Privacy Policy

Last updated: 15 October 2026

Metabolic Balance Global AG ("we", "us") is committed to protecting your personal data and processes it in accordance with the EU General Data Protection Regulation (GDPR) and, where applicable, the German Telecommunications Digital Services Data Protection Act (TDDDG).

1. Controller and contact

Metabolic Balance Global AG, Feringastraße 6, 85774 Unterföhring, Germany.

For any question about your personal data, or to exercise your rights, write to dp@metabolic-balance.com.

2. Hosting and technical data

Our website data is stored on servers provided by Microsoft Ireland Operations Limited, Ireland (Microsoft Azure). All data at rest, including databases, backups, and telemetry logs, is stored exclusively in the European Union (North Europe/Ireland and Germany). Microsoft processes personal data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

To ensure global availability and fast loading times, we use Azure Front Door, a content delivery network (CDN). Because this network operates globally, traffic and connection metadata (such as your IP address) may be processed by edge nodes outside the EU. For any access from or processing in the United States, Microsoft relies on the EU-U.S. Data Privacy Framework. Where the Data Privacy Framework does not apply, transfers are subject to the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914 of 4 June 2021).

When you visit the website, your browser automatically transmits technical data: IP address, browser type and version, operating system, the page requested, the referring URL and the time of access. We use this data to deliver the website, keep it secure and fix errors. We also collect technical error and performance data about our servers. Legal basis: our legitimate interest in operating a secure website, Art. 6(1)(f) GDPR. Retention: 30 days (Log Analytics workspace and file logs).

3. Cookies and your consent

We use a consent banner (Silktide Consent Manager, served from our own servers) to ask which optional services you allow. You can change or withdraw your choice at any time using the cookie icon at the bottom left of every page. Withdrawal applies from that moment on and does not affect processing that took place before it.

Necessary. These are required for the website to work, so they cannot be switched off. Legal basis: § 25(2) TDDDG and Art. 6(1)(f) GDPR.

  • user-language and user-country remember your language and country (1 year);
  • .AspNetCore.Antiforgery.* protects our forms against misuse (until you close the browser);
  • your cookie choice is kept in your browser's local storage until you clear it.

Analytics. Google Analytics 4, see section 5.

Functional / embedded media.

  • the YouTube, Vimeo and Buzzsprout players, see section 7;
  • Google Maps, see section 8;
  • Recently viewed coaches: we remember the last four coach profiles you opened, so that the coach finder can show them to you again. Only the IDs of those profiles are stored, in the cookie mb_recent_coaches in your browser, for 30 days from your last profile view. Your browser sends this cookie to our website, which uses it only to display that list. It is not shared with third parties and not combined with any other data about you. If you withdraw your consent, the cookie is deleted.

You can allow this category in the banner, or by clicking the button on a video, podcast or map placeholder: the placeholder tells you that this click enables Functional / embedded media for the whole website, and your choice is then remembered like any other banner choice. You can switch it off again using the cookie icon.

Marketing. The advertising features of Google Analytics ("Google signals"), see section 6.

Optional services (Analytics, Functional / embedded media and Marketing) are used only with your consent. Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR.

4. Google Tag Manager

We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to manage the tags on our website. Tag Manager itself is loaded on every page, and in doing so Google receives your IP address and browser information. The tags it manages run only according to your consent choice. Legal basis: our legitimate interest in managing our website efficiently, Art. 6(1)(f) GDPR.

5. Google Analytics 4 (with your consent)

If you allow Analytics, we use Google Analytics 4 by Google Ireland Limited to understand how our website is used and to improve it. GA4 processes:

  • the pages you visit, the time of your visit and the referring page;
  • your approximate location (country, city) and information about your browser and device;
  • a random identifier stored in the cookies _ga and _ga_* (up to 2 years).

Google Analytics 4 does not log or store IP addresses. We keep analytics data for 2 months.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. Google processes the data on our behalf under a data processing agreement. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework.

6. Google signals — demographics and interests (with your consent)

If you allow Marketing, Google Analytics uses Google's advertising features ("Google signals"). We receive aggregated reports on our visitors' age group, gender and interests. Google does not give us data about individual visitors. For visitors signed in to a Google account, Google can link this data to their account and use it for advertising. Google may process it for its own purposes as an independent controller; see policies.google.com/privacy.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.

7. Embedded videos and podcasts

Videos and podcast episodes on our website are shown as placeholders. Nothing is loaded from the provider until you press play, or until you have allowed Functional / embedded media. From that moment your browser connects directly to the provider, which receives:

  • your IP address and information about your browser and device;
  • the page you are on;
  • playback or listening data.

The providers are:

  • YouTube, Google Ireland Limited. We use YouTube's privacy-enhanced mode (youtube-nocookie.com).
  • Vimeo, Vimeo.com, Inc., USA. We use Vimeo's "do not track" setting. Data transfers are based on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914 of 4 June 2021). Fastly and Cloudflare may process data as subprocessors for Vimeo.
  • Buzzsprout, Higher Pixels, Inc., USA. Data transfers are based on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914 of 4 June 2021).

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. Pressing play on a placeholder starts that player and enables Functional / embedded media for the whole website, as the placeholder states; from then on the other players, and the maps (section 8), load without a further click until you withdraw this consent using the cookie icon. The same applies to the video that opens in a pop-up window on the "Become a coach" page: opening the window starts it and enables Functional / embedded media, as the note next to the button states. Embeds from any other provider, which may appear in older articles, are loaded only for that single click.

