Imprint

Information pursuant to § 5 DDG (German Digital Services Act) and § 18 (2) MStV.

Service provider

Zandups GmbH
Egelsbacher Straße 79
63225 Langen (Hessen)
Germany

Managing director with power of representation

Tobias Zander

Contact

Email: info@tobiaszander.de

Register entry

Entered in the commercial register.
Register court: Amtsgericht Offenbach am Main
Register number: HRB 48730

Responsible for content under § 18 (2) MStV

Tobias Zander, address as above.

Liability for content

We compile the content of these pages with care, but cannot guarantee that it is accurate, complete or up to date. As a service provider we are responsible for our own content under the general laws. We are not obliged to monitor third-party information transmitted or stored on our systems, or to investigate circumstances that indicate unlawful activity. Obligations to remove or block the use of information under the general laws remain unaffected. Liability in this respect begins only once we become aware of a specific infringement, and we remove such content without delay.

Liability for links

Our pages contain links to external websites over whose content we have no control, so we cannot accept responsibility for it. The provider or operator of a linked page is always responsible for its content. Linked pages were checked for possible legal infringements at the time of linking, and no unlawful content was apparent. Permanent monitoring is not reasonable without specific evidence of an infringement. Where we become aware of infringements, we remove such links without delay.

Copyright

The content and works on these pages are protected by German copyright law. Reproduction, editing, distribution and any form of exploitation beyond the limits of copyright require our written consent. Downloads and copies of this site are permitted for private, non-commercial use only. Where content here was not created by us, third-party rights are respected and such content is marked as third-party. If you notice a copyright infringement, please tell us and we will remove the content without delay.

Dispute resolution

We are neither obliged nor willing to take part in dispute resolution proceedings before a consumer arbitration board.

No medical advice

360° Data Athlete gives training guidance based on your own activity data. It does not replace a physician, a physiotherapist or sports-medical advice, and it makes no diagnoses. Train within your own limits and seek medical advice before starting or changing training if you have any health concerns.

Privacy policy

Last updated: August 2026 · Applies to this website and to the 360° Data Athlete service.

1. Overview

We take the protection of your personal data seriously. We process personal data only where a legal basis under the GDPR applies, only for the purposes described here, and only for as long as we need it. Your training data is used to coach you, and we do not sell it.

2. Controller

Zandups GmbH
Egelsbacher Straße 79, 63225 Langen (Hessen), Germany
Represented by Tobias Zander
Email: info@tobiaszander.de

The controller is the natural or legal person who decides, alone or jointly with others, on the purposes and means of processing personal data.

3. Hosting and server log files

This website and the service are hosted on Amazon Web Services (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg), acting as our processor under a data processing agreement pursuant to Art. 28 GDPR. Data is stored in AWS data centres in the European Union. Each time you access the site, the provider’s systems automatically record technical data your browser transmits: IP address, date and time of the request, the page requested, referrer URL, browser type and version, and operating system. This data is processed to deliver the site securely and reliably (Art. 6 (1)(f) GDPR, our legitimate interest in secure operation) and is deleted or anonymised after 30 days.

4. Cookies and Google Analytics

Cookies that are technically necessary to operate this site and to keep you signed in are set on the basis of § 25 (2) TDDDG and Art. 6 (1)(f) GDPR. Beyond those, the only cookies we set are for Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics helps us understand how the site is used so we can improve it, and it records data such as pages viewed, approximate location, device and browser, and referral source, with IP addresses truncated before storage. These cookies are set only if you consent in our cookie banner (Art. 6 (1)(a) GDPR and § 25 (1) TDDDG). You can withdraw your consent at any time in the banner settings, with effect for the future, and the site works fully without them. Google may process data on servers in the United States; such transfers are covered by the EU Commission’s standard contractual clauses under Art. 46 (2)(c) GDPR and Google LLC’s certification under the EU-US Data Privacy Framework. We use no advertising cookies and no cross-site tracking.

5. Waitlist and contact by email

If you join the waitlist, we process the email address you enter and the optional details you select (the device you train with, your training goal). We use them to inform you when your place is available and to plan the rollout, on the basis of your consent (Art. 6 (1)(a) GDPR). You can withdraw your consent at any time by emailing us or using the unsubscribe link, with effect for the future. We delete waitlist data once you have been onboarded or withdraw, unless statutory retention duties apply. If you contact us by email, we process the content of your message to answer it (Art. 6 (1)(b) and (f) GDPR).

6. Your account and training data

To coach you, we process the account data you provide (email address, name if given, language, training goal) and the activity data you choose to connect: workouts, distance, pace, duration, heart rate, sleep and recovery metrics, and the notes you write. Health-related data of this kind can constitute special category data under Art. 9 GDPR. We process it only with your explicit consent under Art. 9 (2)(a) GDPR, which you give when you connect a data source, and only to plan and explain your training. You can withdraw that consent at any time by disconnecting the source or deleting your account.

7. Connecting Garmin, Strava, Apple Health, Polar and Coros

When you link a platform, you authorise it to share your activity data with us through its official interface. We receive only the data the respective scope covers, and only for as long as the authorisation is active. Revoking access in that platform, or in our settings, stops any further transfer. The platform’s own privacy policy governs its processing. Legal basis: your consent (Art. 6 (1)(a) and Art. 9 (2)(a) GDPR).

8. AI processing of your data

Your plans and explanations are generated with the help of large language models operated by Anthropic (Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland), acting as our processor under a data processing agreement pursuant to Art. 28 GDPR. We transmit only the data needed to produce the coaching output, and the provider may process it only for that purpose and in line with its own terms and retention rules. Where processing takes place outside the EEA, it is safeguarded by the EU Commission’s standard contractual clauses under Art. 46 (2)(c) GDPR. There is no automated decision-making within the meaning of Art. 22 GDPR that produces legal effects for you: coaching output is a recommendation you decide whether to follow.

9. Recipients and processors

We share data only with providers who help us run the service: AWS hosting, email delivery, analytics, error monitoring and Anthropic as named above. Each is bound by a data processing agreement and may use the data only on our instructions. We do not sell personal data and do not pass it to third parties for advertising.

10. Storage periods

We keep your account and training data for as long as your account exists. After you delete your account we remove it within 30 days, except where we must retain records to meet statutory duties. Server logs are deleted after 30 days; waitlist entries when you are onboarded or withdraw consent.

11. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable, machine-readable format (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw any consent you have given, with effect for the future (Art. 7 (3)).

To exercise any of these rights, email info@tobiaszander.de. You also have the right to lodge a complaint with a supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit).

12. Data security

This site uses TLS encryption in transit, shown by the padlock in your browser. We apply appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, and review them regularly.

13. Changes to this policy

We update this policy when the service or the legal position changes. The current version always applies and is available on this page. If a change materially affects you, we will tell you in good time.