Privacy Policy

§ 1 Controller and contact person

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

The contact person for data protection matters is the Managing Director, using the contact details above. Our company is not under a statutory obligation to appoint a data protection officer.

§ 2 Note on data processing outside the EU

The controller is based in the United Arab Emirates (Dubai) and therefore outside the European Union and the European Economic Area. Since we deliberately direct our services at people resident in the EU, the GDPR applies to the processing of personal data pursuant to Art. 3(2) GDPR.

By using our website and making use of our services, personal data is transferred to a controller in a third country (UAE). Depending on the processing situation, the legal basis for this is your consent (Art. 6(1)(a) GDPR), the necessity for the performance of a contract or for pre-contractual measures (Art. 6(1)(b) GDPR), or our legitimate interest (Art. 6(1)(f) GDPR). We take appropriate technical and organisational measures to ensure a level of protection comparable to that under EU law.

§ 3 General information on data processing

As a matter of principle, we process users' personal data only insofar as this is necessary to provide a functioning website together with our content and services, or where a legal basis permits it.

Depending on the processing situation, we base the processing on Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures), Art. 6(1)(c) GDPR (compliance with legal obligations) or Art. 6(1)(f) GDPR (legitimate interests).

Where service providers are based outside the EU or the EEA, the transfer takes place on the basis of an adequacy decision of the EU Commission (for example the EU-US Data Privacy Framework, Canada), EU standard contractual clauses (Art. 46(2)(c) GDPR) or your consent.

Personal data is deleted as soon as the purpose of storage no longer applies, unless statutory retention obligations or contractual reasons prevent deletion (see § 17).

§ 4 Rights of the data subject

If your personal data is processed, you have the following rights in relation to the controller:

• Right of access (Art. 15 GDPR): you can request information about whether and which data we process about you.
• Right to rectification (Art. 16 GDPR): you can request the correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR): you can request the deletion of your data, provided no statutory retention obligations prevent it.
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR): you can request to receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): you can object to processing on grounds relating to your particular situation; you can object to direct marketing at any time without giving reasons.
• Withdrawal of consent (Art. 7(3) GDPR): you can withdraw consent you have given at any time with effect for the future.
• Right to lodge a complaint (Art. 77 GDPR): you have the right to lodge a complaint with a data protection supervisory authority.

An informal message to jeremy@jeremywiederkehr.com is enough to exercise your rights.

§ 5 Provision of the website, hosting and log files

Our website is hosted with Netlify, Inc., San Francisco, USA. Each time our website is accessed, information is automatically collected that your browser transmits to the server: browser type and version, operating system, referrer URL, IP address, and the date and time of access. This data is stored in log files; it is not combined with other personal data.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in delivering the website, ensuring system security and technical optimisation. Log file data is deleted or anonymised after seven days at the latest. The transfer to the USA takes place on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses.

For a consistent presentation of typefaces, the website uses Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When the page is called up, your browser loads the fonts from Google servers, and your IP address is transmitted to Google in the process. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a consistent and appealing presentation).

§ 6 Cookies and consent

Our website uses cookies and comparable technologies. Cookies are small text files that are stored on your device and serve to recognise the browser.

We use technically necessary cookies to provide basic functions (for example language settings and session management). The legal basis is Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG.

We only use analytics and marketing cookies (see § 7) if you have consented to this through our cookie banner. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can withdraw consent you have given at any time with effect for the future by reopening the banner through the „Cookie settings“ link in the footer and selecting „Decline“.

You can also manage or delete cookies at any time through your browser settings. Deactivating them may mean that not all functions of the website can be used in full.

§ 7 Web analytics and marketing

On our website we use, or plan to use, the following services, and only with your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG):

Microsoft Clarity

Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, Dublin, Ireland; parent company: Microsoft Corporation, USA) analyses usage behaviour on our website by means of heatmaps and session recordings (mouse movements, clicks, scrolling behaviour). The data helps us improve the website. The transfer to the USA takes place on the basis of the EU-US Data Privacy Framework. Further information: privacy.microsoft.com.

Google Analytics

Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) analyses the use of our website (for example pages visited, time on page, approximate location). IP addresses are processed in truncated form. The transfer to the USA (Google LLC) takes place on the basis of the EU-US Data Privacy Framework. Further information: policies.google.com/privacy.

