Privacy.

1. Controller

Alexander Keck, trading under the company name Alexander Keck e.U.
Matznergasse 10
1140 Wien
Austria
Registered office: Wien
FN 688215 g · Company register court: Handelsgericht Wien

Email: office@schwimmtrainer.at

VAT identification number: ATU57394867

2. User account and email confirmation

For registration and sign-in, we process the email address, account status and verification timestamps. Regular sign-in requires a password and a time-based code from an authenticator app. We store password hashes rather than passwords, a server-side encrypted authenticator secret, hashes of one-use recovery codes, and limited security information such as unsuccessful attempts and temporary locks. Existing accounts confirm their email address once during the initial setup. No third-party QR-code service is used.

The legal basis is the performance of pre-contractual measures or performance of the contract. Security and abuse-prevention measures are additionally based on our legitimate interest in secure operation of the platform.

3. Profile and organisation data

Depending on the profile, we process in particular display name, profile type, organisation, description, address or place of activity, region, country, telephone number, contact email address, website, social-media links, profile image, qualifications and content provided by users. For offers, courses and events, separate contact details, information/registration links and voluntarily uploaded information PDFs may also be processed.

Processing takes place to provide and manage the profile and therefore to perform the contract. Data that a user releases for public display may be publicly accessible on the internet and indexed by search engines. This applies in particular to contact details and information documents expressly assigned to a published offer, course or appointment.

PerformanceHub and PerformanceLab: processing by product area

PerformanceHub covers published user/organisation profiles, contact details made public by users, courses, offers and events, as well as the related search and map displays. The data processed, its purpose and the potential public visibility are described in the profile and organisation information above. PerformanceLab supports protected athlete, training and diagnostic records within the authorised Gold functions; the applicable controller/processor roles are described in the following section and in the data processing terms.

The fact that the services share one digital ecosystem does not itself constitute a legal basis for additional processing or the disclosure of private athlete records. Creating a public profile or publishing an offer does not automatically publish protected PerformanceLab records. Disclosure and access remain subject to existing roles, permissions and applicable data protection law. The ecosystem description explains the product concept; the detailed provisions of this privacy notice continue to govern data processing.

3a. Gold · Performancelab – athlete, training and diagnostic data

Gold users may store data about athletes and other persons they support in the Performancelab. This may include, in particular, name, date of birth, gender for reference purposes, club or organisation affiliation, contact details, para-swimming classifications, group assignments, competition and start data, placings, goals including coach-defined personal and group target/development corridors, test sessions, test batteries, training and competition notes, body measurements, body weight, body fat, waist/hip measurements, arm span, VO₂max, heart rate, lactate values, strength, jump, coordination and other performance-diagnostic measurements, as well as derived side-to-side asymmetries and strength ratios.

Depending on their content and use, some of these details may constitute health data within the meaning of Article 9 GDPR. schwimmtrainer.at therefore requires Gold users to enter such data only if they are entitled to do so under data protection law. For minors, the applicable representation, information and consent requirements must also be observed.

Where a Gold user determines the purposes of processing for persons they support, schwimmtrainer.at technically processes those data for the user. In this situation, the Gold user is the controller and schwimmtrainer.at is the processor. The following additionally apply: Data Processing Terms. Where users process only their own data, processing is governed by the general provisions of this Privacy Notice.

PDF reports: When the user requests a report, the selected Performancelab records are combined server-side into a PDF document and provided exclusively as a protected download to the authenticated, authorised session. The resulting report is not kept as a separate permanent file in platform storage; the underlying measurement and performance data remain stored in accordance with the applicable rules. Reports are not automatically transmitted to external PDF services or third parties. Any lawful onward disclosure of a downloaded report is the responsibility of the relevant person or organisation.

Processing serves the organisation, documentation, evaluation and progress monitoring requested by the user in the Performancelab. This includes creation of freely configurable test batteries, scheduling individual test components across different sessions, assigning multiple athletes to one test session, displaying competitions, athletic tests and swimming tests in a shared planning calendar, group- and event-related progress evaluation in the Performance Monitor using available benchmark corridors, displaying protocol-matched right/left and anterior/posterior ratios in athletic diagnostics, and managing personal and group target and development corridors independently of results, including future training goals set by the user. These non-public performance data are not intended to be used for advertising or public profiling.

