PRIVACY POLICY

Last updated: 22 August 2026

1. Controller

The controller responsible for the processing of personal data under the General Data Protection Regulation (“GDPR”) and other applicable data protection laws is:

2DISCIPLINE LTD
Pentadaktylou 45, A2
Maroni 7737
Cyprus

Company Registration Number: HE 479186
VAT Identification Number: CY60187906E

Email: info@2discipline.com

2. Scope of this Privacy Policy

This Privacy Policy explains how we collect, use, store and disclose personal data in connection with:

• our website;

• our application and consultation process;

• our online fitness coaching services;

• communication with prospective and existing clients;

• our coaching application and progress-tracking systems;

• video coaching calls;

• payment processing; and

• the voluntary use of testimonials, progress photographs or other promotional content.

Our services are intended exclusively for persons aged 18 or over.

3. Categories of Personal Data

Depending on how you interact with us, we may process the following categories of personal data:

a. Identity and contact data

• title or salutation;

• first and last name;

• email address;

• telephone number;

• country or place of residence;

• age or confirmation that you are at least 18 years old; and

• account and profile information.

b. Application and consultation data

• occupation and professional circumstances;

• fitness, physique, health, wellbeing and performance goals;

• previous coaching or training experience;

• current lifestyle and daily routine;

• time availability;

• readiness and ability to participate in coaching;

• financial readiness to invest in coaching; and

• other information voluntarily provided through our application form or during a consultation.

c. Fitness, health and wellbeing data

To provide personalised coaching, we may process information concerning:

• body weight and body measurements;

• body composition;

• progress and physique photographs;

• training history and training performance;

• exercise logs;

• heart rate and other performance metrics;

• sleep and recovery data;

• nutritional habits and food intake;

• digestion;

• injuries, physical limitations and relevant health conditions;

• medication or supplementation information voluntarily disclosed to us; and

• other information relevant to the safe and appropriate provision of coaching.

Some of this information may constitute special-category personal data, including data concerning health.

d. Coaching and communication data

• training and nutrition plans;

• check-in responses;

• progress reports;

• messages, feedback and voice messages;

• coaching notes;

• video-call information;

• appointment information;

• technical-analysis videos; and

• communications through WhatsApp, email, Trainerize, Zoom or other agreed channels.

e. Contract and payment data

• signed coaching agreements;

• contract term and renewal information;

• agreed instalment plan;

• invoices;

• payment status;

• transaction references; and

• information required for accounting and tax compliance.

We do not normally receive or store complete payment-card details. Card payments are processed directly by Stripe.

f. Website and technical data

When you visit our website, technical data may be processed, including:

• IP address;

• browser type;

• operating system;

• device information;

• date and time of access;

• pages visited;

• referring website;

• request and error information; and

• security and server-log data.

4. Purposes and Legal Bases

We process personal data for the following purposes and legal bases:

a. Responding to enquiries and reviewing applications

We process ordinary personal data to respond to enquiries, review applications, arrange consultations and take steps at your request before entering into a coaching agreement.

Legal basis: Article 6(1)(b) GDPR.

Where application information includes health data or other special-category data, we process that information on the basis of your explicit consent.

Legal basis: Article 6(1)(a) and Article 9(2)(a) GDPR.

b. Providing online fitness coaching

We process personal data to:

• create and adjust training and nutrition strategies;

• monitor progress;

• provide coaching calls and support;

• analyse exercise technique;

• provide supplementation, recovery and lifestyle recommendations;

• operate the coaching app;

• administer the contractual relationship; and

• communicate with the client.

Legal basis for ordinary personal data: Article 6(1)(b) GDPR.

Legal basis for health data and other special-category data: your explicit consent under Article 9(2)(a) GDPR.

If the necessary data is not provided, we may be unable to assess whether coaching is appropriate or provide a sufficiently personalised and safe coaching service.

c. Payments, accounting and legal compliance

We process contract, invoice and payment information to collect payments, maintain accounting records, comply with tax obligations and meet other legal requirements.