Meta pixel

The Meta pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) allows us to measure the effectiveness of our adverts on Facebook and Instagram and to show visitors to our website relevant adverts there (retargeting, custom audiences). Data may be transferred to Meta Platforms, Inc. in the USA in the process (EU-US Data Privacy Framework). Further information: facebook.com/privacy/policy.

HubSpot tracking

Our pages use tracking technology from HubSpot (the „hubspotutk“ cookie among others), which assigns page views and form submissions to a contact in our CRM (see § 11). The provider is HubSpot, Inc., Cambridge, MA, USA; the data is held for us in HubSpot's EU data centre. Further information: legal.hubspot.com/privacy-policy.

§ 8 Forms (free content and application)

On our website we offer forms through which you can request free content or apply for a free intro call. The following in particular is processed: first and last name, email address, telephone number, your answers to the application questions (for example goal, situation, age) as well as the date and time of the enquiry.

To secure your enquiry, the form data is transferred step by step to our CRM (HubSpot, see § 11) while you are still filling the form in, from the point at which you enter your email address, so that your details are not lost if you break off.

The purpose of the processing is to deal with your enquiry, to send the content you requested, to arrange a free intro call, and to initiate a possible coaching relationship. The legal basis is Art. 6(1)(a) GDPR (consent) or Art. 6(1)(b) GDPR (pre-contractual measures).

You can also get in touch by email, telephone or WhatsApp. The data transmitted in the process is used exclusively to deal with your enquiry.

§ 9 Appointment booking

For booking the intro call we use the meetings tool from HubSpot (HubSpot, Inc., USA; EU data centre). Name, email address, telephone number where applicable, and the chosen appointment are processed in the process. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures).

§ 10 Email marketing and newsletter

If you request free content or sign up for our newsletter, you will receive emails from us with content on training, nutrition and coaching. We use Kit (formerly ConvertKit; ConvertKit LLC, Boise, Idaho, USA) to send them. The transfer to the USA takes place on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses.

We process your email address, your first name, the date of sign-up, and language and segmentation attributes (for example which page you signed up through). The sign-up is logged (time and data transmitted) in order to be able to demonstrate consent.

Measurement of success: the emails sent contain technologies that measure open and click rates. This evaluation only takes place on the basis of your consent (Art. 6(1)(a) GDPR), which you give when you sign up.

The legal basis for sending is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the unsubscribe link in every email or by an informal message to us; this ends both the sending and the measurement. After you unsubscribe, your data is removed from the distribution list unless retention obligations prevent this.

§ 11 CRM, client communication and internal tools

We use the following services to manage enquiries, prospective clients and clients:

• HubSpot (HubSpot, Inc., USA; data held in the EU data centre) – CRM, contact and client management, form and appointment management.
• WhatsApp (WhatsApp Ireland Limited / Meta Platforms Ireland Limited, Ireland) – client communication and coaching support. When WhatsApp is used, data (for example your telephone number) is transferred to Meta and may be processed in third countries.
• Cooby (Cooby, Inc.; based outside the EU and the EEA) – synchronises WhatsApp conversations with our CRM (HubSpot). The purpose is a consistent, traceable client history and reliable support. The legal basis is Art. 6(1)(b) GDPR (performance or initiation of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient client support). The transfer takes place on the basis of EU standard contractual clauses.
• Zapier (Zapier, Inc., San Francisco, USA) – automated data transfer between our systems (for example between HubSpot and Kit).
• Google Workspace / Google Drive (Google Ireland Limited, Ireland) – email and document management.
• Slack (Slack Technologies Limited, Ireland / Salesforce, Inc., USA) – internal communication.
• Trello (Atlassian Pty Ltd., Australia) – project organisation.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient business organisation). Where necessary, data processing agreements are in place with the providers; transfers to third countries take place on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses.

§ 12 Video calls (Zoom) and recording of the conclusion of the contract

We hold consultation and sales calls via Zoom (Zoom Video Communications, Inc., San Jose, USA). Your name, your email address, connection data and the audio and video of the call are processed in the process. The transfer to the USA takes place on the basis of the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR (initiation and performance of a contract).

Recording of the conclusion of the contract: if a contract is concluded during the call, we record the relevant part of the call. The recording only takes place with your prior consent (Art. 6(1)(a) GDPR); in addition, we base the storage on our legitimate interest in securing evidence of the contents of the contract (Art. 6(1)(f) GDPR). The recording is stored confidentially, is not passed on to third parties, and is deleted no later than three years after the end of the contract.

