Privacy Policy

Last updated: 23 October 2026

This Privacy Policy explains how Benjamin Ott Group (“we”, “us”, or “our”) collects, uses, stores, and protects personal data when you visit https://benjaminottgroup.com, contact us, receive coaching, create or use an account, book an appointment, or use other website features.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection laws.

1. Controller and Contact Details

The controller responsible for processing personal data on this website and in connection with our coaching services is:

Benjamin Ott
Benjamin Ott Group
Leininger Str. 7
67246 Dirmstein
Germany

Email: info@benjaminottgroup.com
Phone: +49 176 24618103

If you have questions about this Privacy Policy or how we process your personal data, please contact us using the details above.

We have not appointed a data protection officer (DPO). Based on the current scale and nature of our processing, we do not currently consider appointment to be required. We will reassess this if our activities or the scale or nature of processing change.

2. General Information About Data Processing

What is personal data?

Personal data is any information relating to an identified or identifiable natural person. This may include your name, email address, IP address, account details, or information you provide when contacting us.

How do we collect personal data?

We collect personal data in several ways:

When you provide it directly, for example by contacting us, submitting a form, creating an account, or booking an appointment.
When technical information is automatically transmitted by your browser or device while visiting the website.
When you use website features that require information to operate.
Where applicable, when you consent to cookies or similar technologies.

Legal bases for processing

We process personal data only where a legal basis applies. Depending on the circumstances, this may include:

Consent: Article 6(1)(a) GDPR.
Contract or pre-contractual steps: Article 6(1)(b) GDPR.
Legal obligations: Article 6(1)(c) GDPR.
Legitimate interests: Article 6(1)(f) GDPR.

Where processing involves special-category personal data, an additional condition under Article 9 GDPR may be required.

Where cookies or similar technologies access information on your device, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) may also apply.

Whether you must provide personal data

Whether you are required to provide personal data depends on the particular interaction. Information marked as required in a contact form, booking form, or account registration is needed to process your request, arrange an appointment, create or administer an account, or provide the relevant service. If you do not provide required information, we may be unable to respond to your enquiry, complete a booking, create or administer your account, or provide the requested service. Other information is generally voluntary; please do not provide information that is not relevant to your request.

Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. Website statistics may involve limited automated measurement or aggregation of website usage, but are not used to make such decisions about individuals.

The relevant legal basis is explained in the sections below.

3. Hosting and Server Log Files

Our website is hosted by:

ALL-INKL.COM – Neue Medien Münnich

Our hosting provider processes technical information to make the website available and to maintain its stability and security.

When you visit our website, technical information may be recorded in server log files. This may include:

IP address;
date and time of access;
requested pages or files;
browser type and version;
operating system;
referrer URL, where transmitted;
technical response information.

We use this information to operate the website, investigate technical issues, maintain security, and protect against misuse.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable, and technically functional operation of our website.

Server log retention

ALL-INKL’s published privacy information states that server log data is generally deleted after a maximum of seven days, while longer storage may occur in individual cases, for example where needed to investigate security incidents or attacks. The exact retention and configuration applicable to our hosting account may depend on our specific service and has not been independently confirmed.

Where ALL-INKL processes personal data on our behalf, the processing is governed by the applicable data processing agreement.

Further information is available from ALL-INKL:

https://all-inkl.com/datenschutzinformationen/

4. Hosting Backups

Our hosting provider, ALL-INKL.COM – Neue Medien Münnich, provides backup services for website files and databases.

Backups support recovery and are separate from the retention periods of data on the live website. Data deleted from the live website may therefore remain in a backup until that backup is overwritten or removed.

The exact backup frequency, available backup versions, and retention period for our specific hosting account have not been confirmed. Backup copies are retained according to the backup service available under our hosting arrangement and are overwritten or removed as those backup versions expire or are no longer needed for recovery or security. Data deleted from the live website may remain in a backup until that point.

