The following legal texts are legally binding in German. Translations are for information purposes only.
Privacy Policy
GDPR Audit Report (PDF)1. Responsible Controller
Responsible in the sense of the GDPR is:
Martin Buchstaller
Octavianstraße 15 b
50968 Cologne, Germany
Email: martin.buchstaller@passionandkaizen.com
2. General Information on Data Processing
We only process personal data of our users in principle as far as this is necessary to provide a functional website as well as our content and services. Processing is regularly only carried out after consent (Art. 6 para. 1 lit. a GDPR), to fulfill a contract (lit. b), to fulfill legal obligations (lit. c) or on the basis of legitimate interests (lit. f).
3. Hosting & Backend (Lovable Cloud / Supabase)
Our website is provided via the Lovable platform; the backend (database, authentication, file storage) runs on the "Lovable Cloud" infrastructure managed by Lovable (technically Supabase, operated in the EU). When calling the page, server-side log data is processed (IP address, date/time, user agent, called URL). Legal basis: Art. 6 para. 1 lit. f GDPR (secure and stable provision of the website). Log data is deleted or anonymized after a maximum of 30 days.
4. Registration & Member Area
Registration is required for the community function (photo uploads, instructor area). Email address and a password hash as well as optionally a display name are processed. Legal basis: Art. 6 para. 1 lit. b GDPR (fulfillment of the usage relationship). The data will be deleted as soon as the account is deleted; deletion can be requested at any time by email.
5. Photo Uploads
Members can upload photos. These are checked manually by the administrator before publication. With the upload, the member declares that they own the rights to the images and agree to the publication in the public area of the website. Consent can be revoked at any time for the future (deletion of the image by email or via your own dashboard).
6. Contacting us by Email
When contacting us by email, the transmitted data (email address, content of the message) is used exclusively for processing the request. Legal basis: Art. 6 para. 1 lit. f GDPR. Data will be deleted as soon as the request has been finally processed.
7. Instructor Applications
In the application form, name, email, country, Dan grade and voluntary information are processed. Legal basis: Art. 6 para. 1 lit. b GDPR. Application data will be deleted at the latest 12 months after completion of the selection process, provided that no admission as an instructor takes place.
8. Cookies & Tracking
We do not use any marketing or tracking cookies. Only a session token is technically required for login (locally in the user's browser storage). Consent according to § 25 TDDDG is not required for this.
9. Your Rights
You have the right to information (Art. 15), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR) at any time. Please send inquiries to the email address mentioned above.
In addition, you have a right of appeal to a data protection supervisory authority (Art. 77 GDPR).
In addition, you have a right of appeal to a data protection supervisory authority (Art. 77 GDPR).
10. Status
This privacy policy was last updated: May 2026.
