• Controller: I Believe In Fitness, S.L. (IBF Trainers)
• Tax ID (CIF): B44802817
• Registered office: Avenida Francisco Fernández Ordóñez, 1, 4th floor, door A, 28903 Getafe (Madrid), Spain
• Contact email: info@ibftrainers.com

IBF Trainers is a work tool for IBF's personal trainers. It can only be accessed with an account created by IBF and is not intended for the general public or for minors.

The app processes data about three groups of people:

• Trainers who use the app (users).
• Clients of IBF's trainers, whose data is managed to provide the training service.
• Leads, meaning people who have asked for information about IBF's services and whom a trainer is going to contact.

The following sections detail the processing carried out by the app, including its purpose, legal basis, data processed, source and retention periods.

• Purpose: Create and manage your account, let you sign in and make the app work (schedule, clients, passes, sales and commissions). IBF keeps its team members' data for internal organisation and to be able to manage and evaluate how the business runs.
• Legal basis: Performance of the contractual relationship you have with IBF, and our legitimate interest in the security of the app.
• Data: Full name, email address, phone number, assigned centre(s), user ID and sign-in credentials.
• Source: You and IBF, which creates your account.
• Retention: While you keep your relationship with IBF and, afterwards, four years (or the applicable legal period, if longer). After that period the data is not deleted: it is anonymised (section 8).

• Purpose: Record your working time (clock-in and clock-out) and check that you clock in at the centre where you work.
• Legal basis: The legal obligation to record employees' working hours (Article 34.9 of the Spanish Workers' Statute) and IBF's legitimate interest in verifying that clock-in takes place at the centre, under Article 20.3 of the Workers' Statute and Article 90 of Organic Law 3/2018.
• Data: Date and time of clock-in, centre and the exact (GPS) location of your device at the moment you clock in.
• How is location used? To let you clock in, the app asks for permission to access your location only while you are using it. At the moment you clock in, the app checks your position at that moment and compares it with the centre's coordinates; the clock-in is only validated if you are within 100 metres of it. The app does not track your location in the background, does not check it outside clock-in and does not use it for any other purpose. Location is used only to validate the clock-in and is not stored.
• Can I turn it off? You can withdraw location permission in your phone settings at any time. Without it you will not be able to clock in from the app and will have to use the alternative method IBF tells you about.
• Retention: Clock-in records are kept for four years, the legal period. Location is not kept: it is used only to validate the clock-in.

• Purpose: Let the trainer manage their client portfolio, their schedule of training sessions, passes and remaining sessions, and see their sales activity. IBF keeps this data to run the business properly, to be able to contact clients, so that they receive the service, and to keep the accounts. IBF provides the client's details to the trainer who serves them so that the trainer can contact them and deliver the service.
• Legal basis: Performance of the training services contract with the client, IBF's legitimate interest in managing and evaluating business performance, and compliance with tax and accounting obligations.
• Data: Full name, phone number, email address, scheduled sessions, purchased passes, remaining sessions and related payments.
• Source: The client or the trainer who serves them.
• Retention: While the relationship with the client lasts and, afterwards, four years (or the applicable tax and accounting period, if longer). After that period the data is not deleted: it is anonymised (section 8).

• Purpose: Let the trainer contact the person who has asked for information about IBF's services and handle their request.
• Legal basis: Your consent, given when you submit the contact form, or the application of pre-contractual measures at your request.
• Data: Full name, phone number, email address and centre of interest.
• Source: You, through IBF Trainers forms; the trainer, who may collect your details at the centre when you show interest in their services; and IBF's partners, who pass your details to us when you have asked for information about the personal training service.
• How are you contacted? The app includes shortcuts to call, or to write by SMS, WhatsApp or email. These shortcuts open the corresponding app on your phone; IBF Trainers does not store the content of those conversations, which are governed by each service's terms.
• Retention: Four years from when we receive your data or from your last contact with IBF. After that period the data is not deleted: it is anonymised (section 8).

• Purpose: Detect and fix errors and improve the stability and performance of the app.
• Legal basis: Our legitimate interest in the app working properly.
• Data: Crash and performance reports, device model, operating system and app version.
• Who processes it? Reports are stored on IBF's server, hosted with OVHcloud (France), and are not sent to any other provider.
• Retention: 90 days.

• We do not show advertising in the app or use it for marketing.
• We do not sell or share your data with third parties for their own purposes.
• We do not track users across other companies' apps or websites.
• We do not make automated decisions that have legal effects on you.

The app only asks for location permission, and only while you are using it, for the clock-in described in section 3.2. You can grant or withdraw it at any time in your phone settings.

We do not disclose your data to third parties outside IBF Trainers, except where required by law (for example, to the Labour Inspectorate or competent authorities). The following may process data on IBF's behalf as data processors under Article 28 of the GDPR:

• Technology provider, the company that develops and maintains the app.
• OVHcloud, the provider of the server where the data is hosted, located in France.

App data is hosted on IBF's server, contracted with OVHcloud and located in France, within the European Economic Area. We do not transfer data outside the European Union.

When the period ends, IBF does not delete the data: it anonymises it, meaning it is irreversibly transformed so that no person can be identified any more. This lets IBF keep evaluating business performance and trends, and anonymised data is no longer personal data. The exception is crash reports, which are deleted.

We apply technical and organisational measures to protect data against loss, unauthorised access or misuse: encrypted communications (HTTPS), access through a personal account, access limited to those who need it for their work and hosting on a server located in the European Union.

You may exercise the following rights against IBF Trainers at any time and free of charge:

• Withdrawal of consent, without affecting the lawfulness of earlier processing.
• Access: obtain confirmation of whether we process your data and a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to erase your data. We will anonymise it so that you can no longer be identified; data we are legally required to keep (for example tax and accounting records) is kept blocked until the legal period ends and is then also anonymised.
• Restriction: ask us to restrict processing in certain circumstances.
• Objection: object to processing on grounds relating to your particular situation.
• Portability: receive your data in a structured, commonly used format.

To exercise them, write to lopd.ibftrainers@gmail.com attaching a copy of an identity document. We will reply within one month, extendable by two further months in particularly complex cases. If you believe the processing does not comply with the rules, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es).

App accounts are created and closed by IBF. If you stop working with IBF, your account is deactivated. You can ask at any time for your account to be closed and your data erased or anonymised by writing to lopd.ibftrainers@gmail.com. When an account is closed, the data associated with it is anonymised, except what IBF must keep by legal obligation (such as clock-in records), which is kept blocked for its legal period and then also anonymised.

We may update this policy to reflect legal changes or new app features. The current version will always be published on this page, with the date of the last update.