§ 13 Coaching app (Trainerize)

For ongoing support we use the coaching app ABC Trainerize (Trainerize Inc., Vancouver, Canada; part of ABC Fitness Solutions, LLC, USA). The following in particular is processed in the app: your master data, training plans and completed sessions, check-in data (for example weight, photos, measurements, how you are feeling) and the communication within the app.

Where health data is processed in the course of this, it is done on the basis of your explicit consent (Art. 9(2)(a) GDPR); otherwise the legal basis is Art. 6(1)(b) GDPR (performance of a contract). An adequacy decision of the EU Commission exists for Canada; transfers to the USA take place on the basis of EU standard contractual clauses. Further information: trainerize.com/privacy-policy.

§ 14 Information for clients and prospective clients

Within the client relationship, pre-contractual measures and the free intro call, we process the following data in particular: name, address, email, telephone number, age, gender, health-related information (weight, height, relevant pre-existing conditions), eating and exercise habits, personal goals and motivation, payment and account details, and the communication history.

The processing takes place for the following purposes: dealing with your enquiry and holding the intro call, preparing individual coaching offers and concluding a contract, providing the coaching services owed under the contract, invoicing and payment processing, compliance with statutory (in particular tax) obligations, communication during and after the coaching relationship, and the assertion, exercise and defence of legal claims.

The legal bases are Art. 6(1)(a) GDPR (where consent has been given), Art. 6(1)(b) GDPR (performance and initiation of a contract), Art. 6(1)(c) GDPR (legal obligations), Art. 6(1)(f) GDPR (legitimate interests, for example direct communication with existing clients) and Art. 9(2)(a) GDPR (explicit consent for the processing of health data).

Personal data is only passed on to third parties where this is necessary for the performance of the contract or permitted by law. Possible recipients are payment service providers (§ 15), processors (§ 11), tax advisers and public authorities within the scope of statutory obligations, and debt collection service providers in the event of late payment.

§ 15 Payment processing

We use specialised payment service providers to process payments. Depending on the payment method chosen, these may in particular be:

• Stripe (Stripe Payments Europe Ltd., Dublin, Ireland) – card payments.
• Whop (Whop, Inc., New York, USA) – payment processing, including SEPA.
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg).
• CopeCart (CopeCart GmbH, Germany).
• Digistore24 (Digistore24 GmbH, Germany).

The payment service providers process the data required for payment processing (for example name, payment details, billing address) under their own responsibility. The privacy policies of the respective providers are decisive in this respect. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

If you pay by bank transfer, we process your account details (IBAN, account holder) in order to allocate and record the payment.

§ 16 Social media presences

We maintain company presences on the following platforms:

• Instagram (several channels) – Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland.
• YouTube (several channels) – Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
• TikTok (several channels) – TikTok Technology Limited, Dublin, Ireland.
• LinkedIn – LinkedIn Ireland Unlimited Company, Dublin, Ireland.
• Snapchat – Snap Inc., Santa Monica, USA / Snap Group Limited, London, United Kingdom.

Through these presences we provide content and enable interaction with users. If you interact with our presences (comments, likes, messages), personal data may be transferred to the respective platform and also processed in third countries (in particular the USA).

The legal basis is Art. 6(1)(a) GDPR (consent through use of the platform) or Art. 6(1)(f) GDPR (legitimate interest in external presentation and client communication). We have only limited influence over the data processing carried out by the platform operators. You will find details in the privacy policies of the respective providers.

§ 17 Storage period

Personal data is deleted as soon as the purpose of storage no longer applies and no retention obligations prevent it. In detail, the following applies in particular:

• Invoicing and accounting records: retained in accordance with the statutory periods, as a rule up to ten years.
• Contract documents and the video recording of the conclusion of the contract: up to three years after the end of the contract (the standard limitation period), then deleted.
• Health-related data: deleted at the latest when the coaching relationship ends, unless statutory retention obligations or the defence of legal claims prevent this.
• Email marketing data: until withdrawal of consent or unsubscription.
• Server log files: after seven days at the latest.

§ 18 Automated decision-making

Automated decision-making in individual cases, including profiling within the meaning of Art. 22 GDPR, does not take place.