Privacy policy

German version · Translation as of 16 October 2026

This is an English translation of the German original (Datenschutzerklärung), which is available at www.aspect-sports.com/datenschutzerklaerung/. Both versions are available to you and are intended to have the same content.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Alexander Schagowsky
Lohstraße 189
59368 Werne
Germany
Email: contact@aspect-sports.com

No data protection officer has been designated, as the statutory requirements for this are not met.

This privacy policy applies to:

the website www.aspect-sports.com
the online shop shop.aspect-sports.com
the athlete app app.aspect-sports.com
the coaching services of Aspect Endurance Coaching

Last updated: 17 October 2026

1. General information on data processing

1.1 Personal data

Personal data means any information relating to an identified or identifiable natural person, e.g. name, email address, training or health data.

1.2 Legal bases

I only process your data if one of the following legal bases applies:

Legal basis	When it applies
Art. 6(1)(a) GDPR	You have given your consent.
Art. 6(1)(b) GDPR	The processing is necessary for a contract with you or for pre-contractual measures, e.g. purchase, account, coaching.
Art. 6(1)(c) GDPR	I have to comply with a legal obligation, e.g. retention for tax purposes.
Art. 6(1)(f) GDPR	I have a legitimate interest which is not overridden by your interests, e.g. IT security.
Art. 9(2)(a) GDPR	You have given explicit consent to the processing of health data.
Section 25 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG)	Storing information on, and reading information from, your device, e.g. cookies.

1.3 Obligation to provide data

You are under no statutory or contractual obligation to provide me with data. However, without the data required for a contract (e.g. name, email address, billing address), I cannot conclude or perform the contract. You always provide health data voluntarily.

1.4 No automated decision-making

I do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. If you pay via Stripe in the shop, Stripe automatically checks the payment for fraud risks under its own responsibility and may decline it. If you choose Klarna in the process, Klarna additionally makes an automated decision, under its own responsibility, about the payment methods offered (section 3.3).

1.5 Recipients

I only pass on your data if this is necessary for the performance of the contract, if you have given your consent or if I am legally obliged to do so. I name the individual recipients in the following sections. I do not sell any personal data.

2. Website, server log files and cookies

2.1 Server log files

When the website, the shop and the app are accessed, my server automatically processes the following data:

IP address
date and time of the request
page accessed and amount of data transferred
referring URL (website from which the request originates)
browser type and browser version
operating system

Purpose: delivery of the pages, stability and IT security, e.g. defence against attacks.
Legal basis: Art. 6(1)(f) GDPR.
Storage period: 7 days, after which the data are deleted automatically.

Limiting requests: To prevent misuse of the forms and the guessing of access links to purchased training plans, I briefly process the IP address in the server's working memory when a form is submitted or an invalid access link is accessed, in order to limit the number of requests per address. This count is not stored permanently and is discarded after 24 hours at the latest or when the server is restarted. Legal basis: Art. 6(1)(f) GDPR, my interest in secure operation.

2.2 Cookies and local storage

Website www.aspect-sports.com: The website itself does not set any cookies without your consent. I store your choice in the cookie banner in your browser's local storage (localStorage, entry “aspect_consent_v1”) so that the banner does not reappear each time a page is accessed. This entry contains only “allowed” or “declined”, is not transmitted to me and remains stored until you delete it in your browser. The legal basis is Section 25(2) no. 2 TDDDG.

Technically necessary cookies are used by me in the shop and in the app so that login, basket, the ordering process and the securing of login processes work, e.g. when connecting to Intervals.icu. If you choose to pay via Stripe in the shop, Stripe on its payment page and, if you choose Klarna there, Klarna may set their own cookies that are necessary for the payment and for fraud prevention (section 3.3). The legal basis is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(b) or (f) GDPR respectively.

Non-essential cookies, in particular for Google Analytics (section 3.6), are only used by me with your consent, which you give via my cookie banner. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can change or withdraw your consent at any time via the “Cookie settings” link in the footer of the page.

An overview of all cookies with name, purpose and duration can be found in the cookie policy.

