Your data at HALTBAR
Last updated: 13 August 2026
This is a translation provided for your convenience. In case of any discrepancy, the German version prevails.
1. Controller
The controller responsible for processing your personal data on this website within the meaning of Art. 4(7) GDPR is:
HALTBAR Health GbR
represented by Sinan Kücükkurap and Julian Jimmie Franco Horn
c/o IP-Management #11476
Ludwig-Erhard-Strasse 18
20459 Hamburg, Germany
Email: kontakt@haltbar-health.de
We have not appointed a data protection officer, as the statutory conditions for doing so (Sec. 38 BDSG) do not apply to us. For any privacy question or to exercise your rights, please use the email address above.
2. Overview: What Data We Process
We collect as little data as possible. In detail:
- Technical access data (server log files) each time you visit our website — see section 3.
- Your email address when you join our waiting list or newsletter, together with the consents you gave, timestamps, source and IP address — see section 4.
- Your contact details and message when you write to us — see section 5.
- Your answers to our voluntary survey, optionally together with your email address — see section 6.
- Your IP address to prevent spam and automated bulk requests — see section 7.
- Only with your explicit consent (opt-in): usage and web analytics data (approximate location, browser and device information, click and scroll behaviour as well as session recordings) via Google Analytics 4 and Microsoft Clarity — see sections 10 and 11.
We do not sell your data and do not pass it on to third parties for advertising purposes. Data is shared only with the processors listed in section 8, who act for us and on our instructions.
3. Hosting and Server Log Files
Our website is hosted by Vercel Inc. (details in section 8). Every time the site is accessed, data transmitted by your browser is processed automatically for technical reasons: IP address, date and time of the request, the page requested, volume of data transferred, status code, referrer URL as well as browser and operating system details.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically faultless delivery, stability and security of our website. This processing is strictly necessary to provide the website at all; it is not based on consent and cannot be opted out of.
Retention: Log data is retained by Vercel for a short period for troubleshooting and then deleted automatically. We do not merge this data with other sources and do not evaluate it on an individual level.
4. Waiting List and Newsletter
You can join our waiting list via the forms on our website. We obtain two separate consents for this:
- Product information (required for the waiting list): we inform you by email about the launch of our course and our app.
- Editorial newsletter (optional): in addition, you receive our newsletter with content on muscle health and training.
The optional newsletter consent is not a condition for joining the waiting list. You can withdraw either consent independently and at any time.
Data processed: your email address, the consents you gave, the time of consent, the version of the consent text, the source of the sign-up (e.g. waiting list modal, footer or survey) and your IP address at the time of sign-up.
Double opt-in: after signing up you receive an email asking you to confirm your registration. Only then do we add you to the distribution list. This prevents anyone from signing up using someone else's email address. The time of sign-up and confirmation as well as the IP address are logged so that we can demonstrate consent in accordance with Art. 7(1) GDPR.
Delivery measurement: our sending provider Brevo records technical delivery information as well as whether an email was opened and whether links in it were clicked. We use this solely to detect delivery problems and assess the relevance of our emails. Your consent under this section covers this analysis; you can end it at any time by unsubscribing.
Legal basis: your consent under Art. 6(1)(a) GDPR for sending and delivery measurement; Art. 6(1)(c) in conjunction with Art. 7(1) GDPR for logging the record of consent.
Withdrawal: every email contains an unsubscribe link. Alternatively, an informal message to kontakt@haltbar-health.de is sufficient. Withdrawal takes effect for the future; the lawfulness of processing carried out until then remains unaffected.
5. Contacting Us
If you contact us by email or via the channels listed on our contact page, we process the details you provide — at minimum your email address and the content of your message — solely in order to handle your request.
Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract, otherwise Art. 6(1)(f) GDPR based on our legitimate interest in responding to enquiries.
Retention: we delete your enquiry once it has been dealt with conclusively and no statutory retention obligations apply. Commercial and tax retention periods (generally six and ten years under Sec. 257 HGB and Sec. 147 AO) remain unaffected.
6. Voluntary Survey (/umfrage.html)
Participation in our survey is entirely voluntary. You may stop at any time; no data is transmitted to us unless you submit the survey.
Data processed: your answers to the survey questions. These include your age group, your sporting background, your assessment of your own physical capacity in everyday life, your motives and barriers regarding training, and your assessment of the offering we are planning. Providing an email address at the end of the survey is optional.
Note on health-related data: some questions relate to your physical capacity and may therefore concern health data within the meaning of Art. 4(15) GDPR. Such data enjoys special protection. We process it exclusively on the basis of your explicit consent under Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. You are not obliged to provide any of this information and may skip individual questions.
Link to your email address: if you provide an email address at the end of the survey, your answers are stored together with that address in a single record and can therefore be attributed to you. Without an email address, we store the answers without such a personal reference.
