Privacy Policy

This Privacy Policy explains how Trakker collects, uses, retains, protects and shares personal data when you access, register for or use Trakker's web application, mobile application, website and associated services.

Trakker is a technology platform for professionals working in training, strength and conditioning, nutrition, physiotherapy, physical reconditioning, health, wellbeing, sports performance and related activities, and for their clients.

Sensitive personal data may be processed in Trakker, including data concerning health, physical fitness, body composition, training, food intake, physical progress, progress photographs, reported injuries, physical limitations, physiological metrics and performance data.

This Policy should be read together with the Terms and Conditions, the Cookie Policy, the Legal Notice and, where applicable, the Data Processing Agreement applicable to Professionals.

1. Basic information on data protection

• Controller: TRAKKER TECHNOLOGIES S.L., Spanish tax identification number (NIF) B93899235, with its registered office at Calle del Poeta Joan Maragall, 56, bajo 1, 28020 Madrid, Spain.
• Privacy contact: dpo@trakker.fit
• Main purposes: Create and manage accounts, provide the Platform, manage workouts, diets, metrics, communications, payments, subscriptions, support, security, legal compliance and service improvement. Measure Trakker's campaigns and conversions through the Meta pixel, with prior consent. Enable Google sign-in and, if the Professional activates it, check availability and synchronise sessions with Google Calendar under the terms of section 27.
• Data processed: Identification, contact, account and professional profile data, workouts, meals, body metrics, health data, progress photographs, communications, payments, technical data and application usage. With the Meta pixel: online identifiers, browser data, browsing, interactions and conversions. For Google: sign-in identity, calendars, busy intervals, credentials and technical metadata; the appointment fields described in section 27.4 for sessions selected by the Professional are sent to Calendar.
• Legal basis: Performance of a contract or pre-contractual steps, compliance with legal obligations, properly balanced legitimate interests and consent. For special categories of data, a valid exception under Article 9(2) of the GDPR will also apply, such as explicit consent where appropriate. When Trakker acts as processor, it will process data following the Professional's documented instructions. Advertising measurement through the Meta pixel is based on prior consent, not on legitimate interests or performance of a contract.
• Recipients: Professionals linked to the End Client, End Clients linked to the Professional, technology providers, payment providers such as Stripe, hosting, support, communications and security providers, legal or tax advisers and competent authorities where appropriate. Meta Platforms Ireland Limited and, for the relevant transfers, Meta group entities such as Meta Platforms, Inc., for consented advertising measurement. Google for authentication and the connected calendar; Supabase and Vercel for authentication, database and hosting, depending on the function provided. See section 27.
• International transfers: These may occur through the use of technology, payment or advertising measurement providers. The Meta pixel may involve transfers to the United States. See section 16 for the applicable mechanisms and safeguards.
• Rights: Access, rectification, erasure, objection, restriction, portability, withdrawal of consent and lodging a complaint with the Spanish Data Protection Agency.
• Retention: During the contractual or usage relationship and, subsequently, for the periods necessary for legal obligations, security, billing, defence of claims and liability. The specific criteria in section 17 apply to advertising measurement, separately from cookie lifetimes and the validity of consent. Calendar data has specific periods for caching, disconnection, logs and backups, described in section 27.6.

2. Identity of the controller

The controller for certain personal data processing activities is:

• Controller: TRAKKER TECHNOLOGIES S.L.
• Spanish tax identification number (NIF): B93899235
• Registered office: Calle del Poeta Joan Maragall, 56, bajo 1, 28020 Madrid, Spain
• Privacy email address: dpo@trakker.fit
• Website: https://www.trakker.fit

Company registration details: Commercial Registry of Madrid and its province, company file M-894960, entry 1, IRUS 1000477849690.

In this Policy, we refer to this entity as "Trakker", "we", "the Platform" or "the Controller" when Trakker acts as the data controller.

3. Users covered by this Policy

This Policy applies to:

• Professionals registered with Trakker.
• Personal trainers.
• Strength and conditioning coaches.
• Sports instructors.
• Nutritionists, dietitian-nutritionists and other nutrition-related professionals.
• Physiotherapists, physical reconditioning specialists, clinics, sports centres and gyms.
• End Clients linked to Professionals.
• Website visitors.
• People who contact Trakker.
• Users of the web or mobile application.
• Representatives, employees and collaborators of Professionals.
• Anyone whose data is processed through Trakker.

4. Privacy roles when Trakker acts as controller or processor

Trakker may act as a data controller, individually or jointly with another controller for certain operations, and as a data processor on behalf of the Professional.

4.1. Trakker as data controller

Trakker acts as a data controller when it determines the purposes and essential means of processing.

This occurs, among other cases, when Trakker processes data to:

• Create and manage user accounts.
• Manage access to the Platform.
• Provide SaaS services to Professionals.
• Manage Trakker's own subscriptions, billing and payments.
• Manage technical support and customer service.
• Ensure the security of the Platform.
• Prevent fraud, abuse, unauthorised access and misuse.
• Comply with legal obligations.
• Send administrative, technical or contractual communications.
• Send Trakker's own marketing communications where there is a valid legal basis.
• Analyse use of the Platform to improve the service, preferably using aggregated or pseudonymised data.
• Manage claims, incidents and legal defence.
• Comply with tax, accounting, commercial and regulatory obligations.

Measuring Trakker's own campaigns and conversions through the Meta pixel serves a purpose of Trakker. It is not carried out on the Professional's instructions and is not covered by the Data Processing Agreement for their clients' data. The relationship with Meta is explained in section 13.

For Google sign-in and management of the Calendar connection, Trakker acts as controller in relation to the account, connection settings and security. Enabling a connection does not make the content of End Clients' appointments a processing purpose of Trakker's own.

4.2. Trakker as data processor

Trakker acts as a data processor when it processes personal data on behalf of a Professional who uses Trakker to provide services to their End Clients.

This may occur, for example, when a Professional uses Trakker to:

• Create training plans.
• Manage diets or nutritional guidelines.
• Review body, physiological or performance metrics.
• View meals entered by the End Client.
• Monitor physical or sports progress.
• Communicate with the End Client.
• Store progress photographs.
• Record observations, subjective responses, adherence or compliance.
• Manage payments from the End Client to the Professional.