2.3 Enquiry forms on the website

There are three forms on the website through which you can write to me:

Contact form (“Kontakt” page): first name, surname, email address, optionally telephone number, message
Coaching enquiry (home page and “Coaching” page): name, email address, optionally preferred sport, your goals
Enquiry about additional services (“Support im Sport” page): first name, surname, email address, requested service, your goals

In addition, I store the page from which the enquiry was sent, as well as the date and time. Your information on goals and training may contain health information; please only provide what is necessary for the enquiry.

Purpose: answering your enquiry and, if requested, preparing a coaching offer.
Legal basis: Art. 6(1)(b) GDPR insofar as your enquiry is aimed at a contract (e.g. coaching), otherwise Art. 6(1)(f) GDPR, my interest in answering enquiries. I process health information provided voluntarily on the basis of Art. 9(2)(a) GDPR, your consent given by providing the information.
Sending: Your enquiry is delivered to me by email via my own mail server at Hetzner Online GmbH in Germany.
Backup copy: So that no enquiry is lost if sending the email ever fails, each enquiry is additionally stored in an access-protected file on my server at Hetzner. These copies are deleted automatically after 180 days.
Spam protection: The forms do not use Google reCAPTCHA or cookies. Instead, I use a field that is invisible to humans and a signed time stamp to check whether the form was filled in by a person, and I limit the number of requests (section 2.1).

If a contract is concluded following your enquiry, I continue to process the data as part of the coaching (section 4.5). Otherwise, I delete the email as soon as your enquiry has been conclusively answered and no further queries are to be expected.

2.4 “5 Fragen” (“5 questions”) questionnaire

The “5 Fragen um zu starten” (“5 questions to get started”) and “Jetzt starten” (“Start now”) buttons take you to a questionnaire which runs in my athlete app at app.aspect-sports.com.

Data processed: first name, surname, email address, optionally telephone number, your answers to the questions, time of submission and the IP address for protection against misuse.
Purpose: getting to know your starting point and goals and preparing a suitable coaching offer. I am notified of a new response by email.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures); for the IP address and spam protection, Art. 6(1)(f) GDPR.
Storage location: database of the athlete app on my server at Hetzner Online GmbH in Germany.
Storage period: until your enquiry has been conclusively processed; if no coaching results, I delete your information no later than 12 months after submission.

Google reCAPTCHA: To protect the questionnaire against automated entries, I use Google reCAPTCHA v3. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the questionnaire is accessed and submitted, reCAPTCHA evaluates information such as the IP address, browser and device information and usage behaviour on the page and transmits it to Google; cookies or similar technologies from Google may be used in the process. A transfer to Google LLC in the USA is possible (section 6.3). The legal basis is Art. 6(1)(f) GDPR, my interest in protection against misuse and spam; insofar as information is stored on or read from your device in the process, Section 25(2) no. 2 TDDDG. Google's privacy policy: https://policies.google.com/privacy

2.5 Fonts

The fonts used on the website (Manrope, IBM Plex Mono) are embedded locally on my server. No connection to Google Fonts or other font providers is established when the website is accessed.

3. Online shop shop.aspect-sports.com

In the shop I sell digital products, in particular training plans, passes and access to functions of the athlete app. The shop is a proprietary development and is operated at Hetzner Online GmbH in Germany (section 6.1).

3.1 Order and account

Your account in the shop is the same as in the athlete app. As a result, purchased training plans and access are available to you directly in the app.

Data processed:

name, email address, billing address
order data: purchased products, price, order number, time
payment method and payment status
invoices and transaction records
assignment of the purchased products to your account

Purpose: conclusion and performance of the purchase contract, activation of the purchased content, invoicing, customer service and handling of complaints.
Legal basis: Art. 6(1)(b) GDPR; for statutory retention obligations, Art. 6(1)(c) GDPR.

3.2 Payment

In the shop you can pay with PayPal, online via Stripe (section 3.3, e.g. with credit or debit card, Apple Pay, Google Pay, Klarna or SEPA Direct Debit) or by bank transfer. I do not receive full account or card details for any payment method.

