Privacy Policy & GDPR Data Protection (DSGVO)

1. Identity & Contact Details of the Data Controller (Art. 13(1)(a) GDPR)

DATA CONTROLLER

The data controller responsible for the processing of personal data on the oxivel.com platform is:

DATA CONTROLLER (§ 5 ECG, Art. 13(1)(a) GDPR): Păun Marius-Daniel; Einzelunternehmen (Registered Austrian Sole Proprietorship)
REGISTERED BUSINESS ADDRESS (STANDORT): Rennbahngasse, 2525 Günselsdorf, Österreich (Austria)
VAT IDENTIFICATION (UID) & TAX NUMBER: ATU78924201; Steuernummer: 08 547/2868
TRADE REGISTRY & WKO MEMBERSHIP: GISA: 35558859 (IT) · 35558842 (Handel)
WKO Mitgliedsnummer: 1531664 (WKNÖ)
SUPERVISORY TRADE AUTHORITY: Bezirkshauptmannschaft Baden
ELECTRONIC PRIVACY & STATUTORY CONTACT: Electronic Inquiry & GDPR Contact Form (/impressum#contact-form)

2. European Sovereign Infrastructure Pinning (europe-west3)

EU FRANKFURT ONLY

All stateless application compute containers (oxivel-api-prod, oxivel-worker-prod), asynchronous task queues (oxivel-queue-prod), and relational database storage (PostgreSQL 16 logical database oxivel_prod hosted on Cloud SQL instance oxivel-pg16-shared) are strictly provisioned and executed inside the European Union within Google Cloud region europe-west3 (Frankfurt am Main, Germany).

Oxivel strictly forbids unapproved third-country data transfers (Chapters IV and V GDPR). No telemetry streams, athlete workout logs, or authentication records are ever routed to commercial data brokers, foreign surveillance jurisdictions, or advertising ad networks.

3. Data Minimization & Zero Financial Data Processed (Art. 5(1)(c) GDPR)

ZERO FINANCIAL DATA

100% Free Forever Architecture: Pursuant to Article 5(1)(c) GDPR (Principle of Data Minimization), personal data processed by Oxivel is strictly limited to what is mathematically necessary to render endurance analytics, threshold models, and fueling plans. Because all Oxivel platform capabilities are provided 100% Free Forever without subscription paywalls, Oxivel does NOT collect, store, transmit, or process any payment credentials, credit card numbers, bank account IBANs, or billing addresses.

There are zero third-party payment processors or recurring billing gateways, eliminating any risk of financial credential leakage or fraudulent billing exposure.

4. Categories of Processed Data & Lawful Bases (Art. 6 & 9 GDPR)

A. Account Registration & Session Authentication (Art. 6(1)(b) GDPR)

Data processed: athlete email address, Argon2id cryptographically salted password hash (never plaintext), display name, primary discipline (RUNNING, CYCLING, TRIATHLON, CORE), UI density preference (DetailLevel: CASUAL, ATHLETE, PRO), and session authentication tokens.

B. Biometric & Endurance Performance Telemetry (Art. 6(1)(b) & Art. 9(2)(a) GDPR)

Data processed: user-uploaded workout records (heart rate, power output in Watts, cadence, speed/pace, elevation gain/loss, timestamps). Processed strictly with your explicit consent to compute Performance Management Chart (PMC) metrics (Chronic Training Load - CTL, Acute Training Load - ATL, Training Stress Balance - TSB) and deterministic iso-osmolar carbohydrate/sweat sodium intake models.

C. Autonomous 500m Home GPS Privacy Shield (Art. 25 & 32 GDPR)

To prevent the exposure of athletes' residential locations on GPS route tracks, Oxivel implements an autonomous 500m Home GPS Privacy Shield. Using geodesic Haversine mathematics on ingest, trackpoints located within a 500-meter radius of the athlete's designated home coordinates are suppressed and snapped at the perimeter boundary before visual route rendering or storage.