8. Google Maps (with your consent)

The coach finder and the coach profiles can show coaches on an interactive map from the Google Maps JavaScript API (Google Ireland Limited). Until you load it, we show a static map image from our own server and nothing is requested from Google. The map is loaded when you click "Load interactive map", or automatically if you have allowed Functional / embedded media. From that moment your browser connects directly to Google, which receives your IP address, information about your browser and device, the page you are on and your interactions with the map. Clicking the button also enables Functional / embedded media for the whole website (see section 3).

Your precise location. Only after the map has been loaded does the coach finder ask your browser for your location, and it is used only if you allow it in your browser's own prompt. It is used to centre the map and the coach list on your area: the area shown on the map is sent to our server to find the coaches in it, and the map itself is loaded from Google for that area. We do not store your coordinates; the map area searched (not your exact position) may appear in our technical logs, which are kept for 30 days (section 2).

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. Google processes this data as an independent controller under the Google Maps Platform terms; see policies.google.com/privacy. Data may be transferred to Google LLC in the USA under the EU-U.S. Data Privacy Framework.

Coach search without the map. The coach finder also works without the map: the list then starts from the country of the website version you are viewing. If you type a place into the "Location" field, our server sends that text, the page language and a random identifier for that one search to Google Places (Google Ireland Limited) to look it up. Your browser does not connect to Google for this, so Google receives neither your IP address nor any browser information and cannot link the search to you. We do not log the text you type; search results are kept in our server's memory for at most one hour. Legal basis: our legitimate interest in letting you search for coaches by place, Art. 6(1)(f) GDPR.

9. Social Media Share Buttons

We use simple links for sharing content on social networks (Facebook, LinkedIn). No data is transferred to these platforms until you explicitly click the "Share" button. When you click it, a window of that network opens, and the network receives the address of the article you are sharing, together with information telling us that the visit came from a share on our website.

10. Spam protection (Cloudflare Turnstile)

To protect our forms against automated abuse we use Cloudflare Turnstile (Cloudflare, Inc., San Francisco, USA). Turnstile checks your IP address and technical browser signals to tell humans from bots. It does not show you a puzzle.

Turnstile is loaded on every page, because the "Contact us" form can be opened from every page.

Legal basis: our legitimate interest in protecting our forms, Art. 6(1)(f) GDPR. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

11. Contact forms, coach application and coach enquiry

Contact us and "Become a coach". We send your name, e-mail address, country and message, and on the "Become a coach" form also your phone number and occupation (if given), to the Metabolic Balance office responsible for your country, so that it can answer you. We also send the address of the page from which you sent the form. Legal basis: steps prior to a contract, or our legitimate interest in answering enquiries, Art. 6(1)(b) and (f) GDPR.

Coach enquiry form. Metabolic Balance coaches are independent partners. If you use the form on a coach's profile to contact them, we forward your name, e-mail address, phone number (if given), preferred contact time (if given), message and the address of the page you sent it from to that coach, who then processes it as a separate controller. Legal basis: your consent, Art. 6(1)(a) GDPR.

Record of your consent. So that we can prove that you consented to your enquiry being forwarded, and when, we store a record of it: your e-mail address, the coach you contacted, the date and time, the exact consent wording you agreed to and the language version of the website. Your name, phone number and message are not stored. If you withdraw your consent, we add the date of the withdrawal to this record; we do not delete the record, because it documents both your consent and its withdrawal. We keep the record for 3 years after your enquiry or, if you withdrew your consent, for 3 years after the withdrawal, and then delete it. Legal basis: our legal obligation to be able to demonstrate consent, Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

The forms are delivered by e-mail through Postmark (ActiveCampaign, LLC, Chicago, USA) as our processor. Postmark is certified under the EU-U.S. Data Privacy Framework. We use your data from any form only to answer you, and never for marketing without your separate consent.

12. Testimonials

If you provide a testimonial or success story for our website, we process your name, photos, and statements based on your explicit consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future by contacting us at dp@metabolic-balance.com.

13. Retention rules

Unless a specific retention period is stated elsewhere in this policy, our general retention rules apply. We keep your personal data only as long as necessary for the respective purpose. If you withdraw your consent, the related data will be subject to deletion within 60 days of withdrawal, except for the record of your consent described in section 11, unless legal retention obligations require a longer storage period.

14. Web Fonts

To protect your privacy, the core web fonts used for our website's design are hosted entirely locally on our own servers. No connection is made to external servers, and no personal data is transmitted when displaying our standard text. However, once you load a third-party feature on our site, such as Google Maps (see Section 8), the provider may automatically load its own required fonts (e.g., Roboto) directly from its servers (fonts.googleapis.com and fonts.gstatic.com). In such cases, your browser connects to the provider's servers, and the data processing is governed by the rules and legal basis of that specific service.

15. Recipients

We do not sell or rent your personal data. We share it only as described above:

  • with our processors: Microsoft, Google, Cloudflare, Postmark;
  • with the providers you choose to load: YouTube, Vimeo, Buzzsprout, Google Maps;
  • with Google, for place searches made through our server (section 8);
  • with the Metabolic Balance office or coach you contact;
  • with authorities where we are legally obliged to.

16. Transfers outside the EU

Some providers are located in, or may access data from, the USA. We rely strictly on the EU-U.S. Data Privacy Framework where the specific provider is certified. Where the Data Privacy Framework is not applicable, we rely on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914 of 4 June 2021) as the transfer mechanism (Art. 46 GDPR).

17. Your rights and supervisory authority

You have the right to:

  • access your data;
  • request rectification or erasure of your data;
  • request restriction of processing;
  • data portability;
  • object to processing based on legitimate interest;
  • withdraw any consent at any time, with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision:

Bavarian State Office for Data Protection Supervision

P.O. Box 1349

91504 Ansbach

Germany

18. Data security

We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS) and access controls.

19. Changes

We update this policy when our website or the law changes. The current version is always available on this page.