Privacy Policy

Last updated: 30 September 2026

In short: this website sets no cookies and uses no tracking, no analytics and no third-party tools. Fonts and images come from our own server. We process personal data only when you join the waitlist (with double opt-in), if you ask for our news, and in the technical server logs of our host.

1. Who is responsible (controller)

[Legal name] UG (haftungsbeschränkt)

[Street and number]

[Postcode] Berlin, Germany

Managing director: [Name of the managing director]

E-mail: [Contact e-mail]

More in our imprint (Impressum).

2. Data protection officer

Our external data protection officer is Abi [Surname]. You can reach them at [DPO e-mail address] with any question about your data.

3. What this website processes

3.1 Visiting the website: server logs

Our host, Vercel, automatically records technical data for every request to this website: your IP address, date and time, the page or file requested, the referring page, your browser and operating system (user agent) and the status of the response. We need this to deliver the website and to keep it secure and stable (for example, to detect attacks).

  • Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in delivering the website securely and reliably.
  • Retention: Vercel keeps these logs only for a short time and then deletes them automatically ([log retention period of our Vercel plan — to be confirmed]). We do not combine them with other data.

3.2 No cookies, no tracking, no analytics

We do not use cookies, tracking pixels, analytics, advertising or social-media plug-ins. The only thing this website stores on your device is your language choice (English or German) in your browser's local storage (key lang). It never leaves your browser and is not sent to us; you can delete it at any time in your browser settings. Storing it is strictly necessary to show the website in the language you chose (§ 25(2) no. 2 TDDDG).

3.3 Fonts and images

All fonts and images are served from our own website. Your browser does not connect to Google Fonts, image services or any other third party when you visit.

3.4 The waitlist (double opt-in)

When you join the waitlist we process your name, e-mail address, your interest (1:1 coaching, group sessions or corporate programme), your message if you write one, the language of the page, whether you asked for our news, and the times of your sign-up and confirmation. Please do not share health information in the message field.

We then send you an e-mail with a confirmation link. Only when you click it are you on the waitlist — this way nobody can sign up someone else's address. If you do not confirm, we delete your details after 7 days and never write to you again. Ticking "I have read the Privacy Policy" is not a consent; it only confirms that you have seen this information.

  • Purpose: to let you know when places in our group sessions, workshops, coaching or corporate programmes open, and to answer your message.
  • Legal basis: Art. 6(1)(b) GDPR (steps you asked for before a possible contract) and Art. 6(1)(f) GDPR (our legitimate interest in organising the waitlist, in proving your confirmation and in preventing misuse of the form).
  • Is it required? Your name and e-mail address are needed to put you on the waitlist; everything else is optional.

3.5 News about RespiraLab (optional)

If you tick "Also send me news about RespiraLab", we will occasionally e-mail you news about RespiraLab. This is entirely optional and separate from the waitlist — you can join the waitlist without it.

  • Legal basis: your consent, Art. 6(1)(a) GDPR (confirmed with the same double opt-in link).
  • Withdrawal: you can withdraw your consent at any time with the one-click unsubscribe link in every e-mail we send after your confirmation, or by writing to us. The withdrawal does not affect the lawfulness of what happened before it (Art. 7(3) GDPR).

3.6 How long we keep waitlist data

  • Not confirmed: deleted 7 days after your sign-up.
  • Unsubscribed: deleted at once (within a minute of clicking the link).
  • Confirmed: kept until you unsubscribe, and deleted at the latest 2 years after your last sign-up or confirmation.

These periods are being reviewed by our data protection officer; if they change, we will update this policy.

4. Service providers (processors)

We use three service providers, each bound by a data processing agreement under Art. 28 GDPR. We do not sell your data, share it with anyone else or use it for automated decisions or profiling.

Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA — hosting of this website and its server logs (3.1).

Data may be processed in the USA. The transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Vercel is certified, and the standard contractual clauses in Vercel's data processing agreement (Art. 46 GDPR).

Supabase Inc., USA — the database and server function that store the waitlist (3.4–3.6). The data is stored in Supabase's Frankfurt (Germany, EU) region.

Where Supabase staff may access data from outside the EU (for example for support), this is covered by the standard contractual clauses in Supabase's data processing agreement (Art. 46 GDPR).

Resend (Plus Five Five, Inc., USA) — sends the confirmation e-mail and the waitlist e-mails, from its EU region.

Where data is accessed from outside the EU, this is covered by the standard contractual clauses in Resend's data processing agreement (Art. 46 GDPR).

5. Your rights

You have the right to:

  • access your data (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16),
  • erasure (Art. 17),
  • restriction of processing (Art. 18),
  • data portability (Art. 20),
  • withdraw your consent at any time, with effect for the future (Art. 7(3)).

Your right to object (Art. 21 GDPR)

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation; we then stop unless we can show compelling legitimate grounds. You can object to the use of your data for news and other direct marketing at any time and without giving reasons — we will then stop immediately.

To exercise any of these rights, write to [Contact e-mail] or to our data protection officer (section 2).

6. Right to lodge a complaint

You can complain to a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.

7. The RespiraLab apps and classes

This policy covers this website only. The RespiraLab app has its own app privacy policy. What happens with your data in a class — the heart-rate sensor, your results page — is explained in the class notice shown on the studio tablet before every class, which you accept or decline there; you can also ask us for a copy at [Contact e-mail].

8. Changes

We update this policy when our website or the law changes. The date at the top shows the current version.