Legal basis: Article 6(1)(b) and Article 6(1)(c) GDPR.

d. Security and protection of legal rights

We may process data to protect our website, systems, clients and legal rights, prevent misuse, establish or defend legal claims and document compliance.

Legal basis: Article 6(1)(f) GDPR and, where special-category data is necessary for legal claims, Article 9(2)(f) GDPR.

e. Testimonials and promotional use

We use a client’s name, likeness, testimonial, progress photographs, videos or transformation results for advertising only where the client has provided separate, explicit and voluntary consent.

Legal basis: Article 6(1)(a) GDPR and, where the content reveals health information, Article 9(2)(a) GDPR.

The client may withdraw this consent at any time by contacting info@2discipline.com. Withdrawal does not affect the lawfulness of use before withdrawal.

5. Application Form

Our application form is hosted through Framer. Applications are reviewed individually by members of our coaching team.

We do not use solely automated decision-making that produces legal or similarly significant effects. A coaching application may be accepted or rejected based on an individual assessment of suitability, expectations, availability and whether we reasonably believe our service can assist the applicant.

Where the application form requests health-related information, explicit consent must be provided before this information is submitted.

6. Website Hosting and Framer

Our website and application form are provided through Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands.

Framer may process technical data, website requests, form submissions, IP addresses, device and browser information and security information on our behalf.

We also use Framer’s built-in website analytics. According to Framer, this analytics service does not use cookies or persistent identifiers. Framer calculates daily visitor statistics by hashing limited technical information using a rotating value that is deleted daily.

Further information is available at:

https://www.framer.com/legal/privacy-statement
https://www.framer.com/help/articles/gdpr-and-cookies/

7. Cookies and Tracking

We do not currently use Meta Pixel, Google Analytics, advertising cookies or newsletter-tracking technologies on this website.

The website may use strictly necessary technical functions required for security and operation. Framer’s built-in analytics does not, according to Framer, require non-essential analytics cookies.

If we introduce advertising, tracking technologies, embedded third-party media or non-essential cookies in the future, we will update this Privacy Policy and implement an appropriate consent mechanism before activating them where required.

8. Trainerize

We use Trainerize to provide training and nutrition plans, account access, progress tracking, check-ins, messaging and other coaching functions.

Trainerize is operated by ABC Fitness Solutions, LLC and relevant affiliated entities. In relation to client information entered into the coaching platform, Trainerize generally acts as a processor or service provider on our behalf.

Depending on the client’s use of the platform, Trainerize may process:

• identity and account information;

• exercise and training data;

• nutrition and meal-tracking data;

• weight and body-composition data;

• sleep, heart-rate and activity information;

• progress photographs and videos;

• messages and feedback;

• device and usage data; and

• information imported from third-party fitness services at the client’s direction.

Further information is available at:

https://www.trainerize.com/privacy/

9. Microsoft 365 and SharePoint

We use Microsoft 365 and SharePoint for business communication, document management, client administration, contract storage and internal organisation.

Microsoft and its relevant affiliated entities may process personal data on our behalf when providing these services.

Further information is available at:

https://privacy.microsoft.com/privacystatement

10. Zoom

We use Zoom for online coaching calls and consultations.

Zoom may process account information, meeting metadata, device information, IP addresses and information voluntarily disclosed during a call.

Coaching calls are not recorded unless the participant has been informed in advance and has provided any consent required by applicable law.

Further information is available at:

https://www.zoom.com/en/trust/privacy/privacy-statement/

11. WhatsApp

Clients and prospective clients may communicate with us through WhatsApp.

For users in the European Region, WhatsApp is provided by WhatsApp Ireland Limited. WhatsApp processes account, telephone, device, usage and communication metadata under its own privacy terms. The content of personal WhatsApp messages and calls is generally protected by end-to-end encryption.

Clients can send messages at any time, but WhatsApp is not an emergency or continuously monitored communication service.

Because WhatsApp is a third-party communication service, clients should avoid sending unnecessary sensitive information. Where appropriate, Trainerize or email may be used as an alternative communication method.

