Privacy Policy

The controller is [Business Name], trading as Carlen Coaching. Business address: [Business Address]. Company registration number: [Company Registration Number].

For privacy questions, contact nathanaelcarlen@gmail.com. Effective date: [Effective Date]. Last updated: [Last Updated Date].

The data collected depends on how you use the website and coaching service. The website should only request information needed to process applications, provide coaching, manage accounts, process payments, improve the service, and meet legal obligations.

• Account information, such as name, email address, login details managed by the authentication system, language preference, and account role.
• Contact and application information, such as name, email, age, training experience, height, bodyweight, training availability, goals, injuries or limitations, schedule, and message to the coach when you submit the application form.
• Booking information, such as full name, email address, phone number if provided, selected coaching package, goal, notes, booking status, and confirmation details.
• Payment and transaction information, such as payment status, amount, currency, billing dates, payment provider customer ID, checkout session ID, subscription ID, and payment intent ID. Raw card numbers are not collected or stored by the website.
• Coaching-related information you add or that is assigned to you, such as programs, workouts, exercises, sets, reps, weights, meal logs, weight logs, progress photos, goals, preferences, check-ins, and related notes.
• Website usage and technical information, such as device/browser information, pages visited, timestamps, security logs, and information needed to keep the website functioning.
• Cookies and similar technologies, including local storage used to remember language preference and authentication state, and cookies required for secure login and payment flows.

Personal data is collected to respond to applications, create and manage accounts, provide coaching, create training and nutrition plans, track progress, process bookings and subscriptions, secure the website, communicate with you, and comply with legal obligations.

The legal bases may include performance of a contract when providing paid coaching and managing subscriptions, legitimate interests in operating and securing the website, consent where you choose to provide optional information or consent is otherwise required, and legal obligation where records must be kept for accounting, tax, consumer protection, or similar requirements.

Health-related information, injuries, progress photos, body measurements, and nutrition details can be sensitive or personal. You should only provide information you are comfortable sharing for coaching purposes. Where special-category data is processed, explicit consent or another valid GDPR basis should be confirmed before relying on it.

Data may be used to review your coaching application, prepare and adjust your program, track progress, recommend future training targets, communicate about your coaching, manage access to the client portal, handle support, and keep payment and booking records accurate.

Stripe is currently connected to process payments and subscriptions. Payment details are entered in the payment provider's secure checkout, not directly on this website. The website may store payment status and provider reference IDs so bookings and subscriptions can be managed.

The payment provider's own terms and privacy policy may apply to their processing. If Stripe is replaced by another provider, this section should be updated to reflect the provider actually used by the website.

Personal data may be processed by service providers that help operate the website, authentication, database, file storage, payments, email delivery if configured, analytics or security. These providers should only process data for the purposes of delivering the service and under appropriate contractual protections.

Reasonable technical and organisational measures should be used to protect personal data, including account access controls, role-based access, secure payment processing, restricted file access, and protection against unauthorised access.

No website or online service can guarantee absolute security. You should use a strong password and keep your login details private.

Personal data should be kept only for as long as needed for the purposes described in this policy, including providing coaching, managing your account or subscription, resolving disputes, keeping accounting/payment records, and complying with legal obligations.

When data is no longer needed, it should be deleted, anonymised, or archived in line with applicable legal and business requirements. Specific retention periods should be inserted when they have been confirmed.

If GDPR applies to the processing of your personal data, you may have the rights below, subject to legal conditions and exceptions.

• Right to access personal data held about you.
• Right to correction of inaccurate or incomplete personal data.
• Right to deletion where there is no lawful reason to keep the data.
• Right to restriction of processing in certain situations.
• Right to data portability for data you provided, where technically feasible and legally required.
• Right to object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent where processing is based on consent. Withdrawal does not affect processing already carried out before withdrawal.

You may contact us first so we can try to resolve your concern. You also have the right to complain to the relevant data protection authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY).

Some service providers may process data outside Sweden or the EU/EEA. Where this happens, appropriate transfer mechanisms and provider terms should be reviewed and documented before relying on those services for personal data.

This policy may be updated when the website, coaching service, payment flow, providers, or legal requirements change. The latest version should state its effective date and last updated date.

For privacy requests or questions, contact nathanaelcarlen@gmail.com. Legal entity: [Business Name]. Address: [Business Address]. Company registration number: [Company Registration Number].