Coach HightowerDEENBack to home

This is a translation. The German version is legally binding. Read the German original (Datenschutzerklärung)

Privacy policy

How this website handles data.

1. Controller

The controller (Verantwortlicher) responsible for data processing on this website is:

Peter Ganz
Coach Hightower
Kaygasse 2
50676 Köln

Phone: +49 172 5688660
Email: info@coach-hightower.com

No data protection officer has been appointed, because the legal requirements for an appointment are not met.

2. Principle

This website is built so that as little data as possible is generated when you simply visit a page. There is no audience measurement. Content from third-party servers is only loaded on the order page, namely the Stripe payment form (see section 8). Beyond the server log files described below, no personal data is collected when you simply visit the site.

3. Hosting and server log files

The website is hosted by Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C, 81671 München. We have a contract with the provider as our processor (Auftragsverarbeiter) under Art. 28 GDPR (DSGVO).

When you visit a page, data that your browser transmits is automatically stored in server log files:

This data is technically necessary to deliver the page and to fend off attacks. The legal basis is our legitimate interest in the secure and trouble-free operation of the website under Art. 6(1)(f) GDPR. This data is not combined with other data. The hosting provider deletes the log data automatically as soon as the log data is no longer needed for the operation and security of the website. We do not store the log data beyond that.

The provider may also transfer data to its parent company Cloudflare, Inc. in the USA. The transfer is based on the European Commission's standard contractual clauses, which form part of the data processing agreement.

4. Encryption

The website is delivered only over a TLS-encrypted connection, which you can recognise by the "https://" in the address bar. This means third parties cannot read the data transmitted.

5. No cookies, no tracking

This website does not set any cookies of its own. In your browser's storage, we only save whether a notice has already been shown and, for the onboarding questionnaire, your draft until you submit the questionnaire. This information stays on your device. On the order page, Stripe may set technically necessary cookies to prevent fraud (see section 8). No analytics, statistics or marketing services are used, and no profiling takes place. Consent under § 25 TDDDG (the German Telecommunications and Digital Services Data Protection Act, Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) is therefore not required, including for the payment service provider's technically necessary cookies (§ 25(2) no. 2 TDDDG), which is why the site does not show a consent banner.

6. Fonts

All fonts used are delivered from our own server. When you visit the site, no connection is made to servers of Google or other providers, and no IP address is transmitted to them.

7. Links to social networks

The page footer contains links to our profiles on Instagram and Facebook. These are simple links, not embedded plugins. When you visit our site, no connection is made to these networks and no data is transmitted to them. Only when you click one of these links do you leave our website; from that point on, the privacy policy of the respective provider applies.

8. Ordering and payment via Stripe

When you order a coaching package, we process your name, your email address, your billing address, your mobile number if you provide one, the package booked, and the time and content of the consents you give in the order form. The legal basis is Art. 6(1)(b) GDPR (contract) and, for retention, Art. 6(1)(c) GDPR in conjunction with the retention obligations under commercial and tax law (up to 10 years).

We process payments through Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. The payment fields on the order page are loaded directly from Stripe (js.stripe.com). Your card or account details go directly to Stripe in encrypted form; we do not see them. Stripe also processes device and connection data such as your IP address to prevent fraud, and may set technically necessary cookies for this purpose. Stripe may transfer data to Stripe, Inc. in the USA; the basis for this transfer is the European Commission's standard contractual clauses and certification under the EU-US Data Privacy Framework. More information: stripe.com/de/privacy. The payment form is only loaded when you move on to your details on the order page.

Before paying, you sign the contract electronically, either with your finger or the mouse or by typing your name. We store the signed contract as a PDF together with the time, IP address and a checksum, so that we can prove the contract was concluded. Pete can also store contracts there as PDFs that were concluded in other ways before the website existed (Art. 6(1)(b) and (c) GDPR). The contracts are stored at Cloudflare (see section 3) in storage located in the EU. The legal basis is Art. 6(1)(b) and (c) GDPR; we keep the contract for the duration of the statutory retention periods.

If you confirm a change of package via the link Pete sends you, we store the time, IP address and browser information of your confirmation so that we can prove the change. The data is held at Stripe (see above) and at Cloudflare in the EU (see section 3). The legal basis is Art. 6(1)(b) and (c) GDPR.

9. Forms for the intro call, messages and cancellation

When you request an intro call via the website, write us a message or cancel a contract, we process the information from the form (name, email address, phone number if you provide one, your time slots or message, and for a cancellation the contract details). The legal basis is Art. 6(1)(b) GDPR and, for a cancellation, also Art. 6(1)(c) GDPR in conjunction with § 312k BGB (the German Civil Code, Bürgerliches Gesetzbuch). After a cancellation, you can choose a reason for cancelling on a voluntary basis; we store the reason with your contract at our payment service provider Stripe in order to improve our offer (Art. 6(1)(f) GDPR). Messages and cancellations are sent to us as emails; for a cancellation, you also receive an immediate confirmation of receipt. We also store a request for an intro call (name, email address, phone number, time slots, type of call and your message) at Cloudflare in the EU, so that we can confirm an appointment and send you a calendar file; the request is deleted automatically after 60 days. You receive a confirmation of receipt and, as soon as we have chosen a time, an appointment confirmation by email.