PayPal: If you pay with PayPal, I transmit the data required for the payment (name, amount, order number, email address if applicable) to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal processes these data as an independent controller and may carry out an identity or credit check in individual cases. I do not receive full account or card details. PayPal's privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full

Bank transfer: If you pay by bank transfer, I process the information from the incoming payment (name of the account holder, IBAN, amount, payment reference) in order to allocate the payment to your order. The banks involved process the data under their own responsibility.

Legal basis: Art. 6(1)(b) GDPR; for the retention of payment records, Art. 6(1)(c) GDPR.

3.3 Payment via Stripe

I process online payments in the shop via the payment service provider Stripe. My contractual partner is Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland (“Stripe”). Via Stripe you can pay, for example, by credit or debit card, Apple Pay, Google Pay, Klarna or SEPA Direct Debit. Which payment methods are displayed to you depends, among other things, on your country, the currency, the basket and your device.

Process and data transmitted: If you choose payment via Stripe and click on “Order with obligation to pay”, I create a payment session with Stripe and redirect you to Stripe's payment page (checkout.stripe.com). For this purpose, I transmit:

your email address
the order number and an internal order identifier, the products ordered with quantity and price as well as the shipping costs; in individual cases (e.g. with a discount code or a free item), instead a combined item “Order …” for the total amount with the product names
currency and language of the shop

I do not transmit your name, billing address or delivery address to Stripe. Information additionally required for the selected payment method (e.g. name, billing address and payment details) is collected by Stripe and – if you choose Klarna – by Klarna directly from you on the payment page. You enter your payment details (e.g. card number, expiry date and security code or your IBAN) directly on Stripe's payment page; I do not receive them. In the process, Stripe receives, for technical reasons, your IP address as well as device and browser information and uses cookies or similar technologies for fraud prevention. If you pay with Apple Pay or Google Pay, Apple or Google respectively additionally process data in accordance with their own privacy policies.

Payment with Klarna: If you choose Klarna on the payment page, Stripe transmits the data required for the payment (in particular your email address, the order items or the combined item and the amount, as well as the information you provide yourself on the payment page, e.g. name and billing address) to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (“Klarna”), and you complete the payment with Klarna. In the case of pay by invoice or instalment purchase, Klarna pays in advance. Klarna therefore checks your identity and creditworthiness under its own responsibility and may consult credit agencies for this purpose. On this basis, Klarna decides automatically whether a payment method is offered to you. You enter further information that Klarna requires (e.g. date of birth or telephone number) directly with Klarna; I do not receive it. I do not carry out a credit check myself and only learn whether the payment was successful. Which credit agencies Klarna uses and how you can contest the automated decision is set out in Klarna's privacy notice.

What I receive from Stripe and store: identifiers of the payment session and of the payment at Stripe, the type of payment method chosen (e.g. card or SEPA Direct Debit), the payment status (e.g. paid, failed, refunded) and the times and amounts of payments and refunds. I do not store card data such as the card brand or the last digits; in my Stripe account, Stripe only shows me the card brand and the last four digits for card payments. Stripe automatically notifies my server of changes to the status of your payment.

Charging: Stripe charges the amount immediately upon completion of the order. With SEPA Direct Debit, Stripe only confirms the payment after a few working days. I process cancellations, withdrawals and refunds via Stripe; the amount is credited back to the payment method originally used or, in the case of payment with Klarna, credited by Klarna.

