Privacy Policy

1. Controller

Kniger Gym GmbH
Gritznerstr. 68
12163 Berlin
Germany

Phone: +49 (30) 58584839-0
Email: info@kniger.club

Managing directors: Klaus Knese, Johannes Behrndt. Full details in the imprint.

2. General data processing

We process personal data only within the framework of statutory law (GDPR, TDDDG, BDSG). Where we obtain consent for processing operations, Art. 6 (1) (a) GDPR is the legal basis. For processing necessary to perform a contract or pre-contractual measures, Art. 6 (1) (b) GDPR applies. Where a legal obligation requires processing, Art. 6 (1) (c) GDPR is the basis. Where processing is based on a legitimate interest, Art. 6 (1) (f) GDPR applies.

3. Hosting & site delivery

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA — via its Irish subsidiary Vercel Ireland Limited. When the site is accessed, connection data is processed on the server side (IP address, user-agent, requested resource, referrer, timestamp). Legal basis: Art. 6 (1) (f) GDPR (secure and stable provision of the website). Delivery uses the EU region Frankfurt; logs are typically deleted or anonymized after 14 days. A data processing agreement (DPA) is in place with Vercel; standard contractual clauses apply for any transfers to third countries.

4. Google Analytics and Google Ads

We use Google Analytics 4 and Google Ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA), to understand how our site is used and to measure whether a visit came from one of our ads.

What happens before you decide: for this measurement to work technically, the Google library is loaded on every page before you have made a choice in the banner — in a state where it sets no cookies and uses no data for personalised advertising („Consent Mode"). In doing so, your visit to the page is already reported to Google — to our analytics account and to our advertising account — together with your IP address. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest is a functioning reach measurement.

What happens only after your consent: cookies (including _ga, _ga_* and _gcl_au), the analysis of your usage and the building of audiences for ads. Data is also transferred to the USA; Google is certified under the EU-US Data Privacy Framework, supplemented by standard contractual clauses. The legal basis is your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time via „Cookie settings" in the footer.

More information: policies.google.com/privacy.

5. Live chat

With your consent we embed a live chat on our site that lets you write to us directly. It runs on the Chatwoot software on a server operated by us; your messages are stored there and are not passed on to a chat provider. We store the content of your messages, the time and an identifier for your conversation (cookie cw_conversation) so that you can continue where you left off on your next visit.

The connection to the chat runs via Cloudflare (Cloudflare, Inc., USA) as a security and access service. Cloudflare processes connection data such as your IP address in the course of this; the contents of your messages remain with us.

The legal basis is your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.

6. Content management (Sanity)

Editorial content (text, images, packages) is delivered via the headless CMS Sanity by Sanity.io ApS, Forhåbningsholms Allé 6, 1904 Frederiksberg, Denmark. Sanity is used exclusively for delivering editorial content and does not store any personal data of our website visitors. Legal basis: Art. 6 (1) (f) GDPR.

7. Booking system (bsport)

We use the booking system bsport SAS, 35 rue de Penthièvre, 75008 Paris, France, for class bookings, memberships, trial sessions and other appointments. When you click a "Book" or "Trial" button, you are redirected to the bsport portal. There, bsport processes your booking data, contact data, payment data and communication (e.g. reminders, cancellations) under its own controllership. Legal basis: Art. 6 (1) (b) GDPR (contract / pre-contractual measures).

We also send informational and promotional emails via bsport. The technical delivery is handled by Twilio Inc. (SendGrid), USA. In doing so we measure whether and when an email was opened and whether a link in it was clicked; we use this to assess how understandable our messages are and how often we should send them.

bsport's privacy policy: bsport.io/privacy-policy.

8. Newsletter, lead enquiries and delivery

Storage of enquiries. The details you provide in our forms (contact, trial session, partner enquiries, event registrations) are stored in a database operated by Supabase Inc. in the Frankfurt region (Germany). We process your name, email address, phone number where applicable and your message, together with the time of submission, a technical check value derived from your IP address and the identifier of your browser.

For these forms we do not store your IP address in plain text, only as a check value that cannot be reversed. It serves solely to detect misuse. The one exception is the newsletter confirmation described below — there the legally required proof of consent calls for the address in plain text.

Sending newsletters and information. For delivery we use Mailjet SAS, France (a company of the Sinch group). Processing takes place in data centres within the European Union. We transmit your email address, your name and delivery data — including whether and when an email was opened and whether a link in it was clicked.

