Introduction

Thank you for your interest in our website. The protection of your personal data is important to us. Below you will find information about how we handle your data that is collected through your use of our website. Your data will be processed in accordance with Germany's legal data protection regulations.

Controller within the meaning of data protection law

fitnessRAUM.de GmbH für Sport und Fitness online

Kirchstr. 18

69115 Heidelberg, Germany

Data Protection Officer

Proliance GmbH / www.datenschutzexperte.de

Data Protection Officer

Leopoldstraße 21

80802 Munich, Germany

When contacting our Data Protection Officer, please specify the company to which your request relates. Please refrain from enclosing sensitive information such as a copy of an identification document with your request.

Definitions

Our privacy policy should be simple and understandable for everyone. For this reason, our privacy policy generally uses the official terms of the General Data Protection Regulation (GDPR). The official definitions are explained in Art. 4 GDPR.

Access to and storage of information in terminal equipment 

By using our website, access to information (e.g. IP address) or storage of information (e.g. cookies) in your terminal equipment may occur. This access or storage may involve further processing of personal data pursuant to the GDPR.

In cases where such access to information or such storage of information is strictly necessary for the technically error-free delivery of our services, this is done on the basis of § 25 (1) s. 1, (2) no. 2 TTDSG. 

In cases where such a process serves other purposes (e.g. the needs-based design of our website), this will only be carried out on the basis of § 25 (1) TTDSG with your consent pursuant to Art. 6 (1) lit. a GDPR. The consent can be revoked at any time with effect for the future. 

For more information on the processing of your personal data and the relevant legal basis in this context, please refer to the following sections on the specific processing activities on our website. 

Web Hosting

This website is hosted by an external service provider (hoster). This website is hosted in the EU. Personal data collected on this website is stored on the hoster's servers. This may include, but is not limited to, IP addresses, contact requests, meta and communication data, web page accesses and other data generated by a website. We collect the listed data to ensure a proper connection to the website and an error-free delivery of our services. The processing of this data is strictly necessary to make the website available to you. The legal basis for the processing of the data is our legitimate interest in the correct presentation and functionality of our website in accordance with Art. 6 (1) lit. f GDPR. We have concluded a Data Processing Agreement with the provider in accordance with the requirements of Art. 28 GDPR, in which we commit him to protect the data of our customers and not to pass them on to third parties.

For further hosting services (including the hosting of photos), we also use the provider "AWS" (Amazon Web Services EMEA SARL, 38, avenue John F. Kennedy, 1855 Luxembourg) on this website. Personal data (including the IP address) may be transmitted to this provider when you visit the website. We have concluded a Data Processing Agreement with AWS in accordance with the requirements of Art. 28 GDPR, in which we commit AWS to protect the data of our customers and not to pass them on to third parties. Since a transfer of personal data by AWS to affiliates and sub-processors to countries outside the EU and EEA is possible, further appropriate safeguards are required to ensure the level of data protection under the GDPR. For the U.S., there is an adequacy decision of the EU Commission pursuant to Art. 45 (1) GDPR regarding companies with certification under the EU-U.S. Data Privacy Framework. Amazon.com, Inc. and other AWS affiliates are certified under the EU-U.S. Data Privacy Framework and are therefore committed to compliance with adequate data protection standards, which can be verified via the following link: https://www.dataprivacyframework.gov/s/participant-search. For potential transfers to other countries outside the EU and the EEA, for which no adequacy decision of the EU Commission exists, we have concluded standard contractual clauses with the provider in accordance with Art. 46 (2) lit. c GDPR. These oblige the recipient of the data in the country outside the EU to process the data in accordance with the level of protection in Europe.

Server- Logfiles

Once you visit our website, it is technically necessary that data is transmitted to our web server via your internet browser. The following data is recorded during an active connection for communication between your internet browser and our web server:

Date and time of the request
Name of the requested file
Page from which the file was requested
Access status
Web browser used and operating system used
(Full) IP address of the requesting computer
Transmitted amount of data

We collect the listed data to ensure a proper connection to the website and an error-free delivery of our services. The processing of this data is strictly necessary to make the website available to you. The log files are processed for the purpose of evaluating system security and stability as well as for administrative purposes. The log files serve to evaluate system security and stability as well as administrative purposes. The legal basis for the processing of the data is our legitimate interest in the protection and functionality of our website in accordance with Art. 6 (1) lit. f GDPR.

For reasons of technical security, in particular to prevent attempts to attack our web server, we may temporarily store this data. After 180 days at the latest, the data is made anonymous by shortening the IP address at domain level, so that it is no longer possible to establish a reference to the individual user. This data is not evaluated in anonymous form except for statistical purposes. This data is not combined with data from other data sources.