Form drafts may be temporarily stored on the server while data are being entered. They contain the fields entered up to that point and the time of the most recent update. Drafts are assigned to a user account and a specific form key and are generally removed when the relevant record is finally saved.

Gold demonstration data

Gold members may receive a private demonstration group with three fictitious athlete profiles, sample competition results, strength and swim tests, benchmarks and targets. The records can be changed or deleted. A restoration is made only following an explicit member request and is recorded with the acting staff member and time. The sample dataset is not a source of real third-party athlete records.

Public Performancelab product presentation

The public product presentation uses locally hosted example screenshots and a local switcher script. The presentation itself does not request private athlete or diagnostic records from Gold accounts and does not introduce additional advertising or analytics trackers. Normal server log and session rules continue to apply.

4. Qualification review and quality management

For the personal profile types swimming instructor, state-certified instructor (BSPA), swimming teacher (ÖWR), state-certified swimming coach (BSPA) and sport scientist, qualification evidence is processed during registration. In particular, the profile type, file name, file type, file size, submission time, review status, review time, reviewer and, where applicable, a review note are processed.

The review supports the platform’s quality standard and determines whether a personal profile may be made public. Depending on the profile type, the reviewed evidence comes from different education systems: swimming-specific instructor qualifications from Austrian umbrella or specialist federations (in particular OSV/regional swimming federations within the coordinated instructor system), state instructor and coach qualifications from BSPA, ÖWR qualifications from swimming-teacher level upwards, and university degrees in sport sciences. The substantive approval criteria are described in the Terms and Conditions.

The evidence file is stored securely, is not publicly accessible and is deleted from the evidence storage after the manual review is completed. The review status and metadata required for traceability remain documented in the user account.

If evidence is rejected after a paid subscription has meanwhile been concluded, the Stripe subscription, invoice, payment and refund references required for contractual subscription termination and reimbursement are additionally processed, together with refund status, amount, currency and processing time. The legal bases are performance of the contract, compliance with legal obligations and, where applicable, legitimate interests in traceable quality and payment processing.

5. Memberships, payments, refunds and gift memberships

For paid memberships, the selected membership, billing interval, Stripe customer ID, Stripe subscription ID, checkout session ID, price ID, payment or invoice status, contract period and status of changes or cancellations are processed in particular for contract and payment handling.

Complete card or bank details are not stored by schwimmtrainer.at but are processed by Stripe. For refunds, in particular in connection with statutory withdrawal or the contractual refund commitment after a negative qualification review, the payment and refund references required to initiate and document reimbursement are processed.

For a free gift membership, the recipient email address, membership level, start, end, status, optionally a gift message and, after registration with the same email address, assignment to the user account are processed in particular. A gift membership does not create a Stripe payment or automatic renewal.

The legal basis is in particular Article 6(1)(b) GDPR (contract or pre-contractual measures), where necessary Article 6(1)(c) GDPR (legal obligations), and Article 6(1)(f) GDPR for secure and traceable administration.

5a. Editorial premium downloads

When the editorial download library is accessed, account data required for the access decision are processed, in particular user ID and the currently effective membership level. This checks whether the minimum Bronze, Silver or Gold level specified for the respective file has been reached.

For the editorial library, only an aggregated download counter is incremented for each file. No additional personal history is stored showing which specific user downloaded which file. Technically necessary server and security logs under Section 9 remain unaffected.

The files themselves are stored in a protected server area and are not delivered via direct public file URLs. The legal basis for access control and provision is Article 6(1)(b) GDPR (performance of the contract); security measures are additionally based on Article 6(1)(f) GDPR.

