Privacy Policy

Last Updated: 24 June 2026

1. Introduction

Steff The Coach S&C (“the Business”, “we”, “our”, “us”) respects your privacy and is committed to protecting your personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and relevant Greek data protection legislation, including Greek Law 4624/2019 on the protection of personal data.

This Privacy Policy explains how we collect, use, store, process and protect personal data when you interact with our website, coaching services, in-person training, digital platforms, and communication systems.

2. Data Controller

Business Name: Steff The Coach S&C

Address: Dervenakion 4 Street, Chaidari, Attica 12462, Athens, Greece

Email: [email protected]

Website: steffthecoach.com

The Business acts as the data controller for personal data processed in connection with coaching services, website usage, onboarding, payments and related operations.

3. Personal Data We Collect

We may collect and process the following categories of personal data depending on your interaction with the Business:

3.1 Identity and Contact Data

• Full name
• Email address
• Phone number
• Country/location
• Social media identifiers (if provided)

3.2 Coaching and Operational Data

• Training goals and preferences
• Exercise history and performance data
• Onboarding and intake information
• Communication records
• Scheduling and appointment data
• Programme participation details

3.3 Health-Related Information (Limited and Optional Beyond Requirements)

Where necessary for safe and appropriate coaching delivery, we may process limited health-related information, including:

• Injury history and limitations
• Exercise readiness and physical condition disclosures
• Training restrictions or relevant physical considerations
• Other health-related information voluntarily provided by the client and relevant to coaching safety and programme design

Clients are requested not to submit unnecessary sensitive medical documentation beyond what is relevant for coaching participation and safety.

3.4 Mandatory and Optional Data

Certain personal data is required to deliver our coaching services. Where the provision of personal data is a contractual requirement (for example, name and contact details for onboarding, or basic health disclosures for safe programme design), failure to provide such data may mean we are unable to deliver services or fulfil our duty of care.

Where data is optional (for example, additional health background information beyond what is strictly necessary), we will indicate this during collection. Providing optional data may enhance the quality of coaching but is not required to receive our services.

4. Special Category Data (GDPR Health Data)

Health-related information constitutes special category personal data under GDPR.

Such data is processed only where:

• explicitly provided by the client
• necessary for safe coaching delivery
• required for exercise adaptation and risk management
• and subject to explicit consent where required by law

5. Data We Do Not Intend to Store in Standard Systems

The Business does not use standard operational systems for storing:

• formal medical records
• clinical psychotherapy records
• hospital documentation
• physiotherapy clinical files
• extensive diagnostic records

Where necessary, sensitive information may be stored using restricted-access, encrypted offline systems solely for operational safety and coaching suitability purposes.

6. How We Collect Data

Personal data may be collected through:

• website contact forms
• intake and onboarding forms
• checkout and payment systems (WooCommerce / Stripe)
• consultation booking systems
• TrainHeroic onboarding systems
• email communication
• WhatsApp Business communication
• HubSpot forms and CRM
• cookies and analytics technologies

7. Legal Bases for Processing

We process personal data under the following legal bases:

7.1 Contractual Necessity

To:

• provide coaching services
• manage onboarding and programme delivery
• process payments
• deliver scheduled sessions (online and in-person)
• manage service communications

7.2 Legitimate Interests

To:

• operate and improve services
• manage business administration
• ensure platform and system security
• respond to client enquiries
• prevent fraud or misuse

7.3 Consent

Where required, including:

• marketing communications
• optional cookies and tracking technologies
• processing of health-related information where legally required

7.4 Legal Obligations

To comply with:

• tax and accounting requirements
• regulatory obligations
• dispute resolution processes

8. Payments

Payments are processed via third-party payment providers, primarily Stripe, including supported payment methods such as Apple Pay and Google Pay.

We do not store full payment card details.

Payment data is processed in accordance with the privacy and security policies of the respective payment providers.

9. In-Person Coaching Services

We provide in-person coaching sessions at third-party gyms, external training facilities, rented locations, and client-selected training environments.

For these services, we may process:

• scheduling and attendance records
• location logistics
• training-related safety information
• operational communication data

Clients acknowledge that physical training involves inherent risk, and participation is voluntary.

10. External Healthcare and Professional Referrals

Where appropriate, clients may be referred to or choose to work with independent external professionals, including physiotherapists, psychologists, physicians, dietitians, nutritionists, or other qualified specialists.

Such professionals operate independently as separate data controllers under their own professional, legal, and privacy obligations.

The Business does not control or assume responsibility for their professional services, clinical decisions, or record-keeping practices.

