Privacy Policy

1) Introduction and contact details of the controller

1.1 We are delighted that you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data is any data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Frank Sticht, Frank Sticht - Flanko, Meißenwies 10, 66123 Saarbrücken, Germany, phone: 017620962825, email: kontakt@flanko.de. The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data collection when you visit our website

2.1 When you use our website for information purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to the server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

• Our visited website
• Date and time of access
• Amount of data sent in bytes
• Source/referrer from which you came to the page
• Browser used
• Operating system used
• IP address used (if applicable: in anonymised form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to us), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the "https://" prefix and the lock symbol in your browser bar.

3) Hosting & content delivery network

3.1 Vercel

For hosting our website and displaying the page content, we use the system of the following provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA

All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

3.2 Vercel

We use a content delivery network of the following provider: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.

This service enables us to deliver large media files such as graphics, page content or scripts faster via a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website in accordance with Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

3.3 Course videos via Mux

For our course videos we use Mux, Inc., USA. When a video or preview image is loaded, Mux receives technical access data, in particular your IP address, browser information and details of the content accessed. An approximate location can be derived from this. Processing serves video delivery and its security. The legal basis is Art. 6(1)(b) GDPR for providing your course and Art. 6(1)(f) GDPR for protection against unauthorised access.

Additional usage analysis via Mux Data is disabled in the player of this course. We do not transmit any email address, account identifier or answers to course questions to Mux.

Mux also processes data in the USA. The terms of use incorporate the data processing agreement. Its section 10 describes the EU-US Data Privacy Framework and supplementary standard contractual clauses as transfer mechanisms. Access data is processed to provide and secure the service; longer retention may be necessary to comply with legal obligations. Further information: Mux privacy information.

4) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after you close your browser (so-called "session cookies"); others remain on your device for longer and allow page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage period in the overview of the cookie settings of your web browser.

If personal data is also processed by individual cookies used by us, processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, in accordance with Art. 6(1)(a) GDPR if consent has been given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the page visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them or exclude the acceptance of cookies for certain cases or in general.

Please note that the functionality of our website may be limited if cookies are not accepted.

5) Contacting us

When you contact us (e.g. via contact form or email), personal data is processed exclusively for the purpose of handling and answering your enquiry and only to the extent necessary for this.

The legal basis for processing this data is our legitimate interest in answering your enquiry in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, Art. 6(1)(b) GDPR is an additional legal basis for the processing. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided there are no statutory retention obligations to the contrary.

6) Data processing when opening a customer account

In accordance with Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent required in each case if you provide it to us when opening a customer account. You can see which data is required to open an account in the input mask of the corresponding form on our website.

You can delete your customer account at any time by sending a message to the controller's address given above. After your customer account has been deleted, your data will be deleted provided that all contracts concluded via it have been fully processed, there are no statutory retention periods to the contrary and we have no continuing legitimate interest in further storage.

6.1 Learning progress in the course

So that you can continue your course across devices, we store completed lessons, bookmarks, the last lesson opened, and your answers and submission status for course questions in your account. This data is stored in our database at Supabase (see section 11.2). It is not accessible to other students and is not transmitted to Mux.

The legal basis is Art. 6(1)(b) GDPR. We store your learning progress for the use of the course as long as your customer account exists. When the account is deleted, this course data is deleted from the active database. You can contact the address given above for information or deletion.

7) Use of customer data for direct marketing

7.1 Subscribing to our email newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing further data is voluntary and is used to address you personally. For sending the newsletter we use the so-called double opt-in procedure, which ensures that you only receive newsletters once you have expressly confirmed your consent to receive the newsletter by clicking a verification link sent to the email address provided.

When subscribing, providing your Instagram name is required. We use this information exclusively to be able to contact you personally (e.g. by direct message on Instagram) and to better assign your enquiry. Signing up is not possible without an Instagram name. The legal basis is your consent in accordance with Art. 6(1)(a) GDPR.

If you claim a free content offer via our site (e.g. a PDF such as the Mastering Chain, the Mixing Cheatsheet or the Sound Design Workshop, or a video module such as Kick & Bass from Flanko Masterclass), subscribing to our producer emails is part of this sign-up; we point this out transparently in the respective form. You will usually receive a requested PDF immediately by email. For video workshops and course modules (e.g. chapter 01 of the Sound Design Workshop or module 01 Kick & Bass), you will receive access to the respective freebie module in the members' area after confirming your email. We only send further emails after you have verified your email address via the confirmation link (double opt-in). You can unsubscribe at any time.

