Privacy policy

Controller

Marc Haid, Landvogtweg 9/17, 6830 Rankweil, Austria, email coaching@marc-haid.com.

Principles

Personal data is only processed as far as needed to run the website, answer inquiries, provide the coaching and operate our own content and publishing system. Depending on the case, the legal basis is your consent, the performance of a contract, legal obligations or a legitimate interest (Art. 6(1)(a), (b), (c) and (f) GDPR). Providing data is voluntary; without the details marked as required, however, an inquiry, purchase or coaching cannot be processed. No automated decision-making, including profiling, takes place.

Hosting and server logs

When the website is accessed, the hosting provider processes technically necessary data such as IP address, time, page requested and browser, in order to deliver the page and protect it against attacks. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, acting as a processor. The transfer to the USA relies on the European Commission's standard contractual clauses; Cloudflare is also certified under the EU-US Data Privacy Framework. We keep no server logs of our own; Cloudflare retains the data only as long as needed to deliver the site and fend off attacks. The legal basis is the legitimate interest in operating the website securely (Art. 6(1)(f) GDPR). The logs are deleted after a short period.

Storage in your browser

The website stores a few settings only locally in your browser: selected language, currency, cart contents, the calculator units, the email address entered at checkout (so it is already there on your next visit) and an identifier of your graphics chip, which lets the site use a lighter presentation on weaker devices. This data stays in your browser; only the cart and email address are sent to us at checkout to process the purchase. The calculator runs entirely in your browser. No tracking or advertising cookies are used.

Fonts

The fonts used (Urbanist and Lexend Giga) are stored on this website's own server and loaded from there. No connection is made to Google Fonts or any other third-party server, and no IP address is transmitted to third parties.

Contact, inquiry and email

If you write via the contact or inquiry form or by email, your details such as name, email address, goal, starting point, weekly routine, chosen coaching model and message are processed to answer your inquiry and prepare a possible coaching. The legal basis is Art. 6(1)(b) GDPR where a coaching or purchase is concerned, otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR). The information is sent to me by email and also stored so that no inquiry gets lost; it is deleted automatically after 400 days (about 13 months), unless a retention obligation applies. All emails from this website – confirmations, orders and invoices, coaching invoices, inquiries and questionnaires – are sent through Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, acting as a processor. Brevo may technically record whether an email was delivered and opened and whether links in it were clicked. I only use this to spot delivery problems, not for marketing analysis (Art. 6(1)(f) GDPR).

Free guides and newsletter

If you request a free guide, your email address and, if given, your first name are used to send you the download link (Art. 6(1)(b) GDPR). With the request you also receive my newsletter: four short emails with training tips and information about the coaching over the following two weeks, after that only occasional news. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 Austrian Telecommunications Act 2021), which you give with the request; I store the time, IP address and the version of the notice for this. The further emails are only sent after you have opened the download link. You can unsubscribe at any time via the link in every email; after that you receive nothing more. The data is deleted no later than three years after the request, the guide request itself after 30 days. Email service: Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Deutschland. The guides and the newsletter are sent through this service acting as a processor.

Questionnaire for the plans

If you buy a training or nutrition plan, you then answer a questionnaire about your goal, age, height, weight, daily life, sleep, stress, training level, injuries and intolerances. This information, including health data, is used solely to create the plan you ordered and adjust it once. The legal basis is the contract (Art. 6(1)(b) GDPR) and your explicit consent for health data (Art. 9(2)(a) GDPR), which you can withdraw at any time. The information is sent to me by email (through Brevo, see above) and also stored. The stored copy is deleted automatically 60 days after submission, i.e. once the plan is finished and the 30-day adjustment period has ended.

Coaching contract and invoice

If a coaching comes about, your name, address, email address, the chosen model and payment details are processed for the contract, invoice and handling (Art. 6(1)(b) GDPR). Direct debit and card payments are handled by the payment provider Mollie B.V. (see store purchase and payment). Clients outside Europe can pay through Wise (Wise Europe SA, Rue du Trône 100 bte 3, 1050 Ixelles, Belgium); Wise processes the payment data under its own responsibility. Invoices are retained for the periods required by tax law (Art. 6(1)(c) GDPR). During the coaching, the coaching app Everfit is used: it holds your training plan and the videos showing how each exercise is done, you answer the weekly check-in there and log values such as weight and progress photos; if you like, steps can be taken over from Apple Health or Google Fit. This serves to adjust your training and nutrition. The provider is Everfit Technologies Inc. (USA) acting as a processor; the transfer to the USA relies on the European Commission's standard contractual clauses. Because this includes health data, it only happens with your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time with future effect; using the app is voluntary. In addition, the onboarding details as well as training and nutrition data are processed. For questions in between we use WhatsApp (WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a Meta company). Your phone number and the content of our messages are processed (Art. 6(1)(b) GDPR); messages are end-to-end encrypted, connection data may also be processed by Meta in the USA, on the basis of the European Commission adequacy decision for the EU-US Data Privacy Framework, under which Meta is certified (Art. 45 GDPR). Progress photos and health data belong in Everfit, not in WhatsApp. If you do not want to use WhatsApp, tell me and we will find another way. You give the consent for health data when you accept the coaching; I record the time, IP address and wording so that the consent can be proven (Art. 6(1)(c) and (f) GDPR). I delete your data in Everfit and our WhatsApp history no later than three months after the coaching ends, unless a retention obligation applies.