11. Communication

We may communicate via:

• email
• WhatsApp Business
• onboarding platforms
• CRM and operational systems

Please note that when communicating via WhatsApp Business, messages are processed by Meta Platforms, Inc. (Meta), which operates as a separate data controller under its own privacy policy. Meta may process data outside the European Economic Area (EEA), including in the United States. Use of WhatsApp for coaching communication is voluntary, and alternative communication methods are available on request.

Electronic communication methods carry inherent security limitations, and while reasonable safeguards are used, absolute security cannot be guaranteed.

12. Cookies and Analytics

Our website uses:

• essential cookies
• analytics tools (e.g., Google Analytics with IP anonymisation)
• marketing tracking tools (e.g., Meta Pixel)
• security and functionality cookies
• CRM tracking (HubSpot)

Where required, cookie consent is managed via a consent management platform (Complianz).

Analytics data may include:

• device and browser type
• pages visited
• session duration
• approximate geographic region
• interaction data

Tracking and non-essential cookies are only activated after user consent where legally required.

13. Data Retention

We retain personal data only for as long as necessary for:

• service delivery
• operational requirements
• legal obligations
• accounting and tax compliance
• dispute resolution
• legitimate business purposes

Indicative retention periods:

• enquiries: up to 12 months
• non-client leads: up to 24 months
• active client records: duration of service
• inactive client records: up to 24 months post-service
• invoices and accounting records: up to 10 years
• marketing consent records: up to 5 years after withdrawal
• analytics data: up to 14 months

14. Data Security

We implement reasonable technical and organisational measures to protect personal data, including:

• password-protected systems
• restricted-access platforms
• encrypted storage where applicable
• limited-access offline storage for sensitive operational data
• secure third-party processors

However, no system of electronic storage or transmission is fully secure.

15. International Data Transfers

Some service providers may process data outside the European Economic Area (EEA). These include, but are not limited to:

• Stripe — payment processing
• HubSpot — CRM and marketing
• Google — analytics and communication
• TrainHeroic — training platform
• Meta Platforms, Inc. — WhatsApp Business communication and Meta Pixel analytics

Where international transfers occur, appropriate safeguards are implemented in accordance with GDPR requirements, including standard contractual clauses or equivalent protections where applicable.

16. Your Rights Under GDPR

Subject to applicable law, you may exercise the following rights:

• access your personal data
• rectify inaccurate data
• request deletion (subject to legal limitations)
• restrict processing
• object to processing
• withdraw consent
• data portability (where applicable)
• lodge a complaint with a supervisory authority

Requests can be submitted to: [email protected]

We may be required to retain certain data for legal, tax or operational compliance reasons.

16.1 Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority at any time. In Greece, this is the Hellenic Data Protection Authority (HDPA):

Hellenic Data Protection Authority (HDPA)

Address: Kifissias 1-3, 115 23 Athens, Greece

Telephone: +30 210 6475 600

Email: [email protected]

Website: www.dpa.gr

You may also contact the supervisory authority of your country of residence within the EU/EEA.

17. Automated Decision-Making and Profiling

We do not use automated decision-making processes, including profiling, that produce legal effects concerning you or similarly significantly affect you, as described under Article 22 of the GDPR.

All coaching decisions, programme design, and service recommendations are made by qualified human professionals, taking into account individual client information provided during onboarding and throughout the coaching relationship.

18. Marketing Communications

Marketing communications are only sent where:

• explicit opt-in consent has been provided, or
• otherwise permitted under applicable law

You may withdraw consent at any time using unsubscribe mechanisms or by contacting us directly.

19. Minors

Services are generally intended for adults aged 18 and over.

For digital and online services directed at children, the applicable age threshold under GDPR Article 8 in Greece is 16 years of age. Individuals under 16 using our digital services may only do so with verified parental or legal guardian consent, as required by applicable law.

For in-person coaching services, individuals under 18 may only participate with verified parental or legal guardian consent where required by applicable law.

20. Data Deletion and Retention Exceptions

Where deletion is requested, personal data will be removed where legally and operationally feasible.

However, certain data may be retained where required for:

• accounting and tax compliance
• legal obligations
• dispute resolution
• legitimate business interests under GDPR

21. Updates to This Policy

This Privacy Policy may be updated periodically to reflect changes in:

• legal requirements
• business operations
• technology and platforms
• service structure

Updated versions will be published on the website with a revised “Last Updated” date.

22. Contact

For privacy-related enquiries or GDPR requests:

Email: [email protected]

23. Governing Law

This Privacy Policy is governed by the laws of Greece and European Union data protection law, including the GDPR and Greek Law 4624/2019, without prejudice to mandatory protections under European Union data protection and consumer law.