Der Laufcoach - Manuel Hein
English
DeutschEnglish
Contact

Legal information

Privacy notice

Information about how personal data is processed when you use this website, make an enquiry, receive running coaching or take a performance test.

1. Controller and contact

The controller is Manuel Hein, Trackora Sports Technologies & Coaching, Obere Bleiche 12 A, 89347 Bubesheim, Germany. Der Laufcoach is a service of this business.

You can raise privacy enquiries and exercise your rights by emailing derlaufcoach@posteo.de, by post or by telephone at +49 1522 4372 866.

2. Website hosting and security

I use Cloudflare Workers to host this website. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Visiting the website involves processing the connection data needed to deliver it, including your IP address, the address requested, the time of the request and information sent by your browser.

This processing allows the website to be delivered and kept available, and helps protect it against disruption and misuse. The legal basis is Article 6(1)(f) GDPR, based on my legitimate interest in providing a secure, functioning website.

When you visit the main website address, the automatic language selection uses the country identified by Cloudflare. If that information is unavailable, your browser’s language preferences are used. When you choose a language manually, the website stores that preference for up to twelve months in the cookie “laufcoach_language”. It contains only “de” or “en”. You can change your selection at any time or delete the cookie through your browser.

The website’s own code contains no analytics or advertising trackers. Until you submit the form, your entries remain in the open page’s memory; the form’s own code does not save them in cookies, Local Storage or Session Storage. Submission transmits them as described in section 3. The contact page also loads the Cloudflare Turnstile security check, as explained in section 4. External links, such as WhatsApp links, open the relevant service only when you follow the link.

Cloudflare’s data processing agreement governs data it processes on my behalf. For that data, the agreement provides for retention for as long as necessary to deliver the service, until the processing purpose no longer applies or the agreement ends, whichever occurs first, subject to statutory exceptions. The website application does not create a separate database or content logs for enquiries. Data generated during sending and receipt is described below.

3. Enquiries by contact form, email or telephone

The contact form requires your name, email address, topic and message. I need these details to identify and answer your enquiry. The form has no phone number field or file upload facility. When you contact me directly by email or telephone, I process the contact details and content you provide through that channel.

The purpose is to answer your enquiry and, where relevant, prepare a contract. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and Article 6(1)(f) GDPR for other enquiries, based on my legitimate interest in handling incoming correspondence.

Submitting the form sends your entries over an encrypted connection to this website’s contact endpoint on Cloudflare Workers. After validating the entries and checking for abuse, it sends an email through Resend exclusively to my mailbox derlaufcoach@posteo.de with the email provider Posteo. Your email address is included as the reply-to address so I can answer you directly. The technical sender address is anfrage@formular.derlaufcoach.de.

Alternatively, you can email derlaufcoach@posteo.de directly or use the offered link to open your entries in your email app. This fallback prepares a message for you to review and send yourself. The email providers involved process the data needed for delivery and security. Section 9 explains contact through WhatsApp.

Please do not include injury details, existing medical conditions or medical reports in an initial website enquiry. Necessary health information is collected through the agreed intake process on the basis of separate consent.

I delete enquiries that do not result in a contract once they have been fully handled, unless legal retention duties or specific needs to defend legal claims apply. If a contract follows, the purposes and retention periods below also apply. When you use your email app, storage and deletion of drafts and sent messages there depend on your settings and the services used. Section 4 describes technical retention by the delivery service; this is separate from retention of the message I receive, which is covered by the preceding statements.

4. Technical contact process and international processing

I use Cloudflare Turnstile to protect the contact form against automated enquiries. Cloudflare processes signals including your IP address, browser and connection characteristics, and the originating website. According to the provider, Turnstile does not collect form entries. Cloudflare processes these signals on my behalf to protect the website and as a controller in its own right to improve bot detection.

The website server validates the Turnstile result and limits submission attempts using the IP address. This protects against spam and abuse under Article 6(1)(f) GDPR. Technical verification data and counters are processed for this purpose; the website application does not maintain its own database or content logs for enquiries.

