Privacy policy

The German version of this privacy policy is the legally binding one. This English version is for your convenience.

1. Who is responsible for your data

Baumert, Boerger & Lohmann GbR, known together as “Bewegungskollektiv Berlin”
Rotkäppchenstraße 35
12555 Berlin, Germany

Represented by Michael Baumert, Oscar Boerger and Clara Lohmann.
Phone: +49 171 2071788
Email: hey@bewegungskollektiv.de

We have not appointed a data protection officer because the law does not require one for us. For every question about your data and your rights, an email to hey@bewegungskollektiv.de is enough.

2. The short version

• Google Analytics only loads once you agree in the cookie banner. Before that, nothing goes to Google.
• We keep your cookie choice in your browser only, not on our side.
• What you write in the contact form is stored for six months and sent to us by email. You get a short confirmation, without the text of your message.
• For the newsletter you only need your email address. It only goes on our list at Resend once you click the link in our confirmation email. We do not count opens or clicks.
• The schedule is a widget from Eversports. Booking always happens at Eversports, never on this site.
• YouTube videos only load when you press play.
• Our fonts sit on our own server. There is no connection to Google Fonts.

3. Hosting and server logs

The website runs on Vercel. Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.

When you open a page, your browser sends technically necessary data to Vercel’s servers, mainly your IP address, date and time, the address you opened and your browser’s identifier. Vercel needs this to deliver the page and logs requests and errors. On our plan these logs are kept for 30 days at most. The site is served encrypted over HTTPS only.

Our website runs in Frankfurt am Main (EU), and the photos are stored with Vercel in Frankfurt as well (Vercel Blob). You load the photos through our own address (/api/media/…), so your browser does not connect to any other service for them.

The purpose is a secure, stable and fast website. The legal basis is our legitimate interest under Art. 6 (1) (f) GDPR. We have a data processing agreement with Vercel (Art. 28 GDPR). Vercel is a US company and may also process data in the USA, based on the EU-US Data Privacy Framework and, in addition, the European Commission’s standard contractual clauses.

4. Database

The content of the website and the messages from the contact form are stored in a Postgres database at Neon, Inc., USA, in the Frankfurt am Main region (EU). We have a data processing agreement with Neon. Where Neon processes data from the USA for operations and support, this is based on the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.

5. Cookie banner and what is stored in your browser

On your first visit our banner asks whether you allow Google Analytics. We store your choice in your browser’s local storage under the name bkb-consent-v1: whether you allow statistics, and when you chose. This is not a cookie, and it is not sent to us or anyone else. It means we do not have to ask you again on every visit.

The entry stays until you delete it in your browser. You can change your choice any time with “Cookie settings” at the bottom of every page.

The legal basis for storing your choice is § 25 (2) no. 2 TDDDG (strictly necessary) and Art. 6 (1) (f) GDPR: we want to respect your decision and be able to show that we do.

The website sets no cookies of its own for visitors. Only team members signed in to the admin area get a login cookie.

6. Statistics with Google Analytics

Only if you agree, we use Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Before you agree everything is set to “denied” (Google Consent Mode v2). Google’s script is not loaded and nothing is sent to Google.

After you agree your browser loads the script from www.googletagmanager.com. On every page view it sends the address and title of the page to Google. On top of that come a few events without any form content: a click on “trial class” or on a booking link to Eversports (text and target of the link), a click on a class in the schedule (time and name of the class), a newsletter sign-up and a sent contact message (only that it happened; never your email address or message). Google sets the cookies _ga and _ga_… to recognise your browser on your next visit and receives your IP address in the process. Advertising features always stay off: ad storage, ad user data and ad personalisation are permanently denied. Google Signals and data sharing with Google are switched off.

The purpose is to see which pages are read so we can improve the site. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

Withdrawing consent: switch statistics off again with “Cookie settings” at the bottom of every page. The site then stops sending anything to Google and deletes the Google Analytics cookies.

How long data is kept: Google Analytics keeps the data for 14 months. The cookies _ga and _ga_… expire after two years unless you delete them earlier or switch statistics off.
We have a data processing agreement with Google. Google may also process data in the USA, based on the EU-US Data Privacy Framework and, in addition, the European Commission’s standard contractual clauses.

7. Contact form

The contact form on the home page and on the contact page asks for your name, your email address, a subject to choose and your message. With the tick box you confirm that you have read this privacy policy. A hidden field keeps spam bots out: if a bot fills it in, we store nothing.

When you send the form:

• we store what you entered in our database (see section 4),
• we send it by email to hey@bewegungskollektiv.de so we can answer you,
• you get a short confirmation that your message arrived, at the email address you entered. It contains neither your name nor the text of your message.

The emails are sent through the service Resend (Plus Five Five, Inc., USA), via servers in the EU. We have a data processing agreement with Resend; where Resend processes data from the USA, this is based on the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.
Our mailbox hey@bewegungskollektiv.de is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany.

