Privacy policy

1. Controller

This policy explains the processing of personal data when you visit my website or contact me. It covers jr-cycling.de and the corresponding deployment at radsportcoaching.pages.dev.

Jonas Rapp, sole proprietor
Jonas Rapp Cycling Coaching
Hinter Eichbaum 1
55595 Wallhausen, Germany
Email: [email protected]
Telephone: +49 176 79957005

2. Website operation and security

The website is hosted on Cloudflare Pages. I use Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, for content delivery, DNS and protection against attacks. Processing includes IP address, requested URL, timestamp, technical browser and connection information, and security events.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is to provide an accessible, reliable website protected against abuse. When you submit the form, a Cloudflare Function also processes the information you provide.

My application code does not create its own visitor log or a database of message content. Only the counters described in section 4 are stored for spam protection. This is separate from providers’ processing of operational and security data. Their retention is determined in particular by operational and security purposes, the need to investigate incidents, and legal obligations. This does not mean all visitor data is immediately deleted.

More information: Cloudflare Privacy Policy (external website, new tab) and Cloudflare Data Processing Addendum (external website, new tab).

3. Contact form and email

When you submit the form, I process your name, email address, selected coaching option and message. Please do not send medical reports or other health data through the form.

I use these details to handle your enquiry, answer questions and, where applicable, prepare to work together. Article 6(1)(b) GDPR applies to enquiries concerning a prospective or existing contract. I handle other enquiries under Article 6(1)(f) GDPR; my legitimate interest is to answer messages addressed to me.

The required fields are needed to handle a form enquiry. Using the form is voluntary. I reply by email. You can email me directly instead. Without contact details, I cannot reply.

The Cloudflare Function passes the form information to Zoho CPaaS, formerly ZeptoMail, and sends it to my inbox at [email protected]. Your email address is used as the reply-to address. My mailbox is provided by Zoho Mail. For email enquiries, I process the sender address, message, any attachments and technical message data.

I use the EU services of Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands. Use of the EU region does not exclude all access from other countries. Information about international processing and subprocessors is in the Zoho Privacy Policy (external website, new tab).

Open and click tracking are disabled for form delivery. Additional storage of newly sent message content in the CPaaS sending archive is also disabled. This does not affect delivered messages in my mailbox or technical delivery logs. Zoho keeps email delivery logs for 60 days by default. Copies of content stored before the setting was disabled may remain until they are deleted or their previous retention period expires.

Provider information: Zoho CPaaS delivery logs (external website, new tab).

4. Server-side spam protection

The contact form is protected by server-side input validation, a hidden spam field and limits on repeated requests. No external CAPTCHA script is loaded in the browser for this purpose. This form protection does not set cookies or use Local Storage.

When you submit the form, the Cloudflare Function processes the connection IP address. A secret key is used to derive an identifier valid for the current 15-minute window (HMAC). A Cloudflare D1 database stores only this pseudonymous identifier, a counter and its expiry time. The raw IP address, names, email addresses and messages are not stored in this counter database. Separately, Cloudflare processes connection data for hosting and security as explained in section 2.

The limit allows up to five validated sending attempts per IP address and fixed 15-minute window. There is also a website-wide limit of 100 sending attempts per UTC calendar day. Failed sending attempts may count towards these limits. You can still contact me directly by email when a limit is reached. People sharing a public IP address share the same limit.

IP-based counters expire at the end of their 15-minute window; the general daily counter expires at the start of the next UTC day. Expired records are deleted when the next form request passes input validation. Without another request, expired entries may remain stored longer, but are no longer used to enforce limits. Cloudflare also retains automatic D1 recovery copies: currently for up to seven days on the free plan or 30 days on the paid plan.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is to limit automated spam and abuse of the sending service. The identifiers are not used for advertising, visitor analytics or combining usage profiles.

5. Optional Strava preview

In the social media section, you can load a preview of my activities from Strava, Inc., USA. The Strava frame is not embedded before you activate it. Your browser only connects to Strava after you select the button with the accompanying explanation.

Strava receives your IP address and technical browser and connection information. If you are logged in to Strava, it may be possible to associate the request with your account. Strava may use cookies or similar browser technologies. Processing may take place outside the EEA. Strava explains its international transfer mechanisms, including Standard Contractual Clauses, in its Privacy Policy (external website, new tab).

Activation is voluntary. The legal bases are your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. This website does not permanently store your choice.

Selecting “Close preview” removes the embed and withdraws consent for further preview requests on this page. Reloading the page also disables the preview. Data already transmitted cannot be recalled by doing this. You can separately delete browser data set by Strava through your browser settings.

6. Social media links and WhatsApp

Instagram, Facebook and the Strava profile link are ordinary external links. Their icons do not load content from those platforms. Only following an external link opens the platform, where its own privacy terms apply.

Voluntary communication through WhatsApp Business uses a separate consent process and a confirmation message you send yourself. Details about data, recipients, withdrawal and retention are in the WhatsApp privacy information. WhatsApp is not required to make an enquiry or enquire about coaching.

7. Browser storage, fonts and analytics

Cloudflare Web Analytics is disabled. I do not use my own analytics or advertising tracking on this website. The web fonts are served with the website; loading them is not intended to require a direct request from your browser to Google Fonts.

The website does not permanently store the WhatsApp or Strava preview choice in cookies or Local Storage. This is separate from storage access by technical security services or external content you activate, as described above. This is therefore not a blanket statement that no cookies or browser entries can ever be created.

8. Recipients and international transfers

Data is received by the service providers used for hosting, security and communication as described above. Depending on the service, subprocessors, access or processing outside the EEA may be involved. Cloudflare and Zoho publish further information through their privacy and contractual pages.

Transfers to third countries must meet the applicable requirements of Articles 44 et seq. GDPR, such as an applicable adequacy decision or appropriate safeguards including European Commission Standard Contractual Clauses. WhatsApp or Strava consent is not treated as a general substitute for these requirements. You can request information or copies of the safeguards applicable to my processing at [email protected].

9. Retention

I keep enquiries and related correspondence for as long as they are needed to handle the enquiry or provide coaching arising from it. Once an enquiry is fully resolved and no other retention reason applies, the data is deleted. An enquiry does not automatically result in indefinite storage.

Documents subject to statutory retention obligations are kept for the prescribed period. Data needed to establish, exercise or defend legal claims is limited to the necessary information and applicable limitation periods. The legal bases are Article 6(1)(c) GDPR for legal obligations and Article 6(1)(f) GDPR for legal claims.

Consent records may similarly be kept as evidence of lawful processing. Withdrawal ends further communication or embedding based on that consent; necessary evidence retention is treated separately. The specific retention rules for delivery and security services are described above.

10. Your rights

Subject to the applicable legal requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20).

You can withdraw consent at any time for the future. This does not affect the lawfulness of processing before withdrawal. Where no direct withdrawal function is provided, email [email protected].

Where processing is based on Article 6(1)(f) GDPR, you can object on grounds relating to your particular situation. I will then stop processing the data unless overriding compelling legitimate grounds apply or processing is needed to establish, exercise or defend legal claims.

You can complain to a data protection supervisory authority, particularly where you normally live or work or where the suspected infringement took place. The authority responsible for my location is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (external website, new tab).

For contact through this website, I do not make decisions based solely on automated processing that have legal or similarly significant effects, or carry out corresponding profiling. The technical spam check only protects form delivery.