For email delivery, I use Resend, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes the form entries described in section 3 and sending and delivery information on my behalf under its data processing agreement.

The configured sending region is Ireland. According to the provider, stored data is nevertheless held in the USA. On the Free plan used here, Resend retains email and log data for 30 days and states a seven-day backup retention period. Statutory exceptions and further retention for its own purposes described in the provider’s notices remain unaffected. Retention in my mailbox and handling of your enquiry follow section 3.

Cloudflare processes data using international infrastructure; processing outside the European Economic Area, particularly in the USA, is possible. Its contractual terms provide for the EU-US Data Privacy Framework for transfers to Cloudflare and standard contractual clauses for transfers not covered by that framework. Resend’s data processing agreement provides for standard contractual clauses for the relevant international transfers. The linked documents explain these safeguards and the conditions that apply. You can also request a copy from me.

5. Contracts and invoices

I process the identity, contact, contract and payment information necessary for offers, contracts, appointments, service delivery, invoicing and payment administration. The legal bases are Article 6(1)(b) GDPR and Article 6(1)(c) GDPR for legal obligations.

Required contract details are necessary to enter into and perform the contract. Without them, the relevant service may not be available. An enquiry or acknowledgement of this notice is not consent to processing health data.

The contractual legal basis does not automatically cover a child receiving the service or another person who is not a contracting party. Their health and training information is handled through a separate consent and representation process. Necessary professional contact details for companies or clubs may be processed based on the legitimate interest in contract communication under Article 6(1)(f) GDPR.

6. Health data in coaching and testing

Where necessary for the agreed service, I collect information about training, exercise capacity, injuries, existing medical conditions and relevant medication, along with performance test measurements and results. The intake form is called an Anamnesebogen (health questionnaire). Medical reports are not requested.

The purpose is to plan and provide individual coaching appropriate to your capacity, or to prepare, conduct and analyse the agreed test. Special-category data is processed on the basis of separate explicit consent under Article 9(2)(a), together with Article 6(1)(a), GDPR. Necessary ordinary contract data is covered by section 5.

Coaching, testing and optional long-term storage for comparisons are described separately according to their purposes. Without health information or consent necessary for safe delivery, a particular service may be unavailable or limited. Consent to the optional comparison archive is not a condition of taking a test.

You may withdraw consent at any time with future effect, for example by email or WhatsApp. This does not affect the lawfulness of previous processing. Any implications for an ongoing service depend on the data actually needed for it; withdrawal does not automatically incur a contractual penalty.

7. Microsoft OneDrive for Business

I use Microsoft OneDrive for Business through a business Microsoft 365 account to store health questionnaires and backups of locally held testing data that are encrypted before upload. Customers do not need their own Microsoft account solely for this storage. Within my business, only I have access to these customer documents.

The provider of Microsoft's business services in the European Economic Area is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes stored customer content as a processor under its business contractual terms, including the Microsoft Products and Services Data Protection Addendum (DPA). The incorporation of the DPA into my specific business contract has not yet been verified against the contractual records for this working draft.

The purposes are organised storage, availability and backup. The legal bases depend on the content and purpose, particularly sections 5 and 6. Using the storage service neither creates an additional permission to collect health data nor extends retention periods.

Microsoft uses subprocessors. For limited business operations of its own, such as billing and account management, Microsoft assumes controller responsibilities within the scope described in its contractual terms. Processing or access outside the European Economic Area, particularly from the USA, cannot be categorically excluded. Microsoft's contractual arrangements include EU standard contractual clauses. Information about applicable safeguards and a copy can be requested from me or accessed through the linked documentation.

No promise is made that all processing takes place exclusively in Germany or the EU. The actual storage region, access protection, versioning and deletion settings must match the business account being used. This working draft does not confirm that these settings have been audited.

8. TrainingPeaks

As part of agreed coaching, I use TrainingPeaks to plan training, review shared sessions and performance data, and give feedback. Necessary health-related information is processed only to the extent needed for coaching and on the basis of separate consent. Full health questionnaires are not routinely uploaded to TrainingPeaks.