In these cases, the Professional may act as controller for their End Clients' data because they decide why they use that data and how they apply it in their professional service.

Trakker acts as a technology provider that hosts, organises and processes that data following the Professional's instructions, in accordance with the applicable Data Processing Agreement.

Session management, availability imports and appointment exports to the selected calendar are carried out on the Professional's instructions when they determine the purposes of those operations in relation to their clients. Trakker acts as processor for those operations in accordance with section 27 and the Data Processing Agreement. The Professional determines the necessity and lawfulness of the content and provides the relevant information to their End Clients; Trakker retains its own obligations as technology provider and processor.

5. Personal data that Trakker may process

Trakker may process different categories of data depending on the type of user, the features used and the relationship with the Platform.

5.1. Identification and contact data

• First and last names.
• Email address.
• Telephone number, if the user provides it.
• Country, province or city.
• Postal or tax address, where applicable.
• Identification document, where necessary for billing, payments, verification or legal compliance.
• Profile image, if the user provides it.
• Username or internal identifiers.

5.2. Account and access data

• User identifiers.
• Encrypted or protected credentials.
• Registration date.
• Account type.
• Account status.
• Roles and permissions.
• Access history.
• Account settings.
• Language, preferences and settings.

5.3. Professional data

When a user acts as a Professional, Trakker may process:

• Professional activity.
• Declared qualifications or training.
• Professional registration, registration number or accreditations, if provided.
• Professional experience.
• Speciality.
• Centre, company, gym or clinic.
• Tax and billing data.
• Commercial information about services offered.
• Rates, plans or programmes.
• Clients managed.
• Document verification status, if applicable.
• Information required by Stripe or other payment providers to enable payment collection.

5.4. End Client data

When an End Client uses Trakker, the following may be processed:

• Identification data.
• Contact data.
• Linked Professional or Professionals.
• Physical, sports, nutritional or wellbeing goals.
• Activity level.
• Availability.
• Training preferences.
• Dietary preferences.
• Observations entered by the End Client or the Professional.
• History of plans, sessions, records and progress.

5.5. Training and performance data

• Planned workouts.
• Completed workouts.
• Exercises.
• Sets, repetitions, loads, weights, paces, distances, duration or intensity.
• Heart rate, training zones or similar data.
• Power, cadence, speed, elevation gain or other sports metrics.
• Adherence to the plan.
• Subjective responses.
• Fatigue, rest or recovery.
• Comments from the Professional or the End Client.

5.6. Nutritional data and food records

• Meals entered by the End Client.
• Diets or nutritional guidelines created by the Professional.
• Foods, quantities, timings or habits.
• Dietary preferences.
• Reported allergies, intolerances or restrictions.
• Nutritional goals.
• Comments on adherence or compliance.
• Meal photographs, if the feature is available.
• Supplementation information, when entered by the user or the Professional.

5.7. Body, physiological, health and potentially biometric data

Trakker may process particularly sensitive data, including:

• Weight.
• Height.
• Age.
• Sex, where necessary for certain metrics or planning and provided by the user.
• Body composition.
• Body circumferences.
• Body fat percentage.
• Muscle mass.
• Heart rate.
• Sleep or recovery data.
• Reported injuries.
• Physical limitations.
• Voluntarily reported medical conditions or medical history.
• Medication, pregnancy or other health circumstances, if entered by the user.
• Progress photographs.
• Data imported from devices, wearables or connected applications.
• Any other data that may reveal information about health, physical fitness, physiological state or changes in the body.

Not all of this data is processed in every case. Processing depends on the features enabled and the information entered by the user or the Professional.

Trakker will not use photographs, body metrics or physiological data to uniquely identify a person through biometric techniques unless prior information is provided, there is a valid legal basis, enhanced safeguards are adopted and, where necessary, explicit consent is obtained.

5.8. Payment and billing data

Trakker may process:

• Purchased plan.
• Amount.
• Payment status.
• Payment date.
• Subscription history.
• Invoices issued by Trakker.
• Tax data.
• Stripe customer or subscription identifiers.
• Payment or transaction identifiers.
• Limited payment method information.
• Information about disputes, refunds or payment incidents.
• Information necessary for technology fees or application fees.

Trakker does not ordinarily store full payment card details. These details are processed by Stripe or other payment providers.

5.9. Technical and usage data

• IP address.
• Device identifiers.
• Operating system.
• Browser type.
• Application version.
• Date and time of access.
• Technical logs.
• Security events.
• Errors or crashes.
• Pages or screens visited.
• Features used.
• Application performance data.
• Cookies, SDKs or similar technologies, in accordance with the Cookie Policy.

If you authorise the Meta pixel on the website, online identifiers may be collected and disclosed to Meta, such as those associated with the _fbp and _fbc cookies when present, your IP address, browser and device information, date and time, the address of the page visited and the referring page, and campaign attribution data. Events relating to visits, content interactions, clicks, registration steps and outcomes, selection of a professional profile, issues during registration or purchase, trial commencement and subscription purchases are also recorded.

These identifiers and events may allow a browser to be recognised or its activity to be linked to a person. Not expressly adding a name or email address to an event does not make the information anonymous. Meta may link it to other data it holds, in accordance with its terms and the applicable settings and permissions.

5.10. Communications and support

• Messages sent within Trakker.
• Support enquiries.
• Emails.
• Contact forms.
• Marketing or administrative communications.
• Incident history.
• Attachments sent to support.

5.11. Google data

Google sign-in and the Calendar integration also involve processing the identity, calendar, availability, credential and synchronisation categories listed in section 27. Tokens are access credentials, not Google passwords, and are not shown to other users.

6. Special categories of data

Trakker may process data that falls within special categories of personal data, particularly data concerning health. When Trakker determines its own purposes as controller, it will identify both a legal basis under Article 6 of the GDPR and an applicable exception under Article 9(2). When it acts as processor, the Professional must determine both grounds, and Trakker will process the data in accordance with their documented instructions and the Data Processing Agreement.

This data requires enhanced safeguards.

