Privacy policy

Protecting your personal data is important to us. We do not use our own analytics or marketing cookies or proprietary tracking tools when you merely visit this website. Personal data is, however, processed when you use forms, purchase a service, schedule an appointment, participate in coaching, or actively access external services such as Stripe, Cal.com, Discord, Garage61 or YouTube.

01Controller

The appointment of a data protection officer is not legally required.

02Principles, purposes and legal bases

We process personal data only to the extent necessary for the following purposes:

• operation, security and technical provision of the website;
• handling enquiries and taking pre-contractual measures;
• concluding contracts, processing payments, scheduling appointments and providing coaching services;
• communication, customer administration, and documentation of hours and services;
• analysis of telemetry, replays, video and training data;
• compliance with statutory retention and evidentiary obligations;
• establishment, exercise or defence of legal claims; and
• public media or reference use solely on the basis of a separate agreement.

The legal bases, depending on the processing activity, are in particular Article 6(1)(b) GDPR (contract and pre-contractual measures), Article 6(1)(c) GDPR (legal obligations), Article 6(1)(f) GDPR (legitimate interests) and Article 6(1)(a) GDPR (consent). Special categories of personal data are not requested and, should they nevertheless be involved, will be processed only on an appropriate legal basis.

03Server log files and hosting

When the website is accessed, the hosting provider automatically processes technically necessary data. This may include the IP address, date and time, requested file, data volume, browser type, operating system and referrer URL. This processing serves the secure, stable and error-free operation of the website.

• Legal basis: Article 6(1)(f) GDPR.
• Retention: only for as long as required for operation and security, generally no longer than 30 days unless a specific security incident requires longer retention.
• Processing on behalf of the controller: Netlify is used on the basis of an agreement pursuant to Article 28 GDPR.
• International transfers: where data is processed in the United States, transfers are based on applicable adequacy decisions, including the EU–US Data Privacy Framework, and/or appropriate safeguards such as Standard Contractual Clauses.

04Netlify forms and contact

Contact, coaching and withdrawal forms are available on the website. When a form is used, the data you enter is processed through Netlify Forms and transmitted to C-Motion Works e.U. Depending on the form, this may include your name, email address, postal address, iRacing name, iRating, selected package, vehicle, track, objective, message, contract date, and order or payment reference.

• Purpose: handling your enquiry, pre-contractual steps, performance of a contract, or processing a withdrawal.
• Legal basis: Article 6(1)(b) GDPR; for legally relevant declarations, additionally Article 6(1)(c) and (f) GDPR.
• Retention: enquiries that do not lead to a contract are generally deleted no later than twelve months after final handling, unless another legal basis applies. Contract-relevant communication is retained in accordance with statutory obligations and limitation periods.

When you contact us by email or telephone, the information you provide is processed to handle the matter. Please do not submit sensitive data that is not necessary for your enquiry.

05Fonts

The fonts used on this website are served locally from our own web space. No connection to an external font provider is therefore established when the page is accessed.

06YouTube videos

Where YouTube videos are embedded, they are integrated in enhanced privacy mode via youtube-nocookie.com and a click-to-load function. Content is loaded only after an active click. Only then are data such as the IP address and device and browser information transmitted to Google, and third-party cookies may be set.

• Legal basis: Article 6(1)(a) GDPR on the basis of the active click.
• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Privacy: policies.google.com/privacy

07Contract and customer administration

When coaching is purchased or individually agreed, we process master data, contact details, contract, invoice, payment, appointment, communication and service data. For long-term programmes, development objectives, coaching notes, assignments, progress records, hour balances and service journals may also be processed.

• Purpose: preparation of offers, conclusion and performance of contracts, organisation, documentation, invoicing and evidence of the agreed services.
• Legal basis: Article 6(1)(b) and (c) GDPR and Article 6(1)(f) GDPR for documentation and legal defence.
• Recipients: only the payment, scheduling, communication, automation and IT service providers used, together with bodies legally entitled to receive the data.

Private Driver Development is an individually tailored service available on enquiry. The nature and scope of the data processed depend on the services specifically agreed and are limited to what is necessary for their performance.

08Payment processing through Stripe

Stripe Payment Links may be used for directly bookable coaching packages. Stripe processes, in particular, contact, transaction, payment, device and fraud-prevention data. Full card or bank details are generally processed directly by Stripe and are not stored by C-Motion Works e.U.

• Purpose: payment processing, refunds, fraud prevention and proof of payment.
• Legal basis at C-Motion Works e.U.: Article 6(1)(b) and (c) GDPR.
• Provider: Stripe; the responsible Stripe entity depends on the service and region.
• Privacy: stripe.com/privacy

Depending on the processing activity, Stripe may act as an independent controller and/or as a processor. Data may also be processed outside the EEA; Stripe provides information about the transfer mechanisms used in its privacy information.

09Scheduling through Cal.com

Paid or individually agreed live appointments may be scheduled, confirmed, rescheduled or cancelled through Cal.com. In particular, the service processes your name, email address, time zone, appointment time, booking details, responses to booking questions and technical usage data.

• Purpose: appointment administration, reminders and organisational performance of the contract.
• Legal basis: Article 6(1)(b) GDPR.
• Provider: Cal.com, Inc., USA.
• Privacy: cal.com/privacy

Cal.com may process data in the United States and through additional sub-processors. Details of transfers and security measures are provided in Cal.com's privacy information.

10Coaching and communication through Discord

Discord is used for live coaching and private coaching areas. This may involve processing the Discord username and user ID, text messages, files, voice and video communications, screen sharing, reactions, roles, appointment and status information, and technical usage data. Where possible, private coaching areas are restricted to those persons required for the coaching relationship.

