Privacy Policy

Last updated: June 2026. This English text is provided for information only; the German version is legally binding.

1. Controller

Ernest Gaigulo, STRONGFIT Gym (sole trader), Gräfstraße 113, 81241 München · +49 (0) 176 60937184 · info@strongfitgym.de. No data protection officer is required (Art. 37 GDPR); enquiries go directly to the email above.

2. Principles

We process personal data only as necessary to provide a functional website and our services, generally on consent. Legal bases: Art. 6(1)(a)(b)(c)(f) and Art. 9(2)(a). Data is erased once the purpose lapses, subject to statutory retention (§ 257 HGB, § 147 AO).

3. Hosting (Hetzner)

Hosted with Hetzner Online GmbH, Gunzenhausen, Germany (Nuremberg data centre). Standard server log files are recorded for secure, stable operation only; Art. 6(1)(f). An Art. 28 data processing agreement is in place; processing takes place exclusively within the EU/EEA.

4. Consent management (Cookiebot)

We use Cookiebot by Usercentrics A/S, Copenhagen, Denmark (Art. 28 DPA in place). A consent banner appears on first visit (Necessary, Statistics, Marketing); your choice is stored in the CookieConsent cookie (12 months) and can be withdrawn or changed at any time via the cookie settings. Legal basis: Art. 6(1)(c) together with Art. 7. The spam-protection function used on the newsletter sign-up page (Google reCAPTCHA, see section 8.4) is technically necessary and is assigned to the "Necessary" category in the banner.

5. Contact form

We collect name, email address and your message. To prevent spam and abuse your IP address is stored only as a salted cryptographic hash (never in clear text). Used solely to handle your enquiry; the notification email is sent via Brevo (section 8). Legal basis: Art. 6(1)(b) and (f). Retention: 180 days after handling, subject to statutory periods.

6. Analytics (Google Analytics 4)

Only with your consent via the banner we use Google Analytics 4 by Google Ireland Limited, Dublin 4 (parent: Google LLC, USA). An Art. 28 DPA is in place (Google Ads Data Processing Terms; third-country transfers safeguarded by the EU-US Data Privacy Framework / standard contractual clauses). We use Google Consent Mode: no analytics cookies and no transfer without consent; IP processing is truncated. US transfer to Google LLC under the EU-US DPF. Legal basis: Art. 6(1)(a); withdraw any time via the cookie settings. Privacy: https://policies.google.com/privacy

7. Marketing (Meta Pixel)

Only on Marketing consent the Meta Pixel of Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland is active. Purposes: PageView reach measurement of our Facebook/Instagram ads and Lead conversion tracking via our forms. For measurement/analysis Meta Ireland is our processor (Business Tools Terms with the Meta Data Processing Terms); for collecting and transmitting event data we and Meta Ireland are joint controllers (Art. 26 GDPR). US transfer to Meta Platforms, Inc. under the EU-US DPF (plus SCCs). Legal basis: Art. 6(1)(a); withdraw via the cookie settings. Meta privacy: https://www.facebook.com/about/privacy/

8. Newsletter and sign-up form (Brevo, Google reCAPTCHA)

8.1 Sign-up and sending. If you sign up for our emails through the sign-up form on this website (including via a link from our Instagram channel), we currently send you about one email a week with information about the products and services of our online nutrition coaching. Emails are sent via Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France), a service provider based in the EU. We collect: your email address (required), the language of the sign-up page (German or English), the time of sign-up and confirmation, and your IP address as proof of consent. We use the double opt-in procedure: you are added to the mailing list only after you click the link in the confirmation email; until then we send you nothing further. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future — via the unsubscribe link in every email or by emailing info@strongfitgym.de.

8.2 Performance measurement. Our emails contain tracking pixels and tracking links. Brevo uses them to record whether and when an email was opened and which links were clicked. We use this to improve our content.

8.3 Members and customers. If you are a member or customer of STRONGFIT Gym and we received your email address in connection with one of our services, we also use it to tell you by email about similar offers of our own, such as the online nutrition coaching. Legal basis: Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG (German Unfair Competition Act). You can object to this use at any time (Art. 21(2) GDPR) at no cost other than the transmission costs at basic rates — via the unsubscribe link in every email or by emailing info@strongfitgym.de.