Legal basis: Art. 6(1)(b) GDPR (processing of the payment method you have chosen); for the retention of payment records, Art. 6(1)(c) GDPR; for fraud prevention, Art. 6(1)(f) GDPR, my interest and that of Stripe and Klarna in avoiding payment defaults and misuse. Section 25(2) no. 2 TDDDG applies to the cookies used on the payment page, as they are strictly necessary for the payment you have requested.
Responsibility: Stripe processes your data on my behalf for the purpose of processing the payment (Art. 28 GDPR; the basis is Stripe's data processing agreement) and, beyond that, under its own responsibility, e.g. for fraud prevention, the prevention of money laundering and compliance with financial supervisory obligations. Klarna itself is responsible for processing Klarna payments, the identity and credit check and fraud prevention.
Third country: Stripe belongs to the group of Stripe, Inc. (USA) and may transfer data to the USA; a transfer to Klarna service providers outside the EU is also possible (section 6.3).
Stripe's privacy policy: https://stripe.com/privacy
Klarna's privacy notice: https://www.klarna.com/international/privacy-policy/

3.4 Emails for contract processing

I send you emails that are necessary for your contract, e.g. order confirmation, invoice, access data, password reset and information on using purchased training plans. They are sent via my own mail server at Hetzner Online GmbH in Germany.

Legal basis: Art. 6(1)(b) GDPR.

3.5 Newsletter

When registering, you can voluntarily sign up for my newsletter. In it, I provide information on training tips, new training plans and offers. Registration is also possible without the newsletter.

Double opt-in: After signing up, you receive an email with a confirmation link. Only after your confirmation do I add you to the mailing list. I log the time of sign-up and of confirmation as well as the IP address in order to be able to prove your consent.

Data processed: email address, name for the personal salutation, time of sign-up and confirmation, IP address.
Sending: via my own mail server at Hetzner Online GmbH in Germany.
Legal basis: Art. 6(1)(a) GDPR (consent); for the logging, Art. 6(1)(f) GDPR, my interest in proving consent.

Unsubscribing: at any time via the link at the end of each newsletter, in your profile in the app or by email to contact@aspect-sports.com.

3.6 Google Analytics

On the website www.aspect-sports.com and in the shop, I use Google Analytics 4 to understand how visitors use the pages and to improve my offering. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. I do not use Google Analytics in the athlete app.

Only with consent: Google Analytics is only loaded once you give your consent in the cookie banner. You can withdraw your consent at any time via “Cookie settings”.

Data processed: pages accessed, length of visit, source of the visit, device and browser information, approximate location (country, region) and interactions in the shop. Google Analytics 4 does not store full IP addresses of users from the EU.

Cookies: website: “_ga” and “_ga_P3DS0YNKXC”; shop: “_ga” and “_ga_BG2XS60HBL”; each with a lifetime of up to 2 years. On the website, I also record as an event that an enquiry form was submitted successfully (without the content of the enquiry). The IP address is shortened (IP anonymisation).
Storage period at Google: 14 months
Processing on my behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Google.
Transfer to third countries: A transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

Google's privacy policy: https://policies.google.com/privacy

3.7 Contacting me

Section 2.3 applies to the forms on the website.

If you write to me by email or via a contact form, I process your information in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR.

4. Athlete app app.aspect-sports.com

4.1 Registration and user account

Data processed: name, email address, date of birth, gender, password (stored exclusively as a hash), for paid offerings the billing address, optionally telephone number.

Purpose: provision of your account for the app and the shop.
Legal basis: Art. 6(1)(b) GDPR.

4.2 Sign in with Google

You can register or sign in with your Google account. After you give your consent in the Google sign-in window, I receive from Google your Google account ID, your name, your email address and, if shared, the URL of your profile picture.

Purpose: creating or linking your account and secure sign-in.
Legal basis: Art. 6(1)(b) GDPR.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the sign-in data under its own responsibility; a transfer to Google LLC in the USA is possible (section 6.3).

You can remove the link at any time in your Google account under “Third-party apps and services”.

4.3 Training plans

Purchased training plans are assigned to your account and provided in the app. For this purpose, I process the purchased plan, the start date you have chosen and the training calendar calculated from it.

Legal basis: Art. 6(1)(b) GDPR.

Section 5 describes how you transfer your plans to Intervals.icu and from there to your devices.

4.4 Subscriptions and one-off purchases

For paid subscriptions and one-off purchases, I process the booked product, term, activation date, purchased passes, payment status and transaction records as well as a usage log of the activated functions for billing and error analysis.

Legal basis: Art. 6(1)(b) and (c) GDPR.