In particular:

• Trakker must not be used to enter unnecessary or excessive health data.
• Professionals must limit processing to the data necessary to provide their services.
• End Clients must avoid entering unnecessary medical information.
• Professionals must have a sufficient legal basis to process this data.
• Where necessary, the End Client's explicit consent must be obtained.
• Trakker will apply enhanced technical and organisational measures to this data.
• Access to this data will be restricted to authorised users.
• Trakker may encrypt, pseudonymise, restrict, segment or protect this data through specific measures.

Consent to the Meta pixel does not authorise the use or disclosure, for advertising measurement, of health data, injuries, body measurements, training or nutrition plans, progress photographs or the private content of communications between the Professional and the End Client.

7. Purposes and legal bases

Trakker processes personal data for the following purposes.

Create and manage accounts

• Main data: Identification, contact, account, access
• Legal basis: Performance of a contract or pre-contractual steps

Provide the Platform

• Main data: Account, workouts, diets, metrics, communications
• Legal basis: Performance of a contract for Trakker's own account and service data; balanced legitimate interests to maintain and protect the Platform; the Professional's documented instructions when Trakker acts as processor

Training management and monitoring

• Main data: Plans, sessions, metrics, performance, progress
• Legal basis: The Professional's documented instructions and the legal basis they determine; for Trakker's own processing, performance of a contract and, if special categories are involved, explicit consent or another valid exception under Article 9(2) of the GDPR

Diet, meal and nutrition management

• Main data: Diets, meals, food records, preferences
• Legal basis: The Professional's documented instructions and the legal basis they determine; for Trakker's own processing, performance of a contract and, if special categories are involved, explicit consent or another valid exception under Article 9(2) of the GDPR

Body, physiological or health data

• Main data: Weight, photographs, injuries, metrics, progress
• Legal basis: Explicit consent or another valid exception under Article 9(2) of the GDPR for Trakker's own processing; the Professional's documented instructions when Trakker acts as processor; establishment, exercise or defence of legal claims where applicable

Payments from the Professional to Trakker

• Main data: Plan, billing, subscription, payment
• Legal basis: Performance of a contract, legal compliance and legitimate interests in preventing fraud

Payments from the End Client to the Professional

• Main data: Limited transaction data, Stripe identifiers
• Legal basis: Performance of a contract, legitimate interests, legal compliance and the Professional's instructions where appropriate

Support and customer service

• Main data: Contact, enquiry, logs, incident
• Legal basis: Performance of a contract and legitimate interests

Security and fraud prevention

• Main data: IP, logs, security events, activity
• Legal basis: Legitimate interests, legal compliance and performance of a contract

Legal compliance

• Main data: Billing, records, documentation, incidents
• Legal basis: Legal compliance and defence of rights

Administrative communications

• Main data: Account, contact, technical or legal notices
• Legal basis: Performance of a contract, legal compliance and legitimate interests

Marketing communications

• Main data: Contact and preferences
• Legal basis: Consent or legitimate interests where there is a prior relationship and this is legally applicable

Analytics and service improvement

• Main data: Technical data, aggregated or pseudonymised usage
• Legal basis: Legitimate interests or consent where non-essential cookies or SDKs are used

Campaign and conversion measurement through the Meta pixel

• Main data: Online identifiers, browser data, browsing, interactions, registration and purchase events
• Legal basis: Prior consent (Article 6(1)(a) of the GDPR and Article 22.2 of the LSSI)

Google sign-in

• Main data: Google identifier, email address and basic profile
• Legal basis: Performance of a contract or pre-contractual steps requested by the user, Article 6(1)(b) of the GDPR.

Google Calendar settings

• Main data: Account, authorisation, selected calendar and connection status
• Legal basis: Provision of the feature requested by the Professional, Article 6(1)(b); security and defence of claims, legitimate interests under Article 6(1)(f), with data minimisation and limited retention.

Availability and session exports

• Main data: Busy intervals and appointment fields for sessions selected by the Professional, as described in section 27.4
• Legal basis: Trakker acts on the Professional's documented instructions when providing these operations as processor. The Professional determines and documents the applicable legal basis for their End Clients' data under Article 6 of the GDPR and provides the relevant information. The OAuth connection technically authorises access to their calendar without replacing those obligations.

Wherever possible, Trakker will use aggregated, anonymised or pseudonymised data for analysis, product improvement and internal statistics. When it relies on a legitimate interest, it will document the purpose, necessity and balancing of rights and interests, and provide additional information at the data subject's request.

Trakker's current use of the Meta pixel is intended to measure the effectiveness of its campaigns and attribute conversions. Trakker does not currently use these events to create remarketing audiences.

8. Consent and withdrawal

Where processing is based on consent, the user may withdraw it at any time.

Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

Withdrawal of consent may mean that certain Trakker features are no longer available, particularly where processing was necessary to provide a specific feature. Refusing or withdrawing consent to the Meta pixel does not prevent you from creating an account or using the Trakker features you have purchased.

Where consent has been obtained by the Professional as controller, the End Client should preferably contact that Professional to withdraw it, without prejudice to also being able to contact Trakker where appropriate.

Certain features, such as progress photographs, food records, wearable integrations, marketing communications, the Meta pixel or the use of health data, may require specific, separate consent. Reading this Policy or accepting the Terms and Conditions does not replace explicit or specific consent where required by law.

The decision about the pixel belongs to each person using the website, whether a visitor, Professional or End Client, through the cookie preferences panel. The Professional cannot give that consent on behalf of their clients simply because they engage or invite those clients, or manage their data. You can refuse or withdraw consent in that panel and contact dpo@trakker.fit with any enquiry or to exercise your rights.

The Professional is asked to connect Google Calendar separately from sign-in, marketing communications and the pixel. The Professional authorises permissions in Google and may disconnect the integration as described in section 27. End Clients exercise their rights concerning their appointment data with the Professional or, where appropriate, with Trakker, as described in section 21.

9. Requirement to provide data

Data requested in mandatory forms is necessary to create the account, provide the Platform, manage payments, comply with legal obligations or enable certain features.

If the user does not provide that data, Trakker may be unable to provide the requested service.

