Peak Privacy Policy

Peak Motion Labs GmbH, Hildburghäuser Straße 5, 52146 Würselen, Germany, registered with the commercial register of the Amtsgericht Aachen under HRB 30103 ("Peak", "we"), operates the Peak platform, including PeakDive (web and mobile) and the website peakmotionlabs.com.

Contact for all privacy matters: support@peakmotionlabs.com. Further company details are in our Impressum.

Peak is used by sports clubs and federations ("Organizations"). Depending on the data, responsibility differs:

• Team, training, athlete and tracking data (accounts your Organization creates, training plans, calendars, attendance, check-ins, configured metrics such as body weight or wellbeing entries, notes and results inside your Organization's workspace): your Organization is the controllerand decides which data is collected and why. Peak processes this data only on the Organization's behalf as a processor, under a data processing agreement. For questions or requests about this data (access, correction, deletion), please contact your Organization (your club or federation) first — Peak may not answer for it without the Organization's instruction, but we will forward your request.
• Everything Peak decides itself (described in Sections 3–6 below): Peak is the controller.

a) Accounts, operation and support. Account and contact data (name, email address, account identifiers), login and security data, support requests and related correspondence. Purposes: providing and securing the services, handling support, preventing abuse, enforcing our terms. Legal bases: Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (security and abuse prevention).

b) Customer and billing data. Contact, contract and invoice data of our business customers. Purposes: contract management, invoicing, accounting, taxes. Legal bases: Art. 6(1)(b) and (c) GDPR (contract; statutory retention duties).

c) Website and technical data. When you visit peakmotionlabs.com or use the web app, technical access data (IP address, timestamp, requested page, browser information) is processed in short-lived server logs of our hosting provider. Purposes: delivery and security of the site. Legal basis: Art. 6(1)(f) GDPR.

d) Usage analytics. We use Vercel Analytics and Vercel Speed Insights to measure aggregated page views and performance. These tools are cookie-free, do not store identifiers on your device and do not track you across sites. Legal basis: Art. 6(1)(f) GDPR (aggregated usage measurement without profiling).

e) Technical service logs and telemetry. Operational logs and technical usage metadata (feature usage, error and performance data, device type). We deliberately exclude training content, body-weight values and check-in answers from telemetry. Logs and telemetry are deleted or aggregated after at most 90 days. Legal bases: Art. 6(1)(b) and (f) GDPR.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

For the competition-analysis feature, Peak independently collects and curates publicly available competition results from official result providers (for example federation and event result pages). This data may include: athlete name, nation, gender, birth year, competition, date, location, event, discipline, age group, team or synchronized partners, placement, scores, dive codes and difficulty, judge scores, and the source URL. It does not include full birth dates, images or videos. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in sports result analysis based on data already published by the relevant result provider). If you believe a result concerning you is incorrect or should be removed, contact support@peakmotionlabs.com — source URLs allow us to trace and review every entry.

We only use cookies and similar storage that are strictly necessary to run the services (for example login sessions and language settings). We do not use advertising or cross-site tracking cookies, and our analytics (Section 3d) works without cookies. Therefore no consent banner is shown.

We share personal data only with the providers needed to run the services:

When push notifications are enabled, the push service of your device platform or browser (Apple, Google/Firebase, Mozilla) receives a device token and the notification payload. Notification content is kept generic and never contains body weight, wellbeing entries or detailed results.

Our production backend is configured in the European Union (Ireland). Some providers may process data outside the EU/EEA; where that happens, transfers are safeguarded by an EU adequacy decision, the EU Standard Contractual Clauses or an equivalent lawful mechanism. Where Peak, as a processor, makes an Organization's data available to an Organization outside the EEA, the Standard Contractual Clauses (Module Four) included in our Data Processing Addendum apply.

• Organization workspace data (processed on the Organization's behalf): for the duration of the Organization's contract; after termination, active data is deleted or returned within 30 days, backups within 90 days.
• Contract, invoice and accounting records: 6 to 10 years under German commercial and tax law (§ 257 HGB, § 147 AO), then deleted.
• Support correspondence: reviewed annually; correspondence no longer needed is deleted, as a guideline after about 24 months.
• Server logs and telemetry: short-lived; at most 90 days for telemetry.
• Public competition results: for as long as the feature is operated, subject to review requests (Section 4).

PeakDive is a tool for Organizations, and Organizations may add minor athletesto their workspace. In that case the Organization is the controller and is responsible for informing athletes and parents/guardians and for obtaining any required consents (including parental consent). Access is role-based: athletes see their own data, assigned coaches see their assigned athletes, and head coaches have oversight within the Organization. Peak does not knowingly collect personal data from children outside an Organization's workspace; if you believe a child's data was entered without authorization, contact support@peakmotionlabs.com and we will inform the Organization and assist.

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability and objection, and — where processing is based on consent — the right to withdraw consent at any time. For data in an Organization's workspace, please contact your Organization first (see Section 2); for everything else, contact support@peakmotionlabs.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for Peak is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), www.ldi.nrw.de. You may also contact the authority of your place of residence.

We may update this policy; the current version is always available at peakmotionlabs.com/privacy with its Last-updated date. Material changes affecting Organizations are additionally communicated under the applicable contract.

Questions: support@peakmotionlabs.com