Further information is available from ALL-INKL:

https://all-inkl.com/datenschutzinformationen/

5. Cookies and Similar Technologies

Our website uses cookies and similar technologies to provide essential website functions, remember your privacy preferences, and support certain features and services.

Where required by applicable data protection and ePrivacy laws, non-essential cookies and similar technologies are used only after you have given your consent. You can accept or reject non-essential cookies through the cookie banner or adjust your preferences using the available cookie settings.

Essential cookies may be used where they are necessary to operate the website, provide a service you have requested, or maintain your privacy preferences.

You can change or withdraw your consent at any time through the cookie settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

The cookies and similar technologies used may vary depending on the features and services available on a particular page. Further information about the categories of cookies and the providers involved is available through our cookie settings.

6. Contact Forms

If you contact us through a form, we process the information you provide, such as your name, email address, message, and any additional information you choose to submit.

Our WordPress website has the Contact Form 7 and WPForms Lite plugins installed. The plugin used depends on the particular form.

We use the information to respond to enquiries, provide support, and handle related requests.

Legal basis:

Article 6(1)(b) GDPR where your enquiry relates to a contract or requested pre-contractual steps;
Article 6(1)(f) GDPR for other enquiries, based on our legitimate interest in receiving, responding to, and documenting communications and handling related follow-up;
Article 6(1)(a) GDPR where consent is requested and applies.

We retain enquiry information while it is needed to respond to the enquiry, complete any requested follow-up, or manage a resulting contractual or pre-contractual relationship. Once those purposes have ended, we delete it or retain only the information reasonably needed to establish, exercise, or defend legal claims, or to meet a statutory retention obligation. The retention criterion is the end of the relevant communication/follow-up and any applicable legal or claims-related need; we do not currently state a fixed universal period for all enquiries.

7. Contact by Email or Telephone

If you contact us by email or telephone, we process the information you provide, including your contact details and the content of your enquiry.

We use this information to respond to your request and handle related matters.

Legal basis: Article 6(1)(b) GDPR where the enquiry relates to a contract or pre-contractual steps; otherwise, Article 6(1)(f) GDPR, based on our legitimate interest in responding to communications and handling related follow-up, or Article 6(1)(a) GDPR where consent applies.

We retain the information while it is needed to respond to the enquiry and any reasonably expected follow-up. After that, it is deleted unless it is needed to establish, exercise, or defend legal claims or to comply with a statutory retention obligation. The retention criterion is the end of the relevant communication and any applicable legal or claims-related need; no single fixed period applies to every enquiry.

8. Email Delivery

We use WP Mail SMTP to configure website email delivery through the SMTP mail server provided by ALL-INKL.

The email address used for sending website emails is:

info@benjaminottgroup.com

Website emails may include account-related messages, form notifications, membership communications, and responses to enquiries.

The email data necessary for delivery may be processed by ALL-INKL as our hosting and email service provider.

Legal basis: This depends on the purpose of the email. It may include Article 6(1)(b) GDPR for service-related communications, Article 6(1)(c) GDPR for legally required communications, or Article 6(1)(f) GDPR for other necessary communications.

We do not include email passwords or other authentication credentials in this Privacy Policy.

Further information about ALL-INKL’s processing is available at:

https://all-inkl.com/datenschutzinformationen/

9. User Accounts and Membership Services

If you create an account or use membership features, we process information necessary to create and administer your account and provide the services you request.

This may include:

name and contact details;
username and account information;
authentication and login information;
membership level and status;
account-related communications;
support requests;
information submitted through member features.

We use this information to provide access to your account, administer memberships, deliver services, provide support, and comply with legal obligations.

Legal basis: Article 6(1)(b) GDPR for contractual services and Article 6(1)(c) GDPR where processing is required by law.

You are responsible for keeping your login credentials confidential and notifying us if you suspect unauthorized access to your account.

10. Private Messaging

Our website includes private messaging functionality provided through the Better Messages WordPress plugin.

If you use this feature, we may process information such as your account details, message content, message recipients, timestamps, and related technical information.

