Datenschutz
1. What Data We Collect
We process our users' personal data only to the extent necessary to provide a functioning website and our content and services. Specifically:
- Your email address, if you sign up for the newsletter or the waitlist.
- Your message and email address, if you write to us using the contact form.
- Only after your explicit consent (opt-in): Usage and web analytics data (such as approximate location data, technical browser and device information, interaction data like scrolling, clicks, mouse movements, and recorded user sessions) via Google Analytics 4 and Microsoft Clarity.
2. Purpose of Processing
We use your email address exclusively to send you the HALTBAR newsletter. We do not pass your data on to third parties, do not sell it, and do not use it for advertising analysis.
3. Legal Basis
Processing is based on your explicit consent pursuant to Art. 6(1)(a) GDPR. You can withdraw this consent at any time — an unsubscribe link is located at the bottom of each newsletter.
4. Retention Period
We store personal data only as long as necessary for the respective processing purposes:
- Email address (Newsletter / Waitlist): Stored until you withdraw consent or unsubscribe (deletion takes place within 30 days).
- Contact inquiries: Stored for the duration of handling your request and deleted thereafter.
- Survey data: For the retention period of the survey responses, please refer to the specific section in 6.
- Google Analytics 4 and Microsoft Clarity: For the retention period of the analytics data collected via these web analytics services, please refer to the respective sections in 8 and 9.
5. Your Rights
Under GDPR, you have the right to:
- Access information about your processed data (Art. 15 GDPR)
- Rectify incorrect data (Art. 16 GDPR)
- Request deletion of your data (Art. 17 GDPR)
- Restrict processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing (Art. 21 GDPR)
Simply contact us via the form. You also have the right to lodge a complaint with a supervisory authority.
6. Hosting, Databases, Delivery & Survey Processors
We use external service providers (processors under Art. 28 GDPR) for website hosting, database storage, and email delivery:
- Website Hosting & Delivery: Vercel Inc., 650 2nd St, San Francisco, CA 94107, USA (Server location for EU users is in Europe; Vercel is certified under the EU-US Data Privacy Framework). [Draft: A Data Processing Agreement (DPA) under Art. 28 GDPR is established].
- Database & Data Storage: Supabase Inc., 970 Summer St, Stamford, CT 06905, USA. Waitlist and survey response data is stored in the AWS region eu-central-1 in Frankfurt am Main, Germany (no third-country transfer for this data; Supabase provides GDPR-compliant Standard Contractual Clauses). [Draft: A Data Processing Agreement (DPA) under Art. 28 GDPR is established].
- Newsletter Delivery & Subscriber Management: Sendinblue GmbH (Brevo), Köpenicker Str. 126, 10179 Berlin, Germany. Data processing takes place on servers in Germany (EU-based, no third-country transfer; a Data Processing Agreement under Art. 28 GDPR is established).
Double Opt-In Procedure & Proof of Consent: Subscriptions to our newsletter are processed using a double opt-in procedure. After signing up on our website, you will receive an email asking you to confirm your subscription. This confirmation is required to prevent unauthorized signups using third-party email addresses. Subscriptions are logged to provide proof of the registration process in accordance with legal requirements. This includes storing the times of signup and confirmation, the IP address, and the source (e.g. newsletter modal or survey). You can withdraw your consent at any time via the unsubscribe link at the bottom of each email.
Evaluation of the Survey (/umfrage.html): If you participate in our voluntary survey, we collect your answers (e.g. age group, athletic background, training barriers, and optionally your email address). This data is collected to evaluate our training concept for certification by the Central Prevention Testing Office (ZPP). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. Retention period: [Draft: Survey data will be deleted after completing the ZPP certification evaluation, but no later than December 31, 2027].
7. Cookies and Local Storage (Legal Draft for Review)
Our website uses cookies and the browser's local storage (LocalStorage) to ensure functionality and – upon your consent – perform web analytics. Below is a detailed overview of the storage media used:
Necessary — no consent required
| Name | Type | Purpose | Duration |
|---|---|---|---|
| haltbar_cookie_consent | LocalStorage | Stores your cookie consent decision so you are not prompted on every page load. | 12 months |
Google Analytics 4 — only with consent
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | First Party | Distinguishes visitors. | 2 years |
| _ga_0B7KDE6804 | First Party | Maintains session state. | 2 years |
Note: Modern web browsers limit the lifetime of first-party cookies in certain scenarios (e.g. ITP in Safari) to approx. 7 to 400 days, so the effective duration may be shorter.
Microsoft Clarity — only with consent
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _clck | First Party | Stores the Clarity user ID and settings. | 1 year |
| _clsk | First Party | Connects multiple page views to a single session. | 24 hours |
| CLID | Third Party (clarity.ms) | Recognizes when Clarity first saw this user. | 1 year |
| ANONCHK | Third Party (clarity.ms) | Flag indicating MUID/ANID transmission (not actively used by Clarity, always 0). | 10 minutes |
| MR | Third Party (clarity.ms) | Flag indicating whether to refresh the MUID. | 7 days |
| MUID | Third Party (microsoft.com) | Unique browser identifier across Microsoft services (for advertising/analytics). | 1 year |
| SM | Third Party (clarity.ms) | Synchronizes the MUID across different Microsoft domains. | End of session |
Note: The cookies CLID, ANONCHK, MR, MUID, and SM are third-party cookies set on Microsoft domains and are therefore only loaded after your explicit consent.
8. Google Analytics 4 (Legal Draft for Review)
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
Processed Data: GA4 does not collect or store IP addresses. IP addresses are only used transiently by Google at the time of connection to determine the approximate location (country, region, city) and are discarded immediately thereafter. Other data collected includes technical browser/device information, and user interactions (e.g. scroll events, waitlist submissions, survey starts).
Legal Basis & Withdrawal: The processing takes place exclusively on the basis of your explicit consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with future effect via the "Cookie Settings" link in the footer of this website.
US Transfer: Data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework.
Retention Period: Data is automatically deleted after 14 months.
9. Microsoft Clarity (Legal Draft for Review)
We use Microsoft Clarity, an analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft").
Processed Data: Mouse movements, click paths, scrolling behavior, and session recordings to analyze usability issues. All form inputs are masked so that no personal text is processed.
Legal Basis & Withdrawal: The processing takes place exclusively on the basis of your explicit consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the "Cookie Settings" link in the footer of this website.
US Transfer: Data may be transferred to the USA. Microsoft is certified under the EU-US Data Privacy Framework.
Retention Period: Session recordings are deleted after 30 days. Aggregated click and heatmap data as well as favorited sessions are deleted after 9 months.
10. Vercel Speed Insights
We use Vercel Speed Insights provided by Vercel Inc., 650 2nd St, San Francisco, CA 94107, USA, to measure page loading speeds. This service operates cookieless and does not collect IP addresses or any personal data.