Privacy

This site collects data in exactly four places: when you simply open it (server logs), in the Pain Check if you leave your email address at the end, when you play one of the video experiences and, if you have booked coaching, when you upload an exercise video. In addition, our emails measure opens and clicks — see the section “Email address and messages”.

The Pain Check asks about complaints. That is health data. How we handle it is set out in its own section below — please read it before you fill the check in.

Hero Dreams LLC, 1401 Pennsylvania Ave. STE 105, 19806 Wilmington, Delaware, United States. Authorised representative: Marco Lachmann-Anke.

Contact for data protection matters: kontakt@vikinghands.com

Phone: +49 170 8002630

As a controller established outside the Union, we have appointed a representative in the European Union: Hans Schmidt Hermannstraße 52 44263 Dortmund Germany

The representative is the point of contact for supervisory authorities and data subjects; they do not decide on the processing.

The application and its database run on a server operated by Hetzner Online GmbH in Nuremberg, Germany. Your entries are not transferred to the United States, even though the controller is based there.

The legal basis for operating the service is our legitimate interest in a secure and functioning offering, Art. 6 (1) (f) GDPR.

When you open the site, the server processes technically necessary details: the address requested, the time, the amount of data transferred, browser type and IP address. They serve operation and defence against attacks.

The legal basis is Art. 6 (1) (f) GDPR.

The Pain Check asks about the site of pain, its duration, mobility, everyday load and about warning signs such as pain at night, numbness, loss of strength, unintended weight loss, fever or bladder and bowel problems. These are health data and specially protected.

As long as you do not leave an email address, none of it leaves your browser. The evaluation happens on your device. Only when you enter your address at the end and expressly consent is anything stored with us.

Purpose: evaluating your result, sending you the matching exercises and, if you take it up, the ongoing support.

The legal basis is your consent under Art. 6 (1) (a) and Art. 9 (2) (a) GDPR. Without consent we store nothing — not even your email address.

Separate storage: your answers and your result are held in their own record, separate from your email address. The two are linked only by a random key. The record holding your address contains no health value at all.

Passing on to Mirko Naber: Mirko Naber, who supports you, receives your name, your address and a short summary of the result (site of pain, rating, whether a warning sign was present) as soon as you get in touch. If you book a call, we compile your answers from the check together with your name into a preparation sheet that only he receives, by email and via a personal link, so he knows what the call is about. There are no other recipients. This too rests on your consent (Art. 6 (1) (a) and Art. 9 (2) (a) GDPR) and is covered by your withdrawal.

Retention: we delete the raw answers after 180 days. The result and the consent records are kept for as long as the support relationship lasts and beyond that only where statutory retention periods require it.

Withdrawal: you can withdraw your consent at any time. This does not affect the lawfulness of processing up to that point. A message to the address above is enough; we then delete your entries.

The Pain Check is not a medical examination and does not provide a diagnosis. Where warning signs appear, we recommend seeing a doctor and deliberately do not produce a training plan.

We use your address to send you your exercises and, after that, at most one message per week. Every message contains an unsubscribe link.

The legal basis is your consent, Art. 6 (1) (a) GDPR.

As evidence of consent we store the time and the purpose. Your IP address is stored only as a salted hash, or not at all — it cannot be traced back to the address.

Contact form. If you write to us using the form, we process your name, your email address and your message solely in order to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR where a contract or its initiation is involved, otherwise Art. 6 (1) (f) GDPR — our legitimate interest in answering enquiries. An enquiry does not put you on any mailing list; that would require your consent. We keep your message for 24 months so that Mirko Naber knows in the call what you wrote to us beforehand (Art. 6 (1) (b) GDPR, initiation of a contract); then we delete it.

Booking appointments. You book calls through the calendar of Koalendar (koalendar.com). There you enter your name and email address; Koalendar processes them to assign and confirm the appointment and passes them on to Mirko Naber. From there we receive name, address, appointment and your answers in the booking form, in order to send Mirko Naber a preparation sheet before the call (Art. 6 (1) (b) GDPR). We keep the appointment for 24 months and Koalendar's raw message for only 30 days after the appointment. There are no other recipients; the data does not go to other companies or to AI services. How Koalendar processes data is described in its privacy policy (koalendar.com).

The message is delivered as an email to kontakt@vikinghands.com and handled there. We delete it once the enquiry is settled and no statutory retention period applies.

Double opt-in confirmation: a single message with a confirmation link goes to the address you entered. Only once you click it do we send your plan and the further messages. This verifies that the holder of the address really entered it.

