Data Policy

Status: 27.04.2023According to Art. 13 DSGVO we would like to inform you about the processing of your data.

1. contact details

You can reach us as follows:
Ultimate Fighting Academy Wendl-Dietrich-Str. 21D 80634 Munich, GermanyPhone: +49 172 6995002 E-mail: moc.ymedaca-gnithgif-etamitlu%40eciffo Website: https://www.ultimate-fighting-academy.com/

2. purpose and legal basis

Insofar as you provide us with the personal data mentioned below, we will only process this data in order to contact you, if necessary, to answer your inquiries and to process service requests (registration for trial training, pre-registration for a membership application or similar; the legal basis in each case is Art. 6 para. 1 lit. b DSGVO), for competitions (legal basis here is Art. 6 para. 1 lit. a or b DSGVO), in relation to advertising measures towards you (legal basis here is Art. 6 para. 1 lit. a DSGVO, if you have given explicit consent, for example for a newsletter, an SMS or a call, or Art. 6 para. 1 lit. f DSGVO, the processing of personal data for the purpose of direct marketing can be considered as processing serving a legitimate interest), in order to provide you with access to certain information or offers, or to establish, perform or terminate the contract with you (the legal basis here is Art. 6 (1) lit. a (in the context of the above-mentioned advertising consent) or b (if this is necessary to establish, implement or terminate your membership contract) DSGVO), for other communication with you, for example to receive feedback from you (legal basis here is Art. 6 para. 1 lit. a DSGVO for feedback emails sent), as well as in the context of legal requirements, for example to comply with legal obligations (legal basis here is Art. 6 para. 1 lit. c and f DSGVO) and other legitimate interests pursuant to Art. 6 para.1 lit. f DSGVO (for example, for quality assurance (in particular to avoid multiple conclusion of contracts), enforcement of our claims, improvement of the studio and course offerings, prevention of misuse of trial training offers, issuance and enforcement of a house ban or for the prosecution of criminal offenses (for example, in case of locker break-ins, theft or similar)). Further legal bases (in particular with regard to Corona) will be explained in the course of this privacy policy.
Of course, we respect your decision not to provide us with your personal information to support our relationship with you (particularly for direct marketing or market research purposes).
We only disclose personal data about members if we are legally obliged to do so (legal basis here is Art. 6 para. 1 lit. c DSGVO) or if we are obliged to do so by a court decision or if the disclosure is necessary to enforce or protect our interests, General Terms and Conditions or other agreements or the interests of our members (legal basis here is Art. 6 para. 1 lit. f DSGVO). This applies accordingly with regard to other processing of the data.
The data is not disclosed for commercial purposes.
Our employees and the service companies commissioned by us are obligated by us to maintain confidentiality and to comply with the provisions of the DSGVO, the Federal Data Protection Act and other statutory regulations. Access to personal data by our employees is limited to those employees who need the respective data due to their professional tasks.
Specifically, we would like to inform you about the following purposes, the data collected there and their use:

a. Use of personal data for the processing of trial trainings and membership applications and during membership
We collect personal data for the processing of trial trainings and membership applications (legal basis here is Art. 6 para. 1 lit. b DSGVO).
This data is required for the agreement of a trial training or membership with us and is used exclusively for the establishment, execution or termination of the contract between UFA and you, if necessary also for assistance and support purposes when using the member area or when using the UFA app as well as for the scheduling and execution of a trial training. Without this data, it is not possible for us to offer you a trial training or to conclude a contract with you.
The following data is collected when arranging a trial training:- Gender*- Name*, First name*- Date of birth*- Contact details (e-mail address)*
The following data is collected during the pre-registration of membership applications:- Gender*- Name*, First name*- Date of birth*- Contact details (address, e-mail address)*- Bank details (IBAN)
The following data is collected when the UFA contract is agreed:- Gender*- Name*, First name*- Date of birth*- Contact information (e-mail address, phone number, etc.)*.- Payment method*- Health question- Country, type and number of the identity document- If applicable, surname, first name and country, type and number of the identity document of the legal guardian.- Contract data
After the conclusion of the contract, we still collect a picture of you for the Card, so that we can identify you without any doubt during your visits.
In addition, we also store your visit data (e.g. barrier entries to parking spaces or parking garage, locker data, access data) and your occupancy of the changing room and/or valuables lockers on a personal basis for the past and current calendar year so that we can optimize our studios and courses for you or so that you can prove to your health insurance company, employer, etc. that you have trained regularly in order to receive bonuses or similar. We process this data (image data, visit data) for the above-mentioned purposes and legal bases.
If you use other services or offers of UFA, we process the data required in the context of these services and offers pursuant to Art. 6 para. 1 lit. b DSGVO. Examples are training plans, appointments for the creation of training plans, surveys, participation and success of challenges, or similar.

