Skip to content
DE EN
Trial session
Legal

Privacy policy

How personal data is processed on this website (Art. 13 GDPR). This English translation is for convenience only; the German version prevails.

1. Controller

The controller responsible for processing data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Invest Objekt Wittenberger Straße GmbH
Hafenstraße 20
04442 Zwenkau
Germany
represented by its managing director Lilli-Marie Kolatka
Phone: +49 176 36394054
Email: info@maxx-fitness-deluxury.com

The company operates the club Maxx Fitness Deluxury, Rathausstraße 33–35, 04416 Markkleeberg. If you have any questions about data protection, you can reach us at any time using the contact details above.

2. At a glance

  • We only process personal data where this is necessary to run this website and to handle your enquiries.
  • No analytics or tracking tools, no advertising or marketing cookies and no social media plugins.
  • We only load external media – currently the interactive Google Maps map – if you have consented in the privacy settings. You can change your decision at any time.
  • We serve the fonts ourselves. Without your consent, loading our pages only connects your browser to our hosting provider (section 3) – not to Google or any other third party.
  • The connection to this website is encrypted with TLS (HTTPS).
  • We do not sell data. We only share it with the service providers named in this policy, who act on our behalf, or where we are legally obliged to do so.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA (“Vercel”). Vercel delivers the pages through a globally distributed server network and also runs the website’s server functions, such as the enquiry form.

Each time a page is requested, Vercel automatically processes data sent by your browser and stores it in server log files:

  • IP address and the approximate location derived from it (country, city)
  • date and time of access
  • requested page or file and HTTP status code
  • amount of data transferred
  • referrer URL (the page you came from), if transmitted
  • browser type and version and operating system (user agent)

The purpose is to deliver the website technically and to keep it stable and secure, in particular to detect and fend off attacks and misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing our website securely, reliably and quickly. Log data is not combined with other data and is only stored for as long as necessary for these purposes; it is then deleted or anonymised.

Vercel processes this data on our behalf. We have concluded a data processing agreement (Data Processing Addendum) with Vercel in accordance with Art. 28 GDPR.

As Vercel is based in the USA, data may be transferred to the USA. The European Commission has adopted an adequacy decision for the USA (EU-U.S. Data Privacy Framework, Implementing Decision (EU) 2023/1795), and Vercel is certified under this framework (Art. 45 GDPR). In addition, Vercel has agreed to the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). For more information, see Vercel’s privacy notice (opens in a new tab) and the list of certified organisations (opens in a new tab).

4. Database and backend (Supabase)

We use Supabase as our database and backend. Our contractual partner is Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 (“Supabase”). The database stores the enquiries from our form (section 5) and the data of our password-protected admin area.

Our Supabase project is set up in the Frankfurt am Main region (Amazon Web Services, region eu-central-1), where the data is stored. Supabase processes it solely on our behalf under a data processing agreement (Data Processing Addendum) in accordance with Art. 28 GDPR. The legal basis is Art. 6(1)(b) and (f) GDPR; our legitimate interest lies in storing and managing the data securely and reliably. The storage period follows section 5.

Supabase is based in Singapore, for which the European Commission has not adopted an adequacy decision, and uses sub-processors for hosting, support and security that are mostly based in the USA (such as Amazon Web Services, Inc. and Supabase, Inc.). Where data may be processed or accessed outside the EU/EEA in this context, the EU Standard Contractual Clauses apply (Art. 46(2)(c) GDPR); they form part of the data processing agreement. For more information, see Supabase’s Data Processing Addendum (opens in a new tab), list of sub-processors (opens in a new tab) and privacy policy (opens in a new tab).

5. Enquiry form (trial session and membership)

You can use our form to request a trial session or to enquire about a membership. We process:

  • what you are interested in (trial session or the membership you would like)
  • first and last name
  • email address
  • phone number (optional)
  • preferred date or chosen time for the trial session (optional)
  • your message (optional)

We also store the language you used the form in, the time of your enquiry including your confirmation that you have read this privacy policy, and the processing status of your enquiry. We need your name, email address and what you are interested in so that we can reply; without them we cannot handle your enquiry. All other details are optional.

