, or otherwise once storage is no longer required, or we restrict processing where statutory retention obligations exist. Under Section 312k(1), (2) BGB we are legally obliged to provide such a cancellation button. The legal basis for this data processing is therefore Art. 6(1)(c) GDPR.

Your details are passed on for processing to the provider of our management software, Magicline GmbH, Raboisen 6, 20095 Hamburg. The provider acts as a processor. We have concluded a corresponding agreement with the provider.