Data protection
PRIVACY POLICY
Introduction and General Information
Protecting your data is important to us. With this privacy policy, we wish to inform you about the types of personal data (hereinafter referred to simply as "data") we process, as well as the purposes and scope of such processing, in connection with our services and offerings. In principle, it is possible to use the website www.joinpuya.de without providing any personal data. However, if a data subject wishes to utilize specific services offered by our company via our website, the processing of personal data may become necessary. This privacy policy applies to all processing of personal data carried out by us—whether in the course of providing our services or, in particular, on the website, in mobile applications, and within external online presences such as social media profiles (hereinafter collectively referred to as the "Online Offering") of Joinpuya.
Controller
Pouya Pourebrahim
Teichstr. 45
13407 Berlin
Email: fitness@joinpuya.de
Phone: +49 157 58 07 43 29
Legal Notice (Impressum): https://www.joinpuya.de/impressum
Hosting and Provision of the Website (Wix)
This website is hosted on the Wix platform. The provider is Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel. Wix collects and processes data on our behalf that is necessary for the provision and security of the website (e.g., server log files as well as contact, booking, and order data). We have entered into a data processing agreement with Wix in accordance with Art. 28 of the GDPR. This may involve the transfer of data to third countries (including the USA and Israel); Wix ensures an adequate level of data protection through appropriate safeguards (e.g., EU Standard Contractual Clauses). Further information: https://de.wix.com/about/privacy. The legal basis is our legitimate interest in the secure and efficient operation of the website (Art. 6(1)(f) GDPR).
Collection and processing of personal data
We process personal data only when necessary to provide our services or when you voluntarily provide us with data. This may include the following data:
- Contact information: Name, address, email address, telephone number
- Training data: Health data (e.g., medical certificates, health limitations), fitness level, training history and goals
- Contract data: Payment information and contractual agreements
Providing this data is necessary to create an individual training program, provide appropriate advice regarding health issues, and manage the contractual relationship. The processing of health data is governed separately in the section "Processing of health data."
Processing of health data (special categories)
As part of our swimming and fitness training, we process health data (e.g., health limitations, medical certificates, fitness levels). These constitute special categories of personal data under Art. 9 GDPR. Processing takes place solely on the basis of your explicit consent (Art. 9(2)(a) GDPR) and serves exclusively to ensure safe training tailored to your health status. You may revoke this consent at any time with effect for the future. The data will be deleted as soon as it is no longer required for training purposes and there are no statutory retention obligations preventing deletion.
Data concerning children and adolescents
Part of our service offering is aimed at children and adolescents. We process their personal data—including any health data—exclusively with the consent of their legal guardians. Guardians may revoke this consent at any time and exercise all rights on behalf of the child.
Cookies and consent
Our website www.joinpuya.de uses cookies. Cookies are small text files stored on your device via your internet browser. We use technically necessary cookies—those required for the operation of the website (e.g., shopping cart functionality, login)—based on our legitimate interest (Art. 6(1)(f) GDPR) or Section 25(2) TDDDG. We only use non-essential cookies (e.g., for statistics/analytics or social media) with your prior consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You provide this consent via our cookie banner, where you can also adjust or withdraw it at any time with effect for the future. Additionally, you can delete cookies that have already been set at any time via your browser settings. If certain cookies are deactivated, not all website functions may be fully available to you.
Collection of general data and information (server log files)
Each time a data subject or an automated system accesses our website, a series of general data and information is collected and stored in the server's log files. This may include: browser types and versions used, the operating system used, the referring website, the sub-pages accessed, the date and time of access, the Internet Protocol address (IP address), the internet service provider, and other similar data used for security purposes in the event of attacks. This data is required to correctly deliver and optimize the website's content, ensure the long-term functionality of our systems, and provide law enforcement authorities with the necessary information in the event of a cyberattack. The legal basis is our legitimate interest in the secure operation of the website (Art. 6(1)(f) GDPR). Server log files are stored separately from other personal data and are deleted once the purpose for their storage has been fulfilled.
Contacting us via the website
Our website contains information that enables rapid electronic contact and direct communication with us, including an email address. If you contact us via email or a contact form, the personal data transmitted will be stored for the purpose of processing your inquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding). This data is not passed on to third parties. The data is deleted as soon as it is no longer required for the intended purpose.
Online appointment booking
We use the Wix booking system (Wix Bookings) to schedule training appointments. When a booking is made, we process the data you provide (e.g., name, email, telephone number, desired appointment time) to carry out and manage the booking. The legal basis is Art. 6(1)(b) GDPR (contract or pre-contractual measures).