Our form is also available on dedicated campaign pages (addresses under /de/aktion/ or /en/offer/) that we link to, for example, in Instagram and Facebook posts or via QR codes on flyers. If you send your enquiry from such a page, we additionally store which campaign it came from (the campaign’s short name) and the campaign parameters contained in the link you opened (utm_source, utm_medium and utm_campaign, such as “instagram”, “story” and the campaign name). This information comes solely from the address you opened. We do not use cookies, tracking pixels or analytics services for this, do not create usage profiles and do not combine this information with other data. The purpose is to see which channels lead people to contact us so that we can plan our advertising sensibly. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in evaluating which advertising leads to enquiries. This information is stored and deleted together with your enquiry.

If a campaign page asks a few short tap-to-answer questions before the form (for example about your training goal or when you would like to start), we store your answers together with your enquiry. They help us give you the right advice when we first get in touch. Purpose, legal basis and storage period are the same as for the rest of your enquiry.

The purpose is to handle your enquiry, to arrange a trial session and, where applicable, to prepare a membership. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract); where your enquiry is not aimed at a contract, it is Art. 6(1)(f) GDPR – our legitimate interest lies in answering enquiries.

If you choose a free time for your trial session in the form, we reserve it for you in our booking calendar. For this, we store the date, the time and the status of the booking together with your enquiry. The form only shows which times are free or taken – no information about other people. We confirm the appointment by email as soon as your coach is set, and we also let you know by email if we have to move or cancel it. The coach who takes your trial session sees your name, phone number, what you are interested in, your message and, where applicable, your answers from the campaign page in our admin area, and receives an email with your name, phone number and the appointment. Only one future appointment can be reserved per email address at a time. Purpose, legal basis and storage period are the same as for the rest of your enquiry.

To protect the form against misuse, we limit the number of enquiries per IP address. For this, we store for no longer than 30 days a check value calculated from your IP address with a secret key (HMAC hash), together with the time of the enquiry – not the IP address itself and not linked to your enquiry. If our database cannot be reached, your IP address is only processed briefly in the server’s memory (Art. 6(1)(f) GDPR, legitimate interest in protection against automated mass submissions).

Your enquiry is stored in our database at Supabase (section 4) and sent by email to our club mailbox info@maxx-fitness-deluxury.com. You receive an email confirming that we have received your enquiry and, once we have accepted it, a further confirmation – including the agreed appointment where applicable. Only club staff who handle your enquiry and the coach who takes your trial session have access.

To send these emails – including the notification to our mailbox – we use the Resend service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA as a processor (Art. 28 GDPR). Resend processes your email address, the content of these emails – that is, the details from the form – and technical delivery data. Resend stores this data in the USA. The European Commission has adopted an adequacy decision for the USA (EU-U.S. Data Privacy Framework, Implementing Decision (EU) 2023/1795), and Resend is certified under this framework (Art. 45 GDPR). In addition, the EU Standard Contractual Clauses have been agreed (Art. 46(2)(c) GDPR). For more information, see Resend’s Data Processing Addendum (opens in a new tab), privacy policy (opens in a new tab) and the list of certified organisations (opens in a new tab).

Our mailbox is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, also as a processor (Art. 28 GDPR).

We delete your details once your enquiry has been fully dealt with and no membership contract is concluded. If you take out a membership, we keep the related correspondence for as long as commercial and tax law retention obligations require (Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)).

6. Contact by email or phone

If you contact us by email or phone, we process your details (such as your name, contact details and the content of your message) to deal with your request. The legal bases and storage period are the same as in section 5. Emails to us are stored in our mailbox at IONOS SE.

