Privacy policy

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

Lennart de Lange
Moonshot Run Club
Karl-Theodor-Str. 45
80803 Munich
Germany
Email: hello@moonshotrunclub.com
Phone: +49 176 377 50 751

I am not required to appoint a data protection officer. For any question about your data, write to me directly.

2. The short version

• This website uses no cookies, no tracking and no advertising. Fonts and images are served from the site itself.
• I only collect what I need to talk to you, coach you or send you an order.
• Information about your health is only used with your explicit consent, and only to plan your training.
• I don’t sell your data, and I only share it with the services listed below.

3. Visiting this website

The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit a page, your browser sends technical information that is needed to show it to you: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. Cloudflare processes this to deliver the site and to protect it against attacks. Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in a secure, working website.

Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection (Art. 45 GDPR). I have a data processing agreement with Cloudflare.

4. Contacting me

If you contact me by email, phone or WhatsApp, I process your details and your message to reply. Legal basis: Art. 6(1)(b) GDPR if it’s about coaching or an order, otherwise Art. 6(1)(f) GDPR, my interest in answering you. Messages about coaching, including WhatsApp chats, are kept while the coaching runs and deleted three years after the end of the year in which it ends. Other messages are deleted when they are no longer needed.

My email is provided by Google (Google Ireland Limited, Dublin, Ireland). WhatsApp is provided by WhatsApp Ireland Limited, Dublin, Ireland. Both may transfer data to their parent companies in the USA, which are certified under the EU-U.S. Data Privacy Framework.

5. Booking an intro call

You can book an intro call through Cal.com (Cal.com, Inc., USA). When you book, Cal.com processes your name, email address, the time you chose and anything you add, such as your goal. Legal basis: Art. 6(1)(b) GDPR, steps before a possible contract. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 GDPR). If you’d rather not use Cal.com, message me and we’ll find a time that way. The call itself takes place by WhatsApp or phone (see section 4).

6. Newsletter

If you sign up for new Field Notes by email, I use MailerLite (UAB “MailerLite”, J. Basanavičiaus 15, 03108 Vilnius, Lithuania). You’ll first get an email to confirm your address (double opt-in). I store your email address, the time of signup and confirmation, and your IP address at that moment, as proof of your consent. MailerLite also records whether emails are opened and which links are clicked, so I can see what’s useful.

Legal basis: your consent, Art. 6(1)(a) GDPR. You can unsubscribe at any time with the link in every email, and I then delete your address from the list.

7. Coaching

When you become a coaching client, I process your name, contact details, address and bank details for invoicing, plus the information you give me about your running: training history, races, goals, schedule and the life your training has to fit into. Legal basis: Art. 6(1)(b) GDPR, to deliver the coaching.

Health data. To plan your training safely, I also ask about injuries, illness and other health matters, and I see training data such as heart rate. This is health data under Art. 9 GDPR. I only process it with your explicit consent, which you give in the intake form (Art. 9(2)(a) GDPR). You can withdraw this consent at any time for the future; I may then no longer be able to coach you safely.

Intake form. The intake form runs on Tally (Tally BV, Belgium). Tally stores the data in the EU. I have a data processing agreement with Tally.

Final Surge. Your training plan lives in Final Surge, a training platform based in the USA. You create your own account there; Final Surge processes the data in that account under its own privacy policy. I see the workouts and training data you share with me through it.

Calls and messages. Feedback and questions run through Final Surge and WhatsApp, and calls by WhatsApp or phone (see section 4).

8. Merch orders

When you order merch, I process your name, address, email address and order details to process the order, take payment and ship it. Legal basis: Art. 6(1)(b) GDPR. I pass your name and address to the shipping company (for example Deutsche Post / DHL) only to deliver your parcel.

9. Payments

Payment is by bank transfer. Your bank details are processed by your bank and mine to complete the payment.

10. How long I keep your data

I keep your data for as long as I need it for the purpose it was collected for. Coaching data, including health data and WhatsApp chats, is deleted three years after the end of the year in which the coaching ends, unless you ask me to delete it sooner or want me to keep it for a possible return. Invoices and other records that tax and commercial law require me to keep are stored for the statutory periods (up to ten years) and then deleted.

11. Your rights

You have the right to:

• access the data I hold about you (Art. 15 GDPR),
• have it corrected (Art. 16) or deleted (Art. 17),
• have its processing restricted (Art. 18),
• receive it in a common, machine-readable format (Art. 20),
• withdraw your consent at any time, with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where I process your data based on my legitimate interest, you can object at any time for reasons arising from your particular situation. I then stop, unless there are compelling legitimate grounds that override your interests.

To use any of these rights, a message is enough. You also have the right to complain to a data protection authority. The authority responsible for me is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

12. Other points

You don’t have to give me your data, but without it I can’t answer you, coach you or send you an order. I don’t use automated decision-making or profiling. This website is served over an encrypted connection (HTTPS).

If the website or my services change, I will update this policy. The current version is always on this page.