Purpose: we evaluate the answers in order to develop our training concept and to assess it for a planned certification by the German Central Prüfstelle Prävention (ZPP). The evaluation is carried out in aggregated, statistical form; individual participants are not assessed.
Retention: we delete the survey data once the evaluation for the ZPP certification is complete, and at the latest by 31 December 2027.
Withdrawal: if you provided an email address, you can withdraw your consent at any time at kontakt@haltbar-health.de and we will delete your record. Answers submitted without an email address can no longer be attributed to you and therefore cannot be deleted individually.
7. Protection Against Spam and Abuse
To protect our forms against automated bulk sign-ups, we limit the number of requests per sender. For this purpose we store your IP address together with a counter and a timestamp. In addition, our forms contain a field that is invisible to you (a "honeypot") which only automated programs fill in; no personal data arises from this.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the security and functionality of our systems and in preventing the misuse of other people's email addresses.
Retention: IP addresses stored for rate limiting are deleted regularly, and at the latest after 30 days.
8. Recipients and Processors
We use external service providers that process personal data exclusively on our behalf and on our instructions. We have concluded a data processing agreement pursuant to Art. 28 GDPR with each of them.
- Hosting & website delivery: Vercel Inc., 650 2nd St, San Francisco, CA 94107, USA. Delivery for users in the EU takes place via servers in Europe. For transfers to the USA, Vercel is certified under the EU-US Data Privacy Framework; the EU Commission's Standard Contractual Clauses apply in addition.
- Database & data storage: Supabase Inc., 970 Summer St, Stamford, CT 06905, USA. Waiting list, survey and abuse-prevention data is stored in the AWS region eu-central-1 in Frankfurt am Main, Germany. The EU Commission's Standard Contractual Clauses apply to support and administrative access from the USA.
- Newsletter delivery & recipient management: Sendinblue GmbH (Brevo), Köpenicker Str. 126, 10179 Berlin, Germany. Processing takes place on servers in the EU; no transfer to a third country occurs.
Beyond this, we only pass on data where we are legally obliged to do so or where you have explicitly consented. The analytics services described in sections 10 and 11 are loaded only after your consent; the transfers involved are described there.
9. Cookies and Local Storage
Our website uses cookies and your browser's local storage. Storage operations that are strictly necessary to operate the website take place without consent pursuant to Sec. 25(2) no. 2 TDDDG. All other storage operations — in particular for web analytics — take place exclusively with your consent pursuant to Sec. 25(1) TDDDG, which you give via the cookie banner.
How to withdraw your consent: you can withdraw consent you have given at any time with effect for the future. There are two ways to do so:
- Send an informal message to kontakt@haltbar-health.de — we will then reset your consent.
- Clear the website data stored for this site in your browser. This removes the haltbar_cookie_consent entry as well as the analytics cookies that were set; on your next visit the cookie banner will ask you again, and no analytics services are loaded until you consent anew.
Independently of this, your decision expires automatically after 12 months and you are asked again.
Strictly necessary — no consent required
| Name | Type | Purpose | Retention |
|---|---|---|---|
| haltbar_cookie_consent | Local storage | Stores your cookie decision so you are not asked again on every page view. | 12 months |
| haltbar_zpp_state | Local storage | Stores your progress and entries in the ZPP reviewer portal so they are preserved when you return. The data stays in your browser and is not transmitted to us. | Until reset in the portal or until you clear your browser data |
Google Analytics 4 — only with consent
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| _ga | First party | Distinguishes visitors from one another. | 2 years |
| _ga_0B7KDE6804 | First party | Maintains session state. | 2 years |
Note: modern browsers limit the lifetime of first-party cookies in certain scenarios (e.g. ITP in Safari) to roughly 7 to 400 days, so the effective duration may be shorter.
Microsoft Clarity — only with consent
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| _clck | First party | Stores the Clarity user ID and settings. | 1 year |
| _clsk | First party | Connects multiple page views into a single session. | 24 hours |
| CLID | Third party (clarity.ms) | Identifies when Clarity first saw this user. | 1 year |
| ANONCHK | Third party (clarity.ms) | Flag for MUID/ANID transfer (not actively used by Clarity, always 0). | 10 minutes |
| MR | Third party (clarity.ms) | Flag indicating whether the MUID is to be refreshed. | 7 days |
| MUID | Third party (microsoft.com) | Identifies unique browsers across Microsoft services (for advertising and measurement). | 1 year |
| SM | Third party (clarity.ms) | Synchronises the MUID across Microsoft domains. | End of session |
Note: the cookies CLID, ANONCHK, MR, MUID and SM are third-party cookies set on Microsoft domains and are therefore loaded only after your explicit consent. The MUID cookie may also be used by Microsoft for advertising purposes. Only consent to web analytics if you are comfortable with this.
