Privacy Policy

1. Data Protection at a Glance

General Information

The following notices provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator (service provider within the meaning of DDG). You can find their contact details in the section "Information about the responsible body".

How do we collect your data?

Your data is collected in part by you providing it to us. This may be data that you enter in a registration form or provide when booking a training session.

Other data is collected automatically or with your consent when you visit the website through our IT systems. This is primarily technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure error-free provision of the website (e.g., IP addresses in logs). Other data may be used to analyze your user behavior (inactivity, churn) to improve the service. We do not sell your data to third parties.

What rights do you have regarding your data?

You have the right at any time to receive free information about the origin, recipient, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future.

2. Hosting and Content Delivery Networks (CDN)

External Hosting

This website is hosted by external service providers (hosters). The personal data collected on this website is stored on the hosters' servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated through a website.

Hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of secure, fast, and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR).

Data Processing Agreement

We have concluded data processing agreements (DPA) with the above-mentioned providers. These are contracts required by data protection law that ensure they process the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

3. General Information and Mandatory Disclosures

Data Security

For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser's address bar changes from http:// to https:// and by the lock icon in your browser bar.

Additionally, we employ modern security measures such as Argon2 hashing for passwords, HttpOnly cookies for sessions, and Role-Based Access Control (RBAC) to protect your data from unauthorized access.

Retention Period & Backups

Unless a more specific retention period has been specified within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you make a legitimate deletion request or revoke consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data.

Right to Object (Art. 21 GDPR)

Delete Account

The "Delete Account" function in your profile under Settings → Privacy allows you to request the deletion of your data. Your account will first be suspended for 14 days. During this grace period, you can revoke the deletion at any time. After the period expires, all personal data will be permanently and irrevocably deleted from our active system.

4. Data Collection on This Website

Cookies & local storage

Our websites use so-called "cookies" and the local browser storage (LocalStorage).

Legal basis: The storage of information on your device (cookies/storage) is based on § 25(2)(2) TDDDG (Telecommunications Digital Services Data Protection Act), as this is technically mandatory for the operation of the site or was expressly requested by you (login checkbox).

AI-Powered Features (AI Act Transparency)

We use Artificial Intelligence (AI) to create personalized training plans.

• Transparency: The creation of training plans is automated through algorithms.
• Data processing: Your profile data is used for generation. Sharing for AI training purposes does not take place.

5. Product Analytics by THENN·OS

Type and Purpose of Processing

THENN·OS processes certain usage data to technically and functionally improve the platform, to measure app adoption, and to quickly see the relevant context for support requests. Controller for this product analytics is One Step Ahead UG (haftungsbeschränkt), not your tennis academy. The following data is collected:

• Usage duration and session: when and how long you actively use the app (active, idle, total), pseudonymous session ID
• Access mode: whether you access the app via browser or as an installed app from the home screen (PWA)
• Usage events: coarse events (e.g. page view, booking created), frustration signals (rage clicks, dead clicks), activation steps and technical metadata — no content data, no training content, no payment details

Controllership & Separation from Your Tennis Academy

This product analytics is carried out for One Step Ahead UG's own purposes. Your tennis academy receives no access to this data — neither as personalized analysis nor as individual records. We do not use the data to assess your playing strength, to evaluate training content, or to provide your tennis academy with personalized usage profiles of individuals. This separation is contractually established in § 13 of the Data Processing Agreement with your tennis academy.

Recipients & Visibility

The analytics are visible exclusively to authorized platform administrators of One Step Ahead UG (currently: Marcel Klemme as Managing Director). There is no transfer to third parties — no advertising networks, no data brokers, no external analytics service providers. All data remains on our servers in Germany (Ubicloud/Hetzner).

Legal Basis & Retention Period

Legal basis is Art. 6(1)(f) GDPR (legitimate interest in product improvement, activation measurement and PWA adoption analysis), supplemented for support diagnostics by Art. 6(1)(b) GDPR (contract performance of the service component). The legitimate interest assessment (LIA) is documented internally and can be reviewed on request. We retain this data for a maximum of 90 days and delete it automatically thereafter.

Right to Object (Opt-Out)

You can object to this processing at any time (Art. 21 GDPR) — either by email to support@thenn-os.de or via the "Product analytics" toggle in your Profile settings → Privacy. Upon opt-out, existing data is not deleted but anonymized within 24 hours (your user ID is removed). Aggregated statistics thus remain valid, while re-identification is excluded.

5a. Landing-Page-Analytics & A/B-Tests

Type and Purpose of Processing

On our public landing page, we collect pseudonymized usage data with your consent in order to optimize usability and conversion. This is an in-house analytics system — we do not use Google Analytics, Facebook Pixel or any other third-party tracking tools.

