Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Yannik Zengler (Sole Trader)
Im Schnürchen 9
56179 Niederwerth
Germany
Email: yannik.zengler@zystem.one
Phone: +49 174 230 5739
Data Protection Officer: Not appointed (no statutory obligation).

This Privacy Policy applies to the website of ZystemOne (ZO) as well as to all associated processes (e.g., enquiries, communication, payment processing, and execution of the coaching and training program). The services are intended for individuals aged 18 and older (B2C and B2B) worldwide.

We process personal data only if a legal basis exists, in particular:

• Art. 6 (1) (b) GDPR (Contract/Pre-contractual measures) – e.g., enquiries, conducting the coaching.
• Art. 6 (1) (c) GDPR (Legal obligation) – e.g., commercial and tax law retention requirements.
• Art. 6 (1) (f) GDPR (Legitimate interest) – e.g., IT security, fraud prevention, legal defense.
• Art. 6 (1) (a) GDPR (Consent) – e.g., for optional integration of external content or non-essential cookies.
• Art. 9 (2) (a) GDPR (Explicit consent) – insofar as health data (special categories of personal data) are processed.

Our website is provided via the Lovable platform (Lovable Labs Incorporated); delivery takes place via Cloudflare's server infrastructure. Each time you access our website, technical data is processed by the web server (so-called server log files), such as IP address, date and time of access, file/page requested, amount of data transferred, referrer URL, and browser/operating system information.

Lovable is also used to create and maintain the website. Insofar as Lovable processes personal data on our behalf (e.g., technical access data during provisioning), this is done as data processing on the basis of a data processing agreement (Art. 28 GDPR).

• Purpose: Secure and stable operation of the website, error analysis, defense against attacks.
• Legal basis: Art. 6 (1) (f) GDPR.
• Storage duration: Log files are only stored for as long as necessary to achieve the stated purposes (usually a few days to weeks; depending on the hosting configuration).

We do not use cookies for analytics or marketing purposes and do not use any tracking tools. The fonts used on this website are served locally from our own server; no connection to third-party servers (e.g. Google Fonts) is established.

Our website offers links for contacting us via WhatsApp. WhatsApp is operated by WhatsApp Ireland Limited / Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Simply visiting our website does not transfer any data to WhatsApp. Data is only transferred once you click a WhatsApp link and send us a message.

We process the content of your message and your phone number in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR where your enquiry is aimed at concluding a contract (pre-contractual enquiry), otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to enquiries effectively).

Data may be transferred to the USA in this context. For more information, please see WhatsApp's privacy policy: whatsapp.com/legal/privacy-policy-eea.

We delete messages once your enquiry has been fully handled, unless statutory retention obligations apply.

When you contact us by email or phone, we process the data you provide (e.g., name, contact details, inquiry) in order to handle and answer your request.

We use IONOS (email hosting) and Microsoft Outlook as an email client for sending emails and managing mailboxes. Communication content and metadata (e.g., sender/recipient, timestamp) are processed during this procedure.

• Legal basis: Art. 6 (1) (b) GDPR (contract initiation/contract) or Art. 6 (1) (f) GDPR (general communication).

As part of the ZystemOne (ZO) program, we process personal data required for the planning, execution, and quality assurance of our coaching services. The program includes remote coaching, personal training, training and nutrition planning, regular check-ins, and – depending on usage – progress tracking via smartwatch/tracker and our coaching app.

The following data categories may be processed (examples):

• Master data and contact details (e.g., name, email, phone number).
• Contract and billing data (e.g., booked package, payment status, invoice data).
• Lifestyle and context data (e.g., working hours, travel and stress profiles, sleep/recovery details, preferred communication channels).
• Training and performance data (e.g., training history, training location/equipment, training preferences, goals).
• Nutrition-related information (e.g., diet type, allergens/intolerances, habits).
• Content you provide yourself (e.g., progress photos, videos, text messages).
• Legal basis: Art. 6 (1) (b) GDPR.

Insofar as you provide information about your health or provide health data during coaching, we process special categories of personal data (Art. 9 GDPR). This may include: injury history, acute pain, medication, cardiovascular issues, blood panel status, as well as data from smartwatch/health integrations.