The provider is TrainingPeaks, LLC, 285 Century Place, Louisville, CO 80027, USA. TrainingPeaks' own privacy information also applies to your account and platform processing. Linking your account allows me the agreed access; the platform is not solely my processor. Data may be processed in the USA. Its privacy notice describes safeguards including standard contractual clauses where required.

For minors, guardian consent requirements and platform terms must be met before account use. Ending my coach connection does not delete your own TrainingPeaks account. Your account data and rights against the platform provider remain separate.

9. Communication and sending documents

You can contact me by email, phone or WhatsApp. WhatsApp is not loaded simply by visiting this website. For users in the European Economic Area, the provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Alongside messaging functions, WhatsApp processes account, connection and device information for its own purposes. International transfers are possible and described in its notice.

End-to-end encryption of personal messages does not mean all usage and connection data is encrypted or processed only by me. Health information and test results are sent through the channel agreed for this purpose on the basis of the relevant consent. Email is available as an alternative to WhatsApp; email is not automatically end-to-end encrypted either.

An ordinary initial enquiry is not treated as blanket consent to later health data transfers. Before sending such information, we agree on the necessary content and a suitable communication channel.

10. Local testing data and optional comparisons

Test data is recorded and analysed in my own Trackora Track Coaching System software on my local computer. Cloud backups are separate from this local analysis. Without separate comparison consent, testing health data is deleted once the test, report delivery and agreed discussion are complete and no other specifically agreed purpose or legal exception remains.

With separate optional consent, measurements, results and test conditions needed for future comparisons may be retained longer. Each individual test has a maximum retention period of ten years from its date. If no further test takes place for three years, comparison storage ends earlier. A new test restarts only the three-year inactivity period, not the ten-year limit for an older test.

Withdrawal or the end of the comparison purpose results in earlier deletion unless a narrowly defined legal exception applies. A full health questionnaire is not retained for ten years solely because of the comparison archive.

11. Deletion and backups

Coaching health data within my responsibility is deleted when coaching ends, unless a separate validly agreed purpose or a specifically necessary legal exception continues. This includes copies in my records and communications. Customers' independently held platform accounts do not disappear merely because the coaching contract ends.

Invoices and accounting records subject to legal retention are kept for the applicable statutory periods, generally eight years from the end of the relevant calendar year. This does not justify retaining health questionnaires or all health data for the same period. Information specifically needed to establish, exercise or defend legal claims may be retained for a limited purpose and period under Article 6(1)(f), and for health data additionally Article 9(2)(f), GDPR. Mandatory legal retention is based on Article 6(1)(c) GDPR.

Local backups are created after testing, with five rotating local backups. An additional encrypted backup is replaced manually in OneDrive for Business occasionally, currently no more than once a month. Neither the backup count nor this frequency is a separate retention period.

When deletion is due, the process must cover affected backups, cloud file versions and recycle bins. After restoration, previously effective deletions must be reapplied before data is used again. Technical implementation, including residual provider retention, remains to be checked before this draft is finalised. Immediate complete erasure from every internal provider system is not promised.

12. Recipients and international transfers

Within my business, only Manuel Hein handles coaching and testing records. The providers named here may receive data within their respective roles. Authorities or other recipients receive data only where there is a legal basis, such as a legal duty or necessary enforcement of claims.

Transfers outside the European Economic Area require a condition under Articles 44 onwards GDPR in addition to a legal basis for processing, such as an applicable adequacy decision or suitable safeguards including standard contractual clauses and any necessary supplementary measures. Consent to health data processing does not replace this assessment. Information about the applicable safeguards is available through provider notices and on request from me.

13. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with future effect.

Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to direct marketing without giving a reason; this notice does not grant marketing consent.

You may complain to a data protection authority, particularly in the country of your habitual residence, workplace or the alleged infringement. The supervisory authority responsible for my business is the Bavarian State Office for Data Protection Supervision (BayLDA).

Manuel Hein personally makes the coaching and testing decisions described here. Solely automated decisions with legal or similarly significant effects are not envisaged for these services.

Read the terms