• Page views and scroll depth (in 25% steps)
• Visibility of individual page sections (section tracking)
• Clicks on call-to-action buttons (CTA tracking)
• Verweildauer auf der Seite and in einzelnen Abschnitten
• Visit origin (referrer, UTM parameters)
• Gerätetyp (Desktop/Mobil/Tablet) and gekürzter Browser-String

A/B tests

To optimize the landing page, we run A/B tests in which different versions of the page are shown. Assignment to a variant happens automatically based on a random session ID. The assignment is stored in your browser session storage (sessionStorage) and deleted when the tab is closed.

No persistent identifiers

All identifiers (visitor ID, session ID, A/B test assignment) are stored exclusively in your browser's sessionStorage. They are automatically deleted when the tab is closed. No cross-session tracking takes place.

Legal basis & consent

Collection only takes place after your explicit consent (opt-in) pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. The technically necessary session management (sessionStorage) is permitted without consent under § 25(2) no. 2 TDDDG. You can withdraw your consent at any time.

IP anonymization & retention period

IP addresses are anonymized immediately upon collection (last IPv4 octet or last 5 IPv6 groups zeroed out). Landing-page events are automatically deleted after 24 months. There is no transfer to third parties — all data remains on our own servers in Germany.

5. Internal Communication (Messages)

Type and Purpose of Processing

The platform offers an internal messaging function through which coaches, managers, and players within an organization can communicate. The following data is processed:

• Sender and recipient of the message
• Subject and content of the message
• Time of sending and reading

Legal Basis

Processing is based on Art. 6(1)(b) GDPR (contract performance) to enable communication between coaches and players within the context of training operations.

Access by the Operator

Retention Period

Messages are stored as long as your user account exists. When your account is deleted, all messages you have sent are also automatically deleted (Art. 17 GDPR).

6. Special Categories of Personal Data (Art. 9 GDPR)

Type and Purpose of Processing

In the course of using our platform, you may voluntarily provide information about your health condition (e.g., injuries, allergies, physical limitations).

Processing is carried out exclusively for the following purposes:

• Individual adaptation of training plans to avoid overexertion
• Consideration of health limitations in competition planning
• Emergency management (e.g., allergies for first responders)

Legal Basis

Processing is based on your explicit consent pursuant to Art. 9(2)(a) GDPR. The information is voluntary. Non-provision has no effect on your membership or the general usability of the platform.

Circle of Recipients

Your health data is accessible exclusively to the coaching staff responsible for you and the academy management. No transfer to third parties takes place.

Retention Period and Revocation

We store the data until you revoke your consent or leave the academy. You can revoke your consent at any time in your profile settings. After revocation, the corresponding data will be deleted immediately.

7. Season Surveys

Type and Purpose of Processing

Through public survey links, tennis schools and sports organizations can collect training preferences from their members. The following data is collected:

• Name and email address (for identification and verification)
• Phone number (optional, for follow-up questions)
• Training preferences (preferred days, times, group size, etc.)
• Answers to individual questions from the respective organization

Legal Basis

Processing is based on your explicit consent pursuant to Art. 6(1)(a) GDPR, which you give by submitting the survey form.

Recipients of Data

Retention Period

Your survey responses are stored for the duration of the training planning, usually until the end of the respective season. You can revoke your consent at any time by email to the respective organization. After revocation, your data will be deleted immediately.

Double Opt-In

To verify your email address, we will send you a confirmation link. Only after clicking this link will your preferences be saved and transmitted to the organization.

8. Additional Features & Third Parties

10. Your Rights

Right to Complain to the Supervisory Authority (Art. 77 GDPR)

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged infringement.

Right to Data Portability (Art. 20 GDPR)

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format (JSON). You can find this function in your Settings → Privacy → Data Export.

11. AI-Assisted Software Maintenance (Anthropic Claude)

For rapid bug fixing, further development and technical quality assurance, we use the AI service Anthropic Claude (Anthropic PBC, USA). We have designed this access to protect your privacy as much as possible:

• Only pseudonymized data: Your real name, email address, phone number, postal address and date of birth are NEVER sent to Anthropic. Claude only receives stable, organization-scoped pseudo-IDs (e.g. <em>User_a1b4</em>) and generalized data (e.g. birth year only).
• Server-side enforcement: Pseudonymization happens in a middleware before every API response. The AI service cannot bypass it.
• Read-only access: Claude cannot modify or delete data. Every single access is audit-logged (90-day retention).
• US transfer safeguarded: Anthropic is certified under the EU-US Data Privacy Framework. Additionally, standard contractual clauses (SCC) are in place.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in software quality and operational security). The balancing test is documented and can be reviewed on request. You have the right to object to this processing at any time under Art. 21 GDPR.