Privacy Policy

Preamble

With this privacy policy we explain which types of your personal data we process, for which purposes and to what extent. It applies to all processing of personal data we carry out, both when providing our services and in particular on our websites, in mobile applications and on external online presences such as our social media profiles.

Controller

TURAZON LLC
3833 POWERLINE RD, SUITE 201
FORT LAUDERDALE, FL. US 33309

Authorised representative: Jonas Kilthau

Email: hello@regulatedathlete.com

Imprint: regulatedathlete.com/imprint

Relevant legal bases

Relevant legal bases under the GDPR: Below you find an overview of the legal bases of the GDPR on which we process personal data.

• Consent (Art. 6 (1) (a) GDPR) — The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR) — Processing is necessary for the performance of a contract to which the data subject is party, or to take steps prior to entering into a contract.
• Legal obligation (Art. 6 (1) (c) GDPR) — Processing is necessary to comply with a legal obligation.
• Legitimate interests (Art. 6 (1) (f) GDPR) — Processing is necessary for the legitimate interests of the controller or a third party.

Security measures

In line with the legal requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data and protecting online connections with TLS/SSL encryption (HTTPS).

Transfer of personal data

When we process personal data, it may be transferred or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients may include, for example, service providers commissioned with IT tasks or providers of services and content embedded in a website. In such cases we comply with the legal requirements and in particular conclude contracts or agreements with the recipients that protect your data.

International data transfers

If we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), we always do so in line with the legal requirements. For transfers to the USA we rely primarily on the Data Privacy Framework (DPF) and, where applicable, on standard contractual clauses approved by the EU Commission. More information: dataprivacyframework.gov.

General information on data storage and deletion

We delete the personal data we process in line with the legal provisions as soon as the underlying consent is withdrawn or there is no other legal basis for processing. Exceptions apply where legal obligations or special interests require longer retention, in particular retention periods under commercial or tax law.

Rights of data subjects

As a data subject you have various rights under the GDPR (Art. 15–21 GDPR):

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.
• Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
• Right of access: You have the right to request confirmation of whether your data is being processed, and to access this data, further information and a copy of the data.
• Right to rectification: You have the right to have your data completed or incorrect data corrected.
• Right to erasure and restriction of processing: You have the right to request the erasure of your data or a restriction of its processing.
• Right to data portability: You have the right to receive your data in a structured, commonly used and machine-readable format.
• Right to lodge a complaint with a supervisory authority: You have the right to complain to a supervisory authority, in particular in the member state of your habitual residence.

Business services

We process personal data of our contractual and business partners, such as customers, clients and prospects, to initiate, carry out and settle contractual relationships. This includes providing the agreed services (Blindspot Check, Umschalten, Performance Deep Dive, Clarity Session, individually agreed coaching programmes as well as the masterclass and other webinars).

• Types of data processed: master data (name, contact information); payment data; contact data; contract data.
• Data subjects: service recipients and clients; prospects; business and contractual partners.
• Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Legal obligation (Art. 6 (1) (c) GDPR); Legitimate interests (Art. 6 (1) (f) GDPR).

Provision of the website and web hosting

We process users’ data in order to provide our online services. For this purpose we process the user’s IP address.

• Types of data processed: usage data; meta, communication and process data; log data.
• Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

Contact and enquiry management

When you contact us (e.g. by email or via social media) and within existing user and business relationships, we process the information of the person making the enquiry to the extent necessary to answer it.

• Types of data processed: contact data; content data; meta, communication and process data.
• Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR).

Appointment booking

We use an online booking system to book consultations (e.g. Clarity Sessions), podcast recordings and other appointments. In the process we process the data required for the booking (name, email address, preferred appointment).

• Types of data processed: master data; contact data; contract data.
• Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Legitimate interests (Art. 6 (1) (f) GDPR).

Audio content

We use hosting services from service providers to offer our audio content (podcast) for listening and download.

• Types of data processed: usage data; meta, communication and process data; log data.
• Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

Video content

On some pages we embed videos from the YouTube platform. We use the privacy-enhanced mode (youtube-nocookie.com). The video only loads when you click on the preview. Before that, no connection to YouTube is made and no data is transferred to YouTube.

As soon as you start the video, a connection to Google’s servers is made. In particular, your IP address, information about your browser and device, and usage data about the video are transferred to Google. YouTube may store cookies or similar technologies on your device. If you are logged in to your Google account, YouTube can link the playback to your account. Data may be processed in the USA; Google is certified under the EU-US Data Privacy Framework.

• Types of data processed: usage data; meta, communication and process data; log data.
• Purpose: provision of video content.
• Legal bases: Consent (Art. 6 (1) (a) GDPR), which you give by clicking on the video preview; for storing information on your device § 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future by stopping playback and deleting the cookies set by YouTube in your browser.

Newsletter and electronic notifications

We send newsletters, emails and other electronic notifications only with the recipients’ consent or on a legal basis. If the content of the newsletter is described when signing up, this description is decisive for the user’s consent.

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove consent that was previously given. You can request individual deletion at any time.

After you buy a Performance Deep Dive, CopeCart sends us the buyer’s email address. We add it to a separate customer list at Acumbamail and use it to send two informational emails about the booked appointment (confirmation and reminder). The legal basis is the performance of a contract (Art. 6 (1) (b) GDPR). You can unsubscribe at any time via the link in the email.

