Privacy policy
This page explains what personal data EddiFitness collects on this website and in the client area, why, and what you can do about it.
In short: we collect only what is needed to answer you and to coach you. In the client area, only you and your coach can see your data. There are no advertising or analytics trackers. You can delete your account, with everything in it, at any time.
1. Who is responsible
EddiFitness
Kurzemes prospekts 3, Kurzemes rajons, Rīga, LV-1067, Latvia
Email: info@eddifitness.lv
Phone: +371 20412270
This is the “data controller” in the sense of the EU General Data Protection Regulation (GDPR). For any question or request about your data, write to info@eddifitness.lv.
2. What we collect and why
Contact form
Your name, email address and message. We use them only to answer you. Legal basis: your request and our legitimate interest in replying to it (GDPR Art. 6(1)(b) and (f)).
Client area account
Your name, email address, password, chosen language, and the dates when you registered and accepted this policy. The password is stored only as an irreversible hash: nobody, including your coach, can read it. Legal basis: providing the coaching service you asked for (Art. 6(1)(b)).
Training
The workouts your coach assigns to you, the exercises you mark as done, the results and comments you enter, and your coach’s replies. Legal basis: providing the coaching service (Art. 6(1)(b)).
Check-ins and progress photos
Your weight, body measurements, your own ratings of sleep, energy and nutrition, comments, and the photos you choose to upload. This information can say something about your health, so we process it only with your explicit consent (Art. 9(2)(a)), which you give when you create your account. Every field is optional.
You can withdraw this consent at any time: delete a check-in, delete your account, or write to us. Withdrawing consent does not affect what was done before.
Technical data
- A sign-in cookie (see “Cookies” below).
- Your IP address and the email address used at sign-in, to limit repeated password attempts. These records are deleted automatically, normally within an hour.
- Our hosting provider processes IP addresses and basic request data to deliver the site and protect it from attacks.
Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f)).
Payments
Training programs are paid for through Stripe. You enter your card details on Stripe’s page; they never reach us. Stripe tells us your name, email address and what you bought, so that we can deliver it. We keep purchase records for as long as accounting law requires (Art. 6(1)(b) and (c)).
3. Cookies and browser storage
ef_session— a cookie that keeps you signed in to the client area. It is set only after you sign in and expires after 30 days or when you sign out. It is strictly necessary for the client area to work.ef_lang— a setting kept in your browser (not a cookie) that remembers whether you chose English or Russian.
We use no analytics, advertising or tracking cookies. That is why you do not see a cookie banner here.
4. Who can see your data
In the client area: only you and your coach. We do not sell your data and do not share it for advertising.
These companies process data for us, or receive some when you use the site:
- Cloudflare, Inc. (USA) — hosts the website and the client-area database, including photos.
- Web3Forms (Web3Creative, India) — delivers messages from the contact form to our email.
- Google — fonts (Google Fonts) and video previews and playback (YouTube). When a page loads, your browser fetches these files from Google, so Google receives your IP address. Videos start only when you press play and use YouTube’s privacy-enhanced mode.
- Stripe (Stripe Payments Europe, Ltd., Ireland) — handles payments.
- The email provider that hosts info@eddifitness.lv.
Some of these companies are located outside the European Economic Area (USA, India). Transfers are protected by the EU–US Data Privacy Framework or by the EU Standard Contractual Clauses.
The links to Instagram, YouTube and TikTok lead to those services. Once you are there, their own privacy policies apply.
5. How long we keep it
- Client area data — for as long as your account exists. “Delete my account” in Settings removes the account, workouts, results, check-ins and photos at once and for good. Your coach may also delete the account of someone who has stopped training.
- Contact form messages — for as long as needed to deal with your request.
- Sign-in protection records — normally no longer than an hour.
- Purchase records — for as long as accounting law requires.
6. Your rights
Under the GDPR you can ask to see your data, to have it corrected or deleted, to restrict or object to its use, to receive a copy of it, and to withdraw a consent you gave.
Much of this you can do yourself in the client area: change your name and password, edit or delete check-ins and photos, delete your account. For anything else, write to info@eddifitness.lv. We reply within one month.
If you believe your data is handled unlawfully, you can complain to the Latvian supervisory authority: Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, pasts@dvi.gov.lv, www.dvi.gov.lv.
7. Security
The site works only over an encrypted connection (HTTPS). Passwords are stored as hashes. Client data and photos are shown only after sign-in, and only to the client they belong to and the coach.
No system is perfectly secure. If something happens that is likely to affect you, we will tell you and the supervisory authority, as the law requires.
8. Children
The client area is meant for adults. If you are under 18, please use it only with the consent of a parent or guardian, who should contact us first.
9. Changes to this policy
When something changes, we update this page and the date at the top. Clients are told about significant changes in the client area or by email.