When registering for the Sound Design Workshop via the detailed form, your Instagram name is mandatory. We use it to be able to contact you personally (e.g. by direct message). Without a handle we cannot assign the requested service there. The legal basis is Art. 6(1)(b) GDPR or your consent in accordance with Art. 6(1)(a) GDPR. For the Kick-Bass module and other simple module magnets, email and an optional first name are sufficient; Instagram is not mandatory there.

By activating the confirmation link, you give us your consent to the use of your personal data in accordance with Art. 6(1)(a) GDPR. In doing so, we store your IP address registered by your Internet service provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your email address at a later date. The data we collect when you subscribe to the newsletter is used strictly for its intended purpose.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller named at the beginning. After unsubscribing, your email address will be deleted from our newsletter distribution list without undue delay, unless you have expressly consented to further use of your data or we reserve the right to use your data in a way that goes beyond this, which is permitted by law and about which we inform you in this policy.

7.2 Sending the email newsletter to existing customers

If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services to those already purchased from our range by email. In accordance with Section 7(3) UWG (German Act against Unfair Competition), we do not need to obtain separate consent from you for this. In this respect, data processing is carried out solely on the basis of our legitimate interest in personalised direct marketing in accordance with Art. 6(1)(f) GDPR. If you initially objected to the use of your email address for this purpose, we will not send you any emails.

You are entitled to object to the use of your email address for the aforementioned advertising purpose at any time with effect for the future by notifying the controller named at the beginning. You will only incur transmission costs at the basic rates for this. Upon receipt of your objection, the use of your email address for advertising purposes will cease without undue delay.

7.3 Our email newsletters are sent via this provider: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.

On the basis of your express consent and our legitimate interest in effective, secure and verifiable newsletter delivery, we pass on the data you provided when subscribing to the newsletter to this provider so that it can send the newsletter on our behalf.

Subject to your express consent in accordance with Art. 6(1)(a) GDPR, the provider also carries out a statistical analysis of the success of newsletter campaigns using web beacons or tracking pixels in the emails sent, which can measure open rates and specific interactions with the content of the newsletter. Device information (e.g. time of access, IP address, browser type and operating system) is also collected and analysed, but not merged with other data sets.

You can withdraw your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider that protects our site visitors' data and prohibits disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

7.4 Free downloads (lead magnets / zip packages)

If you claim a free download package via our site (e.g. the Low-End Fix), we collect your first name and email address in order to deliver the requested download to you. The legal basis is Art. 6(1)(b) GDPR (fulfilment of your request). The file is behind a time-limited download link and is not publicly indexed. Delivery is handled by Resend (see section 7.3). You can stop further emails at any time via the unsubscribe link. Your data is not passed on or sold.

8) Data processing for order processing

8.1 Insofar as necessary for processing the contract for delivery and payment purposes, the personal data we collect will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6(1)(b) GDPR.

If, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact details you provided when ordering (name, address, email address) in order to inform you personally, within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR, via an appropriate communication channel (e.g. by post or email) about upcoming updates within the statutory period. Your contact details are used strictly for the purpose of notifications about updates owed by us and are only processed by us to the extent necessary for the respective information.

To process your order, we also work with the following service provider(s), who support us in whole or in part in performing concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

8.2 Use of payment service providers

- Stripe

One or more online payment methods of the following provider are available on this website: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

If you select a payment method of the provider for which you pay in advance (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider in accordance with Art. 6(1)(b) GDPR. In this case, your data is passed on exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this.

If you select a payment method for which the provider makes an advance payment (e.g. purchase on account, instalment purchase or direct debit), you will also be asked to provide certain personal data during the ordering process (first and last name, street, house number, postcode, city, date of birth, email address, telephone number, and if applicable data on an alternative means of payment).

In order to safeguard our legitimate interest in determining the solvency of our customers, we forward this data to the provider for the purpose of a credit check in accordance with Art. 6(1)(f) GDPR. On the basis of the personal data you have provided and other data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment option you have selected can be granted with regard to payment and/or default risks.

The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Address data, among other things but not exclusively, is included in the calculation of the score values.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data if this is necessary for contractual payment processing.

8.3 Electronic cancellation option for continuing obligations with consumers

Consumers who have entered into contracts for continuing obligations subject to a fee (e.g. subscription contracts) on this website have the option of terminating them via an electronic button in accordance with the applicable notice periods.

