Privacy notice

1. Controller

Our data protection officer can be reached at the same address marked “Datenschutz”, or by email at datenschutz@fittakt.de.

2. Principles

We process personal data only where this is necessary to provide this website, to perform a contract, or on the basis of your consent. Data is never passed to third parties for advertising purposes, and we do not sell data.

3. Visiting this website (server log files)

When you open the website your browser transmits technically necessary data which our hosting provider stores in log files: a shortened IP address, the date and time of the request, the page requested, the volume of data transferred, the referrer and the browser identifier. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the secure and stable operation of the website. Log files are deleted after seven days.

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. A data processing agreement under Art. 28 GDPR is in place, and the transfer to the USA is based on the European Commission’s standard contractual clauses.

4. Cookies and local storage

This website sets no advertising or analytics cookies. The only items we place in your browser’s local storage are:

• the language you selected,
• the studio selected in the header, so that the site is set to the same studio on your next visit,
• your choice in the cookie notice.

These entries stay on your device, are not transmitted to us and do not allow you to be identified. The legal basis is § 25 (2) TDDG in conjunction with Art. 6 (1) (f) GDPR. You can delete them at any time in your browser settings.

5. Maps

On the Locations page we embed map sections from OpenStreetMap (OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom). The map is only loaded after you explicitly click to load it; no connection to that service is made before that. When it loads, your IP address and details of your browser are transmitted to OpenStreetMap. The legal basis is your consent under Art. 6 (1) (a) GDPR, which you can simply withhold by not loading the map.

6. Trial week requests

When you submit the trial week form we process your first and last name, email address, optionally your telephone number, the studio you chose, your preferred start date and any voluntary information about your training goal. We use this data solely to answer your enquiry and prepare the trial week.

The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into a contract). If no contract follows the trial week, we delete the data no later than three months after the last contact.

Information about your training goal may contain health data. Please tell us only what you wish to share. Where you provide such information voluntarily, we process it on the basis of your explicit consent under Art. 9 (2) (a) GDPR and delete it together with the rest of the enquiry.

7. Corporate wellness enquiries

For corporate wellness enquiries we process the company name, the name of the contact person, the email address, the approximate number of seats and your voluntary message. The legal basis is Art. 6 (1) (b) GDPR. If no contract results, we delete the data after six months. If a contract does result, the statutory commercial and tax retention periods of six and ten years apply.

8. Membership and studio operations

Within a membership we process your master data, contract data, bank details for the SEPA direct debit and your check-in times at the turnstiles. Check-in data is used to bill guest visits, to match lost property and to plan capacity; it is deleted after 30 days. Occupancy figures shown in the app are aggregated per zone and are not linked to individual members.

Information from your induction session, a medical certificate supporting a freeze, or details of pre-existing conditions are health data within the meaning of Art. 9 GDPR. We process them only with your explicit consent, only for the purpose of coaching you, and store them separately from the rest of your contract data. You may withdraw your consent at any time with effect for the future.

9. Recipients

The only recipients of your data are our hosting provider, our payment service provider for the SEPA direct debit, our tax adviser and the studio in which you train. All processors are bound by contract under Art. 28 GDPR. Apart from the hosting described in section 3, no data is transferred to third countries.

10. Your rights

You have the right at any time to

• access the data held about you (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7 (3) GDPR).

An informal message to datenschutz@fittakt.de is enough.

11. Right to lodge a complaint

You may lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

12. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Changes

We update this notice when our processing or the legal situation changes. The version published on this page applies.