Privacy policy
English reading version – only the German text is binding. The contract is concluded in German; if the two versions differ, the German text applies. German original: www.kravmaga-stuttgart.de/datenschutz/
As of: October 20, 2026
In short
- The site works without tracking. Google Analytics and Google Ads only load if you choose "Accept" in the bar at the bottom.
- What you send through a form reaches us by email – only the waitlist and the seminar notification list are stored on the server alone. The server only holds what bookings, the info packet, the waitlist, the notification list, lists, 10-class passes, inquiries via the association, cancellations, personal invitations and the keys to seminar material need – with a fixed deletion date or until you unsubscribe. In addition, there are two lists that contain only checksums: who doesn't want any more emails, and how often we've already followed up.
- We don't sell data and we don't build profiles ourselves.
- For members – fees, portal, cancellation – the privacy information for members also applies (in German).
1. Controller
Benjamin und Julia Wiedenbruch GbR · Krav Maga DEFCON® TC Stuttgart
Wollingnstrassße 1410 · 701439 Stuttgart, Germany
Phone Phone · Email mail(at)kravmaga-stuttgart.de
2. When you visit
Hosting: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany – processes the data on our behalf (Art. 28 GDPR).
Server logs: Each time you access the site, the server processes your IP address, date and time, the address you access, the page you came from, and your browser and operating system – to deliver the site and protect it against attacks (Art. 6(1)(f) GDPR). IONOS stores these logs for no more than eight weeks, with the IP address only in shortened form.
Nothing from other servers: Fonts and images are hosted by us. Without your consent, the site loads nothing from other providers.
In your browser: Your choice in the bar (twelve months, required under Section 25(2) No. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act) and, briefly, your form entries so that nothing is lost if there's an error (from sending until the next page or until you close the tab). We don't set cookies without consent; there is a login cookie only for our own administration area.
Our own visit count: We count visits ourselves – without cookies and without reading anything from your device. We only use what every request brings anyway: the page, whether you came via an ad, whether you're on a phone, and whether you accept or decline in the bar. Only daily totals are stored – no IP address, no identifier; deleted after 400 days. To protect against fake numbers, we keep a checksum of your connection for two days (Art. 6(1)(f) GDPR – we want to know, in a data-saving way, how the site is used).
3. Forms and emails
Form entries are sent encrypted to our server and by email to our inbox; you get a confirmation. Exception: the waitlist and the notification list – there only you get an email, and the entry is stored only on the server. The form is sent along with the page you send it from. What's required is marked on the form; everything else is optional. For each entry, we store technical details such as times, internal identifiers and the keys for the links in our emails; for seminars, also the amount, payment deadline and payment status. Links in our emails first open a page – nothing happens until you click the button there.
| Form | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Trial class | First name, last name, email, phone (optional), date, location, whether you're under 18 | booking, confirming, reminding, following up | Art. 6(1)(b) |
| Contact | First name, last name, email, phone (optional), message | replying | (b) or (f) |
| Job application | First name, last name, email, phone (optional), message, position | reviewing the application, replying | (b); retention (f) |
| Info packet | First name, email | sending the info packet, following up at most twice | (b); follow-up (f) |
| Seminar | Name, email, phone (optional), whether you're under 18, whether you already train with us and whether you attended the seminar – so we write you the right thing afterwards (voucher only for outside guests who attended) | booking, payment, reminder, cancellation, one follow-up afterwards | (b); follow-up (f) |
| Waitlist | First name (optional), email | letting you know when a spot opens up | (b) |
| Notification list | informing you about new seminars | (a) (your consent) | |
| List (e.g. founding list) | First name, last name, email, phone (optional), message (optional); for lists for children, also the child's first name and age | reaching you when things get started – by email, call or text | (b) |
| 10-class pass | Email (we create it when you ask about the pass); when ordering, first name, last name, phone (optional), whether you're under 18; the time and version of your order and consent; for an invoice on request, your address (optional) | offer, contract, pass, informing our instructors, invoice on request | (b); proof (c) and (f) |
| Inquiry via the association | First name, last name, email, phone – from the Krav Maga DEFCON® association (kravmaga.de), where you asked for a trial class in Stuttgart | welcoming you, link to the trial class, at most one reminder | (b) |
| Cancellation | Name, email, membership number (optional), contract, type, time, reason | accepting the cancellation, checking and confirming the contract end date, documenting it | (b) and (c) |
| Withdrawal | Contract, name, email | accepting, confirming and documenting the withdrawal | (b) and (c) |
If you cancel via the cancellation page, your cancellation is stored encrypted on the server – until we've checked the contract end date and confirmed it to you, and after that as proof until the end of the third year after the contract ends. If you cancel by email or letter, we enter it there as well. In addition, every cancellation goes by email to you and to us. We don't store a withdrawal on the server – it only goes by email to you and to us.
