Privacy Policy

Last updated: 26 May 2026

This Privacy Policy explains how Andy Torres Coaching ("we", "us", "our") collects, uses and protects personal data that you provide when you use this website or apply for coaching. We process personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) as implemented in Cyprus by Law 125(I)/2018 on the Protection of Natural Persons with regard to the Processing of Personal Data.

1. Controller

The data controller responsible for this website is Andy Torres, operating from Paphos, Cyprus. Full contact details — including postal address, telephone, email and VAT number where applicable — appear in the **Contact details** section at the bottom of this page.

Because the controller is established in the European Union (Cyprus), no representative under GDPR Art. 27 is required.

2. What personal data we collect

We collect the following personal data:

• **Application form data**: name, email address, phone number, country, goal, training experience, package preference and any free-text notes you choose to submit through the "Apply" form.

• **Email correspondence**: any personal data you include in emails you send to us, including health information you voluntarily disclose for coaching purposes.

• **Server logs**: standard server-side request data (IP address, user agent, referrer, requested URL, response status, timestamp) collected by our web server for security and operations purposes. These logs are not used for marketing or profiling.

• **Coaching data**: weekly check-in data including weight, body measurements, training logs, food logs, progress photos, and any health information you choose to share with the coach to receive personalised coaching.

We do not knowingly collect personal data from individuals under 18 years of age. Cyprus has set the digital-consent age under GDPR Art. 8 at 14, but coaching contracts in any event require adult capacity.

3. Why we process your data (legal basis)

We process personal data only for the purposes listed below:

| Purpose | Legal basis (GDPR Art. 6) | |---|---| | Reply to your enquiry / application | Pre-contractual measures (Art. 6(1)(b)) | | Deliver and adjust your coaching plan | Contract performance (Art. 6(1)(b)) | | Server security and abuse prevention | Legitimate interest (Art. 6(1)(f)) | | Comply with legal obligations (e.g. tax records) | Legal obligation (Art. 6(1)(c)) |

We do not use your data for marketing, profiling, automated decision-making or sale to third parties.

4. How long we keep your data

• **Application data you submit but do not become a client**: deleted after 12 months from the date of submission, unless you ask us to retain it for later.

• **Coaching data for active clients**: kept for the duration of the coaching relationship plus 7 years (tax/accounting retention obligation under Cypriot law).

• **Server logs**: retained for up to 14 days, then rotated and deleted.

5. Recipients and processors

Your personal data may be processed by the following service providers acting on our behalf:

• **Hosting provider**: Hetzner Online GmbH, Germany — hosts the website infrastructure.

• **Email delivery / receipt**: standard SMTP infrastructure used to deliver and receive coaching correspondence. The specific relay (if any external provider is involved) is listed in our internal Record of Processing Activities and disclosed on request.

We do not share personal data with third parties for marketing, advertising or profiling purposes. We do not transfer personal data outside the EU/EEA unless an adequacy decision applies (e.g. UK).

6. Cookies and analytics

This website uses only technically necessary cookies required for basic functionality (e.g. session preferences and Payload CMS administration). We do **not** use marketing cookies, third-party tracking, ad pixels, fingerprinting or behavioural analytics by default.

If this changes (for example, if we later add privacy-respecting analytics), we will update this policy and, where required by law, ask for your consent before any non-essential tracking takes place.

7. Your rights under the GDPR

You have the following rights regarding your personal data:

• **Access** — request a copy of the personal data we hold about you;

• **Rectification** — request correction of inaccurate or incomplete data;

• **Erasure** — request deletion of your personal data, subject to retention obligations above;

• **Restriction** — request restriction of processing;

• **Portability** — receive your data in a structured, machine-readable format;

• **Objection** — object to processing based on legitimate interest;

• **Withdraw consent** — where processing is based on your consent, you can withdraw it at any time (without affecting the lawfulness of prior processing);

• **Lodge a complaint** with a supervisory authority — in Cyprus this is the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy). EU residents may also lodge a complaint with their local authority.

To exercise any right, use the contact details at the bottom of this page. We will respond within 30 days, in line with GDPR Art. 12(3) and Cyprus DPC guidance.

8. Security

We use HTTPS for all traffic, store passwords using industry-standard hashing, restrict admin access via authentication, and apply security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy, Permissions-Policy). No security measure is perfect; please use strong passwords and notify us immediately if you suspect unauthorised access to your account.

9. Changes to this policy

We may update this policy from time to time. The current version is always available on this page with the "Last updated" date at the top. Material changes affecting active clients are also communicated by email.

10. Contact

Our contact details are listed in the **Contact details** section below.