Legal
Privacy information
What this website actually processes, and what it expressly does not do.
Last updated: 12 October 2026
Controller
- Name
- Cedric Benedict Poniewas
- Business name
- Cedrics Coaching & Digital Services
- Address
- Schibsler Weg 6a
41836 Hückelhoven
Germany - info@coachcedric.pro
- Telephone
- +49 162 5333464
How the website works
The website delivers static HTML. Navigation, search and product views use our own JavaScript. The app demo and 5/3/1 calculator are embedded on their respective pages. The training plan generator opens through an app link.
- our own JavaScript for navigation, search, tool selection, fullscreen, product views and the quick enquiry on the contact page; no website session marker for starting the demo
- no cookies set by the marketing website
- no analytics, statistics, advertising or tracking services
- no external fonts or content-delivery network; fonts come from the operating system and images are hosted locally
- embedded app services operated by us: the live demo and 5/3/1 calculator on app.coachcedric.pro; the public training plan generator opens through an external app link
- forms that send data to the server only for ordering, withdrawal and cancellation; the quick enquiry on the contact page only composes a message text in your browser
The App page, calculator pages and tools hub connect directly to app.coachcedric.pro to deliver the application. Generator pages connect to the app only when you open the app link. Other external services open through their links.
Hosting and server logs
The website runs on a virtual server at Hostinger International Ltd. using nginx.
For each request, the server processes the IP address, date and time, requested URL, HTTP status, transferred data volume, referrer and browser user-agent. This is necessary to deliver the site, maintain stability and security, and investigate faults or attacks.
The legal basis is Article 6(1)(f) GDPR. The legitimate interest is secure and reliable operation. Logs rotate daily and are deleted after 14 rotations, approximately 14 days. They are not combined with other data sources. Transport is encrypted with HTTPS.
Public website
This website is publicly accessible. No sign-in or access protection is required to read it.
The statutory online withdrawal and cancellation functions are available without a login.
Embedded app live demo and public tools
The live demo on the App page is visible immediately. It loads app.coachcedric.pro/demo/app with demo=true, embedded=true and the page language. There is no preliminary start click or website session marker.
The embedded demo uses local synthetic sample data. It does not sign into a demo account, call authentication or the regular API, or read or write local storage, session storage, cookies, IndexedDB or Cache Storage. It does not register a service worker or use analytics or marketing services. Changes stay in the running demo and are lost on reload.
Delivering app files sends the IP address and ordinary connection data to app.coachcedric.pro. Server logs follow the retention described above. Normal browser HTTP caching is separate from Cache Storage actively used by the app.
The public tools are separate app flows outside this demo mode: the calculator loads public-calculator with mode=embed and lang=de or lang=en. The generator link opens plan-setup in a new tab with the requested page language. An existing app account language can take priority there. Both can read existing app preferences and app sign-in state. The generator stores the selected language in ccLanguage. With an existing app session, normal app initialisation can send authentication and API requests to api.coachcedric.pro.
- Calculator values stay in memory during use. The calculator’s “Open fullscreen” link transfers them through a versioned URL fragment, rather than local storage.
- The public generator can cache setup data in the browser when you explicitly request a plan preview or continuation. Permanent saving in a personal account belongs to the regular app service.
- An app link opened separately can leave embedded demo mode. The respective regular app flow then applies; the standalone demo in particular uses a session-limited return-route marker.
Ordinary connection and security data follow the basis for secure operation explained above. Section 25 TDDDG also applies to access to device information. This technical description is not a blanket legal certification of all app flows.
You can remove app browser data through the website-data settings for app.coachcedric.pro. There is no site-wide consent platform.
Orders, contracts, withdrawal and cancellation
For orders and for the statutory functions “Withdraw from a contract” (section 356a BGB) and “Cancel a contract” (section 312k BGB), we run a separate contract and automation service on the same server, independent of the app.
For an order, we process your name, email address, the selected service, your acknowledgement of the terms and withdrawal information, any early-start declaration with its wording and timestamp, and the association with the Stripe payment. The purposes are contract formation, the durable-medium contract confirmation under section 312f BGB and proof of the pre-contract information. The legal basis is Article 6(1)(b) GDPR and, for statutory evidence duties, additionally Article 6(1)(c) GDPR.
For a withdrawal, we process your name, details identifying the contract, the email address you provide for the receipt confirmation, and the content and server-generated receipt time of your declaration. The legal basis is Article 6(1)(c) GDPR together with section 356a BGB.
