Last updated: December 2024
1. GDPR Overview
The General Data Protection Regulation (GDPR) is a European Union regulation that governs how we collect, use, and protect your personal data. Even though Professional Fitness HQ is based in the United States, we comply with GDPR principles for all our users to ensure the highest level of data protection.
2. Legal Basis for Data Processing
We process your personal data under the following legal bases:
Consent (Article 6(1)(a))
- Marketing communications and newsletters
- Optional cookies and tracking technologies
- Participation in surveys and feedback programs
- Social media integration and sharing
Contract Performance (Article 6(1)(b))
- Providing fitness services and personal training
- Processing payments and managing accounts
- Scheduling appointments and sessions
- Delivering online coaching programs
Legitimate Interest (Article 6(1)(f))
- Website functionality and security
- Fraud prevention and detection
- Business communications and customer support
- Service improvement and development
Legal Obligation (Article 6(1)(c))
- Tax and accounting record keeping
- Regulatory compliance requirements
- Response to lawful requests from authorities
3. Your GDPR Rights
As a data subject under GDPR, you have the following rights:
Right to Information (Article 13-14)
You have the right to know how your personal data is processed, including the purposes, legal basis, and retention periods.
Right of Access (Article 15)
You can request a copy of all personal data we hold about you, including information about processing activities.
Right to Rectification (Article 16)
You can request corrections to inaccurate or incomplete personal data.
Right to Erasure/"Right to be Forgotten" (Article 17)
You can request deletion of your personal data in certain circumstances, such as when:
- The data is no longer necessary for the original purpose
- You withdraw consent and there's no other legal basis
- The data has been unlawfully processed
- You object to processing and there are no overriding legitimate grounds
Right to Restrict Processing (Article 18)
You can request that we limit how we use your personal data in certain situations.
Right to Data Portability (Article 20)
You can request your personal data in a structured, commonly used format to transfer to another service provider.
Right to Object (Article 21)
You can object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making (Article 22)
You have rights regarding automated decision-making and profiling, though we primarily use manual review processes.
4. Exercising Your Rights
To exercise any of your GDPR rights:
- Email us at: [email protected]
- Call us at: +1 (214) 555-0187
- Write to us at: Professional Fitness HQ, GDPR Compliance Officer, 2847 McKinney Avenue, Suite 450, Dallas, TX 75204, USA
We will respond to your request within 30 days (extendable to 90 days for complex requests).
5. Data Protection Measures
We implement appropriate technical and organizational measures:
Technical Measures:
- Encryption of data in transit and at rest
- Regular security updates and patches
- Secure backup and recovery systems
- Multi-factor authentication for staff access
Organizational Measures:
- Privacy by design principles
- Regular staff training on data protection
- Data breach response procedures
- Regular privacy impact assessments
6. International Data Transfers
When we transfer personal data outside the EEA, we ensure appropriate safeguards such as:
- Standard Contractual Clauses (SCCs)
- Adequacy decisions by the European Commission
- Binding Corporate Rules where applicable
- Explicit consent for specific transfers
7. Data Breach Notification
In case of a personal data breach, we will:
- Notify the relevant supervisory authority within 72 hours (when required)
- Inform affected individuals without undue delay if there's a high risk
- Document all data breaches and our response measures
- Take immediate steps to mitigate the breach
8. Children's Data
We do not knowingly process personal data of children under 16 without parental consent. If we become aware of such processing, we will delete the data unless we have valid consent.
9. Supervisory Authority
If you're unsatisfied with our response to your privacy concerns, you have the right to lodge a complaint with your local data protection authority or the Irish Data Protection Commission (our lead supervisory authority for EU operations).
10. Contact Our Data Protection Officer
For GDPR-related questions or concerns:
Data Protection Officer
Professional Fitness HQ
2847 McKinney Avenue, Suite 450
Dallas, TX 75204, USA
Phone: +1 (214) 555-0187
Email: [email protected]
