Website privacy

1. Controller

Elev8 Labs UG (haftungsbeschränkt), Münchener Straße 1A, 85368 Moosburg an der Isar, Germany. Privacy contact: datenschutz@krest-coaching.com. Further provider details appear in our legal notice.

2. Website & browser

When you visit, our hosting and infrastructure providers process your IP address, access time, requested content, referrer, and browser and device information to deliver the website, diagnose errors and prevent abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure, reliable website operation.

We store your privacy choice as “krest-consent” in your browser’s local storage until you change or delete it (Section 25(2)(2) TDDDG; Art. 6(1)(f) GDPR to respect your choice). Fonts and images load from this website. We use no tracking tools for advertising or audience analytics.

3. Enquiries & coach applications

For enquiries, we process your name, email, optional company and message. For coach applications, we process first and last name, email, profile link, postcode, city, specialisms, coaching formats, certification status, your selection about how you found KREST and an optional personal introduction to your coaching. During review, we consider your optional introduction and the public coaching profile you link to.

Your selection about how you found KREST helps us understand how we reach coaches. You can select ‘Prefer not to say’. The legal basis for this evaluation is Art. 6(1)(f) GDPR; our legitimate interest is improving how we reach coaches.

We handle your enquiry or application, email acknowledgements and responses, and administer the link between the approved benefit and your verified coach account. This also involves processing review status, account assignment and timestamps. The legal basis is Art. 6(1)(b) GDPR for precontractual steps and the promised benefit; otherwise Art. 6(1)(f) GDPR to handle your enquiry and administer the offer accountably.

As soon as you enter a five-digit postcode, your browser requests place suggestions from Zippopotam.us. The service receives your postcode, IP address and technical request data to match your coaching location in the application form (Art. 6(1)(b) GDPR).

Providing data is voluntary; without the marked required information, we cannot process the respective form. People review your application. There is no solely automated decision with legal or similarly significant effects.

4. Spam protection with your consent

On pages containing forms, we load Google reCAPTCHA v3 only after your consent. Google processes information including IP address, browser and device details and interactions to assess the risk of abuse, and may store or access cookies or information on your device for this purpose. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

You can withdraw consent at any time through “Privacy settings” in the footer. Without consent, you can read the website and contact us or apply by email at info@krest-coaching.com. The forms require spam protection. Server security checks also use technical identifiers and request counters to prevent abuse (Art. 6(1)(f) GDPR).

5. Providers & transfers

Hosting and email providers process access or communication data. We use Google Cloud Run and Firebase/Firestore to process and store form information, and Google reCAPTCHA for spam protection. The people responsible for handling requests at KREST also receive access.

Google may process data outside the EEA, particularly in the United States. Google describes the EU–US Data Privacy Framework (Art. 45 GDPR) and supplementary standard contractual clauses (Art. 46 GDPR) for these transfers. Information and access to safeguards: Google data transfers and Google Cloud data processing terms. Further information about reCAPTCHA appears in Google’s privacy policy.

6. Retention

We retain access and security data only as long as needed for technical operation or until the relevant disruption or security investigation is resolved. We retain enquiries and correspondence until fully resolved, and application and approval records for as long as needed to review and administer the promised benefit. We then delete the data unless statutory retention duties or the establishment, exercise or defence of specific legal claims require it.

After a linked coach account is deleted, minimised, pseudonymised approval records may be retained for up to 365 days to prevent abuse. Unsubmitted form entries remain only in the open page’s memory and are discarded on reload.

7. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction and data portability (Arts. 15–20). You may withdraw consent for the future without affecting the lawfulness of earlier processing. Contact datenschutz@krest-coaching.com to exercise your rights.

Right to object: You may object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR).

You can complain to a data protection supervisory authority, in particular the Bavarian State Office for Data Protection Supervision.