Our emails (including the newsletter confirmation, section 8) are designed like the website. When you open one, your email app loads images from our website: the logo and a background pattern, one version each for light and dark mode. The images are the same for everyone and carry no identifier; they do not tell us whether or when you open an email. As with every page view, our host Vercel receives your IP address in the process (see section 3). If your email app does not load images, the email works just the same.

The purpose is to answer your request. The legal basis is Art. 6 (1) (b) GDPR when it is about a booking or a class, otherwise our legitimate interest in answering requests under Art. 6 (1) (f) GDPR.

How long messages are kept: the website deletes messages from the form automatically six months after they were sent.

If you reach us directly by email or phone, we use your details the same way: only to deal with your request.

8. Newsletter

For the newsletter you only need your email address. We add the language of the page (English or German) so the emails arrive in your language.

We use double opt-in. After you sign up, our website sends you an email with a confirmation link through Resend (see section 7). The link works for seven days. It contains, encrypted, your address, the language, the time of the sign-up and the IP address it came from; we store none of this in our database. Only when you click the link does our server add your address and the language to our newsletter list at Resend. Without the click you are not on the list; Resend then knows your address only from sending the confirmation email.

As proof of your consent, we keep the time and IP address of the sign-up and of the confirmation with your contact at Resend, and where the sign-up came from. The legal basis for this is our legitimate interest in being able to prove the consent (Art. 6 (1) (f) GDPR).

We manage the list and send the newsletter with Resend (Plus Five Five, Inc., USA, see section 7). Resend sends the emails via servers in the EU and stores the contact list in the USA. We have a data processing agreement with Resend; the transfer is based on the EU-US Data Privacy Framework and, in addition, the European Commission’s standard contractual clauses.

We do not count whether you open our emails or click links in them: Resend’s open and click tracking is switched off for our domain.

The legal basis is your consent under Art. 6 (1) (a) GDPR. You can unsubscribe any time, with the link in every email or by writing to us. After you unsubscribe, your address stays at Resend marked as “unsubscribed” so that we do not write to you again by mistake (legitimate interest, Art. 6 (1) (f) GDPR). If you ask us, we delete it completely.

9. Schedule and booking via Eversports

We manage our classes, times and prices at Eversports. The provider is Eversports GmbH, Heiligenstädter Straße 31/2/44, 1190 Vienna, Austria.

Schedule widget: on the “Schedule & prices” page and on the pages of individual classes a widget from Eversports shows the current schedule. As soon as you scroll near the schedule, your browser loads a script from widget-static.eversports.io. The widget fetches the schedule from graphql-widget-master.production.eversports.cloud and the trainers’ photos from files.eversports.com. Eversports receives your IP address and technical data about your browser. In our test the widget set no cookies and stored nothing in your browser. On all other pages nothing from Eversports loads.

The purpose is to show you the current schedule you want to look at. The legal basis is our legitimate interest under Art. 6 (1) (f) GDPR.

Booking: every booking button leads to Eversports. You book and pay there, under Eversports’ privacy policy: https://www.eversports.at/h/privacy. Eversports processes the data your booking needs on our behalf, for example name, contact details, bookings and payment data. The legal basis is Art. 6 (1) (b) GDPR. We have a data processing agreement with Eversports.

10. YouTube videos

On the home page and the Summer Camp page we show videos from YouTube. Until you press play you only see a photo of ours. Nothing is loaded from YouTube.

Only after your click does the video open in YouTube’s privacy-enhanced mode from www.youtube-nocookie.com. Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) then receives your IP address and other technical data. YouTube may store information in your browser and process data in the USA as well. More: https://policies.google.com/privacy.

The legal basis is your consent, which you give by pressing play (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

11. Fonts

The website’s fonts (Archivo and Clash Display) sit on our own server. Your browser loads them from our address, not from Google Fonts or any other service.

12. Links to other services and our groups

We link to Instagram, Facebook, YouTube, our WhatsApp community, Google Maps and Google reviews, and to Eversports. These are plain links: only when you click one does your browser connect to that service, and its privacy policy applies.

If you join our WhatsApp community, we and the other members see your name and phone number. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to WhatsApp, it shares data with its parent company Meta in the USA. Members also have a group on Signal (Signal Technology Foundation, USA); there we and the other members see your profile and your phone number as far as you share them. In both cases the legal basis is your consent by joining (Art. 6 (1) (a) GDPR). You can leave the groups at any time.

13. How long we keep data

Unless a section above says otherwise, we delete your data as soon as we no longer need it for its purpose and no legal retention duty applies, for example under tax law.

14. Your rights

You have the right to:

• access the data we process about you (Art. 15 GDPR)
• have wrong data corrected (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw your consent at any time, with effect for the future (Art. 7 (3) GDPR)

Objection (Art. 21 GDPR): where we process data based on our legitimate interest (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to advertising, including the newsletter, at any time without giving a reason.

For all of this, an email to hey@bewegungskollektiv.de is enough.

15. Complaints to the supervisory authority

You can complain to a data protection supervisory authority. The one responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, https://www.datenschutz-berlin.de.

16. Version

28 October 2026