D. Client-Side Storage & Zero Tracking Cookies (§ 165(3) TKG 2021)

oxivel.com does NOT deploy third-party advertising cookies, cross-site tracking scripts, or behavioral tracking pixels. To preserve user visual ergonomics without screen flicker, your interface theme is persisted in client browser localStorage under key oxivel_theme (pursuant to § 165(3) Austrian TKG 2021 as strictly necessary for a user-requested feature state). Authenticated sessions utilize secure session tokens stored locally.

E. Ephemeral Server Telemetry & Latency Probes (Art. 6(1)(f) GDPR)

Google Cloud Run processes ephemeral technical request metadata (HTTP status code, request latency in milliseconds, TLS cipher) strictly to maintain container availability, enforce the sub-200ms readiness smoke gate, and defend against denial-of-service attempts.

5. Data Subject Rights Under GDPR (Articles 15–22) & Supervisory Authority

Under Regulation (EU) 2016/679, you have the following irrevocable statutory rights regarding your personal data:

Right of Access (Art. 15 GDPR): Request confirmation and complete extract of all personal data held.
Right to Rectification (Art. 16 GDPR): Request immediate correction of inaccurate or incomplete records.
Right to Erasure (Art. 17 GDPR): Request deletion of your account and associated telemetry (Right to be Forgotten).
Right to Data Portability (Art. 20 GDPR): Receive your workouts and telemetry corpus in structured, open formats (FIT, CSV, JSON).
Right to Restriction (Art. 18 GDPR): Limit processing during verification or dispute resolution.
Right to Withdraw Consent (Art. 7(3) GDPR): Revoke processing consent for biometric data at any time.

To exercise any data protection right under Articles 15–22 GDPR, submit a request directly via our Electronic Inquiry & GDPR Contact Form (/impressum#contact-form).

Competent Data Protection Supervisory Authority in Austria (Art. 77 GDPR):

You have the statutory right to lodge a complaint with the national supervisory authority if you consider that processing of personal data infringes the GDPR:
Österreichische Datenschutzbehörde (DSB)
Barichgasse 40–42, 1030 Wien, Österreich (Austria)
Web: https://www.dsb.gv.at · Email: dsb@dsb.gv.at · Tel: +43 1 52 152-0

6. Industry Architecture Comparison: Privacy Sovereignty & Data Boundaries

Privacy Feature	OXIVEL (Free Forever)	Social Fitness Networks	Hardware-Locked Apps	Spreadsheet Telemetry Tools	Legacy Coaching Platforms
Financial Data Collection	Zero: 100% Free Forever, no credit cards collected or processed	Processes & stores recurring subscription payment card data	E-commerce billing & device warranty payment data	Processes optional recurring supporter payment records	Processes recurring subscription & coaching billing cards
EU Sovereign Hosting	Strictly pinned to europe-west3 (Frankfurt am Main, EU)	Primary compute & storage in US cloud regions	Global cloud infrastructure with cross-border transfers	European hosting, independent infrastructure footprint	Primary compute & storage in US cloud infrastructure
Third-Party Trackers & Ads	Zero ad cookies; only strictly necessary localStorage	Advertising trackers, social pixels, marketing cookies	Telemetry cookies, analytics, product marketing trackers	Minimal functional tracking; no advertising network	Commercial ad trackers & cross-site marketing pixels
Home GPS Geofencing	Autonomous 500m Home Shield with boundary snapping	Manual setup required; public default activity maps	Manual privacy zones; no automated perimeter snapping	Manual privacy zone configuration	Basic visibility controls
Data Portability (Art. 20)	Instant full-corpus export in standardized FIT/JSON formats	Asynchronous archive request queue	Multi-step manual export portal	Direct export capabilities available	Export available; advanced bulk metrics subject to tier

7. Cross-References & Further Information

For official commercial registration data and trade authority details, review our Impressum. For user agreements, EU consumer rights, and the 100% Free Forever commitment, review our General Terms of Use (/terms).

Privacy Policy & Data Protection Architecture