Live group analysis at events. If you take part in our Blindspot Check during a talk or workshop and enter your email address, we store your email address, your strongest signal, your answer to the last question and the name of the event, so that we can send you your result and get in touch personally after the event. The screen in the room only shows anonymous totals, from a minimum group size, and never names or email addresses. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time by email; we then delete this data.

• Types of data processed: master data; contact data; meta, communication and process data; usage data.
• Legal bases: Consent (Art. 6 (1) (a) GDPR); Legitimate interests (Art. 6 (1) (f) GDPR).
• Opt-out: You can cancel our newsletter at any time. You find an unsubscribe link at the end of every newsletter, or you can use the contact options above.

Promotional communication via email, post, fax or phone

We process personal data for promotional communication, which can take place via various channels such as email. Recipients have the right to withdraw their consent at any time or to object to promotional communication at any time free of charge.

• Types of data processed: master data; contact data; content data.
• Legal bases: Consent (Art. 6 (1) (a) GDPR); Legitimate interests (Art. 6 (1) (f) GDPR).

Blindspot Check

The Blindspot Check is a questionnaire tool that is evaluated entirely locally in the user’s browser. The answers to the individual questions are not transferred to us or third parties and are not stored; the evaluation (including identifying the biggest lever) takes place only on the user’s device.

Only if users voluntarily enter their email address to receive their result is this email address transferred to our email marketing platform (see section “Newsletter”), together with the name of the strongest signal (e.g. “Sleep”). We need the signal to send the matching result email. The answers to the individual questions are not transferred in this case either.

To improve the offer, we also record anonymously at which point of the questionnaire users start, continue or stop. For this we only use a randomly generated, non-personal session ID that exists only for the duration of the browser tab; no IP addresses, cookies or other identifiers that allow conclusions about the person are stored. We also record, without any personal reference, the answer chosen in the last question and, if given, the month and year of the “most important day”. The evaluation takes place only on our own servers, without passing data on to third parties.

• Types of data processed: contact data (only if the email address is given voluntarily); anonymous usage statistics on questionnaire progress (without personal reference).
• Data subjects: participants.
• Legal bases: Consent (Art. 6 (1) (a) GDPR); Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); legitimate interest in developing the offer (Art. 6 (1) (f) GDPR) for the anonymous usage statistics.

Performance Deep Dive: questionnaire

Before a booked Performance Deep Dive we ask participants to fill in a questionnaire. It serves only to prepare and carry out the Deep Dive. We ask for name, email address and, voluntarily, a mobile number for the check-in, information about the most important race or appointment, sport, job and workload, and self-assessments of sleep, energy, body, mood, digestion and relaxation. Participants can also voluntarily state diagnoses or medication.

Some of this information concerns health and therefore belongs to the special categories of personal data under Art. 9 GDPR. We process this information only with explicit consent, which participants give in the questionnaire before submitting it. Consent is voluntary and can be withdrawn at any time with effect for the future by email to hello@regulatedathlete.com. Without the questionnaire the Deep Dive still takes place; we can then only prepare it in a less targeted way.

The answers are transferred to our server in encrypted form, stored there in a directory locked against outside access and sent by email to our mailbox (hello@regulatedathlete.com). Only Jonas and Ines Kilthau have access. The information is not passed on to third parties, not used for advertising and not transferred to our email marketing platform. We delete it no later than 12 months after the Deep Dive. If coaching follows, we keep it until the coaching ends. If consent is withdrawn, we delete it immediately.

In addition, we count anonymously how often the questionnaire was opened and submitted, without content and without personal reference (see section “Blindspot Check”). The Performance Deep Dive is no medical service and does not replace a medical examination.

• Types of data processed: master data (name); contact data (email address, mobile number if given); content data (information in the questionnaire); health data (self-assessments of sleep, energy, body, mood, digestion, relaxation; voluntary information on diagnoses and medication).
• Data subjects: Performance Deep Dive customers.
• Purposes of processing: preparing and carrying out the booked Performance Deep Dive, creating the summary, check-in after 14 days.
• Legal bases: performance of a contract (Art. 6 (1) (b) GDPR); explicit consent for health data (Art. 6 (1) (a) and Art. 9 (2) (a) GDPR).

Customer reviews and rating procedures

We take part in review and rating procedures to evaluate, improve and promote our services (under the name Turazon). If users rate us via the participating rating platform or give feedback in other ways, the provider’s terms and conditions or terms of use and privacy notices also apply.

• Types of data processed: contract data; usage data; meta, communication and process data.
• Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Consent (Art. 6 (1) (a) GDPR).

Presence on social networks (social media)

We maintain online presences on social networks for marketing purposes and to communicate directly with prospects and users (e.g. via direct messages). Please note that user data may be processed outside the European Union.

• Types of data processed: contact data; content data; usage data.
• Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

Changes and updates

Please check the content of our privacy policy regularly. We update the privacy policy as soon as changes in our data processing make this necessary.

Definitions

Personal data: any information relating to an identified or identifiable natural person.

Processing: any operation performed on personal data, with or without automated means.

Controller: the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

Consent: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by a statement or by a clear affirmative action.