Privacy Policy

Draft prepared without legal counsel, prioritising accuracy and completeness over speed. Recommend a professional legal review once budget allows, especially before processing real client payments.

1. Who this policy covers

This Privacy Policy explains how José Fernandes, trading as José Fernandes Coach, of Prodromou 121, Nicosia, Lefkosia 2064, Cyprus (“we”, “us”, “our”) collects, uses, and protects your personal data when you visit this website, contact us, or become a client. We are the data controller for the personal data described below.

Questions about this policy or your data can be sent to info@josefernandescoach.com.

2. What we collect

Depending on how you interact with us, we may collect:

• Contact details — name, email address, phone number, submitted via the contact form or WhatsApp.
• Training information — your goals, training history, and preferences, shared directly by you when planning your programme.
• Progress-tracking data — if you use online coaching, this may include photo-based progress tracking that you choose to share. This is sensitive personal data under EU/UK GDPR and is only collected with your explicit, separate consent.
• Payment information — processed directly by our third-party payment provider. We do not store your full card details ourselves.
• Technical data — basic website usage data collected automatically (see our Cookie Policy).

3. Why we use it, and our legal basis

• To respond to your enquiries and provide a price/availability quote — legitimate interest.
• To deliver personal training or coaching services you’ve signed up for, including billing — performance of a contract.
• To track your progress toward your training goals (including any photos you choose to share) — explicit consent, which you can withdraw at any time.
• To meet legal or accounting obligations (e.g. invoicing records) — legal obligation.

4. Who we share it with

We do not sell your personal data. We share the minimum necessary with:

• Our payment processor, to handle billing securely — they process payment details directly and do not receive your training or health information.
• Our website/email hosting providers, who store data on our behalf under their own security obligations.
• Authorities, only where required by law.

5. How long we keep it

We keep contact and training data for as long as you are an active client, plus a reasonable period afterwards to meet accounting/legal retention requirements. Progress-tracking photos are kept only for as long as you consent to them being used, and deleted on request. Enquiries that don’t turn into a client relationship are deleted after 12 months.

6. Your rights

Under GDPR, you have the right to: access the data we hold about you; correct inaccurate data; request erasure; restrict or object to processing; request a portable copy of your data; and withdraw consent at any time (e.g. for progress photos), without affecting the lawfulness of processing before that withdrawal. To exercise any of these, email info@josefernandescoach.com. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection, Cyprus.

7. Security

We take reasonable technical and organisational measures to protect your data against loss, misuse, or unauthorised access. No method of transmission or storage is 100% secure, but we aim to use industry-standard safeguards.

8. Changes to this policy

We may update this page from time to time. The “Last updated” date at the top will always reflect the most recent version.