Datenschutz
Last updated: September 2026
Overview
We take the protection of your personal data seriously. This is a static marketing website. It sets no tracking cookies, uses no analytics, and loads no fonts or scripts from third-party servers. Content from other providers appears in only two places, described below: the BoxBase timetable (only after you click) and the OpenStreetMap map.
Controller
Thomas Mitterer, sole proprietor (Einzelunternehmen) Daneygasse 30, 6020 Innsbruck, Austria Phone: +43 681 81724831 Email: hallo@gentle-giants.at
Contact form
Data you submit via the contact form (name, email address, message) is used solely to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns entering into a contract, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The message is delivered to our mailbox through our host's mail server. No external delivery services are involved. To limit automated bulk submissions, the server keeps your IP address for one hour, and only as a hash with a secret key that cannot be turned back into the address. Expired entries are deleted the next time the form is sent. The IP address is not included in the message itself (Art. 6(1)(f) GDPR). Enquiries stay in our mailbox for as long as we need them to look after you, for instance to pick up where we left off if you get in touch again. There is no fixed deletion period for them. You can ask us to delete an enquiry at any time and we will, unless a statutory retention obligation prevents it. If the enquiry leads to a membership, statutory retention periods apply.
Hosting and server logs
The website is hosted by helloly (helloly GmbH, Rainerstraße 25, 4020 Linz, Austria). As a processor, the host processes personal data solely on our behalf and under a contract in line with Art. 28 GDPR. Opening the site produces standard server logs (IP address, time, page requested, browser, referrer). These serve secure operation, troubleshooting and an aggregated access statistic we view through the AWStats tool in the hosting panel (Art. 6(1)(f) GDPR). That evaluation is purely server-side: it sets no cookies, uses no JavaScript and builds no profiles. The logs are not merged with other data and are deleted by the host after a short period.
The BoxBase timetable
The weekly timetable on this site comes from BoxBase, a service of Luminous Falcon GmbH, Littengasse 2B, 6850 Dornbirn, Austria. It only loads when you click "Show the timetable"; until then your browser does not contact BoxBase. After the click, your browser sends your IP address and browser details to BoxBase, and BoxBase sets two technically necessary cookies (boxbase_session and XSRF-TOKEN, valid for two hours). Because you request the timetable yourself, we do not ask for separate consent (Section 165(3) of the Austrian Telecommunications Act 2021); the basis for the transfer is our legitimate interest in showing current class times (Art. 6(1)(f) GDPR). Your choice is not stored; you decide again on every visit. BoxBase delivers its content through Cloudflare, so the connection may also run via servers outside the EU. Nothing is booked through BoxBase: to join a session, message us on WhatsApp (see "WhatsApp and Instagram"), use the contact form or send us an email. No payments are processed online.
OpenStreetMap map
The map in the contact section is embedded from OpenStreetMap, a service of the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. As soon as the map scrolls into view, your browser connects to OpenStreetMap's servers and sends your IP address and browser details, even if you click nothing on the map. The basis is our legitimate interest in showing clearly how to find us (Art. 6(1)(f) GDPR). The EU Commission has issued an adequacy decision for the United Kingdom. The "Open in OpenStreetMap" link leads to openstreetmap.org, where OpenStreetMap's own privacy policy applies: https://osmfoundation.org/wiki/Privacy_Policy
WhatsApp and Instagram
The buttons on this site are plain links; no data is transmitted to Meta by them. If you write to us via WhatsApp or Instagram, Meta processes that communication under its own terms. If you would rather avoid that, email or phone reaches us just as well.
Members area (programming of the week)
At /wod/ we show members the training programme for the current week. The area is protected by a shared login handed out at the gym; there are no personal accounts. After signing in, the server sets a cookie (gg_wod, valid for one year) so your phone does not ask for the login every time. The cookie contains no personal data, only a marker that is the same for every member. The page remembers your chosen language and class (All, Regular or a specific class) in your browser's local storage; none of this is sent to the server. The cookie is technically necessary to run the area and you chose both settings yourself (Section 165(3) of the Austrian Telecommunications Act 2021), so we do not ask for consent (Art. 6(1)(f) GDPR). "Log out" deletes the cookie; the settings go with your browser data. To stop the login from being guessed, the server keeps your IP address for 15 minutes after a failed sign-in, and only as a hash with a secret key that cannot be turned back into the address; after five failed attempts, sign-in from that address is blocked for that time (Art. 6(1)(f) GDPR). A successful sign-in removes the entry; expired entries are deleted at the next sign-in attempt. The server also counts, per day, how often the programme was loaded and how often sign-in was tried, as plain totals without IP addresses or anything else linked to a person. The server logs described under "Hosting and server logs" apply here as well. No other data is processed.
Voluntary information and consent
Everything you enter in the contact form is voluntary. Without a name, an email address and a message we cannot answer an enquiry, but no other disadvantage follows from leaving it. We ask for no consent, because we use neither tracking cookies nor advertising or analytics services. There is therefore nothing to withdraw.
Data protection officer
We have not appointed a data protection officer. The conditions in Art. 37 GDPR do not apply: we monitor no one systematically and process no special categories of data at scale. For data protection questions, reach us at hallo@gentle-giants.at.
Your rights
You have the right to information, correction, deletion, restriction of processing, data portability and objection. A message to hallo@gentle-giants.at is enough. You may also lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, dsb.gv.at).