PRIVACY POLICY.

1. Who is responsible?

Email: hello@3stepsbeyond.de
Phone: +357 95 128 627

3 STEPS BEYOND LTD is the controller for the personal data it collects for enquiries and coaching. Kenan Mujezinovic is your contact for privacy questions.

2. Visiting this website

The website uses locally served images, videos and system fonts. It does not load advertising pixels, visitor analytics or embedded scheduling tools.

STRATO GmbH, Berlin, Germany, provides this website through STRATO Hosting Basic and handles the email delivery of applications. A hosting provider processes connection data, such as IP address, request time, requested page, browser information and technical error records, to deliver and secure the website. The basis is our legitimate interest in secure, reliable operation under Article 6(1)(f) GDPR.

3. Enquiries and applications

When you contact us, we use your name, contact details and the information you provide to respond and assess whether coaching is suitable. For steps you request before entering a contract, the basis is Article 6(1)(b) GDPR. Other correspondence may be handled under Article 6(1)(f), for our legitimate interest in answering enquiries.

The application asks for your name, email, main goal, current obstacle and preferred start. Please do not include diagnoses, medical records or other sensitive health details in that initial application. When you submit the form, these details are sent from our STRATO-hosted website to hello@3stepsbeyond.de through STRATO’s mail service. No application database is kept on the website. Your answers are not saved in browser storage. We use temporary, hashed network identifiers and request counters on the server to prevent automated abuse and repeated submissions. They contain no application answers. Counters expire hourly and old files are removed during subsequent requests once they are more than two hours old. The basis for these safeguards is Article 6(1)(f) GDPR, our legitimate interest in protecting the form and mail service.

Applying does not subscribe you to marketing. Any future marketing subscription will have its own information and any consent required by law.

Instagram and WhatsApp are available through optional external links. They are not embedded or loaded automatically on this website. Following a link opens the relevant service, where its own privacy information and controls apply.

4. Arranging a call with Calendly

Calendly LLC is the selected scheduling provider. If we send you a scheduling link and you choose to use it, your name, email, chosen appointment, time-zone information and any booking answers may be processed to arrange the call, under Article 6(1)(b) GDPR.

Calendly is not embedded on this website and does not load just because you visit this page. Its separate site has its own cookies and privacy information. Keep sensitive health details out of booking fields.

See Calendly’s Privacy Notice. We use a separate scheduling link rather than an embedded booking tool. You receive the relevant booking information when arranging a call.

5. Coaching and health information

Trainerize, part of the ABC Fitness group, is the selected coaching platform. Once you join, the relevant account details, your plan, training logs, nutrition and health targets, check-ins, messages and any assessment material agreed with you are used to provide coaching. The basis for ordinary service data is Article 6(1)(b) GDPR.

Some assessment information, for example injuries or medical history, is health data with additional protection. Before collecting it, we will explain the specific purpose, relevant recipients and the applicable Article 9 GDPR condition. Where explicit consent is used, it will be requested separately and can be withdrawn for future processing. We will explain any effect this has on the coaching we can safely provide.

We do not require wearable connections or publish progress photos or testimonials as a condition of coaching. Any optional integration or promotional use needs separate information and, where required, permission.

See ABC Trainerize’s Privacy Policy. Before coaching assessments or health information are collected, you receive the relevant service-specific information and any separate consent request required for that processing.

6. Payments with Stripe

Stripe is the selected provider for hosted payment checkout after an individual coaching offer. If you decide to buy, Stripe processes the payment and relevant billing, transaction and security information. We receive the payment status and records needed to administer your agreement and accounting. Full card details are entered with Stripe rather than in the public application.

For our contract administration, the basis is Article 6(1)(b) GDPR; legally required accounting records are handled under Article 6(1)(c). Stripe also processes certain information for its own obligations and security purposes under its own notice.

See Stripe’s Privacy Policy. The relevant payment information is provided with any individual payment offer. This website has no public checkout. No Stripe script or checkout is loaded merely by visiting this website.

7. Recipients and international transfers

Information is shared only where needed for the stated purpose, with authorised people, the relevant service providers, professional advisers or authorities where legally required. Service providers may act on our instructions under processing terms or as separate controllers for their own activities.

Scheduling and coaching providers may process data outside the EEA. Where GDPR applies, an appropriate transfer mechanism and any necessary safeguards must cover those transfers. We will not describe all processing as EU-only.

8. How long information is kept

Data is kept for the purpose for which it was collected and then deleted or anonymised, unless a legal retention duty or the establishment, exercise or defence of claims requires longer storage. If an enquiry does not become a coaching relationship, we delete the application correspondence from our mailbox no later than six months after the exchange has concluded, unless a legal retention duty or a specific legal claim requires longer storage. If you become a client, the relevant information forms part of your coaching records and is retained according to the service purpose and applicable legal duties. According to STRATO’s published hosting information, visitor IP addresses in its hosting logs are retained for up to seven days to detect and prevent attacks. We use technical logs for troubleshooting and security, not visitor analytics. Specific records needed to investigate a security incident or meet a legal obligation may be retained for that investigation or the applicable legal period. Temporary form-abuse counters are handled as explained above.

9. Your rights

Where GDPR applies, you may request access, correction, erasure, restriction and, where applicable, a portable copy of your data. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Contact hello@3stepsbeyond.de. You can also complain to the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority, including in the country where you live or work.

Providing information for an enquiry is voluntary. We need relevant contact and service information to respond or provide coaching. This website does not use automated decisions producing legal or similarly significant effects.

10. Cookies and policy updates

See the Cookie Policy for this website’s current use of browser storage and external services. This notice must be updated before new providers or materially different processing are introduced.