If you do not confirm, we delete your email address and your pain check answers again once the confirmation link has expired (seven days).

Unsubscribing takes one click: every message contains an unsubscribe link, and opening that link stops the sending immediately — with no further question. We also support your email program's one-click unsubscribe.

Sending provider: we send our emails via Brevo (Sendinblue SAS, Paris, France) as a processor bound by our instructions (Art. 28 GDPR). For this, Brevo receives your email address and the content of each message. There are no other recipients of your address.

Open and click measurement. Our emails contain a tracking pixel: a tiny, invisible image that is loaded from Brevo's server when you open the message. Links in our emails first pass through a Brevo redirect address and only then lead to the actual destination. This tells us whether and when you opened a message and which link you clicked. In the process Brevo processes the time and technical details such as your IP address and your email program.

Purpose of the measurement: we want to know whether our messages arrive and are read, notice delivery problems early and improve content that nobody opens. The legal basis is our legitimate interest in reliably delivered and useful messages, Art. 6 (1) (f) GDPR.

You can object to the measurement at any time (Art. 21 GDPR), informally by writing to kontakt@vikinghands.com or via the unsubscribe link. Because Brevo cannot switch the measurement off for individual recipients, we will then stop sending you messages. The exception is messages we have to send for a contract with you, such as an order confirmation. You can also prevent the tracking pixel yourself by turning off automatic image loading in your email program.

The videos are hosted by Bunny.net (BunnyWay d.o.o., Slovenia). They are loaded only when you click play. Until then you see a still image served from our own server, and no request goes to the video service.

When you click play, Bunny.net receives your IP address and technical details about your device in order to deliver the video.

The legal basis is your click as consent, Art. 6 (1) (a) GDPR.

With “Guided” or “Inner Circle” you can upload exercise videos in your area so that Mirko Naber can look at your movement and write you feedback. For this we store the video, your note on it, the file name, the time and, later, Mirko’s feedback. The sole purpose is this contractually agreed feedback.

Storage location: the video is held on our own server at Hetzner Online GmbH in Germany (see “Where the data is held”), which operates it for us as a processor (Art. 28 GDPR). It is not sent to any video service, not made publicly accessible, not used for advertising and not passed on to third parties. There are no copies with other providers.

Access: only Mirko Naber can view the video, via a personal link that opens exactly this one video. We notify him of a new video by email with your name, your address and your note, not with the video itself. Apart from that, only the operator of this site has technical access to the server, to the extent needed for operation and security.

The legal basis is performance of the contract (Art. 6 (1) (b) GDPR). Because an exercise video shows your body and may reveal complaints, we only accept it with your explicit consent (Art. 9 (2) (a) GDPR), which you give by ticking the box when uploading. You can withdraw it at any time; we then delete your videos.

Retention: we keep your videos together with your notes and the feedback for as long as your coaching runs, and for no more than 90 days after your subscription ends. After that, a daily automatic run deletes them completely from our server.

You can ask us at any time to delete individual videos or all of them earlier. A message to kontakt@vikinghands.com is enough.

We sell paid offers ourselves. For payment we use Stripe (Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA, and affiliated Stripe companies). Stripe processes payment data — such as card details — itself; we do not see it.

For this, we and Stripe process name, email address, billing address, the offer purchased, amount and time. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our statutory retention obligations (Art. 6(1)(c) GDPR). Stripe also processes data on its own responsibility for fraud prevention; Stripe's privacy policy applies (stripe.com/privacy).

Stripe is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision. We keep invoice and payment data for as long as statutory retention periods require.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR).

You may withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority — usually the one where you live.

To understand which pages are read and how many people start and finish the Viking Hands Score, we count page views on our own server. No cookie is set, nothing is stored on or read from your device, and no data is passed to third parties.

We store: the page visited without query parameters, the day, the language, the domain of the page you came from, a campaign tag (utm_source) if present, the device class (phone, tablet or computer; it is derived roughly from the browser identifier, and the identifier itself is not stored), and whether you started or finished the score, left your address or requested a call. During the score we also store the number of the question you got to — never your answers. Your IP address is not stored. To count visitors per day, we combine IP address and browser identifier with a random value that changes daily into a hash; the random value is held in memory only and discarded at midnight at the latest, after which the hash cannot be linked to anyone.

The legal basis is our legitimate interest in a data-minimal evaluation of our service (Art. 6(1)(f) GDPR). If “Do Not Track” or “Global Privacy Control” is switched on in your browser, we do not count you.

We use no advertising or tracking cookies. There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR.

Your health information is not sold, not traded and not used for third-party advertising.