Privacy Policy

1. Controller

Pump It Club
Felix Mangold
Schachhaldenweg 15
73529 Schwäbisch Gmünd, Germany

Email: support@pump-it-club.com

We have not appointed a data protection officer; the statutory requirements for doing so do not apply to us. For any data protection matter, please use the address above.

2. Visiting this website

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you open a page, technically necessary data is processed — IP address, time of access, page requested, volume of data transferred, browser and operating system. This serves to deliver the site and to defend against attacks.

The legal basis is our legitimate interest in secure and reliable operation under Art. 6(1)(f) GDPR.

We do not set analytics or advertising cookies and we embed no tracking services. Individual pages store technically necessary values in your browser’s local storage, such as your language choice. These values never leave your device.

3. Contact and sign-up forms

Through the forms on this site — contact, trainer portal, partner programme, trial access and pre-registration — we process the details you enter. Typically these are your name, email address, possibly a phone number, and your message or the answers requested.

The legal basis is your consent under Art. 6(1)(a) GDPR, and additionally Art. 6(1)(b) GDPR for enquiries relating to a contract.

Double opt-in. If you sign up for trial access or pre-registration, we first send you an email containing a confirmation link. Only once you click it do we add you to our list. Until then your details are stored provisionally. If you do not confirm, we delete them.

Spam protection. The forms are protected by Google reCAPTCHA v3 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your IP address along with information about your device and your behaviour on the page is transmitted to Google and evaluated there to distinguish automated from human input. The legal basis is our legitimate interest in preventing spam and abuse under Art. 6(1)(f) GDPR.

4. Product messages

If you have consented, we inform you by email and — where you have agreed separately — by WhatsApp about the app’s launch, your access and relevant offers. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with section 7(2) no. 2 of the German Act Against Unfair Competition (UWG).

You may withdraw your consent at any time with effect for the future — via the unsubscribe link in any message, informally by email, or by replying to a WhatsApp message. The lawfulness of processing carried out until then remains unaffected.

5. Purchasing lifetime access

When you make a purchase we process the data required to handle it: name, email address, billing address, the item purchased, the amount and the payment status. The legal basis is performance of the contract under Art. 6(1)(b) GDPR.

Payment. Payment is handled by Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter your payment details — card number or bank details, for instance — directly with Stripe. We do not receive them, only the confirmation that payment was made and for what amount. Stripe’s own privacy policy applies in addition.

Activation. After successful payment we assign the purchase to your account in the app by matching the email address given at checkout and recording the entitlement there.

We retain invoices and payment records for ten years under section 147 of the German Fiscal Code (AO) and section 257 of the German Commercial Code (HGB). The legal basis is Art. 6(1)(c) GDPR.

6. AI assistant on this website

This site offers an AI assistant for questions about training and nutrition. Your input is transmitted for processing to OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland; processing in the United States takes place in this context.

The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by sending a message. Please do not enter health information or other sensitive data in the chat — the assistant provides general information and is no substitute for medical or therapeutic advice.

7. Recipients of your data

We share your data only where you have consented, where it is necessary to perform a contract, or where we are legally obliged to. We do not pass data to third parties for advertising purposes, and we do not sell your data.

The recipients are:

• Vercel Inc., Walnut, USA — hosting of this website.
• HighLevel Inc. (GoHighLevel), Dallas, USA — management of your contact data and dispatch of messages, as a processor.
• Google Ireland Limited, Dublin, Ireland — Firebase Authentication and Firestore for your app account, and reCAPTCHA for spam protection.
• Stripe Payments Europe Limited, Dublin, Ireland — payment processing.
• OpenAI Ireland Limited, Dublin, Ireland — operation of the AI assistant, see section 6.
• Our email service provider, through which this site’s messages are sent.

Transfers to the United States. Vercel Inc. and HighLevel Inc. are based in the United States; with Google, Stripe and OpenAI, processing by US parent companies may additionally occur. Such transfers rely on the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR, unless the recipient is itself certified under the EU-US Data Privacy Framework. Despite these safeguards, access by US authorities cannot be entirely ruled out, and legal protection comparable to that in the EU is not available in every case.

8. Retention periods

• Hosting server logs: a few days, then deleted automatically.
• Contact enquiries: until the matter is concluded, then until any statutory retention period expires.
• Pre-registration and mailing list data: until you withdraw consent, at most 24 months after the last contact.
• Unconfirmed sign-ups (double opt-in): deleted after 14 days at the latest.
• Invoices and payment records: ten years, under section 147 AO and section 257 HGB.
• App account data: until you delete the account, see Delete Account and Data.

9. Your rights

You have the right to access the data we hold about you (Art. 15 GDPR), to have inaccurate data corrected (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20).

Withdrawal of consent. Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out until then remains unaffected.

Objection. Where we process data on the basis of a legitimate interest, you may object under Art. 21 GDPR on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.

An informal message to support@pump-it-club.com is enough. How to have your account and data deleted is described under Delete Account and Data.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart, Germany

10. No automated decision-making

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

11. Changes to this policy

We update this policy when our services or the legal framework change. The version published here applies.