Privacy Notice

Last updated: 13 August 2026. Section 22 (this website, bookings and cookies) added 11 September 2026.

This Privacy Notice explains how Simone Puddu, sole trader established in Malta (“I”, “me”, “my”) collects and uses personal data in connection with my fitness, training, coaching, digital products, subscriptions, marketing and related business activities.

For the processing described in this Notice, I am generally the data controller.

Contact email: simonepuddupt-help@outlook.com

1. Personal data I may collect

The information I collect depends on how you interact with me and which product or service you use.

It may include:

• name;
• email address;
• telephone number;
• account and profile information;
• products or services purchased;
• subscription and payment status;
• training route or service preferences;
• bookings and appointments;
• training history and performance;
• body measurements or body-composition information;
• injuries, pain, limitations or other relevant health information;
• nutrition and lifestyle information;
• communications you send to me;
• marketing preferences and consent status;
• interactions with emails or forms;
• technical information generated through the platforms used to deliver my services; and
• other information you choose to provide.

Where health information is processed as special-category personal data, I will use an appropriate legal basis under applicable data-protection law. Where required, I will obtain your explicit consent.

2. How I collect personal data

I may collect personal data:

• directly from you;
• when you contact me;
• when you purchase a product or subscription;
• when you create or use an account connected with my services;
• when you complete a form;
• when you request a free resource;
• through Trainerize;
• through SendFox;
• through Meta, Facebook or Instagram lead forms;
• through payment processors;
• during coaching or service delivery;
• through email or messaging;
• through social-media communications; and
• through other technology used to operate my business.

3. Providing products and services

When you purchase or use one of my products or services, I may use your personal data to:

• create and administer your account;
• deliver the purchased service;
• provide training, coaching or other agreed services;
• manage your subscription;
• process or administer payments;
• provide access to digital content;
• manage appointments;
• provide customer support;
• communicate important information concerning your service;
• manage cancellations and refunds;
• address technical or account problems; and
• otherwise fulfil the agreement between us.

The legal basis for this processing is generally performance of a contract or taking steps at your request before entering into a contract.

Service communications

If you are a customer, I may contact you without treating the communication as marketing where the communication is reasonably necessary to provide or administer the product or service you have purchased.

Examples include:

• account access;
• onboarding;
• program or service instructions;
• appointment information;
• subscription administration;
• billing;
• payment problems;
• cancellations;
• changes materially affecting your service;
• safety-related information;
• technical issues; and
• customer support.

Opting out of marketing does not prevent me from sending communications reasonably necessary to fulfil or administer an active contractual relationship with you.

4. Health, fitness and coaching information

Where relevant to the service you request, I may process information concerning:

• injuries;
• medical conditions;
• pain or physical limitations;
• pregnancy;
• training ability;
• exercise history;
• body measurements;
• physical performance; and
• other health-related information you choose to provide.

Where this constitutes special-category health data, I will generally rely on explicit consent where required by applicable law.

You may withdraw consent where processing depends on consent.

However, if particular information is reasonably necessary for me to provide a service safely or appropriately, withdrawing permission to process that information may mean that I can no longer provide that service.

5. Nutrition and lifestyle information

Where relevant to a product or coaching service, I may process information concerning nutrition, eating habits, activity, sleep, recovery, lifestyle and related preferences.

The exact information required depends on the particular service.

6. Payments and subscriptions

I may process information relating to:

• purchases;
• prices paid;
• subscription type;
• billing frequency;
• subscription status;
• payment status;
• failed payments;
• cancellations;
• refunds; and
• transaction identifiers.

Payment-card information is normally processed by the relevant payment provider rather than stored directly by me.

Payment and transaction information may also be processed where necessary for accounting, taxation, fraud prevention, dispute resolution and other legal or legitimate business purposes.

7. Direct marketing

I may use personal data to tell people about my own products, services, programs, offers, educational content and other relevant business activities where applicable law permits me to do so.

Different rules apply depending on how I obtained your contact details.

A. Existing customers — similar products and services

Where I obtained your electronic contact details in connection with your purchase of one of my products or services, I may use those contact details to send direct marketing about my own similar products or services where the existing-customer or “soft opt-in” rules under applicable law allow this.

Where I rely on this existing-customer exception:

• the contact details must have been obtained in connection with a previous sale of a product or service;
• the marketing must concern my own similar products or services;
• you must have been clearly given an opportunity to object to that marketing when your contact details were collected;
• that objection must be possible free of charge and in an easy manner; and
• every subsequent marketing email must also provide an easy way to stop receiving further marketing.

For GDPR purposes, where appropriate I may rely on my legitimate interests in marketing my own similar products and services to existing customers, together with the specific rules governing electronic direct marketing.

You may object to this marketing at any time.

If you object or unsubscribe, I will stop using your personal data for that direct-marketing purpose.

B. People who explicitly subscribe or request marketing

Where you expressly agree to receive marketing, I may use your contact details according to that consent.

This may occur, for example, through:

• an email signup form;
• a lead-generation form;
• a free guide or resource signup;
• a SendFox form;
• a Meta lead form; or
• another clearly presented marketing-consent mechanism.

Where the legal basis is consent, you may