Peak Privacy Policy

Peak Motion Labs GmbH, Hildburghäuser Straße 5, 52146 Würselen, Germany, registered with the commercial register of the Amtsgericht Aachen under HRB 30103 ("Peak", "we"), operates the Peak platform, including PeakDive (web and mobile) and the website peakmotionlabs.com.

Contact for all privacy matters: support@peakmotionlabs.com. Further company details are in our Impressum.

Peak is used by sports clubs and federations ("Organizations"). Depending on the data, responsibility differs:

• Team, training, athlete and tracking data (accounts your Organization creates, training plans, calendars, attendance, check-ins, configured metrics such as body weight or wellbeing entries, notes and results inside your Organization's workspace): your Organization is the controller and decides which data is collected and why. Peak processes this data only on the Organization's behalf as a processor, under a data processing agreement. For questions or requests about this data (access, correction, deletion), please contact your Organization (your club or federation) first — Peak may not answer for it without the Organization's instruction, but we will forward your request.
• Everything Peak decides itself (described in Sections 3–6 below): Peak is the controller.

a) Accounts, operation and support. Account and contact data (name, email address, account identifiers), login and security data, support requests and related correspondence. When a coach creates a team account in the web app, this also includes the emailed confirmation code, language and time zone, and a short-lived, rate-limited record of signup attempts (including the IP address) to prevent abuse. Purposes: providing and securing the services, handling support, preventing abuse, enforcing our terms. Legal bases: Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (security and abuse prevention).

b) Customer and billing data. Contact, contract and invoice data of our business customers, and for self-service plans the trial and subscription status, plan, billing name and address, country, VAT ID, invoice history and the brand and last four digits of the payment card. Paid plans are processed by Stripe through Link, Stripe's checkout: full card numbers are entered directly with Stripe and never reach Peak. For subscriptions bought in the app, Sold through Link, LLC (Stripe group) acts as the merchant of record and handles the payment, taxes, receipts and invoices under its own responsibility (see Section 6). Purposes: contract management, trials, subscriptions, invoicing, accounting, taxes and the related service emails. Legal bases: Art. 6(1)(b) and (c) GDPR (contract; statutory retention duties).

c) Website and technical data. When you visit peakmotionlabs.com or use the web app, technical access data (IP address, timestamp, requested page, browser information) is processed in short-lived server logs of our hosting provider. Purposes: delivery and security of the site. Legal basis: Art. 6(1)(f) GDPR.

d) Usage analytics. We use Vercel Analytics and Vercel Speed Insights to measure aggregated page views and performance. These tools are cookie-free, do not store identifiers on your device and do not track you across sites. Legal basis: Art. 6(1)(f) GDPR (aggregated usage measurement without profiling).

e) Technical service logs and telemetry. Operational logs and technical usage metadata (feature usage, error and performance data, device type). We deliberately exclude training content, body-weight values and check-in answers from telemetry. Logs and telemetry are deleted or aggregated after at most 90 days. Legal bases: Art. 6(1)(b) and (f) GDPR.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

For the competition-analysis feature, Peak independently collects and curates publicly available competition results from official result providers (for example federation and event result pages). This data may include: athlete name, nation, gender, birth year, competition, date, location, event, discipline, age group, team or synchronized partners, placement, scores, dive codes and difficulty, judge scores, and the source URL. It does not include full birth dates, images or videos. The results are visible to users of Peak. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in sports result analysis based on data already published by the relevant result provider). If you believe a result concerning you is incorrect or should be removed, contact support@peakmotionlabs.com — source URLs allow us to trace and review every entry.

We only use cookies and similar storage that are strictly necessary to run the services (for example login sessions and language settings). We do not use advertising or cross-site tracking cookies, and our analytics (Section 3d) works without cookies. Therefore no consent banner is shown.

We share personal data only with the providers needed to run the services:

When push notifications are enabled, the push service of your device platform or browser (Apple, Google/Firebase, Mozilla) receives a device token and the notification payload. Notification content is kept generic and never contains body weight, wellbeing entries or detailed results.

Our production backend is configured in the European Union (Ireland). Several of the providers listed in Section 6 are based in the USA and may process data there; these transfers are safeguarded by an EU adequacy decision (in particular the EU-US Data Privacy Framework), the EU Standard Contractual Clauses or an equivalent lawful mechanism. Where Peak, as a processor, makes an Organization's data available to that Organization while it is located outside the EEA, the Standard Contractual Clauses (Module Four) included in our Data Processing Addendum apply.

• Organization workspace data (processed on the Organization's behalf): for the duration of the Organization's contract; after termination, active data is deleted or returned within 30 days, backups within 90 days.
• Contract, invoice and accounting records: 6 to 10 years under German commercial and tax law (§ 257 HGB, § 147 AO), then deleted.
• Support correspondence: reviewed annually; correspondence no longer needed is deleted, as a guideline after about 24 months.
• Server logs: deleted automatically after at most 30 days. Telemetry: at most 90 days.
• Public competition results: for as long as the feature is operated, subject to review requests (Section 4).

PeakDive is a tool for Organizations, and Organizations may add minor athletes to their workspace. In that case the Organization is the controller and is responsible for informing athletes and parents/guardians and for obtaining any required consents (including parental consent). Access is role-based: athletes see their own data, assigned coaches see their assigned athletes, and head coaches have oversight within the Organization. Apart from the public competition results described in Section 4, Peak does not knowingly collect personal data from children outside an Organization's workspace; if you believe a child's data was entered without authorization, contact support@peakmotionlabs.com and we will inform the Organization and assist.

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability and objection, and — where processing is based on consent — the right to withdraw consent at any time. For data in an Organization's workspace, please contact your Organization first (see Section 2); for everything else, contact support@peakmotionlabs.com.

Right to object. Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR, for example the public competition results in Section 4), you may object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. To object, write to support@peakmotionlabs.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for Peak is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), www.ldi.nrw.de. You may also contact the authority of your place of residence.

We may update this policy; the current version is always available at peakmotionlabs.com/privacy with its Last-updated date. Material changes affecting Organizations are additionally communicated under the applicable contract.

Questions: support@peakmotionlabs.com