5b. Online shop, orders and shipping

For online-shop orders we process, in particular, email address, ordered products and variants, quantities, prices, shipping method, delivery address, order and payment status, Stripe checkout references, timestamps and the versions of the contractual and withdrawal information applicable at the time of ordering. For signed-in customers, the user ID is additionally stored; guest orders can be placed without a user ID. For digital content, the order items required for download entitlement and the documented declarations regarding requested immediate commencement of performance are also processed. If creation of a customer account is voluntarily selected during checkout, we also use the email address provided to create the password-protected customer account and assign the order history. In the customer account, name, company/organisation, address and optionally a telephone number can be stored and changed as default data for future orders. Changes to these default details do not alter completed orders. Normal sign-in requires a password and authenticator code; email is verified during initial setup.

Processing is carried out for pre-contractual measures and performance of the contract, payment and shipping processing, compliance with statutory information, evidence, warranty, withdrawal, tax and retention obligations and, where applicable, for the establishment, exercise or defence of legal claims. Complete card or bank details are not stored by schwimmtrainer.at; payment is processed through Stripe.

For internal order processing, an order summary is sent to the configured operator address. Transactional order, contract and, where applicable, shipping confirmations are sent to buyers. For paid orders, the invoice number, invoice date and the order, customer and business details required for the invoice are also processed and provided as a PDF in the protected order area.

6. Online withdrawal

When the public online withdrawal form is used, we process in particular name, email address, account email where applicable, membership, order and contract references, voluntary additional information, as well as time and technical evidence data. Processing serves to receive, document and handle the statutory notice of withdrawal and to provide prompt confirmation of receipt.

7. Contact form

If you use the contact form at /kontakt/, we process your name, email address, subject, message and submission time to handle and answer your enquiry. The information is not used for advertising purposes. Depending on the content of the enquiry, processing is carried out for pre-contractual measures, performance of a contract or on the basis of our legitimate interest in handling general enquiries.

Support tickets and time-limited account assistance

For support requests, we process the ticket category, subject, message, related account ID, timestamps, case status and necessary access or change logs for handling the request, account security and documented accountability (GDPR Article 6(1)(b) or (f), depending on the case). Filing a ticket does not in itself authorise access to private performance records. Access to protected account data for assistance requires a separately granted, scoped, expiring authorisation that may be withdrawn; access and changes are logged. Do not transmit passwords, one-time codes or recovery codes via tickets. Ticket content and necessary records are retained only as required for the request and legal obligations, subject to existing retention and erasure rules.

PerformanceHub network relationships

For the organisation network, we process organisation names, organisational types, parent-child relationships, optional publicly intended business addresses, contact telephone numbers, contact emails and websites, as well as the profile account recording a relationship, timestamps, claimed-role details and, where relevant, affiliation ownership approval requests. People can save more than one affiliation and choose individually whether their own affiliation appears publicly. Personal manually entered institutions are not made available in the general organisation directory. Publicly opted-in associations may appear on a person’s profile and under the relevant organisation, always marked as self-reported unless independently confirmed. Users may amend or remove their own affiliations. Providers may edit or archive entries under their control. The processing serves the requested networking service (GDPR Article 6(1)(b)) and, where applicable, the interest in transparent, accountable network administration (Article 6(1)(f)). Do not publish private contact details of third parties.

8. Email communication

We send necessary transactional emails, in particular one-time codes, contract and order confirmations, shipping notifications, notices about gift memberships, and security- or contract-related messages. These emails serve performance of the contract, secure provision of the user account or administration of a specifically granted gift activation. The recipient address of a gift membership is not used for general advertising or newsletters merely because of that gift.

9. Server and security data

When the website is accessed, technically necessary connection data may be processed, such as IP address, time, requested resource, browser or device information and technical error data. This processing serves delivery of the website, error analysis, IT security and prevention of misuse.

For legally relevant confirmations, the IP address is not stored in plain text in the application database but is hashed using a server-side secret; the time and user agent may also be logged.

