Privacy Policy – TheCoach-Link
Information provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

1. General Information

Data subjects are hereby informed of the following general aspects, applicable to all data processing activities:
• - all data is processed in accordance with the applicable data protection legislation, including Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD);
• - all data is processed lawfully, fairly, and transparently with respect to the data subject, in accordance with the general principles set out in Article 5 of the GDPR;
• - appropriate technical and organisational security measures are applied to prevent the loss, unlawful or improper use, and unauthorised access to personal data (Article 32 GDPR).

2. Data Controller

The data controller for the processing of personal data is TheCoach-Link, a private limited company ( sociedad limitada ) with its registered office in Valencia, Spain, and Tax Identification Number (NIF) B75453068 .
The Controller may be contacted for any matters relating to the protection of personal data, as well as for the exercise of the rights set out in this policy, via the following e-mail address: info@thecoach-link.com.

3. Scope of Application

This privacy policy applies to the use of the TheCoach-Link mobile application, which is accessible globally and intended for use by personal trainers and end users (trainees).

4. Data Subject Rights

In accordance with Regulation (EU) 2016/679 (GDPR), data subjects may exercise the following rights:
• - the right of access to personal data concerning them (Art. 15 GDPR);
• - the right to rectification of inaccurate data and to completion of incomplete data (Art. 16 GDPR);
• - the right to erasure of personal data (“right to be forgotten”), where one of the grounds provided by law applies (Art. 17 GDPR);
• - the right to restriction of processing, in the cases provided for by applicable law (Art. 18 GDPR);
• - the right to data portability, i.e., to receive personal data concerning them in a structured, commonly used and machine-readable format, and to transmit it to another controller (Art. 20 GDPR);
• - the right to object to processing, including profiling and automated decision-making (Arts. 21 and 22 GDPR);
• - the right to withdraw consent at any time;
• - the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if they believe their rights have been infringed.

To exercise any of these rights, the data subject may send a request to the following e-mail address: info@thecoach-link.com.

5. Categories of Data Collected

When using the App, various types of personal data may be collected and processed.
Some of this data – such as name, surname, and profile photo – is necessary for account creation and the proper functioning of the App (mandatory data).Other data is optional and voluntarily provided by the user in order to customize and enhance the user experience. Failure to provide optional data does not affect access to the App’s essential functionalities but may limit the use of certain personalized features.
When a public profile is created, for example by a trainer, specific data may be made visible within the platform. The inclusion of personal contact details (such as email address, phone number or links to social networks) is always voluntary and under the exclusive responsibility of the user.
The categories of data collected include:
• - identification and contact data: name, surname, gender, address, phone number, e-mail address, banking and payment details, social media profiles (e.g. Instagram, Facebook, LinkedIn), or personal website;
• - technical authentication data: login via Google or other methods, and access credentials;
• - health-related data: information on physical condition, feedback on exercises performed, and other data that may be provided in relation to training programs (processed exclusively with the data subject’s explicit consent, in accordance with Article 9 GDPR);
• - multimedia data: profile picture, additional images, videos or notes uploaded by users, especially by trainers;
• - usage data: statistics on physical activity, nutrition plans, workout history, and interactions with the App’s functionalities.
Users and trainers assume full responsibility for the content they upload, submit or share through the platform (including multimedia files or comments), as well as for any personal data of third parties included in such content. In such cases, users and trainers declare and warrant that they have previously obtained the consent of the data subjects, or otherwise have a valid legal basis to process and share such data, and expressly release the Controller from any liability in this regard.

6. Purposes of Processing

Personal data will be processed for the following purposes:
• - creation and management of the user account;
• - provision of services offered through the App, such as training and nutrition plans;
• - management of communications between trainer and client;
• - use of self-training functionalities, in autonomous mode and without direct assistance from a trainer, through limited access to tools and content available within the App;
• - publication of the trainer’s profile, in order to facilitate contact between service providers and potential new clients;
• - sending of operational notifications, system updates, and feedback requests;
• - management of subscription plans available to registered trainers;
• - improvement and personalization of the user experience, including through the analysis of interactions with the App;
• - display of promotional or advertising content, in a non-intrusive manner, during the use of the platform in its free version;
• - sending of informational, promotional, or commercial communications related to the Controller’s services, initiatives, or updates, subject to the user’s explicit and optional consent.