b. Use of personal data in the context of the "Member Area"In the Members Area you can manage your membership matters independently. We use the personal data you provide here exclusively to the extent that your data is necessary for the fulfilment and processing of our services (the legal basis here is Art. 6 (1) lit. b DSGVO). The services include in particular:- Changes of user data, change of contract data and bank data- Processing of the requested rest periods- Processing of the requested cancellation and revocation of membership- Support with contractual issues
Sensitive data, such as your bank details, are not displayed in plain text in the Members Area.

c. Contact formIf you send us inquiries via the contact form, your data from the inquiry form, including the contact data you provided there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions (legal basis here is Art. 6 para. 1 lit. a DSGVO).

d. FeedbackWe enable you to give us feedback on trial trainings, the studio visit, etc. to give feedback. Here we would, after prior consent according to Art. 6 para. 1 lit. a DSGVO from you, send a corresponding feedback email. You can revoke your consent at any time with effect for the future. To do so, please contact the data protection officer, which you can find in this privacy policy. 

3. provision of your data

The provision of your data by you is voluntary. Nevertheless, without this provision we can not contact you, send you information ... and finally establish a business relationship with you.

4. transfer of data to third parties or to a third country

We do not share your data with third parties without a legal basis (according to Art. 6 para. 1 lit. c or f DSGVO). We process your data primarily in the European Union (EU) and the European Economic Area (EEA). However, some of the service providers we use are located outside the EU and the EEA ("third country"). The GDPR sets high requirements for the transfer of personal data to so-called third countries. For some third countries, the European Commission has decided that they provide an adequate level of data protection (e.g. Switzerland, Canada, Argentina). To the extent that we transfer data to a third country for which such an adequacy decision does not exist, the corresponding data transfer - unless otherwise stated in this Privacy Policy - is based on a contract between us and the relevant recipient using the standard data protection clauses of the European Union, and, if applicable, further supplementary measures agreed with the recipient to ensure an adequate level of data protection. By these standard data protection clauses alone, the recipient of the data undertakes to process the data in accordance with European standards, even if the data should be processed in the USA (or another insecure third country).
For more information on standard contractual clauses, please visit https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

5. your rights

You have the right to request information from us at any time about the data we have stored about you, as well as about its origin, recipients or categories of recipients to whom this data is disclosed and the purpose of its storage.
If your data should not be correct, you can of course also request a correction of your data.
You can also request deletion of your data. We will comply with this request for deletion without delay. In doing so, we may have to comply with applicable legal storage regulations.
If you have given your consent to the use of data, you can revoke this consent at any time with effect for the future.
You also have a right to data portability, for example after you have terminated the contract with us. We will provide you with your data in a machine-readable format upon your request.
Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) DSGVO; this also applies to profiling based on these provisions. If the personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.
Please direct all requests for information, requests for deletion, etc. or objections to data processing to the contact details of our data protection officer given below.
You also have the right, if you are not satisfied with our data processing, to complain to a competent data protection supervisory authority.
We are happy if you talk to us first, so that we can clarify possible ambiguities or uncertainties together.

6. recipients of data

Internal receivers: - Specialized departments and persons who need to know this data in order to perform their tasks and fulfill the above-mentioned purposes.
External recipients (in addition to the recipients already outlined in this information, we may disclose data to the following external recipients in particular (order processors and third parties), but only if there is a legal basis for doing so (pursuant to Art. 6(1)(a), (b), (c) or (f) DSGVO, see above) or if there are legally compelling reasons for doing so):- Service companies that are required to provide our services (in particular IT service companies, consulting companies)- Companies/institutions to support us in enforcing our claims (e.g. collection agencies)- Public authorities and institutions (health offices, courts)- Investigating authorities (police, public prosecutor's office)- Vicarious agents

7. sources of your data

We collect data directly from you or through our own systems. In exceptional cases (to enforce our legal claims), we also collect data from other sources (in particular civil registers). Exceptions to this can also be found in this privacy policy.