Lists: For new classes or short-notice dates, we set up lists, such as the founding list for the girls' class. A list doesn't commit you to anything; it isn't a booking. Your details reach us by email and are stored encrypted on the server; we only use them to reach you about this list. For lists for children, the parents sign up. You can delete your entry yourself at any time using the link in our email; we then also delete the email in our inbox. Otherwise, we delete both once it's settled, at the latest after one year.
Job applications: What you send through the application form – first and last name, email address, phone (optional), your message and the position – reaches our inbox by email; it isn't stored on the server. We only use it for this application process (Art. 6(1)(b) GDPR). If it doesn't work out, we delete your application six months after our rejection; until then, claims under the German General Equal Treatment Act (AGG) could be asserted ((f)). If you'd like us to keep you in mind for later, let us know – then, with your consent, we'll keep it for up to one year. Please don't send us any information about health, religion, origin or the like; we don't ask for it and don't need it.
10-class pass: If you ask about a 10-class pass, we create an entry with your email address and send you an offer with a personal link. On the page behind it, you add your details and order. We store when you ordered and which texts you agreed to – no IP address. We don't store your bank details; you make the transfer yourself. Our instructors learn your name, pass number and validity. Everything is stored encrypted on the server. If you don't order, we delete the address 30 days after the last offer; otherwise, one year after the pass ends. For an invoice, you can give your address – optionally. It only appears on the invoice; we don't store it on the server. We keep emails about orders and invoices as long as tax law requires.
Inquiries via the association: If you request a trial class with us in Stuttgart on kravmaga.de, the website of the Krav Maga DEFCON® association (Falk Berberich Consulting GmbH, Villingen-Schwenningen), the association sends us your name, email address and phone number. We write to you once with a personal link to the trial class and remind you at most once. The details are stored encrypted on the server; we don't pass them on. If you book, what's said about trial classes applies. Otherwise, we delete them 30 days after our last email – immediately with "No more emails".
By email, phone or text – including through the "Call" and "Send a text" buttons for seminars – we use your details to reply to you ((b) or (f)). The buttons only open your phone; the site learns nothing about it.
Emails sent by hand: Sometimes we send you a single email by hand – such as the info packet, the link to the member portal or a voucher if you asked for it, or, as a member or seminar guest, a note about our offers or a request for a review. We note when and why (twelve months). "No more emails" applies to these too.
We keep emails in our inbox until your request has been handled and no further questions are to be expected; invoices as long as tax law requires; cancellations and withdrawals, with the time of receipt, as proof until the end of the third year after the year in which the contract ends (Art. 6(1)(f) GDPR).
Protection against misuse: an invisible math puzzle, a trap field for bots, no more than 5 requests per hour and 10 per day from one connection, and a daily limit per email address. For this, we store neither your IP address nor your email address, only checksums of them, for two days ((f)). Cancellation and withdrawal have no puzzle; if a limit applies there, it only holds back the automatic confirmation – your notice always reaches us.
4. Trial class – what we store and for how long
For your booking, the server stores your first and last name, email, phone (if you give it), date, location, time of booking, whether you're under 18, which trial class it is (first, second …), your trial class number and a secret key for the links in our emails – so we can reach you directly before the date, for example if something changes. Everything is stored encrypted and blocked from access over the internet, and is deleted 21 days after your last trial class – earlier as soon as you become a member, click "No more emails" or reply to us on the reasons page. During this time, you'll get at most: "How was class?" (once after each trial class, no more than three times in total), a reminder after three days if you ask for it, and a final email 14 days after your last trial class – and nothing after that.