Further information is available at:

https://www.whatsapp.com/legal/privacy-policy-eea

12. Stripe

We use Stripe to process card payments.

For customers in the European Economic Area, payment services may be provided by Stripe Payments Europe, Limited and relevant Stripe entities. Stripe processes payment and transaction information under its own privacy terms.

We generally receive transaction status, payment references, billing information and limited payment details, but not complete card information.

Further information is available at:

https://stripe.com/privacy

13. Bank Transfers

Where payment is made by bank transfer, we process the payer’s name, bank-account information contained in the transaction, transaction reference, amount, date and payment status.

This information is processed for contract performance, accounting, tax compliance and the establishment or defence of legal claims.

14. Recipients of Personal Data

Personal data may be disclosed where necessary to:

• our Directors and authorised coaches;

• IT, website, hosting and software providers;

• payment providers and banks;

• accountants, auditors, legal advisers and insurers;

• public authorities, courts or regulators where legally required;

• service providers supporting our business operations; and

• a purchaser or successor in connection with a lawful corporate restructuring, merger or sale.

We do not sell personal data.

15. International Data Transfers

Some service providers operate internationally and may process data outside Cyprus or the European Economic Area.

Where required, international transfers are based on:

• an adequacy decision by the European Commission;

• the EU-US Data Privacy Framework, where applicable;

• Standard Contractual Clauses approved by the European Commission; or

• another legally recognised transfer safeguard.

Information about the safeguards used by individual providers is available in their respective privacy statements.

16. Retention

We retain personal data only for as long as necessary for the relevant purpose.

The following general periods apply:

• Unsuccessful or incomplete applications: normally deleted within six months after the last substantive contact.

• Active coaching data: retained for the duration of the coaching relationship.

• Coaching, health, progress and internal progress-photograph data: normally deleted or irreversibly anonymised within four weeks after the end of coaching, unless longer retention is necessary for a legal claim or expressly requested and lawfully agreed.

• WhatsApp and ordinary support communications: normally deleted within four weeks after the end of coaching, unless required for accounting, legal claims or another lawful purpose.

• Contract, invoice, accounting and payment information: retained for the periods required by applicable tax, accounting and company law.

• Evidence of consent: retained for as long as reasonably necessary to demonstrate lawful processing.

• Testimonials and promotional photographs: retained and used until the relevant consent is withdrawn or the purpose of the consent no longer applies.

After consent for promotional use is withdrawn, we will stop future use and take reasonable steps to remove the content from channels under our control. Withdrawal cannot reverse lawful use that occurred before withdrawal and may not remove copies already distributed, shared, cached, archived or included in printed material outside our control.

Technical backups may remain for a limited period until they are overwritten in accordance with the relevant provider’s backup cycle.

17. Data Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to client information is limited to persons who require it for coaching, administration, legal compliance or technical support.

No internet-based service can provide an absolute guarantee of security. Clients should protect their account credentials and notify us promptly if they suspect unauthorised access.

18. Rights of Data Subjects

Subject to applicable law, you may have the right to:

• request access to your personal data;

• request correction of inaccurate or incomplete data;

• request deletion of your data;

• request restriction of processing;

• object to processing based on legitimate interests;

• receive certain data in a portable format;

• withdraw consent at any time;

• lodge a complaint with a supervisory authority; and

• receive information about applicable international-transfer safeguards.

Withdrawal of consent does not affect processing carried out lawfully before withdrawal.

A request can be submitted to:

info@2discipline.com

We may request information necessary to verify the requester’s identity.

19. Right to Complain

You have the right to lodge a complaint with the supervisory authority in your country of residence or work or in the country of the alleged infringement.

Our principal supervisory authority is:

Office of the Commissioner for Personal Data Protection
Republic of Cyprus

https://www.dataprotection.gov.cy

We encourage you to contact us first so that we have an opportunity to address your concern.

20. Changes to this Privacy Policy

We may update this Privacy Policy when our services, providers or legal obligations change.

The current version and its revision date will be published on this website. Material changes affecting existing clients may also be communicated directly where appropriate.