Privacy Policy

Last updated: 22 August 2026 · Version 1.0 (draft)

Draft. Complete before taking clients. The controller identity, the retention periods and the list of processors below are placeholders. Health data is a special category under Art. 9 GDPR and a coaching business handles it routinely, so have this checked by a lawyer before you publish it.

This policy covers this coaching website and the coaching relationship itself. The Vollkraaft app is a separate product with its own privacy notice.

1. Controller

The controller for the processing described here is [Legal entity name, address], contactable at timonseul@icloud.com. Full identification is in the Legal Notice. [No data protection officer is appointed, as the thresholds in Art. 37 GDPR are not met.]

2. What we collect, and why

Data	Why	Legal basis
Enquiry form: name, email, chosen plan, your message	To answer your enquiry and arrange a consultation	Your consent, Art. 6(1)(a) GDPR
Client contact details	To deliver coaching, schedule sessions and stay in touch	Performance of a contract, Art. 6(1)(b)
Health information: injuries, conditions, medication, pregnancy, pain reports	To program safely and adapt training to your body	Your explicit consent, Art. 9(2)(a), on top of Art. 6(1)(b)
Training records: lifts, loads, bodyweight, session notes	To track progress and adjust your programme	Performance of a contract, Art. 6(1)(b)
Payment and invoice records	To take payment and meet tax and accounting duties	Legal obligation, Art. 6(1)(c)
Server logs kept by our host, including IP address	To serve the site and keep it secure	Legitimate interests, Art. 6(1)(f)

3. Health data, specifically

Coaching cannot be done safely without knowing about your injuries and relevant conditions. That information is a special category of personal data. We only process it with your explicit consent, we only record what is needed to program safely, we do not share it with anyone else without asking you first, and you can withdraw that consent at any time. If you withdraw it, we can usually no longer coach you safely, and the coaching would have to end.

4. The enquiry form

The form on the homepage is handled by Netlify Forms. Submissions are stored in the Netlify dashboard and emailed to us. The form uses a hidden honeypot field to block spam bots. It sets no cookie and does no profiling. Ticking the consent box is what allows us to use your message to reply. We delete enquiries once the enquiry is closed, unless you go on to become a client.

5. Who else sees your data

We keep the list of processors short on purpose:

Netlify, website hosting and form handling.
[Email provider], our email correspondence with you.
Google Fonts, which serves the typefaces. Your browser requests them from Google's servers, which discloses your IP address to Google. See section 6.
[Nutritionist / recovery provider, where a plan includes them], who receive only what you agree to share and act as their own controllers.
Where your plan includes the Vollkraaft app, your training data is processed there under the app's own privacy notice.

We do not sell your data, we do not use it for advertising, and we run no analytics or tracking on this site.

6. Google Fonts and international transfers

Worth knowing. This site currently loads its typefaces from Google Fonts, so your IP address reaches Google when a page loads. Some EU courts have treated that as a transfer needing its own justification. Self-hosting the font files removes the transfer entirely and is the cleaner option. [Decide before launch: self-host the fonts, or keep this disclosure.]

Where a provider processes data outside the EEA, we rely on the European Commission's standard contractual clauses or an adequacy decision.

7. How long we keep it

Enquiries that do not become coaching: deleted once the enquiry is closed, at the latest after [6 months].
Client records including health and training notes: kept for the coaching relationship and then [period, e.g. until claims are time-barred].
Invoices and payment records: [statutory retention period, e.g. 6 years], because tax law requires it.
Server logs: kept by our host for a short period for security.

8. Your rights

Under the GDPR you can ask for access to your data, correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interests. Where processing rests on consent, you can withdraw that consent at any time, which does not affect what was lawful before you withdrew it.

Email timonseul@icloud.com to exercise any of these. You also have the right to complain to a supervisory authority, in the EU country where you live, work, or where you think the problem happened. The competent authority for us is [supervisory authority and address].

9. Security

The site is served over HTTPS with a strict content security policy and standard security headers. Access to client records is limited to the coach. No system is perfectly secure, so we keep the amount of data we hold deliberately small.

10. Children

Coaching is offered to adults. Clients under 18 are taken on only with the consent of a parent or guardian, who must also consent to the processing of health data.

11. Changes

If this policy changes, the date at the top changes with it. Material changes affecting current clients are communicated directly.