Diese Erklärung gibt es auch auf Deutsch. Bei Abweichungen gilt die deutsche Fassung.

This page explains what personal data we process when you use sol-studio.co, why, and what rights you have. We keep the amount of data small on purpose: no third-party tracking scripts, no cookies for statistics, and only one embedded third-party service, which loads only when you ask for it.

1. Who is responsible

sub-sol GmbH, Oranienstr. 183, 10999 Berlin, Germany, represented by its managing directors Benjamin Brenner and Maria Fernandez.
Email: admin@sol-studio.co · Phone: 030 86305798
Full company details are in the impressum. We have not appointed a data protection officer, as the legal thresholds (article 37 GDPR, section 38 BDSG) are not met.

2. Visiting the website

The site runs on a virtual server in Germany that we rent from STRATO GmbH, Berlin, and operate ourselves. Each request is recorded in a server log containing your IP address, the time, the page requested, the response status, the referring page and your browser identification. We use these logs to deliver the site and to investigate faults and attacks. Legal basis: article 6(1)(f) GDPR, our legitimate interest in a working and secure website. Log files are rotated daily and deleted within 15 days; they are not included in our backups.

The typeface used on this site is hosted by us. Your browser does not contact Google Fonts or any other font service.

3. Web analytics (Umami)

We use Umami, an open-source analytics tool that runs on our own server in Germany, to understand how the site is used: which pages are viewed (the address without its query, apart from campaign tags such as utm_source), where visitors come from, and rough technical data (browser, operating system, device type, language, and the country, region and city derived from the IP address). Umami sets no cookies and stores nothing on your device. Your IP address is not stored: it is combined with your browser identification and a value that changes every month into a pseudonymous identifier that we cannot resolve back to you. That identifier links the pages and actions of one visit and recognises returning visitors within a month; we use it only for statistics about how the site is used, not to learn about or approach individual visitors. The script does not read your screen size, and it honours your browser’s Do Not Track setting.

Umami also records a few actions on the site: which links you follow out of it (for example to Eversports to book, and which product or class that link was for), clicks on our email address or phone number, whether the newsletter box was shown, closed or used to sign up, that a form was sent, and how long a page stays open in the foreground and how far down it is scrolled (with a random number for each page view, so that one view is not counted twice). What you type into a form is never part of this. These actions are stored with the same pseudonymous visit as the page views and are deleted on the same schedule. To estimate which of our sales came through the website, we compare the clicks to Eversports with our Eversports sales by product and time. From the sales we use only the invoice number, date and time, product and amount, never names or contact details. A sale that matches a click is marked as coming through the website, and we count, as totals only, which sources such sales came from (the page a visit started on, the referring site, campaign tags). The result is an estimate, and it does not tell us who a visitor is.

Legal basis: article 6(1)(f) GDPR, our legitimate interest in understanding and improving our website. No data goes to third parties. Raw data is deleted after 12 months; the aggregated statistics contain no personal data. You can switch analytics off for this browser at any time: analytics in this browser: checking…

4. Map on the location page (Google Maps)

The location pagecan show a map provided by Google Maps. This is the only third-party content on the site, and it does not load until you click “load map”. When it loads, your browser connects directly to Google’s servers. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) receives your IP address, the address of the page you are on and technical information about your browser, and may set cookies. Google also processes this data for its own purposes and may transfer it to Google LLC in the USA. For such transfers Google relies on the EU-US Data Privacy Framework, under which Google LLC is certified and which the European Commission has recognised as providing adequate protection (article 45 GDPR, decision of 10 July 2023), and otherwise on the EU standard contractual clauses (article 46(2)(c) GDPR). Google’s privacy policy: policies.google.com/privacy.

Legal basis: your consent, article 6(1)(a) GDPR and section 25(1) TDDDG, given by clicking “load map”. You can withdraw it at any time with effect for the future: with the link below the map, which removes it immediately, or by resetting your stored choice here: reset your map choice. Your choice is stored on your device only (see “Storage on your device” below).

5. Contacting us (form, email, phone)

When you use the form on the contact page, we receive the name, email address and message you enter, plus the time of submission. The form is sent to our own server (dashboard.sol-studio.co, Germany). From there it is delivered as an email to our mailbox admin@sol-studio.co, which is hosted by our email provider STRATO GmbH, Berlin. A copy of the submission stays on our server for 30 days as a safeguard against delivery failures and is then deleted. Our server also records your IP address with the submission to prevent abuse of the form; the IP address is deleted after 14 days.

If you write to us at admin@sol-studio.co instead, an AI tool sorts the message before a person reads it and, where useful, prepares a draft reply; details are in the section “AI tools”. Messages that visibly contain health information are excluded from this and handled by a person only. If you call us, we process your details only in order to reply to you.