8.4 Sign-up form and spam protection (Google reCAPTCHA). The form is provided by Brevo. When you open the sign-up page, your browser therefore loads scripts and style sheets from sibforms.com (Brevo); your IP address is transmitted to Brevo as a technical necessity. To protect against automated sign-ups that could trigger confirmation emails to uninvolved third parties, we use Google reCAPTCHA (version 2, "I'm not a robot" checkbox) on the sign-up page, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent: Google LLC, USA). This transmits, among other things, your IP address, browser and device information, time on page and mouse movements to Google, and a cookie (_GRECAPTCHA) may be set. reCAPTCHA is loaded only on the sign-up page, not on the rest of this website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the form from abuse) and § 25(2) no. 2 TDDDG (technically necessary). Transfer to Google LLC (USA) under the EU-US Data Privacy Framework. Google privacy policy: https://policies.google.com/privacy

8.5 Retention and data processing. We keep your data until you unsubscribe. After unsubscribing, your email address stays only on a suppression list so that we do not email you again (Art. 6(1)(f) GDPR); consent-proof logs are kept for up to 3 years. A data processing agreement under Art. 28 GDPR is in place with Brevo (including EU standard contractual clauses for any transfers by sub-processors).

9. Class booking (Eversports)

Our group-training page embeds a widget of Eversport GmbH, Jakov-Lind-Straße 13, 1020 Vienna, Austria, to display the schedule and book classes. An Art. 28 DPA (AVV) is in place. Loading transmits technical connection data (IP, browser); a booking processes booking data (name, email, possibly payment data). Eversports is EU-based (Austria), but processing partly also takes place in the USA and Canada; an adequate level of protection is ensured by European Commission adequacy decisions (Art. 45 GDPR; Canada and the EU-US DPF). Legal basis: Art. 6(1)(f) display and (b) booking. Privacy: https://www.eversports.com/datenschutz

10. Appointment booking (TidyCal)

For individual and consultation appointments we link to the booking tool of Sumo Group Inc. (d/b/a "TidyCal"), 1305 E. 6th St #3, Austin, TX 78702, USA. The tool is not embedded on our website — it opens only when you actively click the booking button, in a new tab on tidycal.com. Only then is data transmitted to TidyCal: technical connection data (IP, browser) and, for a booking, the booking details (name, email, appointment details). As TidyCal is US-based this involves a third-country transfer to the USA; the specific safeguard (standard contractual clauses or the EU-US Data Privacy Framework) is currently under review. Legal basis: Art. 6(1)(b) (booking / pre-contractual measures) and (f) (providing the booking function). DPA: https://tidycal.com/dpa

11. Google Reviews

Customer reviews may be displayed, provided by Google Ireland Limited, Dublin 4 (parent: Google LLC, USA). Where reviews are rendered server-side, no data is transmitted to Google on page load. Where embedded content loads client-side, IP and device information are transmitted to Google; US transfer under the EU-US DPF. Legal basis: Art. 6(1)(f). Privacy: https://policies.google.com/privacy

12. Error monitoring (Sentry)

To ensure stable operation and diagnose errors we use Sentry (Functional Software, Inc., EU region). Technical error data is processed (e.g. URL, browser type, time, error details). Collection of personal data is disabled (no PII); sensitive fields are scrubbed server-side. A signed Art. 28 DPA is in place (EU-region storage; any third-country transfers safeguarded by the EU-US DPF and SCCs). Legal basis: Art. 6(1)(f).

13. Payments (Stripe / PayPal)

For paid bookings and memberships we use Stripe Payments Europe Ltd. (Dublin, Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). PayPal is currently embedded technically via Stripe. On payment, the relevant data (name, email, payment method, amount) is transmitted directly to the respective provider, which processes it as an independent controller under its own terms. Card data is never stored on our servers (Stripe: SAQ A). Any third-country transfers occur under the respective safeguards (EU SCCs or the EU-US DPF). Legal basis: Art. 6(1)(b) and (f). Privacy: https://stripe.com/privacy · https://www.paypal.com/de/legalhub/privacy-full

14. Your rights

Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and withdrawal of consent with future effect (Art. 7(3); cookie consents via the cookie settings). Right to complain (Art. 77): Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, poststelle@lda.bayern.de, https://www.lda.bayern.de

15. Privacy contact

Ernest Gaigulo — STRONGFIT Gym, Gräfstraße 113, 81241 München · info@strongfitgym.de. We respond without undue delay, at the latest within one month (Art. 12(3)).

16. Changes to this policy

We adapt this policy when legal requirements change or new services are added; the currently published version applies. As of June 2026 | STRONGFIT Gym, München