GARCIA BUILDER FITNESS ยท YOUR DATA
Privacy Notice
Last revised: 5 August 2026
This notice explains how personal data is handled when you visit Garcia Builder Fitness, complete the starter assessment, request information, create an account, purchase or use coaching services, or communicate with the coach.
1. Who controls your information
Trading name: Garcia Builder Fitness.
Legal controller: pending owner verification before publication.
Registration number and address: pending owner verification before publication.
Privacy contact: andre@garciabuilder.fitness.
2. Who and what this notice covers
This notice covers website visitors, assessment participants, leads, newsletter subscribers, people who contact Garcia Builder Fitness through email, social media or WhatsApp, coaching applicants and clients, account holders, and purchasers.
Depending on how you interact with the service, information may include:
- name, email address, age, optional WhatsApp number and optional Instagram or Facebook profile;
- starter-assessment answers, recommendation, lead score/status and result-delivery records;
- messages, enquiries, appointment and consultation information;
- training history, goals, availability, nutrition information and coaching check-ins;
- measurements, progress photographs, injury information and other health-related information you choose to provide;
- account identifiers, preferences, authentication and security information;
- purchase, invoice, subscription and payment-status information (payment-card details are handled by the payment provider, not stored in this assessment database);
- IP address, browser/device information, logs, consent choices, page paths and referring URL;
- UTM parameters and advertising identifiers such as
gclid,gbraid,wbraid,fbclid,_fbpand_fbc, where available and permitted.
3. Why information is used and the lawful basis
| Activity | Information and purpose | Lawful basis |
|---|---|---|
| Starter assessment and requested resources | Use answers, age and contact details to validate the submission, generate a starting recommendation, display and email the result, prevent duplicates and respond about the request. | Legitimate interests in responding to a requested assessment and operating it reliably; steps taken at your request before a coaching contract where applicable. The required acknowledgement records the request; it is not consent to unrelated marketing. |
| Direct enquiries, WhatsApp and social contact | Reply to the enquiry or requested result using the channel supplied and keep a reasonable record of the conversation. | Legitimate interests in responding; steps at your request before a contract where applicable. An assessment WhatsApp number is not enrolled in recurring WhatsApp marketing. |
| Email marketing | Send occasional fitness guidance, coaching updates and offers, and retain consent/suppression evidence. | Consent for messages; legitimate interests and legal obligations for a minimal suppression record after opt-out. |
| Coaching and accounts | Create and secure an account, assess suitability, provide agreed coaching, manage check-ins and support, and maintain service records. | Contract and pre-contract steps; legitimate interests in service administration and security; legal obligations where applicable. |
| Health-related information, measurements and progress photographs | Tailor coaching, review progress and identify when the service may be unsuitable. Publication as a transformation requires separate, specific permission. | Contract or legitimate interests for ordinary coaching data. Where information is special-category health data, a valid Article 9 condition is also required, normally explicit consent. Owner/legal review is required before publication. |
| Payments and subscriptions | Create checkout, confirm payment status, administer subscriptions, invoices, refunds and accounting records. | Contract and legal obligations; legitimate interests in payment administration and fraud prevention. |
| Essential operation and security | Protect accounts and endpoints, diagnose errors, prevent abuse, preserve language/session state and maintain evidence of consent choices. | Legitimate interests in secure, reliable operation; legal obligations where applicable. |
| Analytics and advertising | Measure website/assessment performance, attribute campaigns, limit duplicate conversion events and improve advertising. | Consent for non-essential analytics, campaign-attribution storage and advertising tags. Optional tags and persistent attribution identifiers are not activated sitewide until the matching choice is granted. |
4. Assessment recommendation and lead scoring
The starter assessment applies predefined rules to seven answers to generate a practical starting recommendation and a lead score/status. The output is general educational guidance. It does not diagnose a condition, prescribe medical treatment, guarantee a result, or make a decision that produces legal or similarly significant effects. A person can ask for the result or scoring logic to be explained by using the privacy contact above.
