Privacy Policy

This privacy policy informs you about the nature, scope and purpose of processing personal data on Roxzone pursuant to the GDPR.

1. Data Controller

The controller for data processing on this platform is:

Roxzone Performance UG (haftungsbeschränkt)
Ulmenweg 49
53809 Ruppichteroth, Germany
Email: info@roxzone-performance.de
Managing Director: Jonathan Faber

No data protection officer has been appointed because the conditions (fewer than 20 persons engaged in ongoing data processing, no special categories of data under Art. 9 GDPR) are not met. Should the conditions change, a DPO will be appointed and listed here.

2. Data Collected

We process only the data you provide when using the platform or that is technically necessary to operate it:

• Account data: email address, display name, password hash (Argon2id, never plain text).
• Profile data: gender (for race matching), HYROX experience level, preferred language, optional avatar.
• Race-partner searches: event date, format, free-form search description.
• Ticket listings: race identifier, ticket ID (HYROX-external), price, free-form description.
• Messages: 1:1 conversation content between registered users (max. 2,000 characters per message), timestamps, read status.
• Logs and technical data: truncated IP address, user agent, request ID, error stack trace (on errors).

3. Purpose and Legal Basis per Data Category

• Account, profile, searches, listings, messages: performance of the user contract (matching race partners and start-place transfers) — Art. 6(1)(b) GDPR.
• Admin audit log, anti-fraud mechanisms, reports (RPT-*): legitimate interest in platform safety and abuse prevention — Art. 6(1)(f) GDPR.
• Server logs and error tracking: legitimate interest in operational security and error analysis — Art. 6(1)(f) GDPR.
• Cookieless analytics (Matomo): legitimate interest in aggregated reach measurement — Art. 6(1)(f) GDPR; cookieless configuration requires no consent under TTDSG.

4. Recipients / Data Processors

We use carefully selected data processors. The complete list with legal bases is available in our subprocessor register (see "Last updated:" below for the version date). External data processors at the time of publication:

• Strato AG, Germany — hosting of the entire application infrastructure (application server, Postgres database, offsite backups). Legal basis: Art. 6(1)(b) GDPR. DPA concluded / to be signed before GoLive.
• Resend (EU/Ireland) — transactional email delivery (account verification, match digest, ticket and message notifications) and processing of bounce/complaint webhooks. Legal basis: Art. 6(1)(b) GDPR. DPA concluded / to be signed before GoLive.

Additionally, we operate the following services self-hosted on our own infrastructure. No data is transmitted to third parties:

• Matomo — web analytics in cookieless mode, self-hosted on our infrastructure. No cookies, no cross-site trackers, no outbound connection to Matomo Cloud / InnoCraft Ltd.
• GlitchTip — error tracking (Sentry-API-compatible), self-hosted on our infrastructure. No outbound connection to the Sentry cloud / Sentry GmbH.

5. Data Transfer to Third Countries

None. All external data processors used (Strato, Resend) are based in the European Union and process data exclusively within the EU/EEA. Self-hosted services (Matomo, GlitchTip) run on the same EU infrastructure.

6. Retention

Retention is governed by our retention policy, versioned in config/retention.yml and enforced by automated background jobs (Phase 6):

• Unconfirmed accounts: 30 days after registration, then auto-deletion.
• Race-partner searches: 90 days after event date.
• Ticket listings in terminal state (sold / expired): 24 months.
• Admin audit log: 3 years.
• Postgres backups: 14 days rolling.
• Application logs: 7 days.
• Error events (GlitchTip): 90 days.
• Analytics (Matomo, cookieless): 180 days aggregated, no PII.

Upon account deletion, personal profile data (name, email, avatar, bio) is immediately and irreversibly overwritten (PII-scrub tombstone per LEGL-06). Messages already sent remain in the database because the conversation partner has a legitimate interest in the conversation history (Art. 17(3)(b) GDPR); the sender ID is set to NULL and the partner sees the sender as "deleted user".

7. Your Rights

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR) — to the data stored about you.
• Rectification (Art. 16 GDPR) — directly in your profile at /en/settings.
• Erasure (Art. 17 GDPR) — self-service via /en/settings; profile PII is deleted immediately.
• Restriction (Art. 18 GDPR) — by email to the privacy contact address listed above.
• Data portability (Art. 20 GDPR) — on request, as a JSON export of your personal data.
• Objection (Art. 21 GDPR) — to processing based on legitimate interests (Art. 6(1)(f) GDPR).

8. Cookies and Tracking

We use only strictly necessary cookies (session, CSRF, language preference, cookie consent). Optional embeds (e.g. videos) are blocked by default and only activated after your consent.

Our web analytics (Matomo) runs in cookieless mode: no cookies are set, no fingerprinting is performed and IP addresses are anonymized. Consent under TTDSG is therefore not required.

You can review or change your cookie settings at any time:

Change cookie settings

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR. The competent authority is the supervisory authority of the German federal state where we are based:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de

10. Changes to This Privacy Policy

We update this privacy policy when the legal situation, the services we use, or our processing activities change. There is no automatic mass-email broadcast on changes; the "Last updated:" date below is updated on every content change. We recommend reviewing this page before sensitive actions (e.g. account creation, listing publication).

Last updated: 2026-06-11