Privacy information

Controller

Name

Cedric Benedict Poniewas

Business name

Cedrics Coaching & Digital Services

Address

Schibsler Weg 6a
41836 Hückelhoven
Germany

Email

info@coachcedric.pro

Telephone

+49 162 5333464

How the website works

The marketing website is delivered as static HTML. The App page is the expressly described exception.

• website JavaScript only on the App page, where it loads the live demo after confirmation and remembers that choice for the current browser session
• no cookies set by the marketing website
• no analytics, statistics, advertising or tracking services
• no external fonts or content-delivery network; fonts come from the operating system and images are hosted locally
• one optional third-party context: the separate Coach Cedric App live demo, loaded only after the visitor selects “Start demo”
• forms only for ordering, withdrawal and cancellation

Reading the website does not connect to the separate app. A connection is made only after the visitor starts the demo or intentionally opens an app link.

Hosting and server logs

The website runs on a virtual server at Hostinger International Ltd. using nginx.

For each request, the server processes the IP address, date and time, requested URL, HTTP status, transferred data volume, referrer and browser user-agent. This is necessary to deliver the site, maintain stability and security, and investigate faults or attacks.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is secure and reliable operation. Logs rotate daily and are deleted after 14 rotations, approximately 14 days. They are not combined with other data sources. Transport is encrypted with HTTPS.

Public website

This website is publicly accessible. No sign-in or access protection is required to read it.

The statutory online withdrawal and cancellation functions are available without a login.

Embedded app live demo

The App page can load an interactive demo in an iframe. The iframe and connection to app.coachcedric.pro are created only after the visitor selects “Start demo”.

The iframe loads app.coachcedric.pro/demo/app. The app runs its own JavaScript, signs into an isolated demo account and reads demo data from the separately operated api.coachcedric.pro PocketBase service.

The demo UI blocks permanent writes. The app nevertheless uses browser storage and reads data from the API. Only after confirmation are the IP address and ordinary connection data sent to the app and API domains; their server logs follow the same approximate 14-day retention period. The displayed data belongs to a dedicated demo account, not a real customer.

• coachcedric.demoEmbedConsent in session storage: remembers website consent for the current session and is removed when the demo is closed
• pb_demo_auth in local storage: access token for the isolated demo account
• coachcedric.demo.returnTo in session storage: remembers the demo return route and is removed when the tab closes
• ccLanguage in local storage: selected interface language
• ccWeightUnit, ccRestTimerDefault, ccPendingPreferences and setupNoticeShown in local storage only when the corresponding setting changes

Article 6(1)(f) GDPR is the basis for ordinary connection and security data; the legitimate interest is a transparent and secure pre-registration product demonstration. Section 25 TDDDG also applies to access to device information. Because the demo can store optional convenience settings, it loads only after explicit confirmation.

“Close demo” removes the iframe and website session marker. App storage can be removed through the browser’s website-data controls for app.coachcedric.pro. If the demo is not started, no connection to app.coachcedric.pro is made. There is no site-wide consent platform.

Orders, contracts, withdrawal and cancellation

A separate contract and automation service on the same server handles these functions.

For an order, the service processes the customer’s name, email address, selected service, acknowledgement of the terms and withdrawal information, optional early-start declarations with wording and timestamps, and the association with the Stripe payment. This supports contract formation, the durable-medium confirmation under section 312f BGB, and proof of pre-contract information. The legal bases are Article 6(1)(b) and (c) GDPR.

For a withdrawal, it processes name, contract-identification details, the email address used for the receipt confirmation, the declaration and its server-side receipt time. For a cancellation it additionally processes cancellation type, any reason for extraordinary cancellation, the requested end date and the calculated actual end date. The legal basis is Article 6(1)(c) GDPR together with sections 356a and 312k BGB.

Operational contract records are retained in the service database. Required contractual and tax records are retained for the applicable statutory periods; temporary security and idempotency data is removed according to the documented retention matrix.

Payment through Stripe

Payment is processed by Stripe Payments Europe, Limited. The website sends an opaque pre-contract reference with the checkout request. Payment details are entered directly with Stripe and are not stored by this website.

Stripe processes payment and device data under its own responsibility. The legal basis for initiating and reconciling payment is Article 6(1)(b) GDPR.

Stripe privacy information↗

Email and contact

When you contact us by email, the submitted data is processed to answer the request. Depending on the context, the legal basis is Article 6(1)(b) or (f) GDPR. Do not send sensitive health, financial or identity data in an unencrypted first message. Transactional contract emails are sent only as part of the corresponding contract process.

Recipients and international transfers

Hosting, email and payment providers receive data only as necessary to provide their services. Stripe may process data outside the EEA under the safeguards described in its privacy information. The app and API are separately operated services on the same VPS; starting the demo creates the connections described above.

Your rights

• access under Article 15 GDPR
• rectification under Article 16 GDPR
• erasure under Article 17 GDPR
• restriction under Article 18 GDPR
• data portability under Article 20 GDPR
• objection under Article 21 GDPR
• the right to complain to a competent supervisory authority