Privacy policy

ART. 13 GDPR

Controller

Navin Kaul
TRI-CO-AN – Triathlon Coaching Analysen
Hennakopf 2
6781 Bartholomäberg
Austria

No data protection officer has been appointed. Privacy enquiries can be sent directly to the email address above.

MARKETING WEBSITE

Website access and technical data

When the production website is accessed, the hosting provider processes technically necessary connection data, including IP address, date and time, requested address, data volume, referrer, browser, operating system and status code. This serves secure delivery, error analysis and prevention of misuse. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is secure and stable operation.

We use Cloudflare Web Analytics (Cloudflare, Inc.) for privacy-conscious, aggregate reach and performance statistics. On the public website, a Cloudflare script reports page views, visits, referring sites, approximate country, device type, browser and loading performance to Cloudflare. The provider states that it does not set cookies or persistent browser identifiers for this service or build individual visitor profiles. Form contents are not included in these statistics. The legal basis is our legitimate interest in improving the website under Art. 6(1)(f) GDPR. Technically necessary connection data is processed when the script is loaded and data is transmitted to Cloudflare. See Cloudflare's privacy policy for more information.

To remember your privacy choice, the site stores two yes/no settings locally. If saving a withdrawal fails, it attempts to remove the old choice and set the necessary cookie tricoan_ad_denied for up to one year. This cookie contains only a blocking flag, not a visitor ID. If both mechanisms fail, the page shows instructions to clear this site’s stored data.

Optional Meta advertising measurement

The purpose is to assess whether our Instagram advertising leads to coaching enquiries. We send the event only with your consent. Meta lists a storage duration of 90 days for the advertising cookies _fbp, _fbc and fr. This cookie lifetime does not describe how long Meta retains all event data. Details and controls are described in Meta’s cookie policy.

Only after you explicitly allow Meta in “Ad privacy settings”, this site loads the Meta Pixel from Meta. A coaching enquiry durably accepted by the contact service can trigger a Lead event with a random technical receipt ID. Your name, email address, phone number, message and training details are not included in that event. The enquiry form also works without advertising consent.

Meta receives technical connection and browser information, including your IP address and the page URL, and may use cookies and associate the event with your Meta account. Automatic form matching, customer-list uploads and the Conversions API are not enabled by this implementation. Withdrawal stops further events from this integration; when the choice is saved successfully, the page reloads. It does not recall data already transmitted. Consent to Meta does not grant consent to Google Ads.

The provider is Meta Platforms Ireland Limited. Further processing and possible transfers outside the EEA are described in Meta’s privacy policy. Your choice is stored without a visitor identifier in local browser storage until you change it or clear the site data. If a withdrawal cannot be saved there, the website additionally attempts to store a necessary denial cookie for up to one year. This local withdrawal does not automatically delete the provider’s cookies.

Optional enquiry measurement with Google Ads

We measure whether Google advertising leads to accepted coaching enquiries. Google Ads has its own optional choice in “Ad privacy settings”. Without that consent, our integration does not load a Google tag or send Google measurement events. The form remains available; agreeing to Meta does not enable Google.

After your consent, the Google tag loads. Google may process your IP address, browser information, page URL, ad-click identifiers and cookies. Only a coaching enquiry durably accepted by the contact service triggers the conversion event. A random technical receipt ID is transmitted to prevent duplicate counting. Name, email address, phone number, message and training details are not transmitted as event data. Enhanced conversions, Google Analytics and personalised advertising are not enabled by this integration.

Processing is based on your consent. You can withdraw it at any time in “Ad privacy settings”. Withdrawal stops further enquiry events from this integration; when the choice is saved successfully, the page reloads. It does not recall data already transmitted or automatically delete Google cookies. Your choice remains in local browser storage until you change it or clear the site data. If saving fails, the guidance above applies.

The provider for EEA users is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing outside the EEA is possible. Details about Google's processing, transfers and deletion options are in Google's privacy policy. Google specifies a lifetime of 90 days for conversion cookies with the _gcl_ prefix; this does not describe retention of all event data. See Google's cookie explanation.

Calculators and package finder

Entries in the race, fitness, fueling and offer calculators are processed in the browser. The marketing website does not transmit or store them. No solely automated decision with legal or similarly significant effect takes place.

External links

Links to Intervals.icu, event organisers or other websites connect to those providers only after you click them. Their own privacy policies then apply.

ENQUIRIES

Contact by form, email or phone

When you submit the contact form, your name, email address, optional phone number, selected topic, goal and message are transmitted securely to the contact service at Cloudflare (Cloudflare, Inc.). A Cloudflare Worker checks the enquiry and temporarily stores it in Cloudflare Queues for email delivery. Contact contents are stored temporarily for delivery, for no more than 24 hours in each queue; transfer to the failure queue can extend the total to no more than 48 hours. Successfully processed messages are removed from it. The form confirms receipt only after storage is confirmed. This acceptance does not mean that an email has already been delivered.

The message to the controller and an automatic copy to your email address are then sent in the background through the transactional email service Brevo. Your email address is also used as the reply-to address and is not automatically added to a marketing list. Information about Cloudflare’s processing and possible transfers is in Cloudflare’s privacy policy.

