GDPR Art. 13 + 14 · As of May 8, 2026

Privacy Policy

Information per GDPR Art. 13 + 14.

This page is only available in German in its legally binding version. The English text is a courtesy translation.

1. Data Controller

The controller within the meaning of the GDPR (Art. 4 No. 7) is:

Ironstead — Owner Jakob Seiffert
Kentroper Weg 60a
59063 Hamm
Germany

Email (privacy): datenschutz@iron-stead.com
General contact: contact@iron-stead.com

A data protection officer is not required by law (no applicable case under Art. 37 GDPR or §38 BDSG) and has not been appointed. Privacy enquiries may be directed to the email address above.

2. Data we process

When you visit this website we process technically necessary data (truncated IP address, user agent, timestamp). When registering as a coach: first name, last name, email, hashed password. In the product: training data, sets, RPE, notes, check-ins, photos — pseudonymized and linked to coach and trainee IDs.

3. Purposes & Legal Basis

Contract performance (Art. 6(1)(b) GDPR) — provision of the coaching platform.
Legitimate interest (Art. 6(1)(f) GDPR) — logging, security, abuse prevention.
Consent (Art. 6(1)(a) GDPR) — AI Critique, optional cookies, marketing.

4. AI Critique (Vertex AI)

With the trainee's explicit consent we send pseudonymized training data (no real names) to Google Vertex AI in the Frankfurt region (eu-west-3). Processing is carried out under a data processing agreement with Google Cloud EMEA Ltd. No training on customer data takes place. Trainees can withdraw consent at any time in the app.

5. Payments (Paddle)

Paddle.com Market Limited (Ireland) acts as reseller (Merchant of Record). For payment processing we transmit the data required for invoicing to Paddle. Paddle's own privacy policy also applies.

6. Your rights

You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). An informal email is sufficient.

7. Retention period

Account data: up to 3 months after account deletion (cleanup job). Invoice data: 10 years (§147 AO — German Fiscal Code). Logs: 30 days.

8. Contact & Complaint

Privacy enquiries: datenschutz@iron-stead.com

Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority. The authority responsible for the controller is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) — State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestraße 2–4
40213 Düsseldorf
Email: poststelle@ldi.nrw.de
Web: ldi.nrw.de