1. Controller
The controller responsible for the processing of personal data is:
WILKO GROUP LTD Christaki Kranou 16 4041 Limassol Republic of Cyprus
Managing Director: Wilhelm Kohlwes Company Registration Number: HE 486419 VAT Number: CY60297701D Phone: +491717486257 E-Mail: wilhelm.kohlwes@gmail.com Website: pumpingbuddycontest.com
Privacy contact: wilhelm.kohlwes@gmail.com
No data protection officer has been appointed. Until an appointment is actually made, none is named here.
2. Account and sign-in data
We process your email address, your password (only as a hash) and the sign-in and security data required to operate your account. When you sign in through a third party provider, we process the identifier that provider transmits.
3. Profile data
Username, profile picture, country, rank, lifetime reps, achievements and performance statistics. First name, last name, date of birth, email address and mobile number are private and are never shown publicly.
4. Workout and performance data
Rep counts, sessions, results, group contributions, leaderboard positions and match results.
5. Camera and pose processing
During a session your camera is used to detect body points and count repetitions. That evaluation happens on your device. The raw camera image is not transmitted to us for it.
6. Session recordings
Only if you explicitly agree is a video recording of a session stored. A visible recording indicator is shown while a recording runs. Recordings are deleted automatically once the retention period has passed. Results and leaderboard data stay.
The Rep Counter does not record a persistent session video.
7. Groups
Group membership, your role in a group, contributions and group statistics. Private groups are not publicly searchable.
8. Leaderboards and achievements
Leaderboard positions and unlocked achievements are shown within the community features.
9. VS data
VS mode is not available yet. While it is not released, no VS competitions take place and we process no match results and no rating data from them. Before it is released, this policy is extended with the data categories that then apply.
10. GIB MIR 10!, PVP points and proof photos
For the challenges between users we process: the identifier and player name of the sender and of the accepting player, the required number of repetitions, the public link code of the invitation, both deadlines, the status of the challenge and the PVP points booked from it. These details are visible to the two participating users and to support. A challenge is not deleted, so its history stays traceable.
To complete a challenge the accepting player uploads a picture of their last counted repetition as proof. The picture is stored in protected storage and opened only to the two participating users and to support, through a short-lived link. It is not shown publicly and is not used in leaderboards.
In addition we process training data from every area of the app — Rep Counter, SOLO, GIB MIR 10! and CREW — as repetitions per session and per training day. Every valid repetition is credited exactly once.
PVP points and the PVP rank calculated from them appear in their own leaderboard. Training repetitions and PVP points are kept separately and are not converted into one another.
11. Login streak, notifications and push
For the login streak we store the calendar day of each sign-in in your own time zone. A second sign-in on the same day is not recorded twice; if a day is missing the run ends.
In the app we show notices such as news and friend requests. Push messages are voluntary: we send them only if you switch them on in the settings and the browser grants permission. For this, your device registration together with the technical identifier needed for delivery is stored. You can switch push off at any time; the device registration is then removed. Push currently exists for chat messages and friend requests.
12. Subscriptions and payments
Paid plans are offered. For processing we handle the identifier of your subscription and of your customer account at the payment service provider, the payment status, the billing period and the invoice reference. We never store complete payment card data ourselves; it is processed directly by the payment service provider.
Details on the payment provider, tax handling and invoice retention are kept in the service provider register and in the retention register.
13. Support
Requests you send us, together with the information they contain.
14. Moderation and reports
Reports, moderation decisions and the reasons behind them. These records exist so decisions can be traced.
15. Security logs
Technical logs of sign-ins and security relevant events.
16. Cookies and analytics
No advertising cookies are set and no profiling takes place. Only technically necessary storage technologies are used:
- Sign-in — keeps you signed in (local storage). Purpose: running and securing the app. Category: ESSENTIAL.
- Language and display — stores your chosen language and whether the pose points are shown on the camera image (local storage). Purpose: display. Category: ESSENTIAL.
- Session and invitation state — stores whether a sign-in applies only to the current tab and whether an invitation or challenge link was opened (local storage, session storage). Purpose: running the app. Category: ESSENTIAL.
For two product events — creating a share card and accepting a challenge — anonymous usage counters are recorded through the platform. These counters contain no personal data and serve no advertising or profiling.
When the app loads, fonts and the movement detection library are loaded from external servers. Your IP address is technically transmitted to the respective provider for this. The movement detection itself runs entirely on your device.
17. Service providers
The service providers actually used are recorded in the internal service provider register. It documents each provider, its purpose, the categories of data involved and where it processes data.
The technical operation of PumpingbuddY — hosting, database, sign-in and the sending of system emails (registration, password reset, invitations) — is provided by the operator of the platform. The mailboxes for support, privacy and legal enquiries are hosted by an email hosting provider.
Provider, purpose, categories of data processed, processing location, data processing agreement and transfer basis are documented in the service provider register and are provided on request.
18. International transfers
Where processing takes place outside the European Union or the European Economic Area, it relies on a recognised transfer mechanism — an adequacy decision of the European Commission or the European Commission's standard contractual clauses. The mechanism actually used for each provider is documented in the service provider register.
19. Retention
The retention periods per category are recorded in the internal retention register. Session recordings are deleted automatically once the period set there has passed.
A retention period may only be stated as binding on this page once the automatic deletion actually runs and has been tested.
20. Your rights
Access, correction, deletion, restriction, portability and objection. Account deletion is available directly in the app. For requests: wilhelm.kohlwes@gmail.com
21. Account deletion
You can delete your account in the settings. After deletion, personal data is removed unless a statutory or contractual retention obligation applies.
22. Age restriction
PumpingbuddY is intended for users aged 18 and over.
23. Changes to this policy
We announce changes to this policy at least 14 days before they take effect, in the app and, where an email address is available, by email. The amended version applies from the announced date. If a change materially affects your rights or requires consent, we obtain your consent beforehand.