10. Google Analytics 4
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
Data processed: GA4 does not store IP addresses. Your IP address is processed only briefly when the connection is established, in order to determine an approximate location (country, region, city), and is then discarded. Technical browser and device information as well as interactions on our website (e.g. page views, scrolling, form and newsletter interactions) are also recorded. Google assigns a pseudonymous identifier to this data in order to recognise returning visits.
Legal basis & withdrawal: processing takes place exclusively on the basis of your explicit consent under Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG. You can withdraw it at any time with effect for the future — see section 9 for how.
Transfer to a third country: data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework; the EU Commission's Standard Contractual Clauses apply in addition. Despite these safeguards, access by US authorities cannot be entirely ruled out. By giving your consent, you also consent to this transfer (Art. 49(1)(a) GDPR).
Retention: data recorded at user and event level is deleted automatically after 14 months.
For more information see Google's privacy policy: policies.google.com/privacy ↗
11. Microsoft Clarity
We use Microsoft Clarity, an analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft").
Data processed: mouse movements, click paths, scroll behaviour and recordings of your session that allow the course of your visit to be reconstructed. We use these recordings to identify layout and usability problems. Entries in form fields are masked by Clarity by default, so text you type is not readable for us.
Legal basis & withdrawal: processing takes place exclusively on the basis of your explicit consent under Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG. You can withdraw it at any time with effect for the future — see section 9 for how.
Transfer to a third country: data may be transferred to Microsoft Corporation in the USA. Microsoft is certified under the EU-US Data Privacy Framework; the EU Commission's Standard Contractual Clauses apply in addition. By giving your consent, you also consent to this transfer (Art. 49(1)(a) GDPR).
Retention: session recordings are deleted after 30 days. Aggregated click and heatmap data as well as favourited sessions are deleted after 9 months.
For more information see Microsoft's privacy statement: privacy.microsoft.com ↗
12. Vercel Speed Insights
We use Vercel Speed Insights provided by Vercel Inc., 650 2nd St, San Francisco, CA 94107, USA, to measure the loading speed of our website. The service works without cookies, without accessing your browser's local storage and without storing IP addresses. Only anonymous technical measurements (e.g. loading times, device type, country) are recorded.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in detecting technical problems and improving the performance of our website. As no information is stored on or read from your device, no consent is required under Sec. 25(2) no. 2 TDDDG.
13. External Links and Social Media
In the footer of our website we link to our profiles on LinkedIn, Facebook and Instagram. These are plain links, not embedded social media plugins. No data is therefore transmitted to those networks unless you click the link. Once you click, the privacy policy of the respective provider applies, over which we have no influence. The same applies to links to studies and external expert sources in our content.
14. Retention Periods at a Glance
- Server log files: deleted automatically by our host after a short period.
- Email address (waiting list / newsletter): until you withdraw your consent or unsubscribe; deletion within 30 days. We retain the record of consent until any potential claims are time-barred.
- Contact enquiries: until your request has been dealt with conclusively, subject to statutory retention periods.
- Survey data: until the ZPP evaluation is complete, at the latest 31 December 2027.
- IP addresses for abuse prevention: at the latest after 30 days.
- Google Analytics 4: 14 months.
- Microsoft Clarity: session recordings 30 days, aggregated data 9 months.
15. Your Rights
Under the GDPR you have the following rights against us at any time:
- Access to the data we process about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
Note on the right to object under Art. 21 GDPR: where we process data on the basis of legitimate interests (sections 3, 5, 7 and 12), you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests.
To exercise your rights, an informal message to kontakt@haltbar-health.de is sufficient.
Right to lodge a complaint: without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement. The authority responsible for us is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Strasse 22, 20459 Hamburg, Germany
datenschutz-hamburg.de ↗
16. Whether Providing Data Is Required
Providing personal data is neither required by law nor by contract. However, without your email address we cannot add you to the waiting list or send you the newsletter, and without your contact details we cannot answer an enquiry. Participating in the survey and consenting to web analytics are entirely voluntary; you suffer no disadvantage if you decline.
17. No Automated Decision-Making
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Your data is not used to make automated decisions about you that produce legal effects concerning you or similarly significantly affect you.
18. Data Security
This website uses SSL/TLS encryption, recognisable by the padlock symbol and the "https://" in your browser's address bar. This means the data you send us cannot be read by third parties. We also protect our systems against loss, destruction, access, alteration and unauthorised disclosure through technical and organisational measures.
19. Changes to This Privacy Policy
We update this privacy policy when our website, our offering or the legal situation changes. The version published on this page applies. You will find the date of the current version at the top of this page.