7. Legal Basis for Processing

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and is based on the following legal grounds:
• - the data subject’s explicit consent;
• - the contractual necessity related to the provision of the requested service through the platform;
• - the compliance with legal or regulatory obligations applicable to the Controller.

The processing of data for marketing purposes, such as the sending of promotional communications, shall be carried out exclusively on the basis of the data subject’s specific, freely given, and revocable consent.
The processing does not involve automated decision-making or profiling, in accordance with Articles 22 and 4(4) of the GDPR.

8. Processing Methods

Personal data is processed by electronic and automated means, applying appropriate technical and organisational measures to ensure the security, integrity, and confidentiality of the processed information, in accordance with Article 32 of the GDPR.
The Controller will retain personal data for the time strictly necessary to achieve the purposes for which it was collected, and in compliance with the relevant legal obligations. Data relating to inactive clients may be retained by the respective trainer, in a confidential manner and inaccessible to the user, solely for the purpose of maintaining a record of the activities carried out.
In the event of account deletion by the user, or upon explicit request, the data will be permanently deleted from the Controller’s systems.

9. Data Communication and Disclosure

Personal data may be disclosed to:
• - qualified trainers, who manage client activities within the App and provide personalized support;
• - technology and infrastructure service providers, necessary for the functioning and maintenance of the platform;
• - competent authorities, in compliance with legal obligations or upon their express request.

It is expressly stated that the Controller is not a party to, nor does it in any way participate in, financial transactions between users and trainers. Any payments agreed upon between the parties are made outside the platform and are the exclusive responsibility of those parties.
The Controller processes payment data solely for the purpose of managing subscriptions related to services offered directly through the App.

10. Disclaimer of Liability

TheCoach-Link shall in no event be held liable for:
• - any physical or psychological harm resulting from the use of training or nutrition programs created by trainers using the App;
• - inappropriate, non-compliant, or harmful content (including images, videos, or offensive language) uploaded by trainers or users;
• - unlawful, improper, or unprofessional conduct by trainers registered on the platform;
• - autonomous use of the App by users without a trainer, including the submission and use of content within the self-training functionalities.

In particular:

• - each trainer is solely responsible for the content they share and for the relationships they establish with their clients;
• - each user who uses the App autonomously (i.e. without the direct support of a trainer) assumes full responsibility for the use of self-training functionalities and related content, acknowledging that the effectiveness and safety of exercises depend on their physical condition and on correct adherence to the provided instructions;
• - users expressly acknowledge that responsibility for training activities, services provided, and published content lies entirely with the relevant trainer.

It is also noted that any information regarding titles, certifications, or professional qualifications published by trainers is not verified by the Controller and remains under the exclusive responsibility of the user who provides it.

11. Data Retention

Personal data will be retained for the time strictly necessary to fulfil the purposes indicated, and in any case, no longer than the duration of the user’s active account.
Users may exercise their right to delete their profile at any time, through the functionalities available within the App.

12. International Data Transfers

In the event that international transfers of personal data are made to countries outside the European Union or the European Economic Area, the Controller shall ensure compliance with the provisions of Articles 44 et seq. of the GDPR, guaranteeing an adequate level of data protection. Such transfers shall be carried out, where applicable, through the adoption of standard contractual clauses approved by the European Commission, or by implementing other appropriate safeguards in accordance with the applicable data protection legislation.

13. Withdrawal of Consent

The data subject has the right to withdraw their previously given consent to the processing of their personal data at any time, by sending a request to the email address indicated in Section 2. Likewise, the data subject may withdraw their consent at any time for the processing of data for direct marketing purposes.
Once the request has been processed, the personal data will be removed from the Controller’s records as soon as possible, unless there is a legal obligation to retain such data.
For further information regarding the processing of personal data, or to exercise any of their rights, the data subject may contact the Controller via the email address indicated in Section 2.

14. Changes to this Policy

This privacy policy may be subject to updates or modifications.Any material changes will be duly communicated to users through a notice within the App or by e-mail sent to the address associated with their account.
Continued use of the services following notification of such changes shall constitute implicit acceptance of the new conditions governing the processing of personal data.