With it, we send you: the confirmation (with a calendar entry, and for under-18s with the consent form for your parents), reminders the day before and on the day of training with a link to cancel, and, within three days after the class, the follow-up "How was class?". Reminders and follow-ups never come at night (not between 11 p.m. and 6 a.m.). The follow-up contains the links "Become a member", "Train with us again", "Remind me in 3 days", "Not right now" and "I couldn't make it – pick a new date"; after the third time, only "Become a member", "Remind me in 3 days" and "Not right now". A link only opens a page; you confirm there ("Choose your next date", "Yes, I'd like to become a member", "Choose a new date", "Yes, remind me in 3 days"). We note this on your booking.
No more than three "How was class?" emails in total: So that this also applies across several bookings, we keep a permanent count for each address – only as a checksum and a number.
Becoming a member: If you confirm "Yes, I'd like to become a member", we get a message and send you the welcome email with the link to the membership application. Your request (first name, email, trial class number, date, location, which trial class it was, status of the request) is stored encrypted on the server for seven days, even if the welcome email has already gone out. You submit the application itself in our member portal WISO MeinVerein. It is operated on our behalf by Buhl Data Service GmbH (processing on our behalf, Art. 28 GDPR); we remain the controller. What happens to your data there is explained in the privacy information for members (in German).
Becoming a member with an admission code: Through the "Become a member" form, we process your first and last name, email address and – if you enter it – the admission code from training (Art. 6(1)(b) GDPR). If the code is correct, the welcome email goes to you right away; without a code, we get in touch personally. The request (without the code) is also stored encrypted on the server for seven days.
Personal invitation: If Benjamin or Julia personally invites you after training to become a member, we create an entry with your first name and email address and send you a link that is valid for 14 days; after that, we delete the entry (Art. 6(1)(b) GDPR – you asked for it at training). We note when we invited you, without content, for twelve months, as with emails sent by hand.
Under 18 – consent form on paper: The child's name and date of birth, an emergency number, and the parents' signature and name. We only use it for participation and keep the form until the end of the third year after the last class – as proof in case of claims ((b) and (f)). After that, we destroy it.
Advertising: The follow-up "How was class?", the final email after the last trial class with the request for a review, the follow-ups about the info packet and the thank-you after a seminar are advertising for our training. Legal basis: Section 7(3) UWG (German Act Against Unfair Competition) and Art. 6(1)(f) GDPR – you read about it when you booked and can object at any time ("No more emails").
No more emails from us? You can object at any time – with the link in each of these emails or a short reply, at no cost other than the transmission costs at basic rates. We then put your address on a block list: permanently, so it also applies to a later booking, and only as a checksum from which your address can't be read. We delete your info packet request, your notification list entry and your inquiry via the association right away. You'll still get emails about dates you book yourself.
Info packet: We store your first name and email encrypted for no more than 15 days – for at most two follow-ups during this time. If you book a trial class or unsubscribe, we delete it right away.
"Interested people" overview: In our administration area, we see the status of your path with us for your address – how you started, dates, your answers, whether anything is open on our side. This overview has no deadline of its own: it disappears together with the entry it's based on. Before an entry is deleted, we save an overview once a month (name, email, how you started, dates, your answers) in our inbox, to evaluate our processes and to recognize you if you come back (Art. 6(1)(f) GDPR). We delete it after nine months at the latest.
5. Seminars
Booking: Name, email, phone (optional), booking number and whether you've paid – encrypted on the server, deleted 14 days after the seminar. If you receive a voucher to train with us as an outside guest, your entry stays until the voucher has been redeemed or has expired – and is then deleted. The booking email is also the invoice; it stays in our inbox as long as tax law requires.
Seminar material: After a seminar, you get a personal link to handouts and videos with the thank-you email. The link belongs to your booking (Art. 6(1)(b) GDPR). We don't store when or from where you open it. The link is valid as long as the area is open, at most twelve months after the seminar; then we delete it.
Waitlist: First name (optional) and email, until the seminar.
Notification list: Only your email. You confirm via the link in our email; we delete unconfirmed entries after 3 days. You can unsubscribe at any time via the link in every notification email; we then delete the address. We store the time of your confirmation as proof. The notification list is based on your own consent: if you sign up again after "No more emails" and confirm, you'll get it again.