10. Cookies and sessions

schwimmtrainer.at verwendet einen technisch notwendigen Session-Cookie zur Anmeldung, Sitzungsverwaltung und zum Schutz von Formularen. Der Cookie ist als HttpOnly gesetzt, wird bei HTTPS sicher übertragen und mit SameSite=Lax verwendet. Falls du beim Anmelden ausdrücklich „Auf diesem privaten Gerät 14 Tage angemeldet bleiben“ wählst, setzen wir zusätzlich den Cookie st_remember_device (maximal 14 Tage, HttpOnly, Secure, SameSite=Lax). Dieser enthält einen zufälligen Geräteschlüssel; in der Datenbank liegt nur dessen kryptografischer Hash samt Konto-ID, Ablaufdatum und Sicherheitsversionsnummer. Beim Abmelden wird der aktive Schlüssel widerrufen; eine Passwortzurücksetzung macht ältere Schlüssel ungültig. Ohne Auswahl dieser Option wird kein dauerhafter Anmelde-Cookie gesetzt. Beide Cookies dienen ausschließlich der sicheren Kontonutzung und nicht Werbe- oder Trackingzwecken.

If analytics, marketing or other services that are not technically necessary are used in future, this Privacy Notice will be updated before they are introduced and, where required, prior consent will be obtained.

11. Profile statistics

For profile statistics, public profile views and, for Gold, selected interactions such as clicks on website or social-media links, course/event registrations and downloads are stored as timestamped events. Views by the profile owner are not counted.

For these statistics, the application database stores no visitor IP addresses, no user identifiers and no dedicated statistics cookies. For referrer analysis, at most the hostname of a referring website is stored, not the URL path, search term or other URL parameters. Statistical events are automatically purged after approximately 400 days at the latest.

11a. Europäische Discovery Map, MapLibre, OpenFreeMap und Geocodierung

Für öffentliche Profile, Angebote sowie Kurse und Veranstaltungen kann schwimmtrainer.at eine Kartenposition speichern und im Bereich „Finden“ auf einer interaktiven Europakarte darstellen. Bei Personenprofilen wird standardmäßig nur aus Ort, Region und Land eine ungefähre Position abgeleitet. Wenn Profilinhaber die Checkbox „Genauen Standort meines Profils anzeigen“ ausdrücklich aktivieren, werden auch Straße und Postleitzahl für die Geocodierung verarbeitet, an Nominatim übertragen und als exakte Kartenposition öffentlich sichtbar. Die Freigabe kann jederzeit in der Profilbearbeitung deaktiviert werden; danach wird die Position wieder auf Ortsebene berechnet. Dasselbe Prinzip gilt für öffentlich freigegebene Hauptstandorte von Vereinen, Verbänden und Organisationen. Zusätzlich veröffentlichte Organisationsstandorte werden mit ihrer ausdrücklich freigegebenen Anschrift und Kartenposition angezeigt. Nutzer dürfen keine fremden Privatadressen ohne ausreichende Berechtigung veröffentlichen. Bei Angeboten und Terminen wird der vom Anbieter zur Veröffentlichung bestimmte Orts-/Durchführungstext gemeinsam mit Region und Land verwendet.

Geocoding is performed server-side using the Nominatim service based on OpenStreetMap. Geocoding results are cached locally to avoid repeated external requests. No Performancelab data, athlete data or payment data are transmitted to the geocoding service.

Die interaktive Karte wird beim Aufruf des Bereichs „Finden“ automatisch geladen. Die Kartenbibliothek MapLibre GL JS wird über jsDelivr bezogen. Der Kartenstil und die Vektorkacheln werden beim OpenFreeMap-Dienst (Hyperknot Software Kft., Ungarn; gegebenenfalls mit CDN-Infrastruktur) geladen. Beim technischen Abruf können unter anderem die IP-Adresse, Browser-/Geräteinformationen, Zeitpunkt und Referrer an die beteiligten Dienste übermittelt werden. Falls die Vektorkarte technisch nicht verfügbar ist, kann die bisherige Leaflet-Darstellung mit jsDelivr und Kartenkacheln von OpenStreetMap als Rückfallansicht geladen werden. Die Kartenansicht unterstützt Kategorie- und Ausschnittfilter, 3D-Gebäude, Neigung, Rotation und Standortbestimmung nach aktiver Freigabe. Die Standortfunktion nutzt die Geolocation-Schnittstelle des Browsers erst nach einem Klick und übermittelt die so ermittelten Koordinaten nicht zur Speicherung an schwimmtrainer.at; der Kartenanbieter kann aus den bei dieser Position abgerufenen Kacheln Rückschlüsse auf das dargestellte Gebiet ziehen. Die Plattform setzt für die Karte selbst keine eigenen Analyse- oder Marketing-Cookies ein. OpenStreetMap-Daten werden mit entsprechender Quellenangabe nach den einschlägigen Open-Data-Lizenzen verwendet.