We use this information to provide the messaging functionality and support communications between users where the feature is available.

Legal basis: Article 6(1)(b) GDPR where messaging is part of a service you use, and Article 6(1)(f) GDPR where necessary to maintain and secure the feature.

Messages may be retained while needed to provide the messaging service, subject to account settings, deletion functionality, and applicable legal obligations.

11. Coaching, Training, Nutrition, Weight, and Health Information

In the course of coaching, you may choose to share information about your training, nutrition, goals, progress, weight, body measurements, injuries, physical limitations, medical conditions, or other information relating to your health or wellbeing. We process information you provide in coaching communications or through available member features only to the extent necessary to provide and adapt the coaching or to respond to your requests.

Some information—particularly information revealing a medical condition, health status, or other health-related details—may constitute special-category personal data under Article 9 GDPR. Ordinary fitness goals or weight information are not automatically special-category data in every context; classification depends on the information and what it reveals.

Where we process special-category health data, we will do so only where an applicable Article 9 GDPR condition is met. Where appropriate, this will be your explicit consent under Article 9(2)(a) GDPR, in addition to a legal basis under Article 6 GDPR. We will explain the relevant processing when requesting consent. You may withdraw consent at any time with effect for the future. Withdrawal does not affect processing carried out before withdrawal, and may mean that we can no longer provide coaching that depends on the information.

Providing health-related information is voluntary unless a particular detail is genuinely necessary for a service you request. Please share only information relevant to your coaching. We restrict access to such information to what is necessary for providing the service and handling related obligations.

We do not currently offer a separate coaching app. If an app or other digital service is introduced in the future, we will provide applicable privacy information about its specific data, purposes, providers, retention, and legal bases before or when it is made available, and obtain consent where required.

12. Appointment Scheduling

We use Calendly for appointment scheduling.

If you book an appointment through our scheduling link, we may process your name, email address, appointment date and time, and any additional information you submit in the booking form.

We use this information to arrange and manage appointments. The name and email address fields required by the booking flow are needed to create and manage the appointment. If you do not provide required information, you may be unable to complete the booking. Any additional booking questions are voluntary unless clearly marked as required.

Calendly may process personal data in accordance with its own privacy notice. Please review the information provided by Calendly when booking an appointment.

Legal basis: Article 6(1)(b) GDPR where the appointment relates to a service you request or a contract; otherwise, Article 6(1)(f) GDPR.

13. Payments

Online payments are currently not active on our website.

If online payments are introduced, this Privacy Policy will be updated to identify the relevant payment provider or providers, the personal data processed, the purposes of processing, and the applicable legal bases.

Where purchases or payment-related records are processed in the future, we may need to retain certain information to comply with statutory accounting or tax obligations.

14. Third-Party Services and Recipients

We use service providers and WordPress plugins to operate our website and provide its features. The services identified in our current website setup include:

ALL-INKL.COM – Neue Medien Münnich: website hosting and SMTP email delivery;
Complianz: cookie-consent management;
Contact Form 7 and WPForms Lite: contact-form functionality, depending on the form;
WP Mail SMTP: configuration of website email delivery;
Antispam Bee: spam prevention for supported website features;
Better Messages: private messaging functionality;
Really Simple Security: website security features;
Calendly: appointment scheduling;
WP Statistics: website statistics and analytics.

These services may process technical data, contact information, account information, appointment details, or message content as necessary for their functions. The specific data processed and whether a provider receives data directly depend on the feature being used and its configuration.

A plugin being installed does not necessarily mean that all of its features are active or that its developer receives website visitor data. External recipients depend on the actual configuration and connections used.

We share personal data only where necessary to provide the website or services, where required by law, or where another legal basis permits the disclosure. Where a provider processes personal data on our behalf, an Article 28 GDPR data processing agreement must be in place where required. We assess the role of each provider and the applicable contractual terms; some providers may act as independent controllers for certain processing, in which case their own privacy information applies to that processing. We do not publish the full texts of provider agreements, but may provide information about the applicable arrangements on request, subject to legal restrictions.