5. Direct marketing and your choices
Email marketing is optional and unchecked by default. Declining it does not prevent delivery of the assessment result or requested resources. You may withdraw consent using an unsubscribe link or by emailing the privacy contact. You may also object to direct marketing at any time. A minimal suppression record may be retained so the opt-out is respected.
6. Coaching, health information and progress content
Provide only information relevant to coaching. Garcia Builder Fitness is not an emergency or medical service. Health-related information and progress content require additional care and will not be made public merely because it was supplied for coaching. Separate permission is required before a testimonial, image or transformation is published.
7. Processors and recipients
Information is shared only when needed to operate, secure or administer the service, or where law requires it. Current or intended service categories include:
- Supabase for database, authentication and server-side storage;
- Vercel for website and serverless hosting;
- jsDelivr and cdnjs for delivery of pinned interface libraries and styles; these providers receive ordinary connection data such as IP address and user-agent when an external asset is requested;
- Brevo and/or the configured SMTP provider for transactional and consented marketing email;
- Zapier for workflow automation;
- Stripe for checkout, payment and subscription processing;
- Google Tag Manager, Google Analytics and Google Ads where consent permits;
- Meta technologies where consent permits;
- Calendly for appointment booking and My PT Hub for coaching functionality when you choose to use those services;
- professional advisers, insurers, regulators or authorities where necessary and lawful.
A verified processor list, roles and contractual status must be completed before publication.
8. International transfers
Some providers may process information outside Ireland or the European Economic Area. Before publication, the controller must verify each processing location and the applicable safeguard, such as an adequacy decision or approved contractual safeguards, and make further transfer information available on request. No safeguard is asserted in this draft without that verification.
9. Retention schedule
Records are deleted or anonymised when they are no longer required for the stated purpose, subject to accounting, legal-claim, consent-evidence and security needs. The exact periods below are publication blockers and must be approved by the controller.
| Record | Retention decision required before publication |
|---|---|
| Incomplete assessment/session events | Confirm duration and automatic deletion rule. |
| Completed assessment leads without marketing consent | Confirm response/follow-up period and deletion or anonymisation rule. |
| Completed assessment leads with marketing consent | Confirm active-list review period; retain only a minimal suppression record after withdrawal. |
| Consent and acknowledgement evidence | Confirm limitation/legal-claims period and deletion criteria. |
| Coaching records, health data, measurements and photographs | Confirm service period, post-service period and separate deletion rules for sensitive content. |
| Payment, invoice and tax records | Confirm the applicable Irish accounting/tax retention requirement with an adviser. |
| Account and security records | Confirm inactive-account, deletion-request and security-log periods. |
10. Your data-protection rights
Subject to the applicable conditions and exceptions, you may ask for access to your data, correction, deletion, restriction, portability, or information about its source. You may object to processing based on legitimate interests and to direct marketing, and withdraw consent without affecting processing already carried out lawfully. You may also ask for human review where relevant automated decision-making rights apply.
To make a request, email andre@garciabuilder.fitness with enough information to identify the relevant record. Identity may be checked proportionately before releasing or changing data.
11. Complaints
Please contact Garcia Builder Fitness first so the concern can be investigated. You also have the right to complain to the supervisory authority where you live, work or believe an infringement occurred. In Ireland, this is the Data Protection Commission.
12. Security
Reasonable organisational and technical measures are used, including server-side access controls, restricted database roles, transport encryption, input validation, request limits and private result URLs. No website or storage system can be guaranteed completely secure. Do not send unnecessary medical records or payment-card details through an assessment or ordinary message.
13. Children
The assessment and coaching services are intended only for adults aged 18 or older. The assessment rejects ages below 18. If information about a child is received unexpectedly, contact the privacy address so it can be reviewed and removed where appropriate.
14. Cookies and external links
See the Cookie Policy for storage details and controls. External services have their own privacy information when you follow a link or enter their service.
15. Changes to this notice
Material changes will be shown on this page with a revised date. Where appropriate, an additional notice will be provided. The current draft must not be approved for production until all marked legal values are completed.
16. Contact
For access, correction, deletion, withdrawal, objection or another privacy request, email andre@garciabuilder.fitness.