• Purpose: communication, live coaching, file exchange, support and documentation of the working relationship.
• Legal basis at C-Motion Works e.U.: Article 6(1)(b) GDPR.
• Provider in the EEA: Discord Netherlands B.V.; Discord additionally processes data under its own responsibility.
• Privacy: discord.com/privacy

Data concerning third parties, confidential team data or special categories of personal data should not be shared on Discord unless this is necessary and legally permissible.

11Automated process handling with Make

Make is used to connect bookings, customer status, Discord communication and internal administration. Make may process data from forms or Cal.com webhooks and transmit it to defined systems. This may include the name, email address, booking and appointment status, package, Discord assignment, internal customer ID, communication status and service status.

• Purpose: technical automation of recurring administrative and communication processes.
• Legal basis: Article 6(1)(b) GDPR and Article 6(1)(f) GDPR for efficient and traceable processes.
• Provider: Make, a service of the Celonis group of companies.
• Privacy: make.com/en/privacy-notice

The automations carry out predefined process steps. No decision based solely on automated processing that produces legal or similarly significant effects within the meaning of Article 22 GDPR takes place.

12Garage61, iRacing and telemetry data

For coaching analyses, customers may provide telemetry, replays, setups, screenshots, videos or shared Garage61 links. These data may include the driver's name, session, vehicle, track, lap times, braking, throttle and steering data, vehicle states, results and other performance-related information.

• Purpose: analysis, coaching, comparison, development of exercises and progress monitoring.
• Legal basis: Article 6(1)(b) GDPR.
• Garage61: an independent service based and processing data in the EU; customers control their sharing and privacy settings there.
• Privacy: garage61.net/docs/privacy

C-Motion Works e.U. receives access only to data that has been expressly shared or made accessible. Customers are responsible for not submitting team data, commercial setups or third-party data without authorisation. iRacing and Garage61 additionally process data under their own terms and privacy information.

13Session recordings, image, voice and media use

Live sessions may be recorded after prior information and on the basis of the relevant agreement. A recording may include image, voice, gameplay, screen sharing, telemetry, chat messages and the content of conversations.

• Coaching purposes: analysis, follow-up, progress documentation, creation of personalised training materials and provision to the customer.
• Legal basis: Article 6(1)(b) GDPR where the recording is expressly part of the agreed service; otherwise Article 6(1)(a) GDPR.
• Storage: generally on C-Motion Works e.U.'s internal working systems. Where an external cloud or transfer service is used, this occurs only to the extent necessary and with appropriate information.

Any public use of a person's name, image, voice, personal statements, performance data or identifiable video material for the website, YouTube, social media, advertising, presentations or reference cases takes place solely on the basis of a separate, express media and reference agreement. Purchasing coaching does not in itself constitute public consent.

Consent under data protection law may be withdrawn with effect for the future. Contractual rights of use, processing already lawfully carried out and the treatment of productions already published are additionally governed by the separate media agreement and mandatory statutory provisions.

14Recipients and international data transfers

Data is disclosed only to persons and service providers that require it for the stated purposes. This may include, in particular, Netlify, Stripe, Cal.com, Discord, Make, Garage61, email, IT, storage and tax-advisory service providers, and legally authorised public authorities. Where required, agreements pursuant to Article 28 GDPR are concluded with processors.

Some service providers may process data outside the EEA, particularly in the United States. Transfers take place only on the basis of an adequacy decision pursuant to Article 45 GDPR, appropriate safeguards pursuant to Article 46 GDPR, particularly Standard Contractual Clauses, or another legally recognised basis. The relevant provider's own privacy information also applies to external services.

15Retention periods

We retain data only for as long as required for the relevant purpose or prescribed by law. The following criteria generally apply:

• Website log files: generally no more than 30 days unless a security incident occurs.
• Enquiries that do not lead to a contract: generally up to twelve months after final handling.
• Contract, invoice and payment records: in accordance with statutory retention obligations, generally seven years from the end of the relevant calendar year and, where proceedings are pending, potentially longer.
• Coaching, communication and service data: for the duration of the contract and thereafter for as long as required for warranty, limitation periods, legal defence or agreed follow-up support.
• Hour journals and development documentation: for the term of the programme and generally for up to three years thereafter, unless a longer period is legally required.
• Session recordings for coaching purposes: generally until delivery and follow-up have been completed and, as a rule, no longer than six months after the end of the contract, unless longer retention has been expressly agreed or is required for legal defence.
• Media productions approved for public use: in accordance with the separate media agreement and until consent on which the processing is based is withdrawn or for as long as contractual rights of use remain in force.

Data held by third-party services may additionally be subject to those providers' own deletion and retention rules. Where technically and legally possible, data that is no longer required is deleted, anonymised or access to it is terminated.

16Your rights

Subject to the GDPR, you have in particular the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21). You may withdraw consent at any time with effect for the future. To exercise your rights, send a message to info@c-motion-works.com.

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. Statutory retention obligations and other mandatory legal bases may prevent immediate erasure.

No automated decision-making or profiling within the meaning of Article 22 GDPR takes place.

17Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular:

18Data security and updates

We implement appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and disclosure. These include access restrictions, role-based Discord permissions, secure accounts, encrypted transmission, regular updates and processing limited to the relevant purpose.

This Privacy Policy will be updated when processes, service providers or the legal framework change. The version published on this page at the relevant time applies. Material changes affecting ongoing contractual relationships will be communicated appropriately.