Legal basis: article 6(1)(b) GDPR where your enquiry concerns a booking, a membership or another contract with us, otherwise article 6(1)(f) GDPR, our legitimate interest in answering enquiries. We delete the correspondence 12 months after the matter is closed. Where the correspondence is a commercial letter in the sense of the German Commercial Code, for example because a contract was concluded, we have to keep it for six years (section 257 HGB, section 147 AO).

You are not obliged to provide any data. Without a name, an email address and a message we cannot answer you.

6. AI tools (Anthropic)

For some internal tasks we use the language models of Anthropic through its API and under a data processing agreement. Our contracting party is Anthropic Ireland, Limited, Dublin, Ireland; the data are also processed by Anthropic, PBC, San Francisco, USA. We use these tools to sort incoming email and prepare draft replies, which a person at the studio reads, edits and sends; to classify invoices and bank transactions for our bookkeeping; and when we maintain our systems, where the tool may see data stored there. What goes to Anthropic is the email or document concerned, including the personal data it contains, such as your name, your email address and the content of your message. Anthropic processes these data only for us and does not use them to train its models. The tool takes no decision about you; it prepares the work of a person. We do not pass medical certificates to AI tools, nor the card or bank account details of our customers. For our bookkeeping the tool sees the transactions on our own business accounts, that is the date, amount, payment reference and the name of the payer or payee, and matches them to our invoices.

Legal basis: article 6(1)(f) GDPR, our interest in handling correspondence and bookkeeping reliably with a small team. You can object to this processing at any time; we then handle your emails without the tool (see “Your rights”). Transfer to the USA: the basis is the European Commission’s standard contractual clauses, which form part of the data processing agreement.

7. Class feedback form

When you open the feedback page, your browser fetches the current list of classes from our server (dashboard.sol-studio.co). This request is logged like any other page request (see “Visiting the website”).

The feedback form lets you tell us about a class you attended. It records the date of your visit, the class, your ratings and your free-text answers. Giving your name is optional; leave it blank and we store the feedback without your name. Our server also records your IP address with the submission to prevent abuse of the form; the IP address is deleted after 14 days. Please do not include health information or details about other participants in the free-text fields.

Legal basis for processing your submission: your consent, article 6(1)(a) GDPR, given by ticking the box on the form. You can withdraw it at any time by writing to admin@sol-studio.co; we then delete your submission.

The form does not ask for the instructor’s name, but we can tell from our schedule who taught the class you selected. Feedback is therefore also personal data about that instructor. We process it to assess and improve the quality of our classes and to discuss it with the instructor concerned. Legal basis for this: article 6(1)(f) GDPR, our legitimate interest in the quality of the classes we offer. Feedback is read only by the studio management. When you submit the feedback form, our internal Slack receives a short notification with the date of your visit, the class and a link to the submission. Your ratings, your free text and your name are not sent to Slack; they stay on our server, and only the studio management can open the submission itself. We delete the Slack notification after 90 days. We may discuss the content of your feedback with the instructor it concerns, but we never disclose your name to them. Feedback is not published and not used for any automated decision. Our instructors receive the information required by article 14 GDPR about this processing directly from us.

We delete feedback 12 months after receipt.

8. Booking, memberships and class credits (Eversports)

Bookings do not happen on this website. The booking links take you to Eversport GmbH, Jakov-Lind-Straße 13, 1020 Vienna, Austria, which operates its own platform and is the controller for your Eversports account, including payment details. We never see or store your payment data. Their privacy policy: eversports.com/h/privacy. The same applies if you attend using an Urban Sports Club or Wellhub membership.

What we receive from Eversports we process under our own responsibility: your name, your email address and, if you gave it, your phone number; what you bought (single credits, credit bundles, memberships, vouchers) and how long it is valid; your bookings, cancellations, check-ins and no-shows; and the invoices issued to you. If you sign up at the front desk, we enter the same data ourselves. We use these data to run your bookings and your contract with us: to hold your place, to check you in, to keep your credit balance and membership up to date, to tell you when a class is cancelled or taught by someone else, and to issue invoices and answer questions about them. Legal basis: article 6(1)(b) GDPR (performance of the contract) and, for invoices and booking records, article 6(1)(c) GDPR together with the retention duties under tax and commercial law.

Who sees these data: our instructors see the participant list of their own class (name and check-in status) so they know whom to expect; our bookkeeping and our tax adviser receive the booking and invoice records needed for the accounts; Eversports, as the platform the bookings run through. Nobody else, unless you ask us to.

Health information: we do not ask for it. If you send us a medical certificate to pause a membership or to extend the validity of your credits (sections 5 and 6 of our terms), we use it only to decide on that request and to note the resulting period; we delete the certificate itself once the request is settled. By sending it you consent to this use (article 9(2)(a) GDPR); you can withdraw that consent at any time with effect for the future.

Participants under 18: the signed consent of a parent or guardian, given through a signature tool on our own server in Germany, is kept for as long as the participant attends classes with us and for three years afterwards. Legal basis: article 6(1)(b) and (f) GDPR (our interest in being able to prove the consent).

