Privacy

Who is responsible

Responsible for processing your personal data, as controller under the Swiss Federal Act on Data Protection (FADP), is:

Business

Forged by Marko

Legal form

Sole proprietorship under Swiss law

Owner

Marko Stankovic

Location

Zürich, Switzerland

Email

info@forgedbymarko.com

For anything concerning your data, write to info@forgedbymarko.com.

Visiting the website

This website sets no cookies and uses no analytics, no tracking and no advertising. Its pages load nothing from other companies: their fonts, images and film are delivered with the site itself. The one exception is the application’s spam check, Cloudflare Turnstile, which loads only when you open the application (see Applying).

Every visit produces technical data — your IP address, the date and time, the page requested, and the description your browser sends of itself. The web server records it to deliver the site and to protect it from misuse, and deletes these records after 14 days.

The website runs on a server rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centre in Nuremberg, Germany (privacy policy). Hetzner provides the server; the website on it is operated by us.

Applying

When you apply, we receive what you enter: your name, your email address, your location if you give it, what you want to build, and where you are now and want to be. We use it only to review your application and to reply to you.

Some of what you tell us may concern your health or physical condition — under the FADP, sensitive personal data. Share only what you are comfortable sharing; we use it only to assess your application.

Your application reaches us by email, and you receive a short confirmation at the address you gave. The website itself stores no applications. Giving your name, email address and a description is voluntary, but without them we cannot consider an application.

To keep the form free of automated abuse, opening the application loads Cloudflare Turnstile, a check provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Turnstile privacy addendum). It runs in a frame from Cloudflare and uses signals from your browser — your IP address, the description your browser sends of itself and its TLS fingerprint — to tell people from automated programs. Usually you notice nothing; sometimes it asks you to confirm. We receive only the result. Cloudflare processes these signals on our behalf and, by its own account, also as a controller in its own right to improve its bot detection; it may use strictly necessary security cookies of its own (cookie policy).

In addition, the server briefly remembers a pseudonymised (hashed) form of your IP address and of your application — in working memory only, never on disk or in logs — and forgets it within a day. Submissions that look automated, such as a form sent faster than anyone could fill it in, are turned away; if that happens to you, simply send it again.

Coaching

If we work together, we process what the coaching needs: your contact details; the agreement, invoices and payments; the information about your health, injuries, training, nutrition and progress that you share with us or that arises in the coaching; and our correspondence. Health information is sensitive personal data: it is used only to coach you safely and well, and is not disclosed to anyone else without your consent unless the law requires it.

Payments

You can pay by card through Stripe, by bank transfer, by TWINT, or in cash.

• Stripe processes card payments. It receives your payment details and the amount; we receive confirmation of the payment, never your full card number (privacy policy).
• TWINT (TWINT Ltd., Stauffacherstrasse 41, 8004 Zurich, Switzerland) and your bank process TWINT payments under their own terms.
• Bank transfers pass through your bank and ours, which see the payer, the amount and the reference.
• Cash payments are recorded only in our accounts.

Email

Applications and confirmations are sent through Resend (Plus Five Five, Inc., USA), an email delivery service that processes them on our behalf and keeps emails and their delivery records for a limited period under its own retention rules (privacy policy). Applications arrive in our mailbox, info@forgedbymarko.com, which is hosted by Hostpoint AG in Switzerland, as is all our other email.

If you write to us directly, we use your message and address to answer you.

Data abroad

The website’s server is in Germany, which Switzerland recognises as ensuring adequate data protection. Our mailbox and TWINT are in Switzerland.

Resend, Stripe and Cloudflare may process your data in the United States. Cloudflare states that Cloudflare, Inc. complies with the Swiss-U.S. Data Privacy Framework (privacy policy). Transfers to Resend are made under the European Commission’s standard contractual clauses as adapted for Switzerland, as set out in Resend’s data processing agreement. Stripe states that Stripe, Inc. complies with the Swiss-U.S. Data Privacy Framework — which Switzerland recognises as ensuring adequate protection — and that it also relies on standard contractual clauses.

How long we keep it

• Applications that do not lead to coaching are deleted within 90 days of our decision.
• When an application leads to coaching, we keep only what the coaching needs; it becomes part of the coaching records, and the rest is deleted.
• Coaching records are deleted within 12 months after the coaching ends, unless a longer legal retention obligation applies.
• Health information is deleted as soon as it is no longer needed — normally no later than 12 months after the coaching ends, unless keeping it longer is legally justified.
• Invoices, receipts and the other records our accounts are based on are kept for ten years from the end of the financial year, as Swiss law requires (Art. 958f of the Code of Obligations).
• Server security logs — the technical records of visits: deleted after 14 days.
• What the application form remembers to prevent abuse: deleted within a day.
• What Cloudflare keeps of the spam check: as Cloudflare’s own policies provide; we keep nothing of it beyond the application itself.

Your rights

You can ask us at any time what data about you we hold, and have it corrected, deleted or handed to you in a common electronic format. You can object to its processing and withdraw any consent you have given. Write to info@forgedbymarko.com; we may ask you to confirm your identity. Where the law requires us to keep certain data, we will tell you.

If you believe we are not handling your data lawfully, you can complain to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (edoeb.admin.ch).

If you are in the EU or EEA

Where the EU General Data Protection Regulation applies, we rely on the steps you ask for before a contract and on the contract itself — reviewing your application and coaching you (Art. 6(1)(b) GDPR); on our legal obligations, for business records (Art. 6(1)(c) GDPR); on our legitimate interest in running a secure website free of abuse, the spam check included (Art. 6(1)(f) GDPR); and, for health information, on your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time. You may also complain to the data protection authority where you live or work.

Decisions and security

Every application is read by Marko; we make no decisions about you by automated means and do not profile you. The spam check only tells people from automated programs: if it cannot confirm you, nothing is decided about you — try again, or write to info@forgedbymarko.com.

We protect personal data with technical and organisational measures appropriate to the risk. The website is served only over encrypted connections (HTTPS); applications are processed on the server without being stored there; and administrative access to the server and to the mailbox is restricted and protected by credentials. Service providers process data on our behalf or under their own privacy policies, as described above.

Cookies

This website sets no cookies and stores nothing in your browser. When you open the application, Cloudflare Turnstile’s frame may set strictly necessary security cookies of Cloudflare’s own (see Applying). If anything else ever changes, this notice will say so first — and anything not strictly needed will ask for your consent.

Changes

We update this notice when what we do changes. The current version is always here; the date at the top shows when it last changed.