15. Website Statistics with WP Statistics

We use WP Statistics to collect website statistics and understand how visitors use our website.

The plugin is configured with the following privacy-related settings:

IP address anonymization is enabled;
IP address hashing is enabled;
the plugin’s Privacy Audit setting is enabled;
the consent-plugin integration is currently set to “None.”

The plugin may process technical information relating to visits, such as page views, referring information, browser or device information, and information used to calculate visitor statistics. The precise information processed depends on the plugin’s active settings and version.

We use statistics to understand website usage and improve the website.

Legal basis and consent: The applicable legal basis depends on the actual data collected and how the statistics feature operates. Where consent is required under the GDPR or Section 25 TDDDG for cookies, similar technologies, or access to information on a visitor’s device, that processing must not take place before the required consent is obtained. Where a particular processing operation does not require consent and is based on Article 6(1)(f) GDPR, our legitimate interest is to understand aggregated website usage, maintain the website, and improve its content and functionality, subject to the necessity of the processing and your rights.

IP anonymization and hashing are privacy-protective measures, but do not by themselves establish that analytics is exempt from consent requirements. The actual WP Statistics configuration and its interaction with our consent-management settings determine whether consent is needed. We will configure the statistics tool and cookie banner consistently with the applicable requirements; the consent integration setting alone should not be understood as a determination that consent is or is not required.

Statistical data is retained while it is useful for the stated website-usage and improvement purposes and is deleted or anonymized when it is no longer needed for those purposes, subject to applicable legal requirements. The exact retention period configured in WP Statistics has not been confirmed, so we do not state a fixed number of days or months here.

16. External Links and Social Media

Our website may contain links to external websites, including social media platforms such as Facebook, Instagram, and X.

These are ordinary links unless a specific page contains an embedded widget or other active integration.

When you view a page containing an ordinary external link, the external provider does not generally receive your personal data merely because the link is displayed. If you click the link, your browser connects to the external website, which may process personal data in accordance with its own privacy policy.

We do not control the data processing practices of external websites.

If social media widgets or embedded content are used on our website, the relevant provider may receive technical information when the content is loaded. Where required, such content will be blocked until the necessary consent has been obtained.

17. YouTube and Embedded Content

Our website may contain links to YouTube or other external services.

A normal link to an external video does not generally connect your browser to the video provider until you click the link.

Embedded videos or other embedded content may operate differently. When a page containing embedded content is accessed, the provider may receive technical information, including your IP address, and may use cookies or similar technologies.

Where required, non-essential embedded content must be blocked until the required consent has been obtained.

External content providers process personal data according to their own privacy notices.

Google’s privacy policy is available at:

https://policies.google.com/privacy

18. Self-Hosted Fonts

Our website uses self-hosted fonts.

The font files are served from our own website or hosting environment rather than being requested directly from Google Fonts’ external servers.

This means that loading these font files does not, by itself, require the visitor’s browser to connect to Google Fonts.

If the way fonts are delivered changes in the future, this Privacy Policy will be updated as necessary.

19. Newsletter

We do not currently operate an active newsletter subscription service on our website.

If a newsletter is introduced, we will update this Privacy Policy to identify the newsletter provider, the information collected, the purposes of processing, the applicable legal basis, and how you can unsubscribe or withdraw consent.

Where consent is required, newsletter subscriptions will be processed on the basis of Article 6(1)(a) GDPR.

20. International Data Transfers

Some service providers may process personal data outside the European Economic Area (EEA). Whether a transfer takes place and which safeguards apply depend on the provider, service, and account configuration actually used.

Calendly: Calendly may process data in the United States and other countries. Where a transfer to the United States is covered by Calendly’s valid certification under the EU–US Data Privacy Framework (DPF) and the certification applies to the relevant data and entity, the transfer may rely on the European Commission’s adequacy decision for the DPF. Where the DPF does not apply to a particular transfer, an appropriate alternative safeguard—such as the Standard Contractual Clauses (SCCs)—may be used, together with supplementary measures where required. The transfer mechanism applicable to our account must be determined from the current Calendly terms, DPA, and certification scope; we do not represent that one mechanism applies to every transfer.