7. Privacy settings (consent)

On your first visit, a banner asks whether we may load external media. You can accept all categories, reject them just as easily or choose individually in the settings:

  • Necessary (always active): storing your privacy settings and – for administrators only – the login cookie of the admin area (section 8).
  • External media (optional): third-party content, currently the interactive Google Maps map (section 10).

We store your decision only in your browser (local storage, entry “mx-consent”): the version of the settings, the categories you chose and the time. No cookie is set for this and nothing is sent to a server. This storage is strictly necessary so that we can respect your decision (Section 25(2) No. 2 TDDDG); the legal basis is Art. 6(1)(f) GDPR – our legitimate interest lies in applying your choice without asking you again on every visit. The entry remains until you change your settings or clear the website data in your browser.

You can change or withdraw your consent at any time via the “Privacy settings” link in the footer of every page. Withdrawal takes effect for the future; it does not affect the lawfulness of processing carried out before (Art. 7(3) GDPR).

8. Cookies and storage on your device

We do not set cookies for analytics, tracking or marketing purposes. The only things stored on your device are:

  • your privacy settings in your browser’s local storage (section 7);
  • in the password-protected admin area, used by our staff only: a login cookie that keeps the session active for no more than twelve hours and is deleted when logging out, and the display mode chosen there (light or dark). Both are strictly necessary to provide the service expressly requested (Section 25(2) No. 2 TDDDG; Art. 6(1)(f) GDPR);
  • only with your consent: cookies or similar technologies from Google when the Google Maps map is loaded (section 10).

9. Fonts

The fonts used on this website (Barlow, Barlow Condensed and Cormorant Garamond) are hosted locally and are delivered together with the website by our hosting provider. There is no connection to Google Fonts or any other font provider.

10. Location map and Google Maps

On our location page, we first show a static map that we created from OpenStreetMap data and serve ourselves. No data is transferred to OpenStreetMap, Google or any other third party.

Only if you have consented to the “External media” category do we load an interactive Google Maps map instead, embedded directly from google.com. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may also reach Google LLC in the USA. When the map loads, Google receives your IP address and usage data, such as the page visited, date and time, browser information and your interactions with the map. Google may also set and read cookies or similar technologies. We have no influence over this processing.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time with effect for the future via “Privacy settings”; the map will then no longer be loaded.

For transfers to the USA, the European Commission has adopted an adequacy decision (EU-U.S. Data Privacy Framework, Art. 45 GDPR), and Google LLC is certified under this framework. For more information, see Google’s privacy policy (opens in a new tab) and Google’s information on data transfer frameworks (opens in a new tab).

We also use simple links: “Open in Google Maps” for directions, to our profiles on Instagram in the footer and on the location page, and to the OpenStreetMap licence page. Social networks are not embedded and we do not use social media plugins. As long as you do not click, no data is transferred to these providers. Only after you click does the provider’s website open, and that provider then processes data under its own responsibility – such as your IP address and the fact that you came from our website. The providers are Google Ireland Limited (Google Maps), Meta Platforms Ireland Limited (Instagram) and the OpenStreetMap Foundation. You can find more information in the privacy policies of Google (opens in a new tab), Instagram (opens in a new tab) and the OpenStreetMap Foundation (opens in a new tab).

12. Your rights

With regard to your personal data, you have the following rights:

  • access to the data we process about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing (Art. 21 GDPR, see section 13)
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR, see section 7)

To exercise your rights, simply contact info@maxx-fitness-deluxury.com.

13. Right to object

Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal message to info@maxx-fitness-deluxury.com is sufficient.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

Sächsische Datenschutz- und Transparenzbeauftragte
Maternistraße 17
01067 Dresden
Germany
www.datenschutz.sachsen.de (opens in a new tab)

15. No automated decision-making

We do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

16. Changes to this privacy policy

We update this privacy policy whenever our website, our service providers or the legal situation change. The version published here applies.

Last updated: November 2026