This policy explains which personal data this website processes, for what purpose, on which legal basis, and which rights you have. It describes what the site actually does, service by service.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Diletta Luna OÜ
Sepapaja 6
15551 Tallinn
Estonia
Email: legal@lukabreitig.com
The company is represented by Luka Breitig. We are not required to appoint a data protection officer. Further details are in the legal notice.
2. Hosting and server logs
The website runs on a server that we administer ourselves and rent from a hosting provider. The provider processes data only on our behalf, under a data processing agreement (Art. 28 GDPR).
When you open a page, your browser automatically sends information that the web server records in log files: your IP address, the date and time of the request, the page requested, the page you came from, and your browser and operating system. We need this data to deliver the website and to detect and fix errors and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and working website. The log files are kept only as long as these purposes require and are then deleted.
The application's own logs never contain a complete email or IP address. Where a contact form submission is logged, the email address is shortened (for example j***@example.com) and the IP address is reduced to its network prefix (for example 203.0.x.x). The content of your message is never logged.
3. Cookies and browser storage
The site sets one cookie, _luka_breitig_key. It contains a security token that protects forms against cross-site request forgery, and it is deleted when you close your browser. This cookie is strictly necessary to provide the website (Art. 6(1)(f) GDPR, and in Germany § 25(2) no. 2 TDDDG).
If you arrive through a link carrying campaign parameters (utm_source, utm_medium, utm_campaign) or a Google Ads click ID (gclid), the site keeps these values in your browser's session storage under lb:campaign, so that the analytics events of your visit can be attributed to the campaign that brought you here. Session storage is cleared when you close the tab.
4. Analytics with Umami
We measure how the website is used with Umami, open-source analytics software that we run on our own server (umami.thehappybeavers.com). No data is passed to an external analytics provider.
Umami does not use cookies. To tell visits apart, it derives an identifier from your IP address and browser information combined with a secret value that changes regularly; your IP address itself is not stored. Umami records the pages you view, the website you came from, the country, region and city derived from your IP address, your browser, operating system, device type, screen size and language. In addition, we record these events: opening, submitting or failing to submit the contact form (never its content), starting, progressing through and completing the fit quiz together with its result category, how far you scroll on a page, downloading the trainer profile, and clicking a course card. Events carry the campaign values described in section 3.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is understanding which content helps visitors so that we can improve the website. You can object at any time (section 9), for example by blocking requests to umami.thehappybeavers.com in your browser.
5. Contact form
When you contact us through the contact form, we process your name, your email address and your message. If you completed the fit quiz before writing, your quiz results are attached to the message. We use this data only to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or steps before one, and otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering the enquiries we receive.
Your message reaches our mailbox as an email sent through Postmark, an email delivery service of ActiveCampaign, LLC, 1 N Dearborn St, Chicago, IL 60602, USA, which acts as our processor. Postmark processes the data in the USA. ActiveCampaign, LLC is certified under the EU-U.S. Data Privacy Framework, on which the transfer is based (Art. 45 GDPR). The website itself does not store your message. We keep the resulting email for as long as your enquiry requires and then delete it, unless statutory retention periods apply.
To prevent abuse, the site counts submissions per IP address and accepts at most six per hour. For this purpose your IP address is held in the server's working memory for up to one hour; it is never written to disk. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in protecting the form against misuse.
6. Spam protection with Google reCAPTCHA
When you open the contact form, and only then, the site loads Google reCAPTCHA v3, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA evaluates how the form is used, for example your IP address, browser information, time spent on the page, and mouse and keyboard interaction, to tell whether a submission comes from a person or an automated program, and may store information in your browser for this. When you submit the form, the result is verified with Google.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the contact form against spam. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. For details, see Google's privacy policy.
7. Conversion measurement with Google Ads
We advertise with Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To learn whether our ads lead to enquiries, the site loads the Google tag (gtag.js from www.googletagmanager.com) on its pages. The tag runs in Google Consent Mode with advertising and analytics storage set to "denied", so it neither sets nor reads advertising cookies.
When you open the contact form, submit it or complete the fit quiz, the tag sends a conversion signal to Google, without cookies and without the content of the form or your answers. With every request Google receives technical information such as your IP address, browser information and the address of the page, including the Google Ads click ID if you arrived through an ad. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is measuring whether our advertising works. You can object at any time (section 9), and you can prevent the tag from loading by blocking www.googletagmanager.com in your browser.
8. Fonts and links to other websites
All fonts are served from our own server. Your browser does not contact Google Fonts or any other font service.
Links to LinkedIn, Bluesky, GitHub and other websites are ordinary links. No data is transmitted to these services unless you follow a link; from then on, the privacy policy of the website you visit applies.
9. Your rights
You have the right to access the personal data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16 GDPR) or erased (Art. 17 GDPR), to restrict its processing (Art. 18 GDPR) and to receive it in a portable format (Art. 20 GDPR).
Right to object: where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time, on grounds relating to your particular situation (Art. 21 GDPR). We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
To exercise any of these rights, send us a message through the .
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live or work. The authority responsible for us is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).
10. Changes to this policy
We update this policy when the website or the services it uses change. The date of the current version is shown at the top of this page.