The following legal texts are legally binding in German. Translations are for information purposes only.

1. Responsible Controller

Responsible in the sense of the GDPR is:
Martin Buchstaller
Octavianstraße 15 b
50968 Cologne, Germany
Email: martin.buchstaller@passionandkaizen.com

2. General Information on Data Processing

We only process personal data of our users in principle as far as this is necessary to provide a functional website as well as our content and services. Processing is regularly only carried out after consent (Art. 6 para. 1 lit. a GDPR), to fulfill a contract (lit. b), to fulfill legal obligations (lit. c) or on the basis of legitimate interests (lit. f).

3. Hosting & Backend (Lovable Cloud / Supabase)

Our website is provided via the Lovable platform; the backend (database, authentication, file storage) runs on the "Lovable Cloud" infrastructure managed by Lovable (technically Supabase, operated in the EU). When calling the page, server-side log data is processed (IP address, date/time, user agent, called URL). Legal basis: Art. 6 para. 1 lit. f GDPR (secure and stable provision of the website). Log data is deleted or anonymized after a maximum of 30 days.

4. Registration & Member Area

Registration is required for the community function (photo uploads, instructor area). Email address and a password hash as well as optionally a display name are processed. Legal basis: Art. 6 para. 1 lit. b GDPR (fulfillment of the usage relationship). The data will be deleted as soon as the account is deleted; deletion can be requested at any time by email.

5. Photo Uploads

Members can upload photos. These are checked manually by the administrator before publication. With the upload, the member declares that they own the rights to the images and agree to the publication in the public area of the website. Consent can be revoked at any time for the future (deletion of the image by email or via your own dashboard).

6. Contacting us by Email

When contacting us by email, the transmitted data (email address, content of the message) is used exclusively for processing the request. Legal basis: Art. 6 para. 1 lit. f GDPR. Data will be deleted as soon as the request has been finally processed.

7. Instructor Applications

In the application form, name, email, country, Dan grade and voluntary information are processed. Legal basis: Art. 6 para. 1 lit. b GDPR. Application data will be deleted at the latest 12 months after completion of the selection process, provided that no admission as an instructor takes place.

8. Cookies & Tracking

We do not use any marketing or tracking cookies. Only a session token is technically required for login (locally in the user's browser storage). Consent according to § 25 TDDDG is not required for this.

9. Your Rights

You have the right to information (Art. 15), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR) at any time. Please send inquiries to the email address mentioned above.

In addition, you have a right of appeal to a data protection supervisory authority (Art. 77 GDPR).

10. Status

This privacy policy was last updated: May 2026.