6. Google – only with your consent
A bar appears at the bottom with "Decline" and "Accept", both the same size. Without consent, nothing loads from Google. You can change your choice at any time under "Privacy settings" at the bottom of every page; if you withdraw consent, we delete the Google cookies the site can reach.
With consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), your browser loads the Google tag from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google receives your IP address and information about your browser and device.
- Google Analytics 4 shows us how the site is used. Cookies _ga, _ga_… (according to Google, up to two years). Google processes this for us as a processor; analytics data is deleted after 2 months.
- Google Ads shows us whether someone booked a trial class, wrote to us or requested an info packet after clicking our ad. For this, a random number goes to Google with every real request; we don't store it anywhere else. Cookies _gcl_au and, after a click on our ad, _gcl_aw (90 days each). Google itself is the controller for this measurement.
- No remarketing: We don't use your visit for later advertising.
- Email and phone as a checksum: If you've given consent and send the form for a trial class, contact or the info packet, the Google tag reads your email address and phone number from the form (for the info packet, only the email address) and sends them to Google as a checksum (SHA-256). Google matches them with signed-in accounts to link the request to an ad – so a checksum is not anonymous. For this matching, Google acts as our processor. Never names, never addresses.
- Cancellation page: never Google.
- 10-class pass order page: never Google.
- Trial class via your personal link: never Google.
Google may transfer data to the USA. The basis is the adequacy decision on the EU-U.S. Data Privacy Framework; Google LLC is certified. Standard contractual clauses also apply.
7. Links, blog and images
Links to Google Maps, Facebook, Instagram and WISO MeinVerein only load something when you click. The blog has no comments. We only show people in images with their consent. When images are uploaded, we re-save them; camera and location data are removed in the process.
8. Retention periods at a glance
| What | Where | How long |
|---|---|---|
| Trial class booking | Server, encrypted | 21 days after the last trial class |
| "Become a member" request | Server, encrypted | 7 days |
| Personal invitation | Server, encrypted | 14 days; note without content 12 months |
| Info packet request | Server, encrypted | at most 15 days |
| Seminar booking | Server, encrypted | 14 days after the seminar; with a voucher, until it ends |
| Seminar material (key to your booking) | Server, encrypted | as long as the area is open, at most 12 months after the seminar |
| Waitlist | Server | until the seminar |
| Consent form under 18 | Paper, with us | until the end of the 3rd year after the last class |
| Notification list | Server | until you unsubscribe; unconfirmed 3 days |
| Lists (e.g. founding list) | Server, encrypted, and our inbox | until you delete it or it's settled; at most 1 year |
| 10-class pass | Server, encrypted | without an order 30 days; otherwise 1 year after the pass ends |
| Inquiry via the association | Server, encrypted | 30 days after our last email; with a booking, as for trial classes |
| "No more emails" block list | Server, checksum only | permanently |
| Number of "How was class?" emails | Server, checksum and number | permanently |
| Answer on the reasons page | Server, counter without names | permanently |
| Protection against misuse (forms, counting) | Server, checksum | 2 days |
| Our own visit count | Server, daily totals only | 400 days |
| Cancellation (list in our administration area) | Server, encrypted | until the end of the third year after the contract ends |
| Emails, invoices, cancellations, withdrawals | our inbox | see section 3 |
| Job applications | our inbox | six months after the rejection; if hired, like personnel records |
| Your choice in the bar | your browser | 12 months |
| Server logs | IONOS | at most 8 weeks, IP shortened |
9. Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). You can withdraw consent at any time with effect for the future. Access and erasure also include the emails in our inbox.
Objection (Art. 21 GDPR): Where we rely on our legitimate interest, you can object on grounds relating to your particular situation. You can object to advertising – such as our follow-ups – at any time without giving reasons.
You can lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
You don't have to give us any data; without the required details, however, we can't handle your request. There are no automated decisions about you (Art. 22 GDPR). Only the protection against misuse automatically rejects some requests – for example with a link in the name, with more than two open trial dates per address, or with too many requests at once. You can then reach us by phone or email.
Earlier versions: privacy policy until October 20, 2026 (PDF, German). Older versions and the portal's privacy policy until then on request: mail(at)kravmaga-stuttgart.de.