Optional data, such as certain metrics, photographs, preferences, comments, food records or integrations, will only be processed if entered or enabled by the user or the Professional. Data obtained through cookies or similar technologies is governed by its purposes and, where applicable, the user's decision in the preferences panel; it does not need to be entered manually.

10. Minors

Trakker is intended exclusively for people aged 18 or over. People under 18 may not create an account or use the service as End Clients.

Professionals may not register, invite or manage End Clients under 18 through Trakker, or enter their personal data into the Platform.

Authorisation from those exercising parental responsibility or guardianship does not permit the use of Trakker for clients under 18.

Trakker may request reasonable age verification and restrict or remove access where this requirement is not met. If you identify an account or data belonging to a person under 18, notify dpo@trakker.fit so that its removal and, where appropriate, erasure can be assessed, without prejudice to legal retention obligations.

11. Sources of data

Personal data may come from:

• The user themselves.
• The Professional who invites or registers an End Client.
• The End Client who enters data into the Platform.
• Devices, wearables or applications connected by the user.
• Stripe or other payment providers.
• Contact forms.
• Communications with support.
• Cookies, SDKs or similar technologies.
• Technical records generated through use of the Platform.
• Google, if the user chooses to sign in with their account or the Professional connects Google Calendar, within the scope described in section 27.

Where data is not obtained directly from the data subject, Trakker or the Professional acting as controller will provide the information required by applicable law, as appropriate.

12. Data sharing between the Professional and the End Client

Trakker allows Professionals and End Clients to share information within the Platform.

The End Client understands that the Professional linked to their account may access the data necessary to provide their services, including workouts, meals, metrics, progress, comments, progress photographs and other data entered or generated within the professional relationship.

The Professional must access only the data necessary to provide their services and may not use it for other purposes without an appropriate legal basis.

When the relationship between the Professional and the End Client ends, access to data must be managed in accordance with the Platform's settings, applicable law and the relevant retention obligations.

13. Data recipients

Trakker may disclose or allow access to personal data to:

• Professionals linked to the End Client.
• End Clients linked to the Professional, in relation to information necessary to provide the service.
• Technology providers for hosting, infrastructure, databases, storage, communications, security, support, analytics and maintenance.
• Stripe and other payment providers.
• Email, notification, messaging or transactional communications providers.
• Technical analytics, monitoring and error monitoring providers, where appropriate.
• Legal, tax or accounting advisers or auditors.
• Administrative, judicial, tax, regulatory or law enforcement authorities where there is a legal obligation.
• Third parties in the event of a corporate transaction, merger, acquisition, restructuring or transfer of assets, with appropriate safeguards.
• Other third parties where authorised by the user or where there is a sufficient legal basis.

Trakker does not sell its users' personal data or health data to third parties.

Disclosure of data obtained from Google and its derivatives is also subject to the restrictions in section 27.7. The general clauses on recipients and corporate transactions do not allow these restrictions to be circumvented; where a transfer through a merger, acquisition or sale of assets affects that data, the prior explicit consent required by Google will be obtained.

If you authorise the pixel, the data described in section 5.9 is disclosed to Meta Platforms Ireland Limited to measure Trakker's campaigns and conversions. The absence of data sales does not mean that this disclosure to a third party does not take place.

For operations involving the collection and transmission of data through the pixel whose purposes and means are jointly determined, Trakker and Meta Platforms Ireland Limited act as joint controllers. This joint controllership is limited to those operations and does not mean that all subsequent processing by Meta is carried out on Trakker's behalf. Trakker provides information and obtains consent on its website. You may exercise your rights against Trakker or Meta; Trakker will handle or coordinate the requests for which it is responsible.

You can consult Meta's Business Tools Terms at https://www.facebook.com/legal/terms/businesstools, the Controller Addendum at https://www.facebook.com/legal/controller_addendum and its privacy information at https://www.facebook.com/privacy/policy/. You can also request information about the scope of processing and the applicable agreement from dpo@trakker.fit.

14. Providers and subprocessors

Trakker may engage providers that process personal data on Trakker's behalf to provide the Platform.

These providers may include:

• Cloud infrastructure providers.
• Database providers.
• Storage providers.
• Authentication providers.
• Email and notification providers.
• Payment providers such as Stripe.
• Support providers.
• Technical analytics providers.
• Error monitoring providers.
• Security providers.

Trakker puts the required processing and subprocessing agreements in place before a provider accesses data on its behalf, in accordance with the GDPR.

Trakker will maintain an updated list of subprocessors or provide information about them where legally required.

For Google features, Supabase provides authentication and database services, and Vercel hosts the web application. Providers involved in credential storage or security access only the data necessary for their function. You can request updated information about entities, services, subprocessors and safeguards at dpo@trakker.fit. Google manages the identity and calendar associated with the selected account under the terms applicable to that personal or Google Workspace account. The Professional selects the destination calendar and manages its access permissions.

15. Stripe and payments

Trakker uses Stripe to manage certain payments.

15.1. Payments from Professionals to Trakker

To collect subscription and SaaS plan payments, manage billing and collect recurring payments from Professionals to Trakker, Trakker may use Stripe Billing and other Stripe services.

In this flow, Trakker processes the data necessary to manage its contractual relationship with the Professional, and Stripe processes payment data in accordance with its own terms, agreements and privacy policies.

15.2. Payments from End Clients to Professionals

For payments from End Clients to Professionals, Trakker may use Stripe Connect and, depending on the enabled configuration, Standard accounts and direct charges or other compatible flows.

Where the flow involves direct charges, the Professional will appear as the seller or provider of the professional service, and Trakker may charge a technology fee or application fee as detailed in the Terms and Conditions.

Stripe may process personal data such as name, email address, payment identifiers, payment method information, billing address, amount, date, anti-fraud information, tax information, identity verification information, the Professional's banking details and other information necessary to process payments, prevent fraud, comply with regulatory obligations and provide its services.

Stripe may act as processor, independent controller or both, depending on the context and specific purpose of processing.

Trakker does not ordinarily store full payment card details.