How long: we keep booking and contract data for as long as your contract with us runs and for three years after the end of the year of your last booking, the period in which claims under the contract can still be raised (sections 195 and 199 BGB). Invoices and other booking records stay for eight years under section 147 AO and section 257 HGB and are then deleted. Your Eversports account itself follows the rules of Eversports; you can delete it there.

9. Newsletter

The newsletter box asks for one thing, your email address, and for nothing else. What we send with it: new classes, workshops and events at the studio.

It works as a double opt-in. The address goes to our own server and from there to Listmonk, the newsletter software we run ourselves on the same server in Germany. Listmonk sends you one email asking you to confirm, and the subscription starts only when you open it and confirm on the page it takes you to. Until then the address sits unconfirmed and receives nothing. We store the time and the IP address of that confirmation, because that is what shows the subscription was asked for (article 7(1) GDPR). Legal basis: your consent, article 6(1)(a) GDPR and section 7(2) no. 3 UWG.

You can withdraw your consent at any time with effect for the future. Every email carries an unsubscribe link, and a mail to admin@sol-studio.co does the same. You are then marked as unsubscribed so that you are not written to again, and you receive nothing further; if you want the address gone altogether, say so and we delete it. An address that is never confirmed receives nothing either way.

The emails are delivered by Brevo, our sending provider, which processes your address on our instructions. Listmonk counts how often a newsletter is opened and how often a link in it is clicked, but not who did it: the setting that would tie those counts to a single address is switched off.

How long: your address stays on the list until you unsubscribe. The record of your confirmation stays for as long as the subscription runs and for three years after the end of the year in which it ended, so that we can still show it was given (sections 195 and 199 BGB).

10. Storage on your device

We set no cookies of our own. Two values are stored automatically, both in your browser’s session storage, both without personal data and both gone when you close the tab: sol:introremembers that the opening animation has played, so it does not replay on every page, and sol:newsletter notes that the newsletter box has been shown, so that it does not appear again on every page of the same visit. Everything else is stored in local storage only after your own action: sol_consent holds your map choice together with its date and the version of the map notice, so that we do not ask on every visit (we ask again when the map notice changes or after twelve months); umami.disabled holds your analytics opt-out; sol_newsletter holds whether you signed up or closed the newsletter box, with the date, so that it is not shown again after a signup and not for thirty days after you closed it. These entries exist only to run the site as you asked and are stored without consent (section 25(2) TDDDG). Details are in the cookie policy.

11. Recipients and where your data is processed

We process your data on our own server in Germany. The following companies act for us as processors under a contract pursuant to article 28 GDPR: STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin (server hosting and email hosting; data processing agreement concluded). Anthropic Ireland, Limited, Dublin, Ireland, with processing by Anthropic, PBC, San Francisco, USA (AI tools, see the section on them; transfer on the basis of the European Commission’s standard contractual clauses, which form part of the data processing agreement). Slack Technologies Limited, Dublin, Ireland, part of the Salesforce group with processing also in the United States (internal notification about new submissions of the class feedback form, see “Class feedback form”). STRATO in turn uses sub-processors, above all IONOS SE, Montabaur, Germany, for the server platform and Open-Xchange GmbH and Eleven GmbH, Germany, for email; the current list is part of STRATO’s data processing agreement. Encrypted backups of our server are stored on our own hardware at the studio and kept for up to 12 months; they are used only to restore the system and not to recover data that has been deleted on purpose. For the newsletter, Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, delivers the emails for us as a processor; the data processing agreement is appendix 3 of its terms of service. For bookings, the recipients named in the booking section apply as well: Eversport GmbH, Jakov-Lind-Straße 13, 1020 Vienna, Austria, our instructors, and our bookkeeping and tax adviser, all within the EU. Four processing operations can leave the EU: the Google map described above, which you control; the newsletter dispatch through Brevo; the AI tools of Anthropic, which we describe in the section “AI tools”; and the internal notification about new submissions of the class feedback form through Slack. For all four the European Commission’s standard contractual clauses apply, and for Brevo in addition the EU-US Data Privacy Framework. You can obtain a copy of the standard contractual clauses at admin@sol-studio.co. Everything else stays in the EU.

12. Your rights

You have the right to:

• access the personal data we hold about you (article 15 GDPR)
• have inaccurate data corrected (article 16)
• have data erased (article 17)
• have processing restricted (article 18)
• receive the data you gave us in a portable format (article 20)
• withdraw a consent you have given, at any time and with effect for the future (article 7(3)); this does not affect the lawfulness of processing before the withdrawal

Right to object (article 21 GDPR). Where we process your data on the basis of our legitimate interests (server logs, web analytics, enquiries, AI tools and the instructor-related part of feedback), you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

To exercise any of these rights, write to admin@sol-studio.co.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, datenschutz-berlin.de.

13. Changes

We update this policy when the site changes and record the version and date here. Version 2.5, 20 October 2026.