GDPR

Controller and processor

For personal data submitted through this website, TrackPil is the controller. For client data a studio enters into the application, the studio is the controller and TrackPil acts as processor, processing that data only on the studio's documented instructions.

Categories of personal data

The following categories are processed.

• Identity: name, date of birth, gender
• Contact: email address and phone number, for the studio representative only
• Correspondence: requests and support messages
• Physical characteristics: height, weight, circumference measurements, body composition values
• Images: progress photographs uploaded by the studio

Purposes of processing

Data is processed to deliver the service, to create and administer a studio account, to generate progress reports, to respond to requests, to perform the contract and to meet legal obligations.

Lawful basis

Processing relies on performance of a contract and on our legitimate interests in operating and supporting the service. Physical characteristics and photographs are processed by the studio as controller; establishing the appropriate lawful basis for that processing, including consent where required, is the studio's responsibility.

Special category data

Body measurements and progress photographs may, depending on context and jurisdiction, be treated as sensitive. We do not process health data, and the product must not be used to record diagnosis or treatment. Studios should assess this in their own context before collecting such data.

Sub-processors

We use Cloudflare for hosting, storage and bot protection, and an email provider for notifying us of demo requests. A current list of sub-processors is available on request, along with our data processing agreement.

International transfers

Our infrastructure provider operates a global network and data may be processed outside your country. Transfers rely on the safeguards offered by that provider, including standard contractual clauses where applicable.

Your rights

Under the GDPR you have the following rights.

• Access to your personal data and information about how it is processed
• Rectification of inaccurate or incomplete data
• Erasure where the conditions are met
• Restriction of processing
• Objection to processing based on legitimate interests
• Data portability
• To lodge a complaint with your supervisory authority

Making a request

Write to us and we will respond within one month. Where your request concerns client data held inside the application, please contact the studio you train with first, as they are the controller for that data.

Contact

For questions about this text you can contact TrackPil.