Contact form and e-mail

If you send us an enquiry using the contact form or by e-mail, we will store the information you provide on the form or in your e-mail, including your contact details, for the purposes of processing your enquiry and for any follow-up enquiries. Under no circumstances will we pass on this information without your consent. The legal basis for processing the data is our legitimate interest in responding to your request pursuant to Art. 6 (1) lit. f GDPR and, where applicable, Art. 6 (1) lit. b GDPR if your request is for the purpose of concluding a contract. Your data will be deleted after processing your request, unless there is a legal obligation to retain the data. You can object to the processing of your personal data at any time in the case of Art. 6 (1) lit. f GDPR.

Registration and customer account

You have the option to register for certain services (programmes and courses) offered on our website and thereby create a customer account. As part of the registration and set-up process, we process the following personal information:

First name, last name, title
e-mail address
Password
Date and time of registration
Your customer account will enable you to use other parts of our service and to log in to the services you have purchased. We also store the following information in this account

Additional identification information: Member ID
Contract data: Membership type, membership status, subscription interval, contract status, contract term, contract number.
The legal basis for the processing of the data required for the provision of the customer account and the provision of the requested services (programmes/courses) is Art. 6 (1) lit. b GDPR.

In the customer account you also have the opportunity to provide further optional information to personalise your customer profile and training plan: 

Profile picture, gender
Community settings (settings for publishing profile picture and nickname)
Weekly goals (calories burned and minutes worked)
Activities (activity type, duration, calories)
Training plan/diary
Favourites (saved courses, course ratings, user notes on courses)
Fitness profile: weight, height, age, waist/hip, waist/hip, chest/chest circumference and body mass index (BMI) calculated from these data.
The legal basis for the processing of this data is your consent pursuant to Art. 6 (1) lit. a GDPR or according to Art. 9 (2) lit. a GDPR, insofar as special categories of personal data are processed. You may revoke your consent at any time with effect for the future by deleting the relevant data in your customer account.

Your data will be deleted as soon as the user account on our website is deleted and unless there is a legal obligation to retain the data. You can initiate a change and/or deletion of your user account, including the data you have provided, either directly via your customer account or by sending a message to .

Advertising

If we have obtained your e-mail address from you in connection with the sale of a product or service and have indicated this at the time of collection, we may use this address for direct advertising of our own similar goods or services. The legal basis for this processing is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR (§ 7 Abs. 3 UWG). You can object to this use at any time without incurring any costs other than the transmission costs according to the basic rates.

Cookies

Our website uses so-called “cookies”. Cookies are small text files that are either temporarily stored on your end device for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your terminal device until you delete them yourself or an automatic solution is provided by your web browser.

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping basket function or language settings). Other cookies are used to evaluate user behaviour or display advertising.

The processing of data using strictly necessary cookies is based on a legitimate interest pursuant to Art. 6 (1) lit. f GDPR in the technically error-free delivery of our services. For details on the processing purposes and legitimate interests, please refer to the following explanations on the specific data processing.

The processing of personal data using other cookies is based on consent in accordance with Art. 6 (1) lit. a GDPR. The consent can be revoked at any time with effect for the future. Insofar as such cookies are used for analysis and optimisation purposes, we will inform you separately about this in this privacy policy and obtain your consent in accordance with Art. 6 (1) lit. a GDPR.

You can set your browser to 

be informed about the setting of cookies, 
only allow cookies in individual cases, 
exclude the acceptance of cookies for certain cases or generally,
activate the automatic deletion of cookies when the browser is closed.

The cookie settings can be managed under the following links for each browser:

You can also manage cookies of many companies and functions used for advertising individually. To do so, use the appropriate user tools, available at https://www.aboutads.info/choices/ or http://www.youronlinechoices.com/uk/your-ad-choices.

Most browsers also offer a so-called "do-not-track function". When this feature is enabled, the browser tells ad networks, websites, and applications that you do not want to be "tracked" for behavioural advertising and the like.

For information and instructions on how to edit this feature, please refer to the links below, depending on your browser provider:

Google Chrome 
Mozilla Firefox  
Edge (Microsoft)   
Safari 
Opera

Change cookie settings

You can withdraw or change your cookie preferences at any time. You can do this by accessing the cookie settings again via the link in the footer of our website (at the bottom of our website).

 Google Tag Manager

This website uses the Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This service allows website tags to be managed through an interface. The Google Tag Manager only implements tags. This means that no cookies are used and only the user's IP address is transmitted to Google to establish a connection. The Google Tag Manager triggers other tags, which in turn may collect data. However, the Google Tag Manager does not access this data. If a deactivation has been made on domain or cookie level, it will remain for all tracking tags as long as they are implemented with the Google Tag Manager.