8. modification of our privacy policy

We reserve the right to change our security and data protection measures if this becomes necessary due to technical developments, changes in our data processing or due to legal changes. In these cases, we will also adapt our data protection notices accordingly. Therefore, please note the current version of our data protection statement.

9. deletion

The deletion of stored personal data takes place, in addition to the retention periods specifically mentioned in this information, if you revoke your consent to storage, if their knowledge is no longer necessary for the fulfillment of the purpose pursued with the storage or if their storage is inadmissible for other legal reasons, unless legal retention regulations speak against a deletion, then a blocking of the data takes place instead of the deletion.
We provide for special deletion periods and anonymization periods for this data:
If you attend a trial training without an appointment with us, this data will be anonymized after 4 weeks.
If you make an appointment with us for a trial training session, this data will be- 24 h after the appointment anonymized if you did not appear, and- Anonymized 4 weeks after the appointment if you appeared.
Anonymizing means that it is not possible for us to recover your data (we store a "hash value" for this purpose). If you arrange a trial training again, we can recognize that you have already participated in a trial training once. We store this hash value for at least 6 months. The supplementary legal basis here is Art. 6 (1) lit. f DSGVO. Our legitimate interest for the processing of 6 months is that we need to identify trial trainers for this period to prevent misuse of our offer.
If you make a pre-registration with us and do not confirm it within 4 weeks, your data will be deleted. If you want us to delete the data before then, please contact us at the contact details of the data protection officer given below.
We store your visit data and your occupancy of the changing room and/or valuables lockers on a personal basis for the past and the current calendar year. After that, they are deleted, unless you have given us permission to store this data for a longer period. 
Then we delete the data after revoking your consent. The legal basis is then Art. 6 para. 1 lit. a DSGVO.

10. automated decision making, including profiling

Automated decision-making including profiling does not take place.

11. contact person for questions regarding data protection

If you have any further questions about the collection, processing and use of your personal data, please contact our data protection officer.
Ultimate Fighting Academy Data Protection OfficerWendl-Dietrich-Str. 21D80634 Munich, GermanyE-mail: moc.ymedaca-gnithgif-etamitlu%40eciffo
Please use his e-mail address only for questions regarding data protection and not for contract or other questions. Please contact Member Services directly for this purpose.

12. corona

We also use your visit data (access data to the studio and to courses) to fulfill the requirements of the respective valid corona ordinances of the countries. These oblige us to provide your visit data to the health authorities upon request. Depending on the federal state, this may be:- First name/last name and/or- Address and/or- E-mail address and/or- Phone number and- Visit data
The purposes of processing are derived from the respective corona ordinances and the purposes of the Infection Protection Act, in particular the purpose of contact tracing. The types of data are (see above) contact data and visit data. Recipients in this case are, in particular, authorities (public health offices). There is no legal or contractual obligation to provide your data. However, if you do not provide us with this data, we will have to deny you access. Since the Corona Ordinances and thus the legal basis and the data to be collected are subject to frequent changes, the current Corona Ordinances of the respective country apply and we ask you to observe them. The Corona Ordinance of the federal state in which the studio you are visiting is located applies.
In some federal states we also need your consent. By entering the studio with your membership card, you agree that we process your data in accordance with and for the purposes of the respective regulation and in addition to our general data protection information. If you do not agree, we are unfortunately obliged to deny you access in accordance with these legal provisions.
In addition, we offer you on a voluntary basis the possibility to file your 2G status (vaccinated or recovered) with us and to allow us to process this data in order to facilitate your access and to give us the possibility to prove to authorities the correct implementation of the corona regulations. For this purpose, it is necessary that you give us your consent according to Art. 9 para. 2 lit. a DSGVO. 
The text of the consent reads: "I hereby consent pursuant to Art. 9 (2) lit. a DSGVO that UFA processes my 2G status (vaccinated or recovered) with the data required for this purpose (in particular vaccination date/recovery date). I can revoke this consent at any time with effect for the future. To do so, I contact the UFA data protection officer (see privacy policy). I have read and accept the privacy policy."

13. information on call recordings for telephone calls

Purpose We record phone calls with your consent to our membership management staff for training and quality management purposes. 
Type of data Call recordings of telephone calls.
The legal basis is your consent pursuant to Art. 6 (1) lit a DSGVO or, if you provide us with health data during the interview, Art. 9 (2) lit a DSGVO. You can revoke this consent at any time with effect for the future. To do so, please contact our data protection officer (see above). 
Categories of recipients Recipients of the call recordings are specialist departments and service providers who provide us with the relevant infrastructure or otherwise support us with regard to member communication.
Duration of storage The records are stored for 30 days and then automatically deleted.

