Privacy Policy

Data Controller

Website delivery

The website is technically delivered through Amazon Web Services using Amazon S3 and Amazon CloudFront. When the site is accessed, technically required server and CDN log data such as the IP address, time, requested URL, referrer, browser and operating-system information may be processed.

Processing is necessary to deliver the website securely, reliably and efficiently and is based on our legitimate interests under Article 6(1)(f) GDPR. Technical log data is processed only for as long as required for operation, security and compliance with legal obligations.

The document-download and newsletter-confirmation functions do not use cookies and do not store data in Local Storage or Session Storage. We do not use marketing or analytics trackers.

Contact form

When the contact form is submitted, the data entered is transmitted to us through an Amazon API Gateway endpoint in the AWS eu-central-1 region and processed to handle your enquiry.

The legal basis is Article 6(1)(b) GDPR where your enquiry concerns pre-contractual measures or a contract. In other cases, processing is based on our legitimate interest in responding to business enquiries under Article 6(1)(f) GDPR.

Product-document downloads

To provide the product document you select, we process your email address, optional first and last name, the selected document and language version, the website language, the active privacy-notice version and technical transaction and timestamp data. A download request alone is not used for sales or newsletter purposes.

Processing to fulfil your download request is based on Article 6(1)(b) GDPR. Proportionate measures that protect the form and delivery service against automated or abusive use are based on Article 6(1)(f) GDPR.

Download requests are deleted after 30 days. Technical idempotency data used to prevent unintended duplicate processing is deleted after one day.

The download service is operated with Scaleway S.A.S. in the fr-par region in France. Processing is governed by the existing data-processing agreement with Scaleway and the subprocessors documented for that agreement.

Newsletter and Double Opt-in

Consent to the Gymlock newsletter is voluntary, initially unchecked and not required for a document download. With your consent, we may email you information about products, features, use cases, events and company news no more than once per month.

Processing is based on your consent under Article 6(1)(a) GDPR and the requirements of Section 7 of the German Act Against Unfair Competition (UWG). After registration, we send a transactional confirmation email only. Your subscription is completed only if you confirm the link in that email within 48 hours. No marketing messages are sent without confirmation.

Unconfirmed newsletter records and tokens are deleted after seven days. Confirmed records are processed until you withdraw your consent. Evidence of consent, confirmation and withdrawal is retained for three years after withdrawal and then deleted.

Newsletter data and lifecycle evidence are processed with Scaleway S.A.S. in the fr-par region in France. Scaleway Transactional Email is used solely for Double Opt-in and other operational messages, not to send marketing newsletters. Before newsletter distribution begins, any provider used for that purpose will undergo a data-protection review and this policy will be updated where necessary.

You may withdraw your consent at any time with future effect by using the unsubscribe link in a newsletter email or by emailing info@gymlock.fit. Withdrawal does not affect earlier document downloads or the lawfulness of processing before the withdrawal.

Recipients and processors

Personal data is available only to the teams at mediomicX GmbH responsible for the relevant process and the processors technically required for it. We use Amazon Web Services for the website and contact form, and Scaleway S.A.S. for document downloads and the newsletter lifecycle.

We do not share personal data for third parties' own advertising purposes. Other recipients are involved only where permitted or required by law or where you have consented.

Your rights

Subject to the statutory requirements, you have the rights of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with future effect. You also have the right to lodge a complaint with a competent data-protection supervisory authority.

We generally acknowledge data-subject requests within three working days. Our internal resolution target is 14 days; the applicable statutory deadline, generally no more than one month, remains authoritative.

info@gymlock.fit