We use the Google Tag Manager based on your consent pursuant to Art. 6 (1) lit. a GDPR. 

Since a transfer of personal data by Google to affiliates and sub-processors to countries outside the EU and EEA is possible, further appropriate safeguards are required to ensure the level of data protection under the GDPR. For the U.S., there is an adequacy decision of the EU Commission pursuant to Art. 45 (1) GDPR regarding companies with certification under the EU-U.S. Data Privacy Framework. Google LLC is certified under the EU-U.S. Data Privacy Framework and is therefore committed to compliance with adequate data protection standards, which can be verified via the following link: https://www.dataprivacyframework.gov/s/participant-search 

For potential transfers to other countries outside the EU and the EEA, for which no adequacy decision of the EU Commission exists, we have concluded standard contractual clauses with the provider in accordance with Art. 46 (2) lit. c GDPR. These oblige the recipient of the data in the country outside the EU to process the data in accordance with the level of protection in Europe.

Google Analytics 4

This website uses Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which can be utilized to analyze the use of websites.

When using Google Analytics 4, so-called "cookies" are used. The information collected by cookies about your use of the website (including the IP address transmitted by your terminal device, of which the last digits are shortened, see below) is usually transmitted to a Google server and stored and processed there. This may also result in the transmission of information to the servers of Google LLC, a company based in the U.S., where the information is further processed.

When using Google Analytics 4, the IP address transmitted by your terminal device during your use of the website is always collected and processed automatically and by default only in a shortened form, so that a direct reference of the collected information to your person is excluded. This automatic anonymization is carried out by Google shortening the IP address transmitted by your terminal device within member states of the European Union (EU) or other contracting states of the Agreement on the European Economic Area (EEA) by the last digits.

On our behalf, Google uses this and other information to evaluate your use of the website, to compile reports about your website activities and usage behavior, and to provide us with other services related to your website and internet usage. In this context, the shortened IP address transmitted by your terminal device in the context of Google Analytics 4 will not be merged with other data from Google. The data collected during the use of Google Analytics 4 will be retained for 12 months and then deleted.

Google Analytics 4 also enables the creation of statistics with statements about the age, gender and interests of website users on the basis of an evaluation of interest-based advertising and with the involvement of third-party information via a special function, the so-called "demographic characteristics". This makes it possible to determine and distinguish between groups of website users for the purpose of targeted marketing measures. However, data collected via the "demographic characteristics" cannot be assigned to a specific person and thus not to you personally. This data collected via the "demographic characteristics" function is retained for 12 months and then deleted.

All processing described above, in particular the placement of Google Analytics cookies for the storage and reading of information on the terminal device used by you for the use of the website, will only take place if you have given us your express consent for this in accordance with Art. 6 (1) lit. a GDPR. Without your consent, Google Analytics 4 will not be used during your visit to the website.

As an extension of Google Analytics 4, the "UserIDs" function is also used for this website. By assigning individual UserIDs, we can have Google create cross-device reports (so-called "cross-device tracking"). This means that your usage behavior can also be analyzed across devices if you have given your corresponding consent to the use of Google Analytics 4 in accordance with Art. 6 (1) lit. a GDPR, if you have set up a personal account by registering on this website and are logged into your personal account on different end devices with your relevant login data. The data collected in this way shows, among other things, which end device was used to click on an ad for the first time and which end device was used for conversion.

We have concluded a so-called data processing agreement with Google for our use of Google Analytics 4, by which Google is obliged to protect the data of our website users and not to pass it on to third parties.

Since a transfer of personal data by Google to affiliates and sub-processors to countries outside the EU and EEA is possible, further appropriate safeguards are required to ensure the level of data protection under the GDPR. For the U.S., there is an adequacy decision of the EU Commission pursuant to Art. 45 (1) GDPR regarding companies with certification under the EU-U.S. Data Privacy Framework. Google LLC is certified under the EU-U.S. Data Privacy Framework and is therefore committed to compliance with adequate data protection standards, which can be verified via the following link: https://www.dataprivacyframework.gov/s/participant-search 

For potential transfers to other countries outside the EU and the EEA, for which no adequacy decision of the EU Commission exists, we have concluded standard contractual clauses with the provider in accordance with Art. 46 (2) lit. c GDPR. These oblige the recipient of the data in the country outside the EU to process the data in accordance with the level of protection in Europe.

