GDPR Compliance

mountain-sparrow is committed to protecting your personal data and respecting your privacy. This page provides information about how we comply with the General Data Protection Regulation (GDPR) and explains your rights regarding your personal data.

Who We Are

mountain-sparrow is the data controller responsible for your personal data. We are a fitness coaching service based in Manchester, United Kingdom.

Contact details:
mountain-sparrow
14 Wellington Street
Manchester, M2 4BQ
United Kingdom
[email protected]

What Data We Collect

We may collect, use, store, and transfer different kinds of personal data about you, including:

• Identity Data: Including first name, last name, and similar identifiers
• Contact Data: Including email address and postal address
• Health Data: Information about your fitness level, health conditions, and physical capabilities relevant to providing our services (collected only with your explicit consent)
• Technical Data: Including internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform
• Usage Data: Information about how you use our website and services

Lawful Basis for Processing

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Contract: Where we need to perform the contract we are about to enter into or have entered into with you
• Legitimate interests: Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
• Consent: Where you have given us specific consent to process your personal data for a specific purpose, particularly for health-related data
• Legal obligation: Where we need to comply with a legal obligation

Your Rights Under GDPR

Under certain circumstances, you have the following rights in relation to your personal data:

Right to Access

You have the right to request a copy of the personal information we hold about you. This is commonly known as a "data subject access request." We will provide this information free of charge within one month of receiving your request.

Right to Rectification

You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete. We will respond to your request within one month.

Right to Erasure

You have the right to request that we erase your personal data under certain conditions, such as when the data is no longer necessary for the purpose for which it was collected, or you withdraw your consent where consent was the basis for processing.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data under certain conditions, such as when you contest the accuracy of the data or when processing is unlawful but you do not want the data erased.

Right to Data Portability

You have the right to request that we transfer the data we have collected to another organisation, or directly to you, under certain conditions. This right applies to data you have provided to us where processing is based on consent or contract and is carried out by automated means.

Right to Object

You have the right to object to our processing of your personal data under certain conditions, including processing for direct marketing purposes or processing based on legitimate interests.

Right to Withdraw Consent

Where we rely on consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent.

Data Security

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. We limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know.

Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data, whether we can achieve those purposes through other means, and the applicable legal requirements.

International Transfers

We do not routinely transfer your personal data outside the United Kingdom or European Economic Area. If we do need to transfer data internationally, we will ensure appropriate safeguards are in place to protect your personal data.

Exercising Your Rights

To exercise any of these rights, please contact us using the details provided above. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

We will respond to all legitimate requests within one month. Occasionally, it may take us longer if your request is particularly complex or you have made a number of requests, in which case we will notify you and keep you updated.

Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (ico.org.uk). However, we would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Changes to This Information

We may update this GDPR information from time to time. Any changes will be posted on this page with an updated revision date.

Last updated: January 2024