16. International data transfers

Some technology, payment or advertising measurement providers may process data or allow access from countries outside the European Economic Area. Before carrying out an international transfer, Trakker will verify the applicable mechanism and adopt, as appropriate, one or more of the following safeguards:

• European Commission adequacy decisions, including the EU-US Data Privacy Framework where applicable to the recipient.
• Standard contractual clauses approved by the European Commission and, where appropriate, supplementary measures.
• Binding corporate rules.
• Supplementary technical, organisational and contractual measures.
• Other legally valid mechanisms.

The Meta pixel may involve transferring identifiers and events to Meta group entities outside the European Economic Area, including Meta Platforms, Inc. in the United States. These transfers require a valid mechanism under Chapter V of the GDPR; consent to activate the pixel does not replace the safeguards required for the international transfer.

The user may request additional information and, where appropriate, a copy of the safeguards applied by contacting Trakker at dpo@trakker.fit.

Google authentication, Calendar and infrastructure providers may involve processing or access outside the European Economic Area. These flows are subject to the safeguards in this section, which Trakker verifies before enabling them. You can request information about recipient entities, countries, mechanisms and applicable safeguards at dpo@trakker.fit.

17. Data retention

Trakker will retain personal data for as long as necessary to fulfil the purposes for which it was collected and, subsequently, for the periods necessary to comply with legal obligations, handle claims, prevent fraud, ensure security, resolve disputes or defend rights.

As a general rule:

• Account data will be retained while the account is active.
• Data necessary for billing, accounting and tax obligations will be retained for the applicable statutory periods.
• Contractual data will be retained for the duration of the relationship and, subsequently, for the limitation periods applicable to liability.
• Support data will be retained for as long as necessary to manage the enquiry and any potential liability.
• Technical data and logs will be retained for as long as necessary for security, auditing and operation of the Platform.
• Health, training, nutrition, metric, photograph or monitoring data will be retained while necessary for the relationship between the Professional and the End Client or while there is a legal basis for doing so.
• Data retained in a blocked state will be kept solely to address legal liability, claims or requests from authorities.
• Backups may be retained for additional limited periods for security and business continuity reasons.

When Trakker acts as processor, retention, erasure or return of data will be carried out in accordance with the instructions of the Professional acting as controller and the Data Processing Agreement.

For advertising measurement, a distinction must be made between the lifetime of cookies in the browser, retention of consent preferences and retention of events already disclosed to Meta. Each cookie's lifetime is detailed in the Cookie Policy. Events will be retained for as long as necessary to attribute and measure campaign conversions, taking account of the attribution windows used and the applicable retention periods of Meta's business tools; they will not be retained simply because the Trakker account remains active. You can request information about those periods and exercise your rights at dpo@trakker.fit.

Withdrawal of consent prevents further collection based on that consent, but does not in itself erase events already disclosed to Meta. You can request their erasure where appropriate. Information necessary to demonstrate consent decisions and address liability will be retained only for the periods necessary for those purposes.

For Google Calendar data, the periods and rules in section 27.6 take precedence over the general criteria in this section. Calendar information is not retained simply because the Trakker account remains active.

18. Account deletion and data erasure

The user may request deletion of their account through the mechanisms available on the Platform or by contacting Trakker.

Following the request:

• Trakker will erase or anonymise data that is no longer necessary.
• Certain data may be retained in a blocked state where necessary to comply with legal obligations, handle claims or defend rights.
• Data included in backups may remain for a limited period until those backups expire.
• If the data is processed on behalf of a Professional, Trakker may need to coordinate the request with that Professional when they act as controller.

Account deletion disconnects Calendar and triggers credential revocation and deletion of connection data. Events already created in Google remain unless the user chooses to delete them before disconnecting or an applicable erasure request is processed. Deletion in Google requires valid access and is limited to copies identified as created by Trakker; see section 27.6.

19. Data security

Trakker applies technical and organisational measures appropriate to the risk to protect personal data.

These measures may include:

• Encryption of data in transit.
• Encryption of sensitive data at rest where appropriate.
• Access control.
• User authentication.
• Role-based permission management.
• Logical data segregation.
• Activity logging.
• Backups.
• Security monitoring.
• Vulnerability management.
• Access restricted to authorised personnel.
• Contractual confidentiality.
• Data minimisation measures.
• Pseudonymisation or aggregation measures where appropriate.
• Incident management procedures.
• Provider reviews.
• Business continuity measures.

No system is completely secure. Users must protect their credentials, avoid sharing their accounts, keep their devices up to date and report any suspected unauthorised access.

For Google Calendar, Trakker encrypts stored tokens, keeps their keys separate from the credentials, limits their use to the server and applies access controls per user. Technical logs do not include tokens, titles, descriptions or other event content. The disconnection policy prevents usable credentials from being recovered from backups.

20. Personal data breaches

In the event of a personal data breach, Trakker will act in accordance with applicable law.

When Trakker acts as controller, it will assess the incident and, if there is a risk to rights and freedoms, notify the supervisory authority without undue delay and, where possible, within 72 hours of becoming aware of it. If the risk is high, it will also notify the affected individuals without undue delay, unless a legal exception applies.

When Trakker acts as processor, it will notify the Professional acting as controller of the breach without undue delay, in accordance with the Data Processing Agreement, and cooperate reasonably in managing the incident.

21. Users' rights

Users may exercise the following rights:

• Access: find out whether Trakker processes their data and obtain information about that processing.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of data where appropriate.
• Objection: object to certain processing based on legitimate interests and, at any time, to direct marketing, including related profiling.
• Restriction: request restriction of processing in certain circumstances.
• Portability: receive data in a structured format and transmit it to another controller where appropriate.
• Withdrawal of consent: withdraw consent at any time where processing is based on it.
• Not to be subject to automated decisions: not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect them, except in cases permitted by law.

To exercise their rights, users can contact:

• Email: dpo@trakker.fit
• Postal address: Calle del Poeta Joan Maragall, 56, bajo 1, 28020 Madrid, Spain

Trakker may request proportionate additional information where there are reasonable doubts about the requester's identity; it will not generally require an identification document to exercise rights.

Where the request concerns data processed on behalf of a Professional, Trakker may forward the request to the Professional acting as controller or cooperate with them to address it.

If the request concerns appointments exported to Google, Trakker and the Professional will coordinate the appropriate action. If Trakker no longer has authorisation to modify the calendar, it will explain that limitation and provide instructions for managing the copy through Google, without making deletion of the data retained by Trakker conditional on reconnection.