Further legal information on Google Analytics 4, including a copy of the aforementioned standard contractual clauses, can be found at the following link: https://policies.google.com/privacy 

Details on the processing triggered by Google Analytics 4 and Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites 

Data Transfer and Recipients

Your personal data is not transferred to third parties, unless

we have explicitly pointed this out in the description of the respective data processing.
you have given your explicit consent in accordance with Art. 6 (1) s. 1 lit. a GDPR,
the transfer pursuant to Art. 6 (1) s. 1 lit. f GDPR is necessary for the assertion, exercise or defence of legal claims and our legitimate interests are not overridden by your fundamental rights and freedoms. 
there is a legal obligation to transfer data pursuant to Art. 6 (1) s. 1 lit. c GDPR, and
required by Art. 6 (1) s. 1 lit. b GDPR for the execution of contractual relationships with you.
In addition, we use external service providers for the processing of our services, whom we have carefully selected and commissioned in writing. They are bound by our instructions and are regularly monitored by us. Required data processing agreements pursuant to Art. 28 GDPR are concluded before the commission. In particular, these contracts concern web hosting services, the dispatch of e-mails and IT updates and maintenance. Your personal data will not be transferred to third parties by our service providers. 

Data security

We take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk in accordance with Article 32 of the GDPR, taking into account the state of the art, the cost of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying probability and severity of the risk to the rights and freedoms of natural persons. This website uses SSL encryption for security reasons and to protect the transmission of confidential content.

Storage period

The period for which the personal data will be stored is determined by the relevant statutory storage periods (e.g. from commercial law and tax law). The corresponding data is deleted routinely upon expiry of the respective period. If data is required for the fulfilment of a contract or contract initiation, or if we have a legitimate interest in further storage, the data will be deleted if they are no longer required for these purposes or if you make use of your right of withdrawal or objection.

Your Rights

In the following, you will find information about your data subject rights, which the current data protection law grants you against the controller concerning the processing of personal data:

The right, pursuant to Art. 15 GDPR, to obtain information about your personal data processed by us. In particular, you may request information about the purposes of processing, the categories of personal data concerned, the categories of recipients to whom your data has been or will be disclosed, the envisaged period for which the data will be stored, the existence of the right to request from the controller rectification or erasure or personal data or restriction of processing of personal data concerning you or to object such processing, the existence of a right to lodge a complaint with a supervisory authority, the origin of your data, if these have not been collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information about the logic involved, as well as the significance and the envisaged consequences.

The right to obtain without undue delay the rectification of inaccurate personal data concerning you. in accordance with Art. 16 GDPR.

The right to request the erasure of your personal data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary to exercise the right of freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims.

The right, pursuant to Art. 18 GDPR, to demand the restriction of the processing of your personal data if the accuracy of the data is contested by you, the processing is unlawful, but you oppose the erasure and we no longer need the data for the purposes of processing, but they are required by you for the establishment, exercise or defence of legal claims or you have filed an objection against the processing pursuant to Art. 21 GDPR.

The right, in accordance with Art. 20 GDPR, to receive the personal data concerning you, which you have provided to us in in a commonly used and machine-readable format and the right to transmit those data to another controller. 

The right to withdraw your given consent pursuant to Art. 7 (3) GDPR with effect in the future at any time.

The right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, in particular in the Member State of your habitual residence, place of work. 

The right to withdraw your given consent pursuant to Art. 7 (3) GDPR: You have the right to withdraw your given consent concerning the processing of your personal data with effect for the future at any time. In the event of withdrawal, we will delete the data concerned without delay, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. 

Right to object

If your personal data is processed by us based on legitimate interests pursuant to Art. 6 (1) lit. f GDPR, you have the right, pursuant to Art. 21 GDPR, to object at any time to the processing of your personal data on grounds relating to your particular situation. If the objection is directed against the processing of personal data for the purpose of direct marketing, you have a general right of objection without the requirement of stating a particular situation.

If you wish to exercise your right of withdrawal, objection or any of your other rights, simply send an e-mail to .

Necessity of providing personal data 

The provision of personal data for the decision on the conclusion of a contract, the fulfilment of the contract or for the implementation of pre-contractual measures is voluntary. However, we can only make the decision in the context of contractual measures if you provide such personal data that is required for the conclusion of the contract, the fulfilment of the contract or pre-contractual measures.

Automated decision making

Automated decision making or profiling according to Art. 22 GDPR does not take place.

Subject to change

We reserve the right to adapt or update this privacy policy, if necessary, in compliance with the applicable data protection regulations. In this way, we can adapt it to the current legal requirements and take account of changes to our services, e.g. the introduction of new services. The most current version applies to your visit.

Status of this privacy policy: 2025-08-21