If you arrange coaching with Pete in person, Pete can send you an order link. For this purpose, we store your name, your email address, your phone number if you provide one, and the chosen package at our hosting provider Cloudflare (storage location EU) and pre-fill these details for you on the order page (Art. 6(1)(b) GDPR). The link is valid for 30 days.

If you enter your email address on the “Change payment method” page (Zahlungsart ändern), we check with our payment service provider Stripe whether there is an active contract for that address and, if so, send you a link by email. Via the link, you change your payment method directly at Stripe. If a monthly payment fails, we inform you by email and send you the same link (Art. 6(1)(b) GDPR).

10. Onboarding questionnaire

After your order, you can fill in a questionnaire about your daily life, training, nutrition and health via a personal link. Pete uses the information only to plan your coaching. We process health information with your consent (Art. 9(2)(a) GDPR) and all other information to perform the contract (Art. 6(1)(b) GDPR). The answers are held at our hosting provider Cloudflare (storage location EU) and are deleted 90 days after your coaching ends. You can withdraw your consent at any time by email to info@coach-hightower.com.

11. Sending emails

We send order confirmations, cancellation confirmations and the form messages via the email service of Cloudflare Germany GmbH (address: see section 3), under the same data processing agreement. This involves processing the recipient address, subject and content of the email.

So that we can check whether an email has arrived, for every automatically sent email we store the recipient address, subject, type of email, time, whether sending succeeded and the content of the email, so that we can tell you exactly what you received if you have questions. Attachments are not stored. The data is stored at Cloudflare in the EU, and the entries are deleted automatically after 400 days. The legal basis is our legitimate interest in verifiable and reliable customer communication and in helping with queries (Art. 6(1)(f) GDPR).

12. Gift vouchers

If you buy a voucher, we process your name, your email address, the chosen voucher, the name of the recipient and your message, if you provide them, as well as the time and IP address of your acceptance of the voucher terms. Payment runs through Stripe (see section 8). When the voucher is redeemed, we process the recipient's details (name, email address, postal address, phone number if provided, start date) and the IP address at redemption. The data is held at Cloudflare in the EU. The legal basis is Art. 6(1)(b) GDPR and, for retention, Art. 6(1)(c) GDPR in conjunction with the retention obligations under commercial and tax law.

13. Discount and referral codes

If you use a discount code when ordering, we store the code with your order at Stripe so that the discount is calculated. If the code comes from a cooperation partner (influencer), we calculate their commission from the net package price of your paid months within the minimum term; the partner does not learn your name. Every client also gets a personal referral code. If someone books with it, the referring person gets an email that their code was used, without the new client's name; Coach Hightower sees both names to assign the discount. The codes and their use are stored at Cloudflare in the EU and at Stripe. The legal basis is Art. 6(1)(b) GDPR (performing the contract with the agreed discount), for the commission statement Art. 6(1)(f) GDPR (legitimate interest in correct accounting with cooperation partners) and for retention Art. 6(1)(c) GDPR.

14. Giveaways

For a giveaway on Instagram, we process your Instagram name and your comment to draw the winners and notify them by direct message. From the winners we also process their name and, if given, their email address to send the prize as a voucher code; redeeming it is covered by section 12. We do not store data of participants who did not win. The legal basis is Art. 6(1)(b) GDPR (running the giveaway under the terms of participation, in German). Instagram is a service of Meta Platforms Ireland Ltd.; its privacy policy applies to processing by Instagram.

15. Motivation emails

As a paying client you occasionally get short motivation emails from Pete about your coaching. For this we use your email address, name, package and language from your order. Sending and the log work as described in section 11. The legal basis is our legitimate interest in supporting you during your coaching (Art. 6(1)(f) GDPR, § 7(3) UWG). You can unsubscribe at any time via the link in every email or by replying, at no cost other than the basic transmission costs. Emails about your contract and payments still come.

16. Contacting us by email

If you email us, we process your information to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or to steps before entering into a contract; otherwise, the legal basis is our legitimate interest in replying under Art. 6(1)(f) GDPR. We delete the data as soon as the data is no longer needed for the purpose and no statutory retention periods prevent deletion.

17. Your rights

At any time, you have the following rights:

If you have consented to processing, you can withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of the processing carried out until then. An informal message to the email address above is enough for all of these requests.

18. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Aufsichtsbehörde). The competent authority is the supervisory authority of the German federal state in which we are based. For North Rhine-Westphalia, this is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), reachable via ldi.nrw.de.

19. Changes

We update this policy when the processing on this website changes, for example because new features are added. The version published here applies at any given time.

Last updated: October 2026