22. Complaints to the supervisory authority

Users may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) if they consider that processing of their data does not comply with applicable law.

However, before lodging a complaint, users may contact Trakker to try to resolve the issue.

23. Automated decisions, profiling and artificial intelligence

Trakker may incorporate analysis, automation, recommendation or artificial intelligence features to facilitate management of workouts, metrics, adherence, progress, communication or planning.

Unless expressly stated otherwise, these features will provide assistance or support and will not replace the Professional's judgement.

Trakker will not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the user, unless there is a valid legal basis and the safeguards required by law are applied.

The Professional is responsible for reviewing, validating and adapting any automated recommendation, analysis or suggestion before applying it to the End Client. Before enabling an AI feature that processes personal data, Trakker will provide the necessary specific information about its purpose, data used, provider, retention, international transfers and safeguards; data will not be used to train third-party models unless prior information is provided and there is a valid legal basis.

Data obtained from Google and its derivatives are excluded from AI features and from model training, fine-tuning or evaluation at Trakker and third parties. The general clause on future features or legal bases does not permit their use for those purposes.

Measurement with Meta allows visits, interactions and conversions to be attributed to campaigns. This processing may link activity and identifiers and must not be confused with anonymous data. It is not intended to make automated decisions about the user's access to the service or their training, nutrition or health.

24. Anonymised, aggregated and statistical data

Trakker may use anonymised, aggregated or statistical data to:

• Improve the Platform.
• Analyse general usage.
• Create internal metrics.
• Evaluate technical performance.
• Develop new features.
• Carry out business analysis.
• Produce statistics.

Anonymised data does not allow a natural person to be identified and is not considered personal data. Pseudonymised data and online identifiers remain personal data where they allow a person to be identified or made identifiable; this distinction also applies to Meta pixel data.

Trakker will not use identifiable health data or sensitive data for purposes incompatible with this Policy without a sufficient legal basis.

Data obtained from Google and its derivatives are not used for commercial analytics, advertising or business analysis. Aggregation, pseudonymisation or anonymisation does not permit excluded uses. Only the technical operations necessary for the connection, its security and operation of the calendar feature are permitted, in accordance with section 27.7.

25. Marketing communications

Trakker may send its own marketing communications to users who have given consent, or where there is a prior relationship and the communication concerns similar Trakker products or services, always in accordance with applicable law.

Users may unsubscribe at any time through the link included in the communications or by contacting Trakker.

Unsubscribing from marketing communications does not affect the sending of technical, contractual, security, legal or administrative communications necessary to provide the service.

Authorisation for the Meta pixel is independent of authorisation to receive emails or other marketing communications. Accepting one does not mean accepting the other; opting out of one does not automatically change the other. Pixel preferences are managed in the cookie panel.

26. Cookies, SDKs and similar technologies

Trakker may use cookies, SDKs, device identifiers and similar technologies to enable operation of the Platform, remember preferences, measure usage, analyse performance, prevent fraud, improve the service, send communications or, with prior consent, measure advertising campaigns and conversions through the Meta pixel.

Use of cookies and similar technologies is governed by the Cookie Policy.

Trakker will request prior consent for non-essential cookies and technologies, including the Meta pixel. Its activation is decided in the advertising category of the cookie preferences panel. From that panel, you can refuse it or subsequently disable it without losing access to the service. Accepting this Policy or the Terms and Conditions does not in itself activate the pixel.

27. Third-party integrations

Trakker may allow integrations with devices, wearables, sports applications, health platforms, calendar services, payment systems or other third parties.

When a user voluntarily enables an integration, they request the exchange of data technically necessary to provide that feature. Where processing is based on consent, they may withdraw it without affecting the lawfulness of earlier processing.

The Google Calendar connection can be disabled in Trakker's calendar settings, and its access can be revoked from the Google account. Specific disconnection controls and instructions will be provided for other integrations; where their legal basis is consent, it may be withdrawn at any time.

Where the third party acts as an independent controller, its own processing will be governed by its policies and terms. This does not limit Trakker's obligations to select and review providers acting on its behalf or to provide information about applicable disclosures and transfers.

27.1. Google sign-in

If you choose to register or sign in with Google, Trakker receives your Google account identifier, email address and basic profile data provided by Google, such as your name and profile image, through Supabase Auth. We use this data to identify you, create or link your Trakker account and manage access. We do not receive your Google password.

Signing in with Google does not connect Google Calendar or authorise Trakker to read or write its events. The calendar connection is requested through a separate action.

27.2. Optional connection and scope

When the feature is available, the Professional may connect Google Calendar from the calendar settings. Before authorisation, Trakker displays a notice about the data accessed and sent, background synchronisation and the effects of disconnecting. The Professional authorises permissions in Google and selects a single calendar for which they have write permission.

The feature checks availability and keeps future sessions that the Professional marks for sending to Google synchronised within the next 180 days. It does not automatically export historical sessions or all appointments merely because a connection is established. Synchronisation may run even when the Professional is not using the application. Changes made in Google do not in themselves modify the content of Trakker sessions.

27.3. Permissions and data accessed

Calendar list. The https://www.googleapis.com/auth/calendar.calendarlist.readonly permission allows access to the list of subscribed calendars. Trakker requests identifiers, names, time zones, primary calendar status and access level, and displays for selection only calendars for which the Professional has write permission. The full list is not retained permanently.

Events. The https://www.googleapis.com/auth/calendar.events permission allows events to be read, created, updated and deleted. Although its scope is broader, Trakker's operations are limited to the selected calendar. Reading detects availability, and writing operates on events corresponding to Trakker sessions; it does not modify or delete external events.

Availability. To detect busy intervals, we access event identifiers, start and end times, all-day events, cancellation status, busy or free status, version tags and technical recurrence and synchronisation data. We do not request or import the titles, descriptions, attendees or organisers of external events. We access the date range viewed by the Professional, limited to a maximum of 180 days per query, and the next 180 days necessary for planning.

Connection. We process granted permissions, access and refresh tokens, the selected calendar, event identifiers, cursors and change notifications necessary to update availability and avoid duplicates.