Store purchase and payment

When you buy in the store, order data, email address and invoice details are processed to handle the purchase, issue the invoice and deliver e-books or the questionnaire link by email (Art. 6(1)(b) GDPR). Payment is handled by an external payment provider, which processes the payment data under its own responsibility. Payment provider: Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands.

Online withdrawal

If you withdraw from a contract using the “Withdraw from contract” button, your name, email address, order or booking number, your message, the time and the IP address are processed to handle the withdrawal, confirm its receipt and be able to prove it (Art. 6(1)(c) and (f) GDPR). This information is kept for eight years like the orders and then deleted automatically.

Online cancellation

If you cancel your coaching using the “Cancel coaching” button, your name, email address, booking number, the type of cancellation, any reason given, the time and the IP address are processed to match the cancellation to your booking, end the subscription with the payment provider Mollie, confirm its receipt and be able to prove it (Art. 6(1)(b), (c) and (f) GDPR). This information is kept for eight years like the orders and then deleted automatically.

Storage and retention

Orders, coaching bookings and the related invoice data are stored in the hosting platform's storage (Cloudflare Workers KV) so that invoices, downloads and ongoing billing work. Records relevant to invoicing are kept for seven years because § 132 of the Austrian Federal Fiscal Code requires it (Art. 6(1)(c) GDPR); after that they are deleted automatically, at the latest eight years after the booking. Everything not subject to a retention obligation is deleted once its purpose is fulfilled: download links expire after seven days; stored guide requests are deleted automatically after 30 days, questionnaires after 60 days and inquiries after 400 days. The e-books and plans themselves are stored there too; they contain no personal data.

Appointment booking

The free introductory call is arranged through Cal.com; Premium clients also book their 1:1 sessions there. Your name, email address and the chosen slot are transmitted to Cal.com, Inc., 2261 Market Street, San Francisco, CA 94114, USA; the call itself takes place via Cal Video. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure). The transfer to the USA relies on the European Commission's standard contractual clauses.

YouTube API Services

For our own fitness and coaching channels we run an internal content and publishing system (“Marc Fitness Publishing”). It uses Google’s YouTube API Services. It is not a public service: there are no third-party user accounts, and OAuth is used solely to authorise our own YouTube channels. The system runs locally on a computer of the controller. The legal basis is our legitimate interest in operating and evaluating our own channels (Art. 6(1)(f) GDPR).

We use the YouTube API Services to verify the binding to the respective channel (channel verification), upload our own videos, cancel scheduled publication of our own videos where needed, query upload and processing status, and retrieve raw statistics and raw YouTube Analytics data for our own videos. Metrics derived from YouTube data and our own YouTube scores are currently disabled.

The following data may be processed: the YouTube channel ID, the channel title and channel status (such as visibility and upload permissions), the permissions granted, the IDs and addresses of our own videos, the upload and publishing status including the publication time, error messages from the interface, and raw video statistics and raw YouTube Analytics data (such as views, likes, number of comments and watch time). We do not retrieve comment content, subscriber data or data about individual viewers.

Access tokens are held in memory only and are not stored. The refresh token is stored locally in encrypted form. The other data is kept in a local database. YouTube data is not sold and is not made available to any other users. No YouTube video IDs or addresses are passed to our planning tool Notion.

If the last successful authorisation check is 30 days old or older, the system retrieves no new YouTube data until authorisation has been successfully verified again. For stored performance data, the system provides for re-checking within 30 days whether the respective video still exists. This check is currently carried out through a dedicated maintenance command; if it is overdue or unresolved, the compliance status is treated as not current. No further data is retrieved for videos that no longer exist.

Access can be revoked at any time in the permissions of the Google account: security.google.com/settings/security/permissions. If access is revoked through our own revocation process, the token is also revoked with Google, and the stored YouTube data is removed from the system’s active data: video IDs and addresses, statistics and analytics data, the encrypted token and the channel binding. Please send deletion requests to the email address given above. Deleting our locally stored data does not delete any content or data directly on YouTube.

In addition, Google’s Privacy Policy (policies.google.com/privacy) and the YouTube Terms of Service (youtube.com/t/terms) apply.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent at any time. You can also lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at). An email to the address above is enough for any request.

Right to object

Where data is processed on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). Where your data is used for advertising by email, you can object at any time without giving reasons (Art. 21(2) GDPR); an email or the unsubscribe link in every such email is enough.