Privacy Policy
The German version prevails.
This privacy statement explains how we process personal data on www.crossfitf2.de and for bookings, memberships and purchases at CrossFit F2.
1. Controller
XF3 GmbH (CrossFit F2)
Kirschstr. 18
80999 Munich, Germany
Email: Info@CrossFitF2.de
Phone: +49 89 81893827
XF3 GmbH runs CrossFit F2 and also develops the booking software Box Planner, which handles trial classes, drop-ins, classes, memberships and the shop. Box Planner is therefore not an outside service provider: XF3 GmbH alone is the controller for your data as a visitor, prospect and member of CrossFit F2. For your Box Planner account and the Box Planner app, the Box Planner privacy policy applies in addition.
2. What We Process and Why
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the website, security | IP address, time, page requested, browser | legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR) |
| Enquiries by email, phone or WhatsApp | name, email address or phone number, message | handling your enquiry ((b) or (f)) |
| Trial class, drop-in, class booking, membership | name, contact details, bookings, contract and payment data | contract or pre-contractual steps (b), statutory retention duties (c) |
| Shop purchase | name, email address, order, payment status | contract (b), statutory retention duties (c) |
| Visitor statistics (only with consent) | see section 4 | consent ((a), § 25(1) TDDDG) |
| Google Maps map (only on click) | see section 5 | consent (a) |
3. Hosting and Service Providers
The website, Box Planner and the database run on Microsoft Azure (Microsoft Ireland Operations Ltd., Dublin) in data centres in the EU; the website's images are stored there too. Our mailbox runs on Google Workspace (Google Ireland Limited, Dublin). These providers process data on our behalf (Art. 28 GDPR); Google may transfer data to the USA (EU-U.S. Data Privacy Framework).
If you pay online in the shop, payment is handled by Stripe (Stripe Payments Europe Ltd., Dublin). Stripe receives your name, email address, the amount and your payment details; you enter card or account details directly with Stripe and we never see them. Stripe may also transfer data to the USA (EU-U.S. Data Privacy Framework, Standard Contractual Clauses).
4. Cookies, Local Storage and Visitor Statistics
Without your consent we only store what the website needs (§ 25(2) TDDDG): your choice in the cookie banner (local storage) and your language choice (cookie, 1 year).
With your consent we load Google Tag Manager (Google Ireland Limited, Dublin) and through it Google Analytics to understand how the website is used. This sets cookies (e.g. _ga, up to 2 years) and sends data such as your IP address, pages viewed and device information to Google, including to the USA (EU-U.S. Data Privacy Framework). Tag Manager is not loaded before you consent.
You can withdraw your consent at any time via the "Cookie settings" link in the footer; the Google cookies are then deleted.
5. Fonts, Maps and External Content
Fonts, icons and scripts are served from our own server; visiting the website opens no connection to Google Fonts, content delivery networks or other third parties.
Map: On the contact page you can load a map from Google Maps (Google Ireland Limited). Your browser connects to Google only when you click "Show map"; this sends your IP address, among other things, and may set cookies, including transfers to the USA (EU-U.S. Data Privacy Framework).
Google reviews: We show reviews from our Google business profile. Our server fetches them from Google; your browser does not connect to Google for this. Only the name the reviewers gave on Google and the review text are shown.
Links to social networks (Facebook, Instagram, YouTube) and to WhatsApp are plain links; data are only transferred when you click them. If you message us on WhatsApp, WhatsApp (Meta) processes your message and phone number.
6. Retention
- Server log data are automatically deleted after 90 days.
- Backups are overwritten after 35 days at the latest.
- Membership, booking and contract data are kept as long as the membership or contract exists; afterwards we delete or anonymise them unless statutory retention periods apply (e.g. 8 years for invoices and accounting records, § 147 AO, § 257 HGB).
- Enquiries are deleted once handled, unless we have to keep them.
7. Your Rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You can withdraw any consent at any time with effect for the future.
Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.
Right to lodge a complaint: You can complain to a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
8. Contact
For questions about data protection or to exercise your rights, contact us at Info@CrossFitF2.de or by post to XF3 GmbH, Kirschstr. 18, 80999 Munich, Germany.