Legal basis. For the newsletter it is your consent under Art. 6 (1) (a) GDPR. You can withdraw it at any time — via the unsubscribe link in every message or informally by email to info@kniger.club. For handling your enquiry it is Art. 6 (1) (b) or (f) GDPR; consent is not required for this.

Objection. You can object at any time to processing for direct marketing purposes (Art. 21 (2) GDPR). We will then no longer use your data for this purpose.

Reservation for the Kids and Youngstars courses. Through the reservation form we collect from you your first name, last name, email address and phone number, and from your child their first name, last name and date of birth, together with the requested course dates. We need the date of birth in order to check whether your child meets the age requirement of the chosen course.

We use these details to hold the place and to add your child to the booking system after the purchase. The legal basis is Art. 6 (1) (b) GDPR — the processing takes place at your request and in order to perform the subsequent contract.

The data is stored in our database at Supabase in Frankfurt. To confirm your reservation we send you an email; in doing so your details are processed by our automation service and our email system (Microsoft 365). Your child's data is only transmitted to our booking system once a purchase has been made. We do not collect an IP address or the identifier of your browser here.

We delete the details as soon as your child has been added to the booking system, at the latest 14 days after the reservation. They are removed completely, not archived.

As a parent you provide your child's data. The rights under this policy — access, rectification, erasure, restriction, portability and objection — also apply to your child; you can exercise them on your child's behalf.

Newsletter sign-up and confirmation

When you sign up for our newsletter, we send you an email with a confirmation link. Only once you confirm there do we add your address — before that you will not receive any newsletters from us.

On confirmation we store your IP address in plain text, together with the time of sign-up and confirmation, your browser identifier and the wording you agreed to. This serves solely to prove that the consent genuinely came from you — we are legally required to be able to demonstrate this (Art. 7(1) GDPR). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the demonstrability of consent.

If you do not confirm, we delete the sign-up including the IP address after seven days. If you unsubscribe later, we delete the entire record three years after you unsubscribe.

You can withdraw your consent at any time — via the unsubscribe link in every message or informally by email to info@kniger.club.

9. Online shop (Shopify)

Our merchandise shop at shop.kniger.club is provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. As soon as you visit the shop domain or place an order, Shopify processes order, payment and contact data under its own controllership and under Shopify's own privacy policy. Legal basis: Art. 6 (1) (b) GDPR.

Shopify's privacy policy: shopify.com/legal/privacy.

10. Maps (Google Maps)

On our location page you can activate an interactive map provided by Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). The map only loads after you explicitly click the "Activate map" button. Until then, no data is transmitted to Google. Once activated, your browser transmits connection data (in particular IP address) to Google; Google may also set cookies and similar technologies. Legal basis: Art. 6 (1) (a) GDPR (consent via active click).

Google may process data in the USA as well. Google is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses apply. Google's privacy policy: policies.google.com/privacy.

11. Cookie management (Klaro)

To obtain and manage consent for non-essential cookies and third-party services, we use the self-hosted, open-source consent management software Klaro by KIProtect GmbH. Klaro runs entirely client-side in your browser — no data is transmitted to KIProtect or any other third party. Your consent or refusal decision is stored exclusively in your browser's local storage, so it can be honored on future visits and documented as required. Legal basis: Art. 6 (1) (c) GDPR in conjunction with § 25 TDDDG (legal obligation to document consent) and Art. 6 (1) (f) GDPR (legitimate interest in a legally compliant website).

You can adjust or revoke your consent at any time via the "Cookie Settings" link in the footer. Further information: kiprotect.com/klaro.

12. Embedded fonts

This site uses the fonts Fahkwang and Manrope, served locally from our domain / Vercel hosting. No transmission to third-party providers (e.g. Google Fonts) takes place.

13. Retention

Lead data is kept up to 12 months after the last contact if no membership is concluded. Member data is kept for the duration of the membership and afterwards for the duration of statutory retention periods (in particular HGB/AO, up to 10 years). Newsletter subscriptions remain active until you unsubscribe. Server logs are deleted or anonymized after a maximum of 14 days.

14. Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where you have given consent, you can withdraw it at any time with effect for the future.

To exercise your rights, contact info@kniger.club.

You also have the right to lodge a complaint with the competent supervisory authority — for Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin.

15. Changes to this privacy policy

We reserve the right to adjust this privacy policy if legal frameworks or the tools we use change. The current version published on this page applies.