DRAWorkout

Datenschutzerklärung

This page describes what draworkout.com does with personal data. The application at draworkout.app does more, and carriesits own notice.

Controller

Verantwortlicher

Michael Gaston, Faithfully Fit For Life
Günderrodestr. 21, 60327 Frankfurt am Main, Deutschland

[email protected] — or the form at draworkout.com/kontakt.

No Datenschutzbeauftragter has been appointed; the thresholds in Art. 37 GDPR and § 38 BDSG are not met.

What this site does

Datenverarbeitung auf dieser Website

This site is a set of static pages. It embeds no third-party media and no advertising. Until 21 August 2026 it also set nothing at all on your device; since then it asks, once, whether it may measure how the site is used — see Reichweitenmessung below. Nothing is stored and nothing is measured unless you say yes, and the site works identically either way.

The one exception, which you are not asked about: if you answer the banner, your answer itself is kept in your browser’s local storage underdraworkout.v1.consent. That is strictly necessary within the meaning of § 25(2) TDDDG — it is the only way to honour a refusal without asking you again on every page. It holds one word, granted or denied, and nothing that identifies you.

The contact form sends one email. What you write — with your address, and a name if you give one — goes to the people who operate DRAWorkout, who use it to answer you. It is not stored anywhere else by this site, not added to any mailing list, and not shared beyond the processors named below. Legal basis: Art. 6(1)(b) GDPR where you are writing about a contract with us, and otherwise Art. 6(1)(f) GDPR — our legitimate interest in answering people who write to us.

Buying — the buttons on the home page send only which tier and which deck you chose. Your name, email address and payment details are given toStripe on Stripe’s own hosted checkout page, not to this site.No card details ever reach us. Legal basis: Art. 6(1)(b) GDPR.

Cancelling — the Kündigung form takes an email address so we can find the contract to cancel. It answers every address identically, whether or not one exists, so that the page cannot be used to discover who has an account. Legal basis: Art. 6(1)(b) GDPR, and § 312k BGB, which requires this route to exist.

Reach measurement

Reichweitenmessung mit Google Analytics

We use Google Analytics 4 to see how many people visit this site, which pages they read and where they arrived from. We use it to decide what to write and what to fix — not to profile you, and not to advertise to you.

It runs only if you agree. When you first arrive, the tag is loaded with every storage permission set to denied (Google Consent Mode v2): it writes no cookie, reads no cookie, and cannot recognise you between pages or visits. If you pressAccept, and only then, it sets the cookies _ga and_ga_<ID>, which hold a randomly generated number that distinguishes one browser from another. If you press Decline, or ignore the banner entirely, nothing further happens.

The advertising permissions are never requested.ad_storage, ad_user_data and ad_personalization stay denied even after you accept. There is no Google Ads account behind this measurement, and no data from this site is used to build advertising audiences.

Legal basis: your consent — Art. 6(1)(a) GDPR for the processing, and § 25(1) TDDDG for the storage on your device.

How long it is kept. Event- and user-level data on the Google Analytics property is retained for 14 months and then deleted automatically. We keep it for that long, rather than the shorter option, for one reason: training is strongly seasonal, and comparing one January with the previous January is not possible with less than a year of history. Aggregated reporting — visitor counts and page totals with no user-level detail — is kept beyond that period by Google in a form that does not identify anyone.

Data processing and international transfers. Google Ireland Limited processes Google Analytics data on our behalf under Google's data processing terms pursuant to Art. 28 GDPR. Where personal data is transferred to Google LLC in the United States, Google participates in the EU–US Data Privacy Framework. Google LLC has certified its compliance with the Framework. Where applicable, Google's data processing terms also provide the contractual safeguards for international transfers required by Chapter V GDPR.

Withdrawing costs one click, and takes effect immediately. Art. 7(3) GDPR gives you the right to take consent back at any time, as easily as you gave it. The button below forgets your answer, switches measurement off without waiting for a reload, deletes the _ga cookies already on this device, and shows you the banner again so you can choose afresh. Withdrawal does not affect the lawfulness of what was measured before it.

(This button needs JavaScript, which is also what the measurement needs — if it does not appear, nothing is measuring you.)

Processors

Auftragsverarbeiter

Cloudflare serves this site (Cloudflare Pages) and, in doing so, processes the technical data any web server sees — IP address, requested URL, user agent.

Resend delivers the contact email from [email protected] to our mailboxes. United States.

Stripe runs checkout, billing and the customer portal. It receives the name, email address, payment details and billing address you give it.

Google (Google Ireland Ltd, with Google LLC in the United States) provides the reach measurement described above, only where you have consented to it. It receives your IP address, which Google shortens before storing, together with the pages you opened, the approximate location that address resolves to, and technical details of your browser and device.

Processing agreements and international transfers. We use our processors under data processing agreements in accordance with Art. 28 GDPR where required. Cloudflare's Data Processing Addendum incorporates safeguards for international transfers, including the EU Standard Contractual Clauses, and Cloudflare also participates in the EU–US Data Privacy Framework. Resend processes data primarily in the United States under its Data Processing Addendum, which incorporates the EU Standard Contractual Clauses for transfers from the EEA. Google processes analytics data as described above. Stripe processes payment and billing data subject to its applicable data protection terms and safeguards for international transfers. Where personal data is transferred to a country outside the EEA and no adequacy decision applies, the transfer is protected using appropriate safeguards under Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses where applicable.

Retention

Speicherdauer

Reach measurement — 14 months, then deleted automatically. SeeReichweitenmessung above for what that covers and why.

An access request or a contact message lives in our mailbox. It is deleted once the matter it concerns is resolved, and in any case within six months.

Where a request becomes an account, the account is governed by theapplication’s notice instead. Where it becomes a purchase, the payment records are kept for as long as commercial and tax law requires — up to ten years under § 147 AO and § 257 HGB.

Your rights

Betroffenenrechte

You can ask for a copy of what is held about you (Art. 15), have it corrected (Art. 16) or deleted (Art. 17), have its use restricted (Art. 18), receive it in a portable form (Art. 20), and object to processing that rests on a legitimate interest (Art. 21). Where anything rests on your consent you can withdraw it at any time, without affecting what was done before (Art. 7(3)).

Write to [email protected], and we will answer within one month.

You can also complain to a supervisory authority. The competent one for us isDer Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wilhelmstraße 7, 65185 Wiesbaden —datenschutz.hessen.de.

Stand — August 2026

Who operates this site is a separate page: Impressum. The terms are the AGB, and the right of withdrawal is theWiderrufsbelehrung.