General Data Protection Regulation (GDPR) Compliance
FitDirection Now is committed to protecting your privacy and personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.
Data Controller Information
FitDirection Now
2847 Highland Avenue
Birmingham, AL 35205, USA
Email: [email protected]
Phone: +1 (205) 555-0847
Lawful Basis for Processing
We process personal data under the following lawful bases:
- Article 6(1)(a) - Consent: For marketing communications and optional data processing
- Article 6(1)(b) - Contract: To perform fitness coaching services
- Article 6(1)(f) - Legitimate Interest: For business operations and service improvement
- Article 9(2)(h) - Health Data: For providing health and fitness services with explicit consent
Your Rights Under GDPR
You have the following rights regarding your personal data:
Right of Access (Article 15)
Request information about how your personal data is processed and obtain a copy of your data.
Right to Rectification (Article 16)
Request correction of inaccurate or incomplete personal data.
Right to Erasure (Article 17)
Request deletion of your personal data under certain circumstances.
Right to Restrict Processing (Article 18)
Request limitation of processing your personal data in specific situations.
Right to Data Portability (Article 20)
Request transfer of your data to another controller in a structured, machine-readable format.
Right to Object (Article 21)
Object to processing of your personal data for direct marketing or legitimate interest purposes.
Right to Withdraw Consent (Article 7)
Withdraw consent for processing activities that rely on your consent.
Special Categories of Data
We process health data (special category under Article 9) with your explicit consent for providing fitness and nutrition coaching services. This includes:
- Medical history and health conditions
- Fitness assessments and progress data
- Nutritional preferences and restrictions
- Physical measurements and body composition
Data Transfers
If we transfer your data outside the EEA, we ensure adequate protection through:
- Adequacy decisions by the European Commission
- Standard Contractual Clauses (SCCs)
- Binding Corporate Rules where applicable
Data Retention
We retain personal data for different periods based on:
- Service Data: Duration of service relationship plus 1 year
- Health Data: 7 years after service termination for continuity of care
- Marketing Data: Until consent is withdrawn
- Legal Compliance: As required by applicable laws
Data Breach Notification
In case of a data breach affecting your rights and freedoms, we will:
- Notify supervisory authorities within 72 hours
- Inform affected individuals without undue delay
- Provide clear information about the breach and mitigation measures
Supervisory Authority
You have the right to lodge a complaint with your local data protection supervisory authority if you believe your data protection rights have been violated.
Data Protection Officer
For data protection inquiries, contact our privacy team at [email protected]
Exercising Your Rights
To exercise any of your GDPR rights, please contact us using the information provided above. We will respond to your request within one month and may request additional information to verify your identity.
Last Updated: December 2024
