Privacy Policy
This privacy statement explains how Box Planner (XF3 GmbH) processes personal data on the website www.box-planner.com, in the web application app.box-planner.com and in the Box Planner apps.
1. Controller and Roles
XF3 GmbH
Kirschstr. 18
80999 Munich, Germany
Email: office@box-planner.com
Phone: +49 (170) 4546193
Members of a box: If you use Box Planner as a member, trial participant or drop-in guest of a box (gym, studio), the box is the controller for your membership, booking, payment and training data. XF3 GmbH processes these data on behalf of and on the instructions of the box (Art. 28 GDPR, Art. 9 Swiss FADP). Please address questions and requests about these data to your box; requests that reach us are forwarded to the box without delay. Your box's privacy notice explains how it uses your data.
XF3 GmbH is the controller for this website, for the accounts of box owners and trainers, for the contracts and billing of Box Planner subscriptions, for app subscriptions you conclude directly with Box Planner, and for accounts that are not linked to a box.
2. What We Process and Why
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the website, security | IP address, time, page requested, browser | legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR) |
| Registration and account | name, email, phone, password (stored only as a hash), box | contract or pre-contractual steps (Art. 6(1)(b) GDPR) |
| Box Planner subscriptions of boxes, app subscriptions | contract, invoice and payment data | contract (b), statutory retention duties (Art. 6(1)(c) GDPR) |
| Contact form, email, WhatsApp | name, email or phone number, message | handling your request ((b) or (f)) |
| Protecting the contact form from spam | technical browser and device data, IP address | legitimate interest (f) |
| Visitor statistics (only with consent) | see section 4 | consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) |
| Member management, bookings, billing for a box | see the box's privacy notice | processing on behalf of the box (section 1) |
| Improving the app and platform | crash reports, usage events with a pseudonymous user ID | legitimate interest in an error-free app (f) |
3. Hosting and Service Providers
We run the website, the web application and the database on Microsoft Azure (Microsoft Ireland Operations Ltd., Dublin) in data centres in the EU (region North Europe, Ireland). We send emails via Microsoft 365. For crash reports and usage events of the apps we use Microsoft App Center, and for push notifications on iPhones the Apple Push Notification service (Apple Inc., USA). AI features for training planning use OpenAI (OpenAI Ireland Ltd., Dublin); only the text users enter is sent, no member data.
These providers process data on our behalf (Art. 28 GDPR). Where data reach the USA, this is based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
4. Cookies, Local Storage and Visitor Statistics
Without your consent we only store what the website needs in your browser (§ 25(2) TDDDG): your choice in the cookie banner (local storage) and, if you switch them, the language (cookie user_language, 1 year) and the light or dark display mode (cookie, 1 year). Our hosting provider Microsoft Azure sets the cookies ARRAffinity and ARRAffinitySameSite for the duration of your visit so that your requests reach the same server. Signing in to the web application sets a session cookie.
With your consent we load Google Tag Manager (Google Ireland Limited, Dublin) and through it Google Analytics to understand how the website is used. This sets cookies (e.g. _ga, up to 2 years) and sends data such as your IP address, pages viewed and device information to Google, including to the USA (EU-U.S. Data Privacy Framework). Tag Manager is not loaded before you consent.
You can withdraw your consent at any time via the "Cookie settings" link in the website footer; the Google cookies are then deleted.
5. Fonts, Icons and External Content
Fonts, icons and scripts are served from our own server; visiting the website opens no connection to Google Fonts, content delivery networks or other third parties. The only exceptions are the services below.
Contact form: To protect it from spam we use Cloudflare Turnstile (Cloudflare, Inc., USA). Turnstile checks technical characteristics of your browser to tell humans from bots and sends, among other things, your IP address to Cloudflare (EU-U.S. Data Privacy Framework).
Videos: Exercise pages contain YouTube videos (Google Ireland Limited) in privacy-enhanced mode (youtube-nocookie.com). YouTube sets cookies only once you play a video, but loading the page already sends your IP address to Google.
Links to social networks (Facebook, Instagram, X, YouTube, LinkedIn) and to WhatsApp are plain links; data are only transferred when you click them. If you message us on WhatsApp, WhatsApp (Meta) processes your message and phone number.
6. Box Integrations (Lead Integration, Partner Platforms)
A box can switch on integrations with its own services in Box Planner, e.g. a CRM system (HighLevel, GymPilot by MemberBoost), payment providers or partner platforms (Urban Sports Club, Wellpass, Wellhub). Box Planner then sends the data described for that integration on behalf of the box; for the lead integration these are name, email, phone, language and events such as "trial booked" or "became a member". Some of these providers are based in the USA. The box is responsible for this transfer and for its contract with the provider; details are in your box's privacy notice.
7. Retention
- Log data (e.g. login times, technical requests) are stored solely for security and stability purposes and are automatically deleted after 90 days.
- Backups are overwritten after 35 days at the latest.
- Account and contract data are kept as long as the account or contract exists; afterwards we delete or anonymise them unless statutory retention periods apply (e.g. 8 years for invoices and accounting records, § 147 AO, § 257 HGB).
- Enquiries are deleted once handled, unless we have to keep them.
8. Access to Your Data
You can see your data on memberships, class bookings, payments and your account at any time in the member portal or the app. A formal copy of all data we store about you (Art. 15 GDPR) is available on request at office@box-planner.com within one month in a structured format (e.g. CSV or JSON). The first copy is free of charge. For data we process for a box, please contact the box (section 1).
9. Data Security
All connections are TLS-encrypted. Passwords are stored only as a hash. We take technical and organisational measures to protect your data against unauthorised access, alteration and loss.
10. Your Rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You can withdraw any consent at any time with effect for the future.
Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.
Right to lodge a complaint: You can complain to a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. In Switzerland the Federal Data Protection and Information Commissioner (FDPIC) is responsible, in Austria the Datenschutzbehörde.
11. Contact
For questions about data protection or to exercise your rights, please contact us (members of a box: please contact your box first, see section 1):
XF3 GmbH
Kirschstr. 18, 80999 Munich, Germany
Email: office@box-planner.com
Phone: +49 (170) 4546193
Last updated: 17 October 2026 · © 2026 Box Planner | XF3 GmbH