Pressing the button leads to a confirmation page on which the consumer can provide further details about the termination, identify themselves clearly and then declare their termination electronically.

The collection of personal data and its transmission to us is carried out in accordance with Art. 6(1)(b) GDPR and only to the extent necessary for the proper processing of the termination. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm receipt of the notice of termination and the termination date electronically in text form. A further legal basis for the processing is Art. 6(1)(c) GDPR. We are legally obliged to provide an electronic termination option for consumer contracts for continuing obligations subject to a fee concluded by electronic means.

9) Sending transactional emails

Resend

For sending transactional emails (e.g. order and booking confirmations, confirmations of receipt of termination, session reminders, service notifications, notices about contract updates), we use the service of the following provider: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.

As part of sending, personal data (in particular email address, name and the content of the respective message) is transmitted to the provider. The legal basis for the processing is Art. 6(1)(b) GDPR (contract processing or pre-contractual measures) or Art. 6(1)(c) GDPR insofar as sending serves to fulfil a legal obligation (e.g. confirmation of receipt of termination in accordance with Section 312k(4) BGB), or Art. 6(1)(f) GDPR (legitimate interest in reliable, secure and verifiable communication with our customers).

We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

10) Retargeting/remarketing and conversion tracking

Meta Pixel with advanced matching

Within our online offering we use the "Meta Pixel" service in advanced matching mode from the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta").

If you click on an advertisement placed by us on Facebook or Instagram, "Meta Pixel" adds a parameter to the URL of our linked page. After the redirect, this URL parameter is entered into your browser by a cookie set by our linked page itself. In addition, this cookie records specific customer data such as your email address, which we collect on our website linked to the Facebook or Instagram ad during processes such as purchases, account logins or registrations (advanced matching). The cookie is then read and enables the data, including your specific customer data, to be transmitted to Meta.

We use "Meta Pixel" with advanced matching to make our advertisements ("ads") on Facebook and/or Instagram more effective and to ensure that they match your interests or have certain characteristics (e.g. interests in certain topics or products determined on the basis of the websites visited) that we transmit to Meta (so-called "custom audiences").

We also analyse the effectiveness of our advertisements by tracking whether users were redirected to our website after clicking on an advertisement (conversion). Compared to the standard version of "Meta Pixel", the advanced matching function helps us to better measure the effectiveness of our advertising campaigns by recording more attributed conversions.

All transmitted data is stored and processed by Meta so that it can be assigned to the respective user profile and Meta can use the data for its own advertising purposes in accordance with Meta's data policy (https://www.facebook.com/about/privacy/). The data may enable Meta and its partners to place advertisements on and off Facebook.

All of the processing described above, in particular the setting of cookies for reading information on the device used, will only be carried out if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website. Without this consent, the Meta Pixel is not loaded.

Meta Platforms Ireland Limited processes the data transmitted via the Meta Pixel for its own advertising purposes and decides on the purposes and means in this respect. Meta does not act as a classic processor. Insofar as the measurement of advertising success is designed jointly, Meta may be a joint controller within the meaning of Art. 26 GDPR; otherwise Meta is an independent controller. The Meta Business Tools Terms and Meta's data policy apply.

The information generated by Meta is usually transmitted to and stored on a Meta server; in this context, data may also be transferred to servers of Meta Platforms Inc. in the USA.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

Meta Conversions API (CAPI)

In addition to the Meta Pixel, we use the "Meta Conversions API" (CAPI) of the same provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta").

The CAPI is a server-side interface. It allows us to transmit conversion events (e.g. newsletter sign-up, track submission, completed purchase) directly from our server to Meta. Personal data such as email address, name, telephone number and IP address is irreversibly hashed with SHA-256 before transmission (irreversible pseudonymisation) before being sent to Meta. Meta uses the hash values exclusively for matching with user profiles stored there in order to reliably measure advertising success even when browser cookies (Pixel) are blocked.

Unlike the Meta Pixel, the CAPI does not run in the browser but on our server. It is subject to the same consent via the cookie consent tool: without your express consent in accordance with Art. 6(1)(a) GDPR, no CAPI events are triggered. With the CAPI, too, Meta is not our processor but — as with the Meta Pixel — an independent controller or, insofar as the measurement of advertising success is designed jointly, a joint controller.

You can withdraw your consent at any time with effect for the future by deactivating the corresponding service in the cookie consent tool. A withdrawal stops both Pixel and CAPI events.

The hash values transmitted with the CAPI are stored by Meta under the same processing conditions as Pixel data (see above). Here, too, the provider has joined the EU-US Data Privacy Framework.