For a cancellation, we additionally process the type of cancellation, the reason you give for an extraordinary cancellation, the requested end date and the calculated actual end date. The legal basis is Article 6(1)(c) GDPR together with section 312k BGB.
To prevent abuse, these forms briefly process the IP address and time of the request for rate limiting. The legal basis is Article 6(1)(f) GDPR.
No health, coaching or payment data is stored in this contract service. We never see card details or bank details.
Payment through Stripe
Payment is processed by Stripe Payments Europe, Ltd. as an independent controller. When you select “Continue to Stripe payment” in the order step, the selected service, a technical contract reference and your email address are passed to Stripe so that your payment can be matched to the contract.
You enter all further payment details directly with Stripe. From Stripe we receive the payment confirmation, the payment or subscription identifier, the billing period and the invoice data. The legal basis is Article 6(1)(b) GDPR.
Stripe is responsible for its payment page and any cookies set there; Stripe’s privacy information applies.
Confirmation emails
Contract confirmations, withdrawal receipt confirmations and cancellation confirmations are sent automatically by email. This is required by law: sections 312f(2), 356a(4) and 312k(4) BGB require confirmation on a durable medium.
They are sent through the email service of our hosting provider Hostinger International Ltd. from the sender address noreply@coachcedric.pro. Hostinger processes the recipient address and the content of the confirmation in order to deliver it. There is no newsletter or marketing email and no open or click tracking.
Document archive in Google Drive
In live operation, contract and billing records are archived automatically in a Google Drive account of the operator. The contract and automation service files them on a schedule after the respective records are created.
Archived records are contract confirmations, invoices, payment receipts, credit notes, and withdrawal and cancellation confirmations. The purposes are performance of the contract, compliance with statutory retention duties and traceable business records. The legal bases are Article 6(1)(b) and (c) GDPR.
The operator uses a personal Google account for this business purpose; it is not a Google Workspace account. Customers do not connect a Google account of their own. The service uses only the `drive.file` access scope: it can manage only files and folders it created itself or that were explicitly used with it. Other Drive files are not searched or listed.
File and folder names contain technical references rather than customer names. Health, training and coaching content is not included in this tax and records archive.
Personal data in the archived documents may be processed by Google. Processing outside the European Economic Area cannot be fully ruled out. No conclusive statement is made here about Google’s data-protection role, a specific data processing agreement or a specific transfer mechanism.
The operator can revoke the Google permission. Records already archived are not deleted automatically as a result. Records are kept for the applicable statutory or contractual periods and deleted afterwards, unless an ongoing audit or legal dispute prevents this.
Contact by email and WhatsApp
Apart from the forms mentioned above, contact options are provided as email and WhatsApp links. On the contact page, a quick enquiry lets you prepare a message by answering a few questions. Your answers are only combined into a text in your browser; the website does not store them or send them to our server.
Email: selecting “Send by email” or an email link opens your email app with our address and, where applicable, a subject and the prepared text. We only receive the message once you send it from there.
WhatsApp: selecting “Send on WhatsApp” or another WhatsApp link opens a link to WhatsApp (wa.me). For the quick enquiry, this link contains your prepared text. When the link opens, this text and ordinary connection data such as your IP address are transmitted to WhatsApp – before you send the message, and even if you then decide not to send it. WhatsApp Ireland Limited is responsible for this processing; we have no influence over it. According to its own privacy policy, WhatsApp also transfers data to countries outside the European Economic Area, including the United States.
When you contact us, the information you provide is processed to answer your request. Depending on the context, the legal basis is Article 6(1)(b) GDPR (contract or pre-contractual steps) or Article 6(1)(f) GDPR.
If you message us on WhatsApp or use WhatsApp support, communication takes place through WhatsApp. We are responsible for the content of your messages to the extent that we receive it and use it for your request or the coaching. WhatsApp Ireland Limited is responsible for operating the service and for its own processing – for example transmission, storage on its servers, and connection and usage data; the WhatsApp privacy policy applies.
Please do not include sensitive health, financial or identity data in a first message – neither by email nor on WhatsApp. Email is not a confidential channel.
External services at a glance
This overview shows which services are contacted, when, and who is responsible.
