Privacy Policy
1. Controller
Christian Huckstorf, Max-Planck-Str. 7, 19063 Schwerin, Germany
Email: christian@hxf-coaching.com
2. Processing Principles
We process personal data only where necessary to operate the website, handle inquiries and provide requested services. Legal bases include Article 6(1)(a), (b) and (f) GDPR. Health data is processed only under the conditions of Article 9 GDPR.
3. Contact and Coaching Inquiries
When you submit the contact form, we process your name, email address, optional phone number and age, as well as fitness level, availability, program interest, goals and voluntary notes. Processing takes place to handle your non-binding inquiry and pre-contractual steps (Article 6(1)(b) GDPR) and on the basis of your consent (Article 6(1)(a) GDPR).
The information is sent to hxf-coaching by email. Inquiries that do not result in a contract are generally deleted no later than six months after completion, unless statutory retention duties require otherwise.
4. Nutrition Questionnaire and Health Data
The training and nutrition questionnaire may include information on age, weight, allergies, intolerances, medication, pre-existing conditions and other health circumstances. This may constitute special categories of personal data. Processing takes place to create, securely match payment to, and deliver the selected plan, and only with explicit consent under Article 6(1)(a) and (b) and Article 9(2)(a) GDPR.
You may withdraw consent for the future at any time by email. Without the required consent, no plan can be created. Unpaid order references remain usable for 24 hours. The personal plan access link is valid for 30 days after payment confirmation. Plan and order data is stored securely outside the publicly reachable web directory and is generally deleted no later than 90 days after delivery, unless statutory retention duties require longer storage.
For the free nutrition consultation, your questionnaire information is processed for the automatic evaluation and the result is sent to you by email; the questionnaire content is not stored permanently in the process. To prevent repeated requests, we only store an irreversible check value (hash) of your email address with a timestamp; it is deleted on request. If a personal review is required, the information temporarily stored for it is deleted after 30 days at the latest.
5. Internal Client Overview
To organise existing coaching and planning inquiries, hxf-coaching maintains an internal overview of past inquiries (name, email address, age, selected program, as well as goal, training and, where applicable, nutrition information). This overview is stored outside the publicly reachable web directory and is accessible only via an individual, secret access key that is not published. The legal basis is Article 6(1)(b) and (f) GDPR (contract performance and legitimate interest in organised client management).
6. Automatic Creation of Plans and Nutrition Guidance
The free nutrition guidance and the plans of one-time purchases are calculated automatically from your information according to fixed rules on the hxf-coaching server. No data is transmitted to external AI services. No profiles are created beyond the creation of your plan.
If your information indicates that automatic guidance is not appropriate (for example pregnancy, certain medical conditions or conspicuous body measurements), no guidance is created automatically. You then receive a notice and the option to get in touch for a personal conversation. This decision is not a medical assessment. Plans for which you report special health circumstances are reviewed personally by me before they are provided. You may request a personal review at any time.
The output does not replace medical or professional dietetic advice. Should an AI service be used in future, this will only happen after prior information and, where health data is concerned, only with your explicit consent; this policy will then be updated.
7. Payments, App Access and External Links
For one-time purchases, a random order number is generated once the plan questionnaire is completed. When you actively open the Stripe payment link, this order number and the email address used to pre-fill the form are transmitted to Stripe. Stripe processes the payment data and reports the confirmed payment status back to hxf-coaching via a signed technical interface. Only afterwards is the personal plan access link sent. Stripe's privacy information applies in addition for payment processing.
For programs with app access (Selfguided subscription, Supported, Premium), you receive an invitation link to the training app My PT Hub by email after confirmed payment. Only when you actively open this link and join the offering do you transmit your data (e.g. name, email address) directly to My PT Hub; hxf-coaching does not transmit any data to My PT Hub itself in this process. My PT Hub's privacy policy applies in addition. Links to Instagram or other external services likewise only transfer data once you actively open them.
8. Email Delivery
Form details and confirmations are processed through the email service configured on the server. The hosting and email providers used for technical delivery receive the data necessary for transmission. Data processing agreements under Article 28 GDPR are concluded with the processors used, where required.
9. Contact via WhatsApp
The website contains a button that lets you contact me via WhatsApp. Merely visiting the page does not transfer any data to WhatsApp. Only when you actively click the button are you forwarded to WhatsApp. In that case, data (e.g. your phone number, name, profile picture, the content of your message and metadata) may be processed by WhatsApp Ireland Limited, Dublin, Ireland, and the Meta group of companies. A transfer to third countries, in particular the USA, is possible. WhatsApp's privacy policy applies in addition.
When you write to me, I process your phone number, name and message content to answer your inquiry. The legal basis is Article 6(1)(b) GDPR (pre-contractual steps or contract performance), otherwise Article 6(1)(f) GDPR (legitimate interest in answering inquiries quickly). Please do not send health data or other sensitive information via WhatsApp; use the forms on this website or email instead. You may object to the processing at any time and simply ask me to delete your data.
10. Abuse Prevention and Server Logs
To protect forms, the IP address is briefly processed in hashed form with timestamps in the server's temporary area. This rate-limit data expires after one hour. The hosting provider may also process technically required server logs such as IP address, time, requested page, browser type and referrer. The legal basis is Article 6(1)(f) GDPR.
11. Reach Measurement with IONOS WebAnalytics
To statistically evaluate website usage, we use IONOS WebAnalytics provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The measurement works without cookies and without tracking technologies that store information on your device. Evaluation is based on a counting pixel or on server log data.
The following data is processed: the page you came from (referrer), the page requested, browser type and version, operating system, device type and the time of the visit. The IP address is used only in anonymised form to determine your approximate country of origin. The data is not passed on to third parties and not combined with other data.
The legal basis is Article 6(1)(f) GDPR (legitimate interest in designing and improving the website to the needs of its visitors). A data processing agreement under Article 28 GDPR exists with IONOS. More information: IONOS WebAnalytics privacy information. You may object to the processing at any time (Article 21 GDPR).
12. Local Fonts and Cookies
Fonts are served locally. The website uses no analytics, marketing or tracking cookies; reach measurement (section 11) also works without cookies. If this changes, this policy will be updated and consent obtained where required.
13. Your Rights
Subject to the statutory conditions, you have rights to access, rectification, erasure, restriction, data portability and objection. You may withdraw consent for the future at any time. You also have the right to lodge a complaint with a data protection authority.
14. Security and Version
Confidential content is transmitted only through an encrypted HTTPS connection. Version of this Privacy Policy: 30 October 2026.