14. information on other functions of our website

Cookies
a) General:In order to make your visit to our website more attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your terminal device. Some of the cookies we use are deleted after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your terminal device and enable us or our partner companies to recognize your browser on your next visit (persistent cookies). We use cookies to personalize content and ads and to analyze traffic to our website. We also share information about your use of our website with our social media, advertising and analytics partners.
b) Legal basis and objection:The legal basis for the use of cookies is your consent. We only set one or more cookies if you have consented to the use of cookies in the cookie popup that appears when you visit our website. The legal basis is then Art. 6 (6) 1 lit. a DSGVO. ]
Privacy policy for the use of Google Ads (formerly Google AdWords)This website uses the Google Ads service. Google Ads is an online advertising program of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). In doing so, we use the remarketing function within the Google Ads service on the one hand. The remarketing function allows us to present users of our website with advertisements based on their interests on other websites within the Google display network or the Google search network (on Google itself, so-called "Google ads" or on other websites). For this purpose, the interaction of the users on our website is analyzed, e.g. which offers the user was interested in, in order to be able to display targeted advertising to the users on other sites even after they have visited our website. For this purpose, Google stores a number in the browsers of users who visit certain Google services or websites via Google display network or Google search network. This number, known as a "cookie", is used to record the visits of these users. This number is used to uniquely identify a web browser on a particular computer and not to identify a person, personal data is not stored. You can disable Google's use of cookies by following the link below and downloading and installing the plug-in provided there: https://www.google.com/settings/ads/plugin. You can find more information about Google remarketing and Google's privacy policy at: http://www.google.com/privacy/ads/. Furthermore, this website uses the so-called conversion tracking in the context of using the Google Ads service. When you click on an ad placed by Google, a cookie for conversion tracking is stored on your computer/end device. These cookies lose their validity after 30 days, do not contain any personal data and are therefore not used for personal identification. The information collected using the conversion cookie is used to create conversion statistics for Ads customers who have opted for conversion tracking.
You may refuse the use of cookies by selecting the appropriate settings on your browser, or by choosing not to accept them; however, please note that if you do this you may not be able to use the full functionality of this website. In addition, you can deactivate interest-based ads on Google as well as interest-based Google ads on the web (within the Google display network and search network) in your browser by activating the "Off" button at http://www.google.de/settings/ads or by deactivating it at http://www.aboutads.info/choices/. You can find more information about your settings options in this regard and Google's data protection at: https://www.google.de/intl/de/policies/privacy/?fg=1.
Privacy policy for the use of Google AnalyticsThis website uses functions of the web analysis service Google Analytics. The provider is Google Inc. 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. Google Analytics uses so-called "cookies". These are text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of the website such as:- Browser type/version,- Operating system used,- Referrer URL (the previously visited page),- Host name of the accessing computer (IP address),- Time of the server request are usually transferred to a Google server in the USA and stored there.
IP anonymization: If IP anonymization is activated on this website, however, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
Objection: You may refuse the use of cookies by selecting the appropriate settings on your browser, or by not giving your consent; however, please note that if you do this, you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent the collection by Google Analytics by clicking on this link: Disable Google Analytics. An opt-out cookie will be set that prevents future collection of your data when visiting this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again.
Further information:We continue to use Google Analytics to analyze data from double-click cookies and also Google Ads for statistical purposes. If you do not want this, you can deactivate this via the Ads Preferences Manager (http://www.google.com/settings/ads/onweb/?hl=de).
Use of Google Web Fonts (local hosting)This site uses so-called web fonts provided by Google for the uniform display of fonts. The Google Fonts are installed locally. A connection to Google servers does not take place. Further information on Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google's privacy policy: https://policies.google.com/privacy?hl=de.
Use of Google Tag ManagerThis website uses the Google Tag Manager. Through this service, website tags can be managed through an interface. The Google Tool Manager only implements tags. This means that no cookies are used and no personal data is collected. The Google Tool Manager triggers other tags, which in turn may collect data. However, the Google Tag Manager does not access this data. If a deactivation has been made at domain or cookie level, it remains in place for all tracking tags, insofar as these are implemented with the Google Tag Manager.
