We process personal data only to the extent necessary – e.g. to handle contact and trial session requests, manage memberships, and provide external services after consent.
Controller
The controller for data processing on this website and in the studio operations of Stahlbox (Stahlbox, Industriezeile 47, 4020 Linz) is RAEDBOX GmbH, Friedhofstraße 4, 4020 Linz, Austria. Contact: office@stahlbox.at, +43 660 49 60 211.
What data we process
- Contact form: name, email, phone, optional WhatsApp reply preference, and message to handle your request.
- Trial session form: name, email, phone, optional WhatsApp reply preference, and preferred date/message.
- Membership & booking management (Eversports): we process name, contact details, membership and booking data in the booking and membership management system Eversports, which we – like RAEDBOX – use for the schedule, class bookings, memberships, and vouchers. Eversports processes this data on our behalf; the legal basis is performance of a contract (Art. 6(1)(b) GDPR).
- Cookies: storage of your cookie consent (stahlbox-cookie-consent).
- Statistics (optional, only after consent): Google Analytics 4 for pseudonymized analysis of website usage. Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: consent (Art. 6(1)(a) GDPR). Event data retention: 14 months (GA4 default). Withdrawing consent via "Cookie settings" in the footer takes effect immediately and deletes any statistics cookies already set.
- Google Maps: the map on the contact page only loads after a click (two-click solution), so Google does not receive data on page load.
- Eversports: our price and schedule overview is shown via an embedded Eversports widget, which only loads after your consent for external media.
WhatsApp & Meta
We use WhatsApp to communicate with our studio and – where configured – for internal staff notifications when forms are submitted.
- Chat button / wa.me link: If you message us via WhatsApp, WhatsApp Ireland Limited / Meta Platforms’ terms and privacy policy apply. We receive the message content you send and your phone number.
- Optional reply preference in forms: If you select “Reply via WhatsApp”, we store and use your phone number to contact you preferably via WhatsApp (Art. 6(1)(b) or (f) GDPR).
- Internal team notification: Form submissions may also be sent as a short notice to a studio WhatsApp number (without a visible chat for website visitors).
Payment processing & billing
For memberships, individual services, and vouchers, we use external payment providers.
- Online payment: credit card, SEPA direct debit, and PayPal are processed by our payment provider Mollie B.V. (Netherlands). We generally do not receive full payment card details.
- Membership billing: for ongoing direct debit collection we use the online banking system "George", accessible only to management.
- Communication: transactional emails (e.g. booking and payment confirmations) are sent via an SMTP mail server operated by our hosting provider.
- Online shop: our product catalog and order processing run on the Shopify e-commerce platform (Shopify International Limited, Ireland).
Processing by our service providers
We use server infrastructure operated by our technical service provider to host and operate this website. The website is hosted in data centers of Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft Azure, EU region).
We use Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands for payment processing. Privacy policy: https://www.mollie.com/privacy
We use Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland for our online shop. Privacy policy: https://www.shopify.com/legal/privacy
We have data processing agreements with our service providers pursuant to Art. 28 GDPR where required. Processing outside the EU (e.g. USA) occurs only on the basis of appropriate safeguards such as standard contractual clauses.
Legal bases: Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(c) GDPR (legal obligations, e.g. tax retention), and – where required – Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Your rights
- Access to stored personal data
- Rectification of incorrect data
- Erasure where no legal retention obligations apply
- Restriction of processing and objection
- Complaint to the Austrian Data Protection Authority (dsb.gv.at)
Privacy contact
For privacy questions, please contact office@stahlbox.at. Further company details can be found in the legal notice. Legal notice.
Cookies & consent
On your first visit, a cookie banner appears. We store your choice in the cookie stahlbox-cookie-consent (duration: 12 months). Statistics and external media services start only after opt-in. You can change or revoke your consent at any time via “Cookie settings” in the footer.
| Category | Purpose | Examples |
|---|---|---|
| Essentialrequired | Required for the website to function, e.g. storing your cookie consent and basic features. | stahlbox-cookie-consent |
| Statisticsconsent required | Google Analytics 4 for reach and usage analysis of the website. Only loads after your consent; withdrawing it deletes the statistics cookies immediately. | _ga, _ga_<container ID> |
| Marketingconsent required | For personalized content or advertising. Currently inactive – reserved for future services. | no active cookies |
| External mediaconsent required | For embedded third-party content (e.g. schedule widget, YouTube). Placeholders remain visible without consent. | YouTube |
External services
For statistical analysis we use Google Analytics 4 (see the "Statistics" category above); it only loads after your consent. Beyond that, we currently do not use any social media plugins or advertising tracking pixels. Contact and trial session requests are sent to us by email; optionally also as an internal WhatsApp notification to our team.