For other providers, where a restricted transfer occurs, we rely on an applicable adequacy decision or another appropriate safeguard under Chapter V GDPR and consider supplementary measures where required.

You may contact us for information about the safeguards applicable to a particular transfer and, where legally permitted, to request a copy or a description of those safeguards. You may also consult the providers’ published documentation.

Further information:

Calendly Privacy Notice: https://calendly.com/privacy
Calendly Data Processing Addendum and transfer terms: https://calendly.com/dpa
EU–US Data Privacy Framework: https://www.dataprivacyframework.gov/

21. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

Retention periods depend on the type of data and purpose of processing. For example:

Server logs: retained according to the applicable hosting configuration and the purposes described in Section 3.
Contact enquiries: retained while needed to respond and handle reasonably expected follow-up; afterward deleted unless needed for legal claims or statutory obligations. The criterion is the end of the communication/follow-up and any applicable legal need.
Account data: retained while needed to provide the account and related services, and afterward where necessary for legal obligations or claims.
Private messages: retained while needed to provide the messaging service, subject to applicable settings and legal obligations.
Appointment data: retained as needed to arrange and manage appointments and comply with applicable obligations.
Consent records: retained as necessary to demonstrate consent and comply with applicable obligations.
Website statistics: retained while needed for website-usage analysis and improvement, then deleted or anonymized; the precise configured period in WP Statistics has not yet been confirmed.
Purchase and accounting records: retained for applicable statutory retention periods where relevant.

When personal data is no longer required, it is deleted or anonymized unless a legal obligation or legitimate need requires further retention.

Data in backups may remain until the relevant backup is overwritten or removed, as described in Section 4.

22. Data Security

We implement technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Our website uses security-related functionality provided by WordPress, our hosting provider, and the Really Simple Security plugin. The specific measures depend on the plugin and hosting configuration.

Our website uses HTTPS to protect the transmission of information between your browser and the website.

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

23. Your Rights Under the GDPR

Subject to the conditions of the GDPR, you may have the following rights:

Right of access — Article 15 GDPR

You may request confirmation as to whether we process personal data about you and, where applicable, obtain access to that data and information about the processing.

Right to rectification — Article 16 GDPR

You may request correction of inaccurate personal data or completion of incomplete data.

Right to erasure — Article 17 GDPR

You may request deletion of your personal data where the legal requirements are met.

Right to restriction — Article 18 GDPR

You may request restriction of processing in circumstances provided by the GDPR, including where you contest the accuracy of data or object to processing while the relevant matter is assessed.

Right to data portability — Article 20 GDPR

You may have the right to receive personal data that you have provided to us and that we process by automated means on the basis of consent or a contract, in a structured, commonly used, and machine-readable format.

Where technically feasible, you may request that we transmit this data directly to another controller.

Right to object — Article 21 GDPR

Where we process your personal data on the basis of Article 6(1)(e) or Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.

If you object, we will no longer process the relevant personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

Where personal data is processed for direct marketing, you have the right to object at any time to that processing, including profiling related to direct marketing. If you object, your personal data will no longer be processed for direct marketing.

Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

How to exercise your rights

To exercise your rights, please contact:

info@benjaminottgroup.com

We may need to verify your identity before responding to a request.

24. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, particularly in the EU Member State where you live, work, or where the alleged infringement occurred.

For our location in Rhineland-Palatinate, Germany, the relevant authority may be:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI Rheinland-Pfalz)

Website: https://www.datenschutz.rlp.de/

You may also contact another competent supervisory authority where permitted under the GDPR.

25. Children

Our website and services are not intended for children unless expressly stated otherwise.

If we become aware that personal data has been collected from a child in circumstances where consent or other safeguards are required and have not been obtained, we will take appropriate steps to address the situation.