PINCORE / LEGAL DRAFT
Privacy policy
Structured draft for this website. Controller, hosting, legal bases and retention must be reviewed against the actual configuration before public operation. This draft does not guarantee legal compliance.
1. Controller and contact
[UNTERNEHMENSNAME] · [RECHTSFORM]
[ANSCHRIFT]
Privacy contact: [E-MAIL]
[DATA PROTECTION OFFICER / IF REQUIRED]
2. Scope
This policy covers this website and the pilot enquiry. The app and studio interfaces are product concepts with fictional data. No real registration, hardware connections, analytics, marketing, newsletters or third-party media embeds are implemented.
3. Hosting and server logs
[ADD HOSTING PROVIDER, ADDRESS, PROCESSING LOCATION, PROCESSING AGREEMENT AND LOGGING]. Serving the website technically involves IP address, request time, requested resource and browser information. Actual log fields and retention depend on the chosen host and must be specified.
Article 6(1)(f) GDPR may apply to secure technical operation. The legitimate interest and actual configuration must be reviewed before operation.
4. Pilot enquiries and business communication
The form processes gym/company, name and email. Location count, equipment count and message are optional. Please do not submit health information or other particularly sensitive data.
When persistent storage is configured, the server stores the enquiry as a private record. A reference identifies the request and repeated submissions. No successful submission is confirmed without storage. There is no automated email or external CRM forwarding.
Depending on the enquiry, Article 6(1)(b) GDPR may apply to pre-contractual steps, or Article 6(1)(f) GDPR to business enquiries. [SPECIFY PURPOSE, LEGAL BASIS AND AUTHORIZED PEOPLE].
[DEFINE RETENTION PERIOD AND DELETION ROUTINE]. The operator must review stored enquiries and delete them after the purpose expires, subject to statutory retention obligations.
5. Abuse prevention
A hidden form field, minimum completion time, size limits, origin checks and a request rate limit help reduce automated abuse. An email hash is held temporarily in memory for rate limiting and is discarded after one hour on the next form request. No external CAPTCHA service is loaded.
The lawful basis, including Article 6(1)(f) GDPR where appropriate, and necessity must be assessed for actual operation.
6. Cookies and local storage
No optional tracking cookies are set and no privacy choice is stored in the browser. Because no optional categories are active, no consent dialog is shown on the first visit.
The “Privacy settings” link in the footer explains the current state. Before optional analytics, marketing or third-party services are introduced, the legal requirements must be reviewed and an appropriate consent mechanism added.
7. Local fonts and imagery
Fonts and images are served from this website. There are no Google Fonts requests or external media. Images are labelled concept visualizations. Hosting infrastructure may deliver these assets; its recipients must be specified under hosting.
8. App and platform previews
Training values, equipment, locations and profiles are sample data. Demo preferences and corrected workout values stay in the memory of the open page. A voluntary export creates a local JSON file containing sample data.
A future app may process account information, workout history, weight, repetitions, movement, tempo, hardware identifiers and gym attribution. A separate, specific privacy policy and access architecture are required before such processing. This website does not yet process real product data. PINCORE is presented as fitness technology, not a medical product.
9. Recipients and transfers
[IDENTIFY HOST AND AUTHORIZED PEOPLE]. No additional services are integrated here. Processing agreements, sub-processors and any international transfers must be documented for the chosen host. Where relevant, specify and review the applicable safeguards under Articles 44 onward GDPR.
10. Individual rights
Subject to applicable legal conditions, rights include access, rectification, erasure, restriction and portability. Consent may be withdrawn for the future. Processing based on legitimate interests may be subject to objection under Article 21 GDPR.
Contact [E-MAIL]. You may also complain to a data protection supervisory authority. [ADD COMPETENT AUTHORITY AND CONTACT].
11. Security and automated decisions
Form data is validated server-side. On Vercel, a private access-restricted Blob store is intended; local servers may use the persistent filesystem adapter. HTTPS, access controls, a deletion routine and suitable backups must be defined for production. [SPECIFY ACTUAL SECURITY MEASURES].
No automated decision with legal or similarly significant effect is made by this website. App prototypes do not provide medical assessments.
12. Changes and review
Draft date: 10 October 2026. Changes to hosting, form storage or product features require a new review. Analytics, marketing or external media services must undergo legal assessment and appropriate consent integration before being added.