Privacy notice

1. Controller

The controller within the meaning of the GDPR is: Sportpark Lessing GmbH, represented by Mareike Voss Lessingstraße 24, 38304 Wolfenbüttel Telephone +49 5331 904120, email hallo@sportpark-lessing.de We have not appointed a data protection officer, as we are not required to do so under § 38 BDSG. Enquiries about data protection go to the address above; questions about the childcare room may be sent to betreuung@sportpark-lessing.de.

2. What this website does and does not do

This website sets no analytics cookies, no advertising cookies and no tracking pixels. There is no web analytics service, no social media plugin and no advertising network embedded in these pages. The only value stored in your browser is your choice in the cookie notice, so that the notice does not appear again. It is stored in the browser (local storage) under the key "spl-consent-v1", stays on your device, and is never transmitted to us.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you call up a page, the hosting provider automatically records data that your browser transmits, in particular the IP address, the date and time of the request, the page requested, the referrer URL, the browser and operating system used, and the amount of data transferred. This is technically necessary to deliver the page and to keep the service stable and secure.

Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in the technically secure and reliable provision of this website. A transfer to the USA takes place; it is based on the standard contractual clauses under Art. 46 (2) (c) GDPR concluded with the provider, together with the EU–US Data Privacy Framework. Log data is deleted after 30 days at the latest.

4. Fonts

The fonts Wix Madefor Display and Nunito are delivered from our own server. No connection to Google servers is established when you load a page.

5. Map

The location on the home page is shown first as a plan drawn by us; no third party is contacted for it. Only if you press the button "Load the map from Google Maps" is a map from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland loaded. From that moment Google receives your IP address and may set cookies. Legal basis: your consent under Art. 6 (1) (a) GDPR, which you may withdraw at any time by reloading the page without pressing the button. Google's privacy policy: https://policies.google.com/privacy.

6. Trial session enquiry form

If you use the trial session form we process the name, email address and, if given, the telephone number you enter, together with your answers on what you are interested in, when you could come, whether you need a childcare place, and any free text you add.

Purpose: to answer your enquiry and arrange an appointment. Legal basis: Art. 6 (1) (b) GDPR (steps prior to entering into a contract) and, for the free text, Art. 6 (1) (a) GDPR. We delete the enquiry six months after the last contact, unless a membership arises from it. We do not use these details for a newsletter or for telephone advertising.

7. Booking a class, and children's data

The timetable allows you to book an adult class together with the children's session or the childcare place that runs at the same time. For this we process your name, your email address, optionally your telephone number, the hour selected, and for each child a first name and an age band. Where you tell us about an allergy, asthma or a similar circumstance in the free text field, that is health data within the meaning of Art. 9 GDPR.

What we deliberately do not collect

• no surname of the child
• no date of birth — an age band is enough for us to place a child in the right group
• no photograph, height, weight or any other physical detail
• no separate address, telephone number or email address for the child
• no school, no kindergarten, no nationality

Who may submit the form

A booking that names a child may only be submitted by a parent or another person with parental responsibility, and the form asks you to confirm this. We do not invite children or young people to enter their own details, and a membership for a person under 18 is concluded in person at reception with the signature of a parent or guardian. Legal basis: Art. 6 (1) (b) GDPR for the booking itself, Art. 6 (1) (a) in conjunction with Art. 8 GDPR for the child's first name and age band, and Art. 9 (2) (a) GDPR for any health information, which we process only on the basis of your explicit consent given by sending the form.

How long we keep it

• The child's first name and age band: deleted eight weeks after the booked session at the latest.
• Health information from the free text field: written on the paper group sheet for that hour only, and destroyed at the end of the day.
• Your own contact details from a booking: deleted twelve months after the last booking, unless a membership contract exists.
• The arrival and collection times written on the childcare register: kept for four weeks, then destroyed.

No personal data entered into a booking form is stored by this website itself. There is no visitor database behind these pages, and nothing about a child is passed to a third party, published, or used for any purpose other than running the hour you booked.

Photographs

There are no photographs of children on this website, and no camera in the children's hall or in the childcare room. If we ever wish to photograph in the building we ask the parents concerned beforehand, in writing, for that specific picture and that specific use; consent may be withdrawn at any time.

8. Membership administration

For an existing membership we process the contract data (name, address, date of birth, bank details for the SEPA direct debit, the plan chosen, and for a minor the name of the parent or guardian who signed). Legal basis: Art. 6 (1) (b) GDPR. Invoicing data is kept for ten years under § 147 AO and § 257 HGB; the remaining contract data is deleted three years after the end of the membership.

9. Recipients and processors

We use the hosting provider named above as a processor under Art. 28 GDPR, and a tax adviser and a bank in the ordinary course of business. We do not sell personal data, and we do not pass it to advertisers.

10. Your rights

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of a consent at any time, with effect for the future (Art. 7 (3) GDPR)

A person with parental responsibility exercises these rights on behalf of a child. Write to hallo@sportpark-lessing.de or to the postal address above; we answer within one month.

Right to complain

You may complain to a supervisory authority. The one responsible for us is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.

11. Security and changes

This site is delivered over TLS; you can recognise it by the padlock in your browser. This privacy notice reflects the state of the website as of 1 September 2026. If we change the site in a way that changes the processing, we will update this page.