We process the contact and message data to answer your enquiry, prepare an introductory consultation and, where applicable, take pre-contractual steps. The legal basis is Art. 6(1)(b) GDPR and, for general enquiries, also Art. 6(1)(f) GDPR. Enquiries that do not lead to a contract are normally deleted no later than six months after communication ends unless legal claims or obligations require longer retention.

After acceptance is confirmed, the form keeps only the technical receipt ID and acceptance status in the open browser tab’s session storage so that the confirmation remains visible after a reload. Form contents are not stored there. This storage ends with the browser session; the browser may restore it when restoring a session.

Technical connection data is processed briefly for rate-limiting and security checks without adding it to the form content or sent message. Do not send diagnoses, medical reports or other detailed health data in the first contact enquiry.

Technical delivery receipts

To prevent duplicate email delivery, the contact service stores a keyed digest of the enquiry, a random receipt ID, creation time and delivery status in Cloudflare D1. Name, email address, phone number and message are not stored there in plain text. The database is configured for EU storage. Technical receipt IDs are also included in Brevo delivery tags to investigate uncertain delivery outcomes. These records serve delivery reliability, not advertising profiles. Accepted receipts are eligible for manual removal after 90 days; no automatic deletion schedule is currently enabled. Unresolved delivery cases are retained for investigation to avoid sending the same message twice.

WORKING TOGETHER

Data in coaching and individual analyses

If a contract is concluded, we process — depending on the booked service — identity and contact details, contract and payment data, goals, appointment and availability information, training history, performance, device and activity data, communication and voluntarily provided information about recovery, injury, illness or menstrual cycle. The purposes are contract performance, individual training management, analysis, communication, billing and documentation.

Art. 6(1)(b) GDPR is the legal basis for ordinary contract data. Health data or other special categories are processed only with explicit, voluntary consent under Art. 9(2)(a) GDPR. Consent can be withdrawn at any time for the future. Without information required for a service, individual management may be limited or impossible; voluntary cycle data is never a condition of coaching.

Coaching and analysis data is kept for the duration of the relationship and afterwards only as long as necessary for follow-up, evidence or legal obligations. Tax and billing documents are retained for statutory periods; other training and health data is deleted or anonymised according to the confirmed deletion concept.

SERVICE PROVIDERS

Recipients and transfers

Data is disclosed only to parties that need it for the relevant purpose. These may include email and IT providers, the production host, banks and tax advisers and — when agreed for coaching — Intervals.icu or another explicitly selected training platform. WhatsApp is used only when the athlete chooses that communication channel.

Externally collected test results are not automatically retrieved from their providers. Results you provide are used only for the agreed interpretation. Contact contents, training data and supplied test results are not shared for advertising. Processors are bound under Art. 28 GDPR; transfers outside the EEA require a valid legal basis and appropriate safeguards.

DATA-SUBJECT RIGHTS

Your rights

Where the legal requirements are met, you have rights to information, access, rectification, erasure, restriction, data portability and objection. You may withdraw consent at any time for the future. Send requests to kaul.navin@gmx.at. Proof of identity may be required to prevent unauthorised disclosure.

If you believe processing breaches data-protection law, you can complain to the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

Personal intake questionnaire and documents

The personally shared “Tell me about yourself.” page asks for personal contact, goal, availability, equipment and organisation details to prepare coaching. The legal basis is preparing or performing a contract under Art. 6(1)(b) GDPR. Optional health, examination, assessment and weight information is processed only with explicit consent; optional cycle information requires additional, separate consent. The basis is Art. 9(2)(a) GDPR. Both consents can be withdrawn for the future at any time by contacting kaul.navin@gmx.at. Acknowledging participation information does not replace these consents or conclude a contract.

The questionnaire is transmitted over HTTPS through the contact service at Render or Cloudflare, then through Brevo to Navin Kaul at kaul.navin@gmx.at. The receiving inbox is operated by the email provider GMX. The acknowledgement to the email address entered contains no answers, health information or documents. The delivery queue and technical receipt retention periods described above apply. Questionnaire information is used to prepare and, where agreed, provide coaching; the enquiry and coaching retention rules described above apply.

When you add documents, files are transmitted over HTTPS to private Cloudflare R2 storage with EU jurisdiction. Retrieval requires a separate coach access key. There are no public file links. Technical file identifiers, names, formats, sizes and questionnaire associations are stored in Cloudflare D1. File names may contain personal information; avoid unnecessary health details in names. Files not associated with a submitted questionnaire are scheduled for deletion after 24 hours; associated files after 30 days. An hourly cleanup removes them and retries deletion after technical failures. Retrieval of associated files ends no later than 30 days after submission. Required documents may subsequently be kept in protected coaching storage under the retention rules for coaching.

The questionnaire and document area use no analytics or advertising tags of their own. Session storage contains only a technical transmission status or confirmed receipt, not answers, files or upload keys. An unresolved transmission status prevents resending after reloading the same session. These pages are not listed in navigation or the sitemap and are marked “noindex”; this alone is not access control.

Last updated: October 2026