• Legal basis: Your explicit consent pursuant to Art. 9 (2) (a) GDPR, and – as far as necessary – Art. 6 (1) (b) GDPR (contract) for the execution of the coaching services.

You can revoke your consent at any time with future effect. A revocation does not affect the lawfulness of the processing up to the point of revocation.

Note on WhatsApp: Please transmit medical documents or highly sensitive health information preferably via the ZystemOne coaching app or by email rather than via messenger services, if you wish to avoid this.

For digital support and documentation, we use our own ZystemOne platform/app. Through this app, onboarding questions (anamnesis questionnaire), training/nutrition plans, check-ins, and tracking data can be processed.

If you actively set this up, data from health/fitness integrations (e.g., Apple Health or Android Health) can flow into the ZystemOne app. The connection is made only with your explicit authorization.

• Legal basis: Art. 6 (1) (b) GDPR; for health data additionally Art. 9 (2) (a) GDPR.
• Recipient: Data processing takes place on secure servers within the EU.

As part of the coaching support, communication can take place via the ZystemOne app, email, and/or WhatsApp Business, depending on your preferences.

If you use WhatsApp, communication takes place via a third-party service. Please note that connection and usage data may be processed by the provider.

• Legal basis: Art. 6 (1) (b) GDPR (contract); for health data additionally Art. 9 (2) (a) GDPR.

We use Microsoft Teams and/or Google Meet for online appointments and live sessions. Meeting metadata (e.g., name/display name, time, duration, connection data) is processed. Content (audio/video) is only processed within the meeting.

Recordings are generally not made. A recording will only take place if you expressly request it and have given your prior consent.

• Legal basis: Art. 6 (1) (b) GDPR.

We use Stripe for payment processing. Stripe processes payment and transaction data (e.g., name, payment method, amount, time, payment status) to execute the payment and prevent fraud.

• Legal basis: Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (c) GDPR (legal obligations, e.g., tax retention).
• Recipient: Stripe (service provider).

We deploy service providers (processors) who process personal data on our behalf. We conclude data processing agreements with such service providers pursuant to Art. 28 GDPR where required by law.

To provide the coaching service, authorized coaches may receive access to the necessary data. This is done on a need-to-know basis and subject to confidentiality and data protection obligations.

For certain services used, processing outside the EU/EEA (e.g., in the USA) cannot be completely ruled out. Where this is the case, the transfer takes place on the basis of appropriate safeguards (e.g., EU Standard Contractual Clauses) and/or recognized transfer mechanisms (e.g., Data Privacy Framework), insofar as offered by the respective provider and applicable.

We store personal data only as long as necessary for the stated purposes or as long as statutory retention periods exist.

The following deletion periods generally apply:

• Coaching and program data (including communication, plans, check-ins): Deletion or anonymization no later than 3 years after the end of the calendar year in which the contractual relationship ends, unless statutory retention obligations prevent this or the data is still required for legal defense in individual cases.
• Health data: Deletion or anonymization generally together with the coaching data; where possible, highly sensitive health data can be deleted earlier if it is no longer required for support.
• Invoices and accounting records: Storage in accordance with commercial and tax retention obligations (typically 6 or 10 years, depending on the type of document).

Deletion will also take place upon request, provided that no statutory retention obligations or overriding legitimate interests conflict with it.

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR). You can revoke any consent given at any time with future effect (Art. 7 (3) GDPR).

You have the right to complain to a data protection supervisory authority. The authority responsible for the controller in Rhineland-Palatinate is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34
55116 Mainz
Germany

We take appropriate technical and organizational measures to protect your data (e.g., access restrictions, authorization concepts, secure passwords, multi-factor authentication where possible, state-of-the-art encryption, regular updates).

If we publish reviews/testimonials (e.g., name, position, photo/video), this is only done with the consent of the person concerned. For verification purposes, we recommend written authorization.

Automated decision-making or profiling within the meaning of Art. 22 GDPR does not take place.

We reserve the right to amend this Privacy Policy if required due to changes in the legal situation, technical changes, or the further development of our services.