12. Recipients and service providers

Personal data may be disclosed to technical service providers to the extent necessary. The production system of schwimmtrainer.at is hosted by World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, BT3, 4020 Linz, Austria World4You provides technical hosting and infrastructure services. The specific technical location of storage and processing depends on the hosting product used for schwimmtrainer.at and the agreements applicable to that product with the provider.

Weitere Empfänger können insbesondere E-Mail-Infrastruktur-Dienstleister, Stripe für die Zahlungsabwicklung sowie – beim Aufruf der Suchseite mit Karte bzw. bei serverseitiger Standort-Geocodierung – OpenStreetMap/Nominatim, OpenFreeMap (Hyperknot Software Kft.) und jsDelivr sein. Dienstleister erhalten Daten nur soweit dies für die jeweilige Leistung erforderlich ist. Soweit ein Dienstleister als Auftragsverarbeiter eingesetzt wird, erfolgt die Einbindung auf Grundlage der hierfür erforderlichen vertraglichen Vereinbarungen.

According to Stripe’s contractual information, Stripe Payments Europe, Limited in Ireland is involved in particular for Stripe services outside the Americas; other affiliated companies and sub-processors within the Stripe group may also be involved.

13. Transfers to third countries

For certain service providers, processing outside the European Economic Area cannot be ruled out. In such cases, the transfer mechanisms and safeguards provided for under the GDPR and used by the respective service provider are relied upon where necessary.

14. Storage period, account deletion and statutory retention

Account data are generally stored for as long as the user account exists and the data are required for use of the platform. Users can delete their account and profile themselves in the signed-in area. The operator may also delete a profile at the user’s documented request or in the event of an objectively justified rule violation.

For reversible temporary account suspension we process account status, reason code, concise case notes, administrator ID, timestamps of suspension and reinstatement, and a limited history of moderation decisions. This processing is carried out to safeguard platform security, investigate objectively justified incidents and document decisions, generally pursuant to Article 6(1)(f) GDPR and, where applicable, contract performance or legal duties. Access is limited to authorised operator accounts. Suspension blocks sign-in and invalidates existing authenticated sessions without itself deleting the underlying personal data; reinstatement restores access. Relevant data subject rights continue to apply, and moderation records are retained only for as long as necessary for incident resolution, accountability or legal claims, subject to applicable duties.

When an account is deleted, the public profile, directly associated profile content and profile files stored for it are removed. Active user access is disabled and the account email address used in the active user record is anonymised. Any active paid subscription is terminated before deletion is completed so that no further automatic renewal occurs.

In the event of an administrative suspension or deletion, the time, deletion source, reason for deletion, a brief factual justification and the operator account taking the action may be documented in particular for traceability. These details are retained only for as long as necessary for legal obligations, traceability of the decision or the establishment, exercise or defence of legal claims.

Deletion of a user account does not necessarily mean that all data may immediately be removed from all contract and evidence systems. Payment, invoice, contract-confirmation, consent and accounting data may continue to be stored for the period required by statutory retention obligations or for the establishment, exercise or defence of legal claims. Tax and business-law retention periods in Austria may in particular be seven years and may be extended in individual cases.

Uploaded qualification files are deleted after completion of the manual review. Information PDFs relating to offers, courses or events and profile images are generally removed from the designated storage area when replaced, removed or when the associated profile or content is permanently deleted.

Where Stripe stores its own payment, invoice or refund data due to legal or contractual obligations, the further storage period is additionally governed by Stripe’s privacy and retention rules.