Coach Cedric App (live demo)
- Purpose
- interactive product demo with local sample data and public training tools
- When
- demo and calculator directly on their pages; generator after selecting the app link
- Controller
- our own service at app.coachcedric.pro and api.coachcedric.pro, controller Cedric Benedict Poniewas
Stripe
- Purpose
- payment processing, subscription management, invoice and payment receipt
- When
- selecting “Continue to Stripe payment” in the order step
- Controller
- Stripe Payments Europe, Ltd. as an independent controller
Email delivery (Hostinger)
- Purpose
- statutory contract, withdrawal and cancellation confirmations
- When
- automatically after an order, withdrawal or cancellation
- Controller
- Hostinger International Ltd. as delivery provider; Cedric Benedict Poniewas is responsible for the confirmations
Google Drive
- Purpose
- business contract, tax and records archive
- When
- automatically on a schedule after an order, payment, credit note, withdrawal or cancellation
- Controller
- operator’s personal Google account (not Google Workspace); controller Cedric Benedict Poniewas; Google’s role not conclusively stated here
WhatsApp
- Purpose
- direct messaging and channel for WhatsApp support
- When
- selecting a WhatsApp link (for the quick enquiry with a prepared text that is already transmitted to WhatsApp at that point) or using the booked service
- Controller
- WhatsApp Ireland Limited
YouTube and Instagram
- Purpose
- links to the public profiles
- When
- selecting one of the two links on the About page
- Controller
- Google Ireland Limited or Meta Platforms Ireland Limited respectively
The calculator is embedded from the separate app on its tool pages and in the tools hub. The generator and additional app links open separate app flows in a new tab.
How long data is kept
There is no blanket period. Each category is kept for the period its purpose and the law require.
- Invoices and payment receipts
- 8 years — from the end of the calendar year in which the accounting record was created
Article 6(1)(c) GDPR together with section 147(1) no. 4 and (3) sentence 1 of the German Fiscal Code (AO) - Tax and commercial books and financial statements
- 10 years — from the end of the calendar year of the last entry or preparation
Article 6(1)(c) GDPR together with section 147(3) sentence 1 AO and section 257 of the German Commercial Code (HGB) - Contract evidence (order, terms and withdrawal version, contract confirmation)
- 3 years after the contract ends, at most until outstanding claims expire — from the end of the year in which the contract ended
Article 6(1)(b) and (c) GDPR together with sections 312d and 312f BGB - Early-start declaration (request and acknowledgement)
- 3 years after the contract ends — from the end of the year in which the contract ended
Article 6(1)(c) GDPR together with sections 356 and 357a BGB - Withdrawal declarations and receipt confirmations
- 3 years after receipt — from the end of the year of receipt
Article 6(1)(c) GDPR together with section 356a BGB - Cancellation declarations and confirmations
- 3 years after the contract ends — from the end of the year in which the contract ended
Article 6(1)(c) GDPR together with section 312k BGB - Email delivery records of the contract service
- 3 years — from the end of the year of sending
Article 6(1)(c) GDPR together with sections 312k and 356a BGB - Coaching content and personal notes
- for the duration of the coaching, then at most 12 months — from the end of the coaching
Article 6(1)(b) GDPR - Server log files of the website and the contract service
- approximately 14 days — from the time of access
Article 6(1)(f) GDPR - App and demo data (Coach Cedric App)
- app account until you delete it; demo data is not stored in a personal form — from account creation or opening the demo
Article 6(1)(b) GDPR (app account), Article 6(1)(f) GDPR (demo operation)
Accounting records including invoices are subject to the eight-year period of section 147(3) sentence 1 AO. Books, inventories and financial statements are subject to the ten-year period. A blanket ten-year period for all customer data is expressly not applied.
What expressly does not happen here
Many privacy policies list services that do not run on the site at all. For this website:
- no web analytics and no audience measurement
- no advertising tracking and no sharing of your data for advertising
- no newsletter and no email marketing
- no captcha service and no external spam-protection service
- no payment data on this website itself — you enter card and bank details only with Stripe
- no automated decision-making and no profiling
- no personalised pricing
Your rights
Under the GDPR you have the right to:
- access to the data stored about you (Article 15 GDPR)
- rectification of inaccurate data (Article 16 GDPR)
- erasure (Article 17 GDPR)
- restriction of processing (Article 18 GDPR)
- data portability (Article 20 GDPR)
- object to processing based on legitimate interests (Article 21 GDPR)
An email to the address above is enough for any of these requests.
You also have the right to lodge a complaint with a data-protection supervisory authority, in particular in the place of your residence or of the alleged infringement.