27.4. Purposes and data sent to Google

We use calendar data to manage the connection, reflect availability, avoid scheduling conflicts and synchronise sessions selected by the Professional. Busy intervals are incorporated into the Professional's schedule without showing the content of external events to End Clients or other Professionals.

When synchronising a session, we send Google its full title and description, dates and times, time zone, location where present and a Trakker technical identifier. We do not add guests, client contact details or attachments to the event as separate fields. Content that the Professional writes in the title, description or location forms part of the text sent.

We create events with private visibility. This setting reduces exposure but does not prevent access by people with sufficient calendar permissions or processing by the provider under its terms. The Professional must check sharing settings and limit the content to data that is necessary and lawful for appointment management. Changes or cancellations made in Trakker update or delete the synchronised copy while the connection is active.

27.5. Information for the End Client and responsibilities of the Professional

Where an appointment includes an End Client's personal data, the Professional must determine and document the applicable legal basis for disclosure under the GDPR and inform the End Client about the use of Google Calendar, the data sent, the purpose of appointment management, recipients and potential visibility to people with sufficient calendar permissions. The OAuth connection technically enables access to the Professional's calendar; it does not replace the legal basis or information obligations concerning their clients.

Trakker synchronises the appointment fields described in section 27.4 on the Professional's instructions and under the Data Processing Agreement. The End Client may exercise applicable rights with their Professional or contact dpo@trakker.fit. Trakker and the Professional will coordinate action concerning synchronised copies as described in section 21 and subject to valid access to the calendar.

27.6. Retention, disconnection and deletion

The calendar list is kept only in a temporary cache for up to 15 minutes. The selected calendar and necessary connection data are retained while the integration is active. Busy intervals are updated, and their cache has a maximum lifetime of 24 hours; data outside the range used is deleted when the cache is refreshed.

When disconnection is confirmed in Trakker, synchronisation is disabled and access revocation and deletion of its tokens are processed without undue delay. If Google temporarily prevents completion of closure, the connection remains inactive and credentials are kept encrypted solely to revoke access or carry out the selected deletion, for a maximum of 24 hours; they are then deleted and information is provided on how to withdraw access through Google. Imported operational data and synchronisation identifiers are deleted from active systems within a maximum of 24 hours. If you revoke access through Google or permission expires, we apply these measures when we receive the signal or detect the loss of access; we do not reconnect without your intervention.

Before disconnecting, you may choose to delete events identified as created by Trakker in the selected calendar, while valid authorisation remains. By default, they remain in Google and you may manage them there. External events are not deleted. If deletion cannot be completed, Trakker reports the outcome and allows disconnection without keeping synchronisation active.

Disconnecting Calendar does not delete your Trakker account or in itself disable Google sign-in. Changing calendars requires a new informed selection and an explanation of whether copies in the previous calendar remain or are deleted before the change.

Technical logs without event content are retained for up to 30 days. Minimal evidence of notices to the Professional, their connection decisions, permissions granted, revocations and disconnections is retained during the connection and for up to three years after it ends, to demonstrate decisions and handle claims. If there is a specific claim or legal obligation, only the necessary evidence is retained in a blocked state for the applicable period.

Backups containing operational data have a maximum lifetime of 30 days, restricted access and controls to prevent erased data from being reactivated or recovered for ordinary use. Tokens do not remain recoverable in those backups after deletion. Original Trakker sessions are subject to their own retention rules; deleting the connection does not mean deleting those sessions or all copies existing in Google.

27.7. Limited Use of Google data

Trakker's use and transfer to other applications of information received from Google APIs comply with the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy.

Data obtained from Google and its derivatives are used only for the features described and their operation and security. They are not sold, disclosed to Meta or other advertising platforms, or used for advertising, commercial analytics, business analysis, AI services or model training. These restrictions remain in place even if the data is aggregated or anonymised.

Data is shared only where necessary to provide the visible features requested with the user's authorisation, protect security or comply with the law. A transfer through a merger, acquisition or sale of assets requires prior explicit consent. Staff do not read the data unless there is documented affirmative consent for specific data, a security or legal compliance need, or aggregated and anonymised data for permitted internal operations. The general provisions of this Policy do not expand these uses.

27.8. Protection, providers and assistance

Supabase provides authentication and database services, and Vercel hosts the web application. Identity data is incorporated into the Trakker account. Calendar credentials are encrypted when stored and used only on the server; their keys are kept separate. Communications use HTTPS, and access is restricted through authentication and controls per user. We do not make tokens available to End Clients or other Professionals.

We do not record tokens or event titles or descriptions in analytics tools, technical logs or error messages. Support that requires viewing specific data follows the access conditions in section 27.7. Provider agreements and transfer safeguards are described in sections 14 and 16.

You can disconnect through Trakker's calendar settings and withdraw access through the third-party connections section of your Google account, available at https://myaccount.google.com/connections. Use Google Calendar to manage retained events. You can request assistance or exercise your rights at dpo@trakker.fit. Revocation in Google does not automatically delete events already created.

28. Professionals' privacy obligations

Professionals using Trakker undertake to:

• Comply with the GDPR, the LOPDGDD and other applicable law.
• Provide their End Clients with appropriate information.
• Determine the legal basis for processing.
• Obtain explicit consent where necessary.
• Avoid entering excessive, unnecessary or irrelevant data.
• Process health, biometric or sensitive data only where necessary and lawful.
• Configure permissions and access correctly.
• Avoid sharing credentials.
• Avoid exporting data without a legal basis and appropriate security measures.
• Before synchronising appointments with Google, inform the End Client where their data is disclosed, determine and document the applicable legal basis, review calendar permissions and select only sessions whose content is necessary and lawful for appointment management. Handle rights requests and coordinate with Trakker the relevant action concerning synchronised copies.
• Avoid publishing End Clients' photographs, testimonials or results without valid authorisation.
• Address data subjects' rights when acting as controllers.
• Notify security incidents where appropriate.
• Maintain confidentiality.
• Enter into or accept the Data Processing Agreement with Trakker.

Failure to comply with these obligations may give rise to the liability provided for by law, the Terms and Conditions and the Data Processing Agreement, without this Policy in itself extending the parties' legal liability.