Performancelab data are generally stored until the Gold user deletes them, the associated account is deleted, or storage is no longer required for the agreed platform provision. Individual persons, competitions, planned starts, test sessions, test batteries and measurements may be deleted separately where the relevant function provides for this. If membership ends or is downgraded, existing data may remain stored in readable form for a reasonable transition or reactivation period unless previously deleted; active editing may be restricted depending on the plan. Statutory retention obligations remain unaffected.

Athleteneinladungen, Kontoverknüpfung und Altersbestätigung

Coaches may invite adult athletes to view their own records. For this we process the athlete’s invitation email address, coach and record references, a hashed, time-limited invitation token, invitation status and timestamps; the invitation token itself is only sent by email. To activate the invitation, a six-digit code is sent to the invited mailbox and processed in the protected session (10-minute validity, maximum five failed attempts). The email code verifies access to the mailbox, not the holder’s official identity or age. We record the express adult declaration (18+), acceptance of portal terms, acknowledgement of this notice and the separate request for read-only data access, including timestamps and the documented legal version. An existing date of birth can prevent activation by someone under 18; no identity-document or biometric check is currently performed.

The athlete account is limited to the individual’s permitted competition, test, body and target records, which remain stored under the coach’s Gold account. No other athlete’s data, group-wide confidential records or internal coach notes are shared. The coach is the controller for the underlying records, including establishing an Article 6 GDPR basis and any necessary Article 9 exception for health-related data; the operator processes coach-held records as set out in the data processing terms. Account authentication and invitation administration are processed by the platform operator for account security and service provision. Revoking portal access removes the account-to-record link but does not delete the coach’s original records. For rectification, access, erasure or objection please contact the relevant coach/controller or office@schwimmtrainer.at. No marketing consent is bundled into portal activation.

For access by a legal guardian, the coach records the contact email, guardian name, relationship, declaration that authority has been independently checked and date of that check. The invited adult confirms their age, parental authority and read-only access request using an expiring link and an email code. This is not an official identity or guardianship verification by the platform. Guardian access is restricted to the minor’s own trainer records and is blocked if that person reaches adulthood. The coach remains responsible for checking legal authority and appropriate lawful grounds for sharing sensitive performance and potentially health-related data (GDPR Articles 6 and 9).

Athlete-created motivational goal corridors are stored separately with the athlete user ID, permission ID, event, target date, boundaries and audit timestamps. They cannot change coach-defined goals or test data and are not disclosed through the coach workspace. When an invitation or personal account link is revoked or the athlete email is changed, the link is closed. Generated portal-only accounts with no remaining active permission or other services may be deactivated without silently deleting audit or legal records. Administrative searches may display the associated athlete or guardian name for user-account management.

15. Rights of data subjects and self-service deletion

Subject to the statutory requirements, data subjects have rights in particular to access, rectification, erasure, restriction of processing, data portability and objection. Consent may be withdrawn for the future insofar as processing is actually based on consent.

Registered users additionally have access to a technical self-service deletion function under “My account”. This removes the profile and disables/anonymises active user access, but does not replace the individual data-protection assessment of data that must continue to be retained because of legal obligations or permissible preservation of legal claims.

Privacy enquiries — particularly matters that go beyond technical account deletion — may be sent to office@schwimmtrainer.at.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna.

17. Automated decisions

schwimmtrainer.at currently makes no decisions producing legal or similarly significant effects based solely on automated processing of personal data.

Downloadable athlete performance reports

After checking an active athlete or legal guardian permission on every request, the platform compiles only the permitted individual coach-held data and the chosen categories and time period into an A4 landscape PDF using the existing local reporting engine. The report may contain health-related and para-sport data, test results, benchmarks and targets. Optionally selected private athlete targets are added separately without changing source records. The PDF is sent directly to the authenticated user with no-store response headers, and is not kept as a separate permanent file on the server. The browser/device and any recipients of subsequently shared reports may retain a local copy. Requests to access, correct or erase the underlying records continue to be governed by the controller’s obligations and data subject rights.

18. Changes

this Privacy Notice is updated when functions, service providers or the legal framework change. The current version is available on this page.