4.5 Coaching

As part of coaching, I process:

contact data: name, email address, telephone number
health data: injury history, self-reported health information, training and diagnostic data, biometric body data
performance data: training logs, progress, competition analyses, threshold values (e.g. FTP, lactate threshold heart rate, threshold pace)
workout and health data from Intervals.icu if you share them for your coaching (section 5.6)
training calendar: planned sessions, notes and comments from you and me on sessions
communication: emails, video conferences, feedback meetings

Purpose: individual training planning, performance analysis, support and scheduling of appointments.
Legal basis: Art. 6(1)(b) GDPR; for health data, Art. 9(2)(a) GDPR.
Video conferences: via Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

A data processing agreement pursuant to Art. 28 GDPR is in place with Microsoft. A transfer to Microsoft Corporation in the USA is possible (section 6.3). Privacy statement: https://privacy.microsoft.com/de-de/privacystatement

4.6 Aspect Carb Lab

The Aspect Carb Lab is a free tool in the app. You can search sports nutrition products, add them to a personal inventory and add ratings and notes on taste and tolerability.

Data processed: account data, your product inventory, star ratings, free-text notes and technically necessary search and filter settings. Notes on tolerability may contain health information and are treated in the same way as health data.
Visibility: Only you can see your inventory, ratings and notes.
Legal basis: Art. 6(1)(b) GDPR; for health-related notes, Art. 9(2)(a) GDPR.

Maintenance of the product database: I update the product data (e.g. nutritional values, certifications such as Kölner Liste or Informed Sport) with the help of the Claude API of Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA. In the process, publicly accessible manufacturer websites are retrieved insofar as their robots.txt permits this. No personal data of users are transmitted to Anthropic in the process. I only show product images with the written consent of the manufacturer.

5. Connection to Intervals.icu

You can voluntarily connect your account in the athlete app to your account at Intervals.icu. The connection consists of several functions. For each function, I only request from Intervals.icu the permission it needs, and only when you want to use the function. Without a connection, you can continue to use the app and your training plans in full.

5.1 Provider

Intervals.icu Ltd, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
Privacy policy: https://www.intervals.icu/privacy-policy/
Representative in the EU pursuant to Art. 27 GDPR: Prighter Group, https://app.prighter.com/portal/intervals-icu

Intervals.icu is itself responsible for the data in your Intervals.icu account. I am responsible for the data that I retrieve via the connection and store in the app.

5.2 Connecting and permissions

You click on “Mit Intervals.icu verbinden” (“Connect with Intervals.icu”) in the app and are redirected to Intervals.icu. There you sign in and grant access. I do not learn your Intervals.icu password. I receive an access token, the permissions granted as well as your Intervals.icu athlete ID and the name stored there. I store the token in encrypted form. For the connection process, I set a technically necessary, short-lived cookie which protects the process against manipulation.

Permission at Intervals.icu	What for	When I request it
Write calendar (CALENDAR:WRITE)	Entering, changing and removing planned sessions in your calendar (section 5.3)	when connecting
Read and write sport settings (SETTINGS:WRITE)	Synchronising threshold values (section 5.4)	only when you start synchronising the threshold values
Read activities (ACTIVITY:READ)	Assigning completed sessions to the training diary (section 5.5) or to your coaching (section 5.6)	only when you link the training diary to Intervals.icu or grant the “Für dein Coaching” (“For your coaching”) authorisation
Read wellness data (WELLNESS:READ)	Resting heart rate, HRV and Body Battery for your coaching (section 5.6)	only when granting the “Für dein Coaching” authorisation

With each new authorisation, Intervals.icu applies the most recently granted permissions to the entire connection. If I request an additional permission, I therefore also request the permissions already granted; in the Intervals.icu authorisation window you always see the complete list. A permission alone does not trigger any data retrieval: I only retrieve workout and health data for your coaching if you have additionally granted the “Für dein Coaching” authorisation (section 5.6).