Google Ads conversion upload (Enhanced Conversions)

In addition, we use the server-side conversion upload ("Enhanced Conversions for Leads") of the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

If you click on an advertisement placed by us on Google, Google appends a click identifier ("GCLID") to the target URL. We store this and, in the event of a later conversion event (e.g. newsletter sign-up, registration, completed purchase), transmit it together with the time and, if applicable, the order value directly from our server to Google. This allows us to measure the effectiveness of our Google advertising campaigns even if browser cookies are blocked.

The upload runs server-side and is subject to the same consent via the cookie consent tool: without your express consent in accordance with Art. 6(1)(a) GDPR, no GCLID is stored and no conversion event is transmitted to Google. You can withdraw your consent at any time with effect for the future by deactivating the corresponding service in the cookie consent tool.

As part of this processing, data may be transmitted to Google LLC in the USA. For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission. Further information can be found at https://policies.google.com/privacy.

11) Site functionalities

11.1 YouTube

This website uses plugins to display and play videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC., USA

When you visit a page of our website that contains such a plugin, your browser establishes a direct connection to the provider's servers in order to load the plugin. Certain information, including your IP address, is transmitted to the provider.

If playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behaviour, compile playback statistics and prevent abusive behaviour.

If you are logged into a user account with the provider during your visit, your data will be assigned directly to your account when you click on a video. If you do not want this assignment to your account, you must log out before pressing the play button.

All of the aforementioned processing, in particular the setting of cookies for reading information on the device used, only takes place if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service via the "cookie consent tool" provided on the website.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

11.2 Supabase

On our website we use the service of the following provider to verify registration and login attempts for protected areas of the site: Supabase, Inc., 548 Market St, San Francisco, CA 94104, USA.

Exclusively on the basis of our legitimate interest in maintaining the structural and data security of our website, your login data (email, user name and password) is transmitted to the provider for authentication in accordance with Art. 6(1)(f) GDPR in order to decide whether to approve the login attempt.

We have concluded a data processing agreement with the provider that protects our site visitors' data and prohibits disclosure to third parties.

For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

11.3 Fonts

The fonts on this website are delivered from our own servers. During normal page visits, no connection is established to a Google font service and no cookie is set for this purpose.

11.4 Zoom

For conducting online meetings, video conferences and/or webinars, we use this provider: Zoom Video Communications Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA.

The provider processes various data, the scope of which depends on the data you provide before or during participation in an online meeting, video conference or webinar. Your data as a communication participant is processed and stored on the provider's servers. This may include in particular your registration data (name, email address, telephone number (optional) and password) and session data (topic, participant IP address, device information, description (optional)).

In addition, video and audio contributions of participants as well as voice input in chats may be processed. Art. 6(1)(b) GDPR serves as the legal basis for the processing of personal data that is necessary for the performance of a contract with you (this also applies to processing operations that are necessary for carrying out pre-contractual measures). If you have given us consent to process your data, processing is carried out on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. Otherwise, the legal basis for data processing when conducting online meetings, video conferences or webinars is our legitimate interest in accordance with Art. 6(1)(f) GDPR in the effective conduct of the online meeting, webinar or video conference.

We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

11.5 Cal.com

For booking introductory calls, 1:1 studio sessions and co-production requests, we use the service of the following provider: Cal.com, Inc., 2261 Market Street #4493, San Francisco, CA 94114, USA.

When you book an appointment, your name, email address, selected appointment and optional details (e.g. telephone number, question about the appointment) are transmitted to the provider and processed on its servers. This data is used exclusively for coordinating appointments, sending appointment confirmations and reminders and synchronising with our calendar.

The legal basis for the processing is Art. 6(1)(b) GDPR (contract processing or pre-contractual measures), as booking an appointment is a prerequisite for providing the requested service.

The data is stored by the provider until 30 days after the end of the booked appointment and then deleted or anonymised. Longer storage only takes place if required by statutory retention obligations.

We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

Further information can be found in the provider's privacy notice at https://cal.com/privacy.

11.6 Push notifications

If you activate push notifications in your account, we store a web push subscription: your browser's push endpoint, the subscription's public keys, optionally a shortened browser identifier (user agent) and the link to your account. The purpose is to inform you about new messages on this device. For administration accounts, operational notices may also be triggered, for example about new enquiries, bookings or payments. The function is voluntary.

