Privacy Policy
1. Controller
The controller for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Matthias Rottmann, autónomo
PHOENIX Private Health Coaching
Avenida Diego Ramírez Pastor 277B, 03182 Torrevieja (Alicante), Spain
Email: private@phoenix-personaltraining.com
Telephone / WhatsApp: +34 624 604 480
NIF/NIE: Y4233457E
No Data Protection Officer has currently been appointed.
2. Scope
This policy explains the processing of personal data when you use this website and when you contact us by email, telephone or WhatsApp. Personal data means any information relating to an identified or identifiable natural person.
3. Processing activities at a glance
| Processing | Data / purpose | Legal basis | Retention period |
|---|---|---|---|
| Technical provision and website security | Server log data such as IP address, date/time, requested page, referrer URL, browser and operating-system details. Purpose: secure and stable delivery, error analysis and prevention of misuse. | Article 6(1)(f) GDPR; legitimate interest in IT security and proper operation. | Normally no longer than 30 days; longer only for the final resolution of a security incident or where a legal obligation requires it. |
| Enquiries | Name, contact details, language, requested appointment/service and message content. Purpose: responding to an enquiry and taking steps towards a possible contract. | Article 6(1)(b) GDPR (pre-contractual steps) and, where necessary, Article 6(1)(f) GDPR (handling general enquiries). | Without a contract: up to 12 months after the enquiry has been completed; earlier where a valid objection applies and no overriding grounds exist. |
| Contract and client administration | Master data, communication data, agreed services, appointment and service documentation, invoicing and payment data. Purpose: performance of coaching, billing, communication and statutory compliance. | Article 6(1)(b) GDPR; Article 6(1)(c) GDPR. | For the contract period and thereafter for statutory retention periods; business records in Spain are generally retained for six years unless a longer obligation applies. |
| Health-related information in coaching | Only necessary and voluntarily supplied information about capacity, symptoms, injuries, limitations or training relevance. Purpose: safe, personalised training planning and risk reduction. | Article 6(1)(a) GDPR together with Article 9(2)(a) GDPR: explicit consent to the processing of special categories of personal data. | For the period of coaching and then up to three years, unless a statutory retention duty, legal defence or expressly renewed consent justifies longer storage. |
4. Health data: special notice
Health data is particularly sensitive. Please do not send medical records, diagnoses or detailed health information through a general website contact form. Where such information is necessary for individual coaching, it will be collected only after separate, explicit consent. Consent may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of prior processing, but may mean that personalised or safe training planning cannot be provided in full.
5. Recipients and processors
Your data is disclosed only where necessary and lawful. Recipients may include:
- technical providers for hosting, maintenance, email infrastructure and backups, acting as processors;
- tax advisers, bookkeeping providers, banks and payment providers where necessary for billing, accounting or legal obligations;
- public authorities or other bodies where required by law or necessary to establish, exercise or defend legal claims.
Health data will be disclosed to external professionals, such as doctors or physiotherapists, only with separate explicit consent or where a legal obligation applies. Personal data is not sold.
6. WhatsApp
The website may contain a button or link to contact us through WhatsApp. This is an external link; a connection to WhatsApp is made only when you activate it. WhatsApp and Meta process data under their own privacy policies, and processing outside the European Economic Area cannot be ruled out. PHOENIX Private Health Coaching processes data in your message only from the moment you choose to contact us. Do not send medical records or other highly sensitive health data via WhatsApp unless this has been expressly agreed and secured in advance.
7. International transfers
The website must be operated so that hosting, email infrastructure and backups are located in the European Economic Area, or so that any transfer to a third country is covered by an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR. When you voluntarily use external communication services such as WhatsApp, their own processing may take place outside the EEA. This policy will be updated before any further third-party service is activated.
8. No automated decision-making
No automated decision-making, including profiling, is carried out that produces legal effects concerning you or similarly significantly affects you.
9. Whether provision of data is required
You are not required to provide personal data merely to use the website. To deal with an enquiry, contact details marked as necessary are required. To enter into and perform a contract, the data necessary for service delivery, invoicing and legal duties is required. Without this data, an enquiry may not be answered or a contract may not be performed.
10. Your rights
Subject to the GDPR, you have the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on Article 6(1)(e) or (f) GDPR. You may withdraw consent at any time with future effect. To exercise your rights, contact private@phoenix-personaltraining.com.
You also have the right to lodge a complaint with the competent supervisory authority. In Spain, this is in particular the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain.
11. Security
Appropriate technical and organisational measures are used to protect personal data against loss, destruction, unauthorised access, alteration or disclosure. These measures are reviewed in line with technical developments and risk.
12. Updates
This privacy policy will be updated where the services used, processing activities or legal position change. The version published on the website at the relevant time applies.
Cookie Notice
In its basic version, this website must operate without analytics, marketing or advertising cookies. It uses only technically necessary storage, where required for secure delivery of the website or to save your cookie choice. No consent is required for strictly necessary cookies.
If analytics tools, advertising pixels, embedded maps, videos, social-media feeds, external fonts or similar non-essential technologies are added in future, they may load only after your active consent. The options “Accept all” and “Reject” must be offered at the same time, with equivalent prominence, in the first cookie notice. Consent must be easy to withdraw at any time.
Technical implementation: External content must not load automatically before consent. Fonts, images and scripts should be hosted locally wherever possible. A simple link to WhatsApp, Instagram or another external website is preferable to an embedded feed.