5.3 Transferring training plans and the training calendar

Purchased training plans: You choose a purchased plan and a start date. I transfer the individual sessions with date, title, description and workout structure (duration, intervals, target ranges).
Coaching training calendar: In the coaching, I transfer the sessions I plan for you as well as rest days and notes to your Intervals.icu calendar.
Changes in the app: If you move or remove sessions or a plan, I update or delete the entries I created in your Intervals.icu calendar.
Changes in Intervals.icu: If you move or delete an entry I created directly in Intervals.icu, Intervals.icu notifies me automatically (webhook). I apply the change in the app so that both calendars match. In doing so, I only process entries that I created myself; I ignore other entries in your calendar.

I store which entries I have created (technical identifiers, date, transfer status) so that no duplicates are created and changes are possible.

Legal basis: Art. 6(1)(b) GDPR, as you actively use the function as part of the purchased plan or of your coaching.

5.4 Synchronising threshold values

The target ranges of the workouts are based on your threshold values. You can synchronise the threshold values stored in the app with the sport settings in Intervals.icu, in both directions.

Data processed: functional threshold power (FTP, including indoor FTP), lactate threshold heart rate (LTHR), maximum heart rate, threshold pace and the associated sports and training zones.
Process: The synchronisation always takes place via a comparison dialogue. I read the values from Intervals.icu, display them to you next to the values in the app and only adopt or transfer the values that you select and confirm. I only have your heart rate zones in Intervals.icu recalculated if you expressly select this option in the dialogue.
Legal basis: Art. 6(1)(b) GDPR. Insofar as heart rate values allow conclusions to be drawn about your health, I process them on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR, which you give by confirming in the dialogue.

5.5 Training diary for purchased plans

In the training diary of a purchased plan, you can record your own notes on each session and, if you link the diary to Intervals.icu, have the completed activity assigned to the planned session, automatically or manually.

Data processed: your notes and, from the assigned activity, only the activity ID, start time, sport, title, moving and total time and distance. I do not retrieve heart rate, power, GPS data or body values for the training diary.
Legal basis: Art. 6(1)(b) GDPR.
Storage period: as long as the purchase exists in your account or until you remove the note or assignment, at the latest until your account is deleted.

5.6 “Für dein Coaching” (“For your coaching”) authorisation: workout and health data

If you are a coaching athlete, you can share your completed sessions and selected health values from Intervals.icu with me. This allows me to compare planned and actual training, assess your load and recovery and adjust your training accordingly. Sharing is voluntary; the coaching is also possible without it, but then only on the basis of the information you provide to me yourself. This function is not available for accounts that exist only in the shop.

Workout data per completed session:

activity ID, date and start time, sport, title, indoor flag
moving and total time, distance, elevation gain, average speed, cadence, calories
training load and intensity, average and normalised power
average and maximum heart rate
time in the power, heart rate and pace zones as well as your zone boundaries
your rating of perceived exertion (RPE) and how you felt, insofar as you enter them in Intervals.icu
assignment to the planned session

Health data per day: resting heart rate, heart rate variability (HRV) and, if your device provides them, the lowest and highest Garmin Body Battery values.

What I do not retrieve: GPS tracks, second-by-second data (streams), device information, weight, sleep, mood, blood pressure, information on the menstrual cycle and comments from your wellness entries. Intervals.icu does not make activities imported via Strava available; they are not imported.

Process: After you grant the authorisation, I retrieve the sessions and health values of the last 12 months step by step. After that, Intervals.icu notifies me of new or changed activities (webhook), and a nightly synchronisation retrieves the values of the last few days. If you delete an activity in Intervals.icu, I remove its performance and health values in the app; only the date, sport and title are retained so that comments on it remain readable.

Visibility: Only you and I, as your coach, can see the data. We can comment on sessions in the app.

Purpose: training management, performance and load analysis and documentation of your coaching.
Legal basis: Art. 6(1)(b) GDPR in conjunction with Art. 9(2)(a) GDPR. Heart rate, power and wellness data are health data. I only process them with your explicit consent, which you give in the app via “Für dein Coaching freigeben” (“Share for your coaching”) and the subsequent authorisation at Intervals.icu.