Online shop, vouchers, and payment processing
We use Wix Stores for the sale of training packages and vouchers. When an order is placed, we process the data required for this purpose (e.g., name, address, email, order and payment details). Payment processing is handled by the payment service providers offered in our shop (e.g., Wix Payments, PayPal). The data required for payment is transmitted to the respective selected provider. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention obligations).
Member area (registration and login)
You can create a user account on our website. During registration and login, we process the data you provide (e.g., name, email address, access credentials) to provide and manage your account. The legal basis is Art. 6(1)(b) GDPR. You may have your account deleted at any time.
Use of social media (Facebook, Instagram, TikTok, YouTube)
Our website integrates content or plugins from the networks Facebook, Instagram, TikTok, and YouTube to share our content and make usage more interactive. When you visit a page containing such an element, your browser may establish a direct connection to the respective provider's servers; in the process, personal data such as your IP address and technical details of your device may be transmitted. Integration occurs only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can grant and revoke via our cookie banner. Providers include: Meta Platforms Ireland Ltd. (Facebook, Instagram), 4 Grand Canal Square, Dublin 2, Ireland (Privacy Policy: https://www.facebook.com/privacy/policy/); TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (https://www.tiktok.com/legal/privacy-policy); Google Ireland Ltd. (YouTube), Gordon House, Barrow Street, Dublin 4, Ireland (https://policies.google.com/privacy). In this process, data may be transferred to third countries (including the USA); such transfers are safeguarded by appropriate guarantees (e.g., standard contractual clauses). We have no influence over the nature and scope of data processing carried out by these providers.
Google Analytics
On this website, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyze website usage (e.g., pages visited, duration of stay, approximate origin). Processing takes place exclusively on the basis of your consent (Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG), which you provide via our cookie banner and which you may revoke at any time with effect for the
...may revoke [consent] for the future. The IP address is processed in truncated form. In this process, data may be transmitted to Google in the USA, safeguarded by appropriate guarantees (EU Standard Contractual Clauses; Google is certified under the EU-US Data Privacy Framework). Further information: https://policies.google.com/privacy.
Purposes of data processing
Your data is collected and processed for the following purposes:
- Creation and customization of training, swimming, and nutrition plans
- Management of the trainer-client relationship
- Communication regarding appointment scheduling and organizational information
- Payment processing
- Adjustment of the training program based on individual fitness levels and health information
Relevant legal bases
We process personal data based on the following legal grounds:
- Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) – particularly for the processing of health data as well as for non-essential cookies, analytics, and social media services.
- Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR).
- Legal obligation (Art. 6(1)(c) GDPR), e.g., record-keeping obligations.
- Legitimate interests (Art. 6(1)(f) GDPR), e.g., secure operation of the website.
National data protection regulations in Germany
In addition to the GDPR, national regulations apply, specifically the Federal Data Protection Act (BDSG) and, where applicable, state data protection laws. These contain, among other things, specific provisions regarding the right of access, the right to erasure, and the right to object, as well as the processing of special categories of personal data. Disclosure of data to third parties
We only disclose your data to third parties if this is necessary for the performance of the contract (e.g., to payment service providers or to Wix as a data processor), if you have expressly consented, or if we are legally obliged to do so.
Storage period
Personal data is stored only for as long as is necessary to fulfill the respective purpose or as long as a statutory retention obligation exists. Once the purpose has been fulfilled or the statutory periods have expired, the data is deleted.
Rights of data subjects
You have the right to:
- obtain information about your processed data (Art. 15 GDPR);
- request the correction of incorrect data (Art. 16 GDPR);
- request the deletion of your data (Art. 17 GDPR), provided there are no statutory retention obligations preventing this;
- request the restriction of processing (Art. 18 GDPR);
- request data portability (Art. 20 GDPR);
- object to the processing of your data (Art. 21 GDPR);
- withdraw your consent at any time (Art. 7 para. 3 GDPR);
- lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information.
Data security
We employ technical and organizational measures to protect your data against unauthorized access, loss, and misuse. These measures are regularly reviewed and updated in line with the state of the art.
Changes to the privacy policy
We reserve the right to amend this privacy policy to reflect legal changes or changes to our services. The current version is published on this website.
Contact
For questions regarding the processing of your personal data or to exercise your rights, please use the contact details provided above.
As of: June 2026