Click here to be excluded from collection by Google Tag Manager.
You can find more information about Google Tag Manager at:• http://www.google.de/tagmanager/faq.html• http://www.google.de/tagmanager/use-policy.html
YouTube with enhanced privacy modeOur website uses plugins of the company YouTube. The operator is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
UFA uses YouTube in the so-called extended data protection mode. According to YouTube, this mode ensures that YouTube does not store any information about visitors to our website before they view the video. However, the transfer of data to, for example, partners of YouTube is not conclusively excluded by this mode. Thus, YouTube - regardless of whether you watch a video - establishes a connection to Google's DoubleClick network. As soon as you start a video from YouTube on our website, a connection to YouTube's servers is established. In the process, which of our pages you have visited is transmitted to the Youtube server. If you are logged in to your Youtube account and link this website or its content to your Youtube profile, various personal data will be transmitted to Youtube and/or Google as part of this process. In this way, Youtube and/or Google also become aware that you have visited our website. We would like to explicitly point out that we as the provider of this website have no or only little knowledge of the categories of this data, the content of this data and its further processing and use by Youtube and/or Google. You can find more information about this in the privacy policy of Youtube or Google at: https://www.google.com/intl/de/policies/privacy. Furthermore, YouTube can save various cookies on your end device after starting a video. With the help of these cookies, YouTube can obtain information about visitors to our website. This information is used, among other things, to collect video statistics, improve the user experience and prevent fraud attempts. Cookies remain on your terminal device until you delete them. If necessary, further data processing can be started after the start and during the playback of a video on Youtube, over which we unfortunately have no influence.
Our legitimate interest pursuant to Art. 6 (1) lit. f DSGVO in using YouTube and its videos is to present an appealing presentation of the offers of our website and in our app. 
For more information about YouTube's privacy policy, please see YouTube's privacy policy at: https://www.youtube.com/t/privacy_at_youtube.
Use of Google MapsThis site uses the map service Google Maps via an API. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this site has no influence on this data transmission.
The use of Google Maps is in the interest of an appealing presentation of our online offers and an easy location of the places indicated by us on the website. This represents a legitimate interest within the meaning of Art. 6 para. 1 lit. f DSGVO. Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a DSGVO; the consent can be revoked at any time.
More information on the handling of user data can be found in Google's privacy policy: https://policies.google.com/privacy?hl=de.
Use of Google reCAPTCHAWe use "Google reCAPTCHA" (hereinafter "reCAPTCHA") on this website. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.The purpose of reCAPTCHA is to verify whether data entry on this website (e.g. in a contact form) is made by a human or by an automated program. For this purpose, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. For the analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent by the website visitor on the website or mouse movements made by the user). The data collected during the analysis is forwarded to Google.
The reCAPTCHA analyses run entirely in the background. Website visitors are not notified that an analysis is taking place.
The storage and analysis of the data is based on Art. 6 para. 1 lit. f DSGVO. The website operator has a legitimate interest in protecting its web offers from abusive automated spying and from SPAM. If a corresponding consent was requested, the processing is based exclusively on Art. 6 para. 1 lit. a DSGVO; the consent can be revoked at any time.
For more information on Google reCAPTCHA, please refer to the Google Privacy Policy and the Google Terms of Use at the following links: https://policies.google.com/privacy?hl=de and https://policies.google.com/terms?hl=de.
Transfer to a third countryWhen using technologies that help us to optimize our website, our marketing activities or your visit to our website, we may use providers in third countries (e.g. USA) within the scope of the legal provisions. To ensure an adequate level of data protection when processing this data, we use in particular the so-called standard contractual clauses pursuant to Art. 46 DSGVO, in accordance with the implementing decisions of the European Commission, as amended from time to time. You can view the standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.
We would like to point out that for all providers mentioned in this privacy statement that are based in the USA and/or also process data in the USA, where according to the opinion of the ECJ there may not be an adequate level of data protection and thus there are risks for the processing of personal data. 
We counter these risks by establishing an appropriate level of data protection with the aforementioned service providers by concluding the aforementioned standard contractual clauses with the providers pursuant to Art. 46 DSGVO. Through these contractual agreements, the respective providers undertake to apply appropriate standards in their companies when processing personal data so that the European level of data protection is complied with. This is particularly the case when data is processed in the USA. For the providers above, we have linked to the corresponding standard contractual clauses or additional information where applicable.