Withdrawal: You can withdraw the authorisation at any time with effect for the future by disconnecting the connection in the app, revoking access in your Intervals.icu settings or sending me an email to contact@aspect-sports.com. From then on, I no longer retrieve any data. The data already retrieved remain stored as documentation of your coaching until the coaching ends. If you would like me to delete them earlier, a short message is sufficient; I will then delete them unless a legal obligation prevents this.

5.7 Passing on to devices and platforms

You determine in your Intervals.icu account which devices and platforms receive the workouts, e.g. Garmin, Wahoo or Zwift. This synchronisation is carried out by Intervals.icu, not by me. The privacy policies of Intervals.icu and of the respective provider apply to it.

5.8 Transfer to the United Kingdom

Intervals.icu has its registered office in the United Kingdom. For the United Kingdom, there is an adequacy decision of the EU Commission pursuant to Art. 45 GDPR, most recently renewed on 19 December 2025. According to its own information, Intervals.icu stores the data on servers in Germany and Finland and additionally uses cloud storage from Google, Backblaze and Wasabi.

5.9 Disconnecting and storage period

You can disconnect the connection in the app at any time. I then revoke access at Intervals.icu and immediately delete the access token, athlete ID and name. Any “Für dein Coaching” authorisation granted also ends as a result.
Alternatively, you can revoke access in your Intervals.icu settings. If I notice this the next time I access it, I treat the connection as disconnected.
When disconnecting, you can choose whether I remove the future sessions I created from your Intervals.icu calendar. Past sessions remain there so that they continue to be assigned to your completed activities. You can delete them yourself in Intervals.icu at any time.
I store which entries I have created in your calendar even after disconnection, so that I do not create them twice if you reconnect and so that I can remove them on request. I delete this assignment when you remove the plan, at the latest when your account is deleted.
Section 5.6 applies to retrieved workout and health data, and section 5.5 to the training diary.

6. Hosting, security and third countries

6.1 Hosting

The website, shop, app and mail server are operated at Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, on servers in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in secure and reliable operation.
Data protection at Hetzner: https://www.hetzner.com/legal/privacy-policy/

6.2 Security

All connections are encrypted via TLS (HTTPS).
I store passwords exclusively as a hash; they cannot be recovered.
I store access tokens for connected services such as Intervals.icu in encrypted form.
I store health data exclusively in the access-protected database on my server in Germany and do not pass them on to third parties.
For the connection to Intervals.icu, I only request the data fields I need for the respective function (section 5). The server's log files contain only technical identifiers and counters in this respect, no names, training or health values.
Only I have access to personal data; service providers such as Hetzner only receive access insofar as this is necessary for their task.

6.3 Transfers to third countries

Some recipients are located outside the EU or may transfer data there:

Recipient	Country	Basis
Intervals.icu Ltd (section 5)	United Kingdom	Adequacy decision, Art. 45 GDPR
Google LLC (Google Analytics, sign-in with Google, reCAPTCHA in the questionnaire)	USA	EU-US Data Privacy Framework, Art. 45 GDPR
PayPal (intra-group)	USA	According to the information in PayPal's privacy policy
Stripe, Inc. and other companies of the Stripe group (section 3.3)	USA	EU-US Data Privacy Framework, Art. 45 GDPR; additionally standard contractual clauses, Art. 46(2)(c) GDPR
Klarna, only when paying with Klarna (intra-group and Klarna service providers, section 3.3)	Partly outside the EU	According to the information in Klarna's privacy notice
Microsoft Corporation (Microsoft Teams)	USA	EU-US Data Privacy Framework, Art. 45 GDPR

In the USA, authorities may under certain circumstances access data without you being informed of this or being able to take effective action against it.

No personal data of users are transmitted to Anthropic (Claude API) (section 4.6).

7. Storage period

I only store personal data for as long as is necessary for the respective purpose or as required by statutory obligations.