The legal basis is your consent in accordance with Art. 6(1)(a) GDPR. It is given when you allow your browser's prompt and switch on notifications in your account. You can switch them off at any time with effect for the future: via "Off" in the account settings or in the dashboard, or via the permission in your browser or operating system. We then delete the stored subscription. Subscriptions are also removed when the account is deleted. A maximum of five devices are stored per account.

Technical delivery runs via the push service of your browser or operating system. Only the endpoints of Google (Firebase Cloud Messaging), Apple, Mozilla and Microsoft are permitted. The push endpoint and connection data may be processed by this service. The content of the message is sent to the device in encrypted form. These services deliver the notification you requested; they are not our processors for advertising. The subscriptions themselves are stored in our database at Supabase (section 11.2).

12) Tools and miscellaneous

12.1 Use of AI software (Google Gemini)

To provide certain functions of our platform, we use the Gemini AI interface of the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transmitted to Google LLC, USA.

We use Gemini for these purposes:

• automatic translation of community posts and comments into the display language you have selected; the original remains stored with us;
• automatic analysis of tracks you submit via the track feedback form (the track and the information provided with it, such as goal or uncertainty);
• on request, the translation of delivered coach feedback when you trigger the translate function.

Before these functions, we point out in the interface that an AI processes the content, the result may be inaccurate and is not feedback from a human coach. We do not use a chatbot for this.

The legal basis is Art. 6(1)(b) GDPR insofar as the processing is part of providing the function you requested (track feedback, community, translation of feedback). Otherwise, we base the multilingual display on Art. 6(1)(f) GDPR (legitimate interest in an understandable platform).

According to Google's specifications for the paid Gemini API, transmitted prompts, files and responses are not used to train the models. This only applies to this paid interface, not to free use.

For data transfers to the USA, Google has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission. In addition, we base transfers on standard contractual clauses of the European Commission. We have concluded a data processing agreement with the provider that ensures the protection of your data and prohibits unauthorised disclosure to third parties.

12.2 Error monitoring (Sentry)

For error monitoring we use Sentry from the provider Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.

Basic error recording (error messages and technical stack traces, without session recording) serves the stability and security of the website. By default, we do not transmit any personal identifiers such as IP address or user agent. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable operation). This basic recording does not depend on your cookie consent.

Session Replay (a recording of session excerpts for troubleshooting) is only loaded if you consent to analytics cookies in the cookie consent tool. Without this consent, no replay is loaded, not even in the event of an error. The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by switching off analytics cookies in the cookie consent tool.

The ingest endpoint we have configured is located in the EU (ingest.de.sentry.io). The provider is based in the USA. For transfers to the USA, the provider has joined the EU-US Data Privacy Framework; standard contractual clauses also apply. We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

12.3 Vercel Web Analytics and Speed Insights

In addition to hosting (section 3), we use Vercel Web Analytics and Speed Insights from the provider Vercel Inc., USA. This allows us to see which pages are visited and how quickly they load. IP address and browser identifier may be transmitted to Vercel.

These two services are only loaded if you consent to analytics cookies in the cookie consent tool. The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. For transfers to the USA, the provider has joined the EU-US Data Privacy Framework; standard contractual clauses also apply. We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

12.4 Cookie consent tool

This website uses its own cookie consent tool to obtain effective user consent for cookies and cookie-based applications that require consent. It is displayed to you when you visit the page in the form of an interactive user interface on which you can give consent for analytics and advertising. Services requiring consent (Meta Pixel and Meta Conversions API, Vercel Web Analytics and Speed Insights, Sentry Session Replay) are only loaded if you have agreed.

The tool stores your selection locally in your browser (local storage and a necessary cookie called flanko_consent). No external consent provider is integrated. As a rule, no personal user data is transmitted to third parties.

If, in individual cases, personal data is processed for the purpose of storing your selection (such as the IP address in the server log files of the page visit), this is done in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant consent management.

A further legal basis is Art. 6(1)(c) GDPR. We are obliged to make the use of technically unnecessary cookies dependent on your consent.

You can reopen and change the settings at any time via the cookie symbol on the website.

13) Rights of the data subject

13.1 Applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis us as the controller with regard to the processing of your personal data, whereby reference is made to the cited legal basis for the respective conditions of exercise:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw consent given pursuant to Art. 7(3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

13.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

14) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and — where relevant — additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

When personal data is processed on the basis of express consent in accordance with Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

If there are statutory retention periods for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data will be routinely deleted after the retention periods have expired, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in further storage.

When personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

When personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise stated in the other information in this policy on specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.