Privacy Policy
Last updated: September 2026
This English version is provided for your convenience. In case of any discrepancy, the German version of this privacy policy prevails.
1. Privacy at a glance
In accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), this privacy policy explains which personal data we process when you visit our website mam-pt.pro, contact us or, as a client, use our protected client area, for which purposes we do so and which rights you have.
Personal data is any information that can be used to identify you personally, such as your name, email address, IP address or training and test results.
In short: the public website uses no analytics or advertising tools and no tracking cookies. Data you send us through our forms is used solely to handle your request. In the client area, we process health-related data only with your explicit consent.
2. Controller
The controller responsible for data processing on this website and in the client area is:
MAM Personal Training
Owner: Marc-André Muckhoff
Falkstr. 105
60487 Frankfurt am Main
Germany
Phone: +49 (0) 152 22510288
Email: frankfurt@mam-pt.com
We have not appointed a data protection officer, as we are not legally required to do so. For any questions about data protection, please contact us directly using the details above.
3. Legal bases
We process personal data on the following legal bases. For each processing activity, we state which one applies.
- Art. 6(1)(a) GDPR: your consent.
- Art. 6(1)(b) GDPR: performance of a contract with you, or steps taken at your request prior to entering into a contract.
- Art. 6(1)(c) GDPR: compliance with a legal obligation, such as retention obligations under commercial and tax law.
- Art. 6(1)(f) GDPR: our legitimate interests, such as the secure and stable operation of the website, unless your interests override them.
- Art. 9(2)(a) GDPR: your explicit consent to the processing of health data.
- Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act): storing and accessing information on your device where this is strictly necessary for a service you have explicitly requested.
4. Hosting and server log files
This website and our client area run on Firebase App Hosting, a service of Google Cloud Platform. For users in the European Economic Area, the provider is:
Google Ireland Limited
Gordon House, Barrow Street
Dublin 4, Ireland
Google operates data centres worldwide, so processing outside the EU cannot be ruled out; it is covered by the safeguards described below.
Each time you access the website, the server automatically processes information transmitted by your browser: IP address, date and time of access, page requested, amount of data transferred, referrer URL, browser type and version, and operating system. This data is technically required to deliver the website to you and also serves security purposes, such as defending against attacks and analysing errors.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website reliably, securely and without errors. Log data is stored in Google Cloud Logging and deleted automatically after 30 days, unless it is needed for longer to investigate a specific security incident.
We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR (Cloud Data Processing Addendum). Google LLC in the USA is certified under the EU-U.S. Data Privacy Framework; the European Commission’s Standard Contractual Clauses apply in addition. More information: https://cloud.google.com/terms/data-processing-addendum and https://policies.google.com/privacy.
5. SSL/TLS encryption
For security reasons, this website uses TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar. This prevents third parties from reading data you send to us, such as form entries or login details.
7. Fonts
The fonts used on this website are hosted locally on our server. No connection to Google Fonts or any other font provider is made when you visit the website.
8. Contact form and seminar enquiry
When you write to us using the contact form or the seminar enquiry form, we process the details you enter:
- Contact form: name, email address, optionally phone number, selected topic and your message.
- Seminar enquiry: requested seminar, name, email address, phone number, number of participants, preferred time frame, professional background and optionally your message.
We use this data solely to answer your enquiry and, where applicable, to arrange training or a seminar with you. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in responding to enquiries addressed to us.
After you submit the form, our server forwards your details to our mailbox by encrypted email (SMTP). The mailbox is provided by Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18), purchased through domainfactory GmbH; a data processing agreement with Microsoft is in place (Microsoft Products and Services Data Protection Addendum). Microsoft Corporation in the USA is certified under the EU-U.S. Data Privacy Framework. The details are not additionally stored in a database.
Please do not send us detailed health information via the forms. If you nevertheless voluntarily share health details, for example about an injury, we process them on the basis of your explicit consent (Art. 9(2)(a) GDPR) solely to answer your enquiry. You can withdraw this consent at any time.
We delete your enquiry once it has been fully dealt with and no contract results from it, at the latest after twelve months. If a contract is concluded, the section “Storage period” applies. Statutory retention obligations remain unaffected.
9. Contact by email or phone
If you contact us by email or phone, we process your enquiry, including the data you provide (such as your name, phone number, email address and the content of your enquiry), in order to deal with your request. The legal bases and storage period are the same as for the contact form.