29. Data Processing Agreement

When Trakker acts as processor on behalf of the Professional, processing will be governed by a Data Processing Agreement in accordance with the GDPR.

That agreement may be incorporated as an annex to the Terms and Conditions, accepted during registration or formalised in a separate document.

The Professional must accept the Data Processing Agreement before managing End Clients in Trakker.

Where Google Calendar is used for client data, the processing arrangement covers appointment management, availability imports, exports under instructions, and assistance with information, rights, disconnection and erasure, with the relevant recipients and safeguards. The Professional selects and manages the destination calendar under the terms of their Google account.

The Data Processing Agreement will govern, among other matters:

• Subject matter of the processing.
• Duration.
• Nature and purpose of processing.
• Categories of data.
• Categories of data subjects.
• Trakker's obligations as processor.
• The Professional's obligations as controller.
• Security measures.
• Subprocessors.
• International transfers.
• Assistance with rights and incidents.
• Erasure or return of data.
• Liability.

30. Data Protection Impact Assessment

Before starting or extending processing that may involve health data, body metrics, physiological data, progress photographs, food records, profiling or ongoing monitoring, Trakker will carry out and document a risk analysis and determine whether a Data Protection Impact Assessment is required.

Where the analysis determines that processing may entail a high risk to the rights and freedoms of natural persons, Trakker will carry out an Impact Assessment before starting or extending that processing and review its conclusions when the risk, scale, purposes, technology or categories of data change.

31. Privacy contact

Privacy contact: dpo@trakker.fit

32. Changes to this Policy

Trakker may amend this Privacy Policy to reflect legal, technical, operational, security, functional or business changes.

Where changes are substantial, Trakker will inform users through the Platform, email or other appropriate means. If data is to be used for a new purpose, it will provide the relevant information before starting that processing.

Where a change requires consent, Trakker will request it before carrying out the relevant processing. Merely publishing a new version or continuing to use Trakker does not replace that consent.

The introduction of Google Calendar is communicated to the Professional before the integration is activated. Where End Client data is to be disclosed, the Professional must provide the applicable information before that disclosure. A change in destination, scope or uses requires a review of the relevant information and legal basis; continued use of Trakker does not replace consent where required by law.

33. Contact

For any enquiry about privacy or data protection, users may contact Trakker at:

• Privacy email address: dpo@trakker.fit
• Postal address: Calle del Poeta Joan Maragall, 56, bajo 1, 28020 Madrid, Spain
• General enquiries and support: soporte@trakker.fit

Annex I — Information for End Clients

When you use Trakker as an End Client, you should know that:

• Trakker is a technology tool.
• Your Professional may access the data you share on the Platform.
• Your Professional may process sensitive data, such as workouts, meals, metrics, progress photographs or health information you enter.
• Your Professional is responsible for using that data correctly to provide their services to you.
• Trakker provides technical protection for the Platform but does not control every professional decision made by your Professional.
• Your Professional may synchronise your appointments with Google Calendar to manage their schedule. The full title and description, dates and times, time zone and location where present are sent. The content may be visible to people with sufficient calendar permissions. Your Professional must inform you about this processing and have a valid legal basis. You may exercise applicable rights with your Professional or contact dpo@trakker.fit, including requests for erasure of copies where appropriate.
• You should not enter unnecessary medical data.
• If you have an injury, illness or symptom, are pregnant, take medication or have a medical question, you should consult a qualified healthcare professional.
• You can exercise your rights by contacting Trakker or, where appropriate, your Professional.

Annex II — Information for Professionals

When you use Trakker as a Professional, you should know that:

• You may act as controller for your End Clients' data.
• You must inform your End Clients about how you process their data.
• You must have a sufficient legal basis to process health, biometric or sensitive data.
• You must obtain explicit consent where necessary.
• You must use Trakker in accordance with the Data Processing Agreement.
• You must restrict access to End Clients' data to authorised people.
• You must avoid exporting data outside Trakker unless it is necessary and secure.
• For Google Calendar, you must comply with section 27, review calendar access, limit the content to data that is necessary and lawful for appointment management, and inform End Clients where their data is disclosed. You must determine and document the applicable legal basis; connecting your Google account does not replace those obligations.
• You must address your End Clients' rights where this is your responsibility.
• You must notify security incidents where appropriate.
• You must comply with the data protection law applicable to your activity.

Annex III — Specific notice on biometric data

Trakker may process data that, in a broad sense, relates to the body, physiology, image, physical performance or changes in the body.

Biometric data is data obtained through specific technical processing relating to physical, physiological or behavioural characteristics that allows or confirms the unique identification of a person. Article 9 of the GDPR protects biometric data used for unique identification as a special category. A photograph or body metric is not in itself biometric data within that category, although it may reveal health data and require protection as such.

Trakker will not use biometric data to uniquely identify a person unless there is a valid legal basis, clear information, appropriate safeguards and, where applicable, explicit consent.

Trakker does not recommend using body photographs, metrics or physiological data for purposes other than the monitoring agreed between the Professional and the End Client.

Annex IV — Specific notice on progress photographs

Progress photographs may reveal sensitive information about the End Client's body, health, physical state, progress, habits or personal condition.

For this reason:

• They should only be uploaded when necessary for monitoring.
• The End Client must know who will have access to them.
• The Professional may not download, publish or share them without valid authorisation.
• The Professional may not use them as a testimonial, success story or advertisement without express, specific and documented consent.
• Trakker will apply reasonable security measures to protect them.
• The End Client may request their erasure where appropriate.

Annex V — Specific notice on sports or wearable integrations

If a user connects Trakker to devices, wearables or external applications, data such as workouts, heart rate, sleep, activity, calories, distances, paces, power, recovery or other metrics may be imported.

The user must review the permissions granted and the external provider's privacy policies.

Where those third parties act as independent controllers, Trakker does not control their accuracy, availability, security or privacy policies, without prejudice to its obligations in relation to providers acting on Trakker's behalf.

The user may withdraw consent where it is the legal basis for processing and request disconnection of the integration through its controls or by contacting Trakker. The specific procedure in section 27 applies to Google Calendar.