Data	Storage period
Server log files	7 days
Invoices, accounting and payment records including bank details from bank transfers	8 years (Section 147 of the German Fiscal Code (Abgabenordnung – AO), Section 257 of the German Commercial Code (Handelsgesetzbuch – HGB))
Commercial and business letters	6 years (Section 147 AO, Section 257 HGB)
User account, training plans, Carb Lab data	Until the account is deleted
Coaching data including health data	Until the end of the coaching or until consent is withdrawn
Intervals.icu access token, athlete ID and name	Until the connection is disconnected or the account is deleted
Assignment of the calendar entries created in Intervals.icu	Until the plan is removed, at the latest until the account is deleted
Training diary of purchased plans (notes, assigned activities)	As long as the purchase exists in the account, at the latest until the account is deleted
Workout and health data from Intervals.icu (“Für dein Coaching” authorisation)	Until the end of the coaching or earlier at your request
Stripe payment identifiers, payment method and payment status	Like invoices and payment records: 8 years
Newsletter data	Until you unsubscribe
Proof of newsletter consent	Up to 3 years after you unsubscribe
Google Analytics	14 months
Enquiries by email or form	Until conclusively processed
Backup copy of form enquiries on the server	180 days
Answers from the “5 Fragen” questionnaire (without subsequent coaching)	A maximum of 12 months
Consent decision in the cookie banner (in your browser)	Until you delete it in your browser

Periods under commercial and tax law begin at the end of the calendar year in which the document was created. During this period, I block the data for any other use.

If you delete your account, I remove all associated data unless a statutory retention obligation prevents this.

8. Your rights

You have the following rights vis-à-vis me:

Access (Art. 15 GDPR): You have the right to obtain confirmation as to whether, and which, personal data concerning you are being processed.
Rectification (Art. 16 GDPR): You have the right to request the rectification of inaccurate or incomplete data.
Erasure (Art. 17 GDPR): You have the right to erasure of your personal data, insofar as this is not precluded by statutory retention obligations.
Restriction of processing (Art. 18 GDPR): You can request the restriction of processing of your data.
Data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format.
Objection (Art. 21 GDPR): You can object to the processing of your data at any time.
Right to lodge a complaint (Art. 77 GDPR): In the event of data protection infringements, you have the right to lodge a complaint with the competent supervisory authority.

To exercise these rights, please contact contact@aspect-sports.com.

8.1 Withdrawal of consent

You can withdraw any consent you have given at any time with effect for the future, via your profile in the app, via “Cookie settings” (for Google Analytics), via the unsubscribe link in the newsletter or by email to contact@aspect-sports.com. The lawfulness of the processing carried out up to that point remains unaffected. You disconnect the connection to Intervals.icu directly in the app; this also ends the “Für dein Coaching” authorisation (section 5.6).

8.2 Right to object under Art. 21 GDPR

If I process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. I will then no longer process your data unless I demonstrate compelling legitimate grounds which override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You can object to processing for direct marketing purposes at any time without giving reasons.

8.3 Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for me is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf
https://www.ldi.nrw.de

9. Social media

I maintain profiles on the following services. On my website, these are only linked; data only flow to the provider when you click on the link.

Instagram

I have a profile on Instagram. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. For details of how they handle your personal data, please refer to Instagram's privacy policy: https://privacycenter.instagram.com/policy/.

YouTube

I have a channel on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For details of how they handle your personal data, please refer to Google's privacy policy: https://policies.google.com/privacy. No YouTube videos are embedded on my website; the channel is only linked.

I have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. For details of how they handle your personal data, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.

Strava

I have a profile on Strava. The provider is Strava, Inc., 208 Utah Street, Suite 400, San Francisco, CA 94103, USA. For details of how they handle your personal data, please refer to Strava's privacy policy: https://www.strava.com/legal/privacy.

When you visit my profiles, the respective provider processes your data under its own responsibility. I am joint controller with Meta for the page statistics on Instagram (Art. 26 GDPR). The legal basis is Art. 6(1)(f) GDPR, my interest in presenting my offering effectively.

10. Changes

I adapt this privacy policy when my offerings or the legal situation change. The version currently published on my website applies.