10. Client area and performance diagnostics
To support our clients, we operate a protected area in which we manage training groups, carry out and evaluate performance diagnostics and make your results available to you. Access is only possible for people we have invited.
Which data we process
- Account and master data: name, email address, user ID, role (client or trainer), assigned training group and details we need to support you, such as date of birth, gender, sport, playing position and shirt number.
- Sign-in data: time of registration and last sign-in, and the IP address used when signing in. Trainers sign in with email and password; we never store passwords in plain text, Firebase Authentication only processes them as hashes. Clients sign in via a link that we send to their email address.
- Diagnostics and training data: test and measurement results (such as sprint, jump, strength and endurance values), evaluations and comparisons calculated from them, appointments and notes from your trainer.
- Health data: information on injuries, complaints, physical capacity and body measurements, insofar as this is required for safe training or your return to competition.
Purposes and legal bases
We process this data to perform our training and coaching contract with you, to document your performance development and to give you access to your results. The legal basis is Art. 6(1)(b) GDPR.
Health data belongs to the special categories of personal data. We only process it if you have given your explicit consent in advance (Art. 9(2)(a) and Art. 6(1)(a) GDPR). Consent is voluntary. You can withdraw it at any time with effect for the future, for example by email to frankfurt@mam-pt.com. Without your consent we store no health information; in that case, we may only be able to tailor your training to your health situation to a limited extent. For minors under the age of 16, we obtain the consent of their parents or legal guardians.
Who has access
Only Marc-André Muckhoff and the trainers who look after you or your training group have access to your data. You yourself only see your own results that we have released to you. Access rights are technically enforced through roles and database security rules. We only share data with clubs, employers or other third parties if you have explicitly agreed.
Services used
We use Firebase Authentication for sign-in and Cloud Firestore to store the data. Both services are operated by Google Ireland Limited as our processor; the agreements and safeguards described under “Hosting” apply, in particular for any transfers to the USA. Data is encrypted in transit and at rest.
Storage period
We store client area data for as long as we look after you. When our cooperation ends, we delete your account and your diagnostics and health data within three months, unless you ask us to keep your results for a later return. If you withdraw your consent, we delete the health data concerned without undue delay. Documents relevant for invoicing are retained in accordance with statutory periods.
No automated decision-making within the meaning of Art. 22 GDPR takes place. Although the diagnostics calculate evaluations automatically, decisions about your training are always made by your trainer.
11. Links to social networks
Our website links to our profiles on Instagram, Facebook, LinkedIn and YouTube. These are plain links, not embedded plugins, so no data is transferred to these networks when you visit our website. Only when you click a link are you taken to the respective provider’s site, which is subject to that provider’s own privacy policy.
12. Recipients and transfers to third countries
We only pass on your data where this is necessary for the purposes stated, where we are legally obliged to do so or where you have consented. Recipients are in particular our processors (Google for hosting, sign-in and database, and Microsoft for our mailbox) and, within the scope of legal obligations, our tax advisers and public authorities.
Where data is transferred to countries outside the European Economic Area, this only takes place on the basis of an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework for certified companies) or appropriate safeguards under Art. 46 GDPR, such as the Standard Contractual Clauses.
13. Storage period
Unless a more specific period is stated in this policy, we only store personal data for as long as is necessary for the respective purpose. We then delete it, unless statutory retention obligations prevent this. Under German commercial and tax law, we keep business correspondence for six years and accounting records such as invoices for eight years (Section 257 HGB, Section 147 AO). In these cases, we restrict processing and delete the data once the period has expired.
14. Your rights
You have the following rights regarding your personal data at any time:
- Access to the data stored about you (Art. 15 GDPR).
- Rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR).
- Erasure of your data, unless we are obliged to retain it (Art. 17 GDPR).
- Restriction of processing (Art. 18 GDPR).
- Data portability: receiving your data, such as your test results, in a structured, commonly used and machine-readable format (Art. 20 GDPR).
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.
Right to object under Art. 21 GDPR
Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
To exercise your rights, an informal message to frankfurt@mam-pt.com is sufficient.
Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:
The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
https://datenschutz.hessen.de
15. Obligation to provide data
You are under no legal or contractual obligation to provide us with personal data. However, we cannot process your enquiry without the details marked as required in the forms, and we cannot provide you with the client area without account and diagnostics data.
16. Changes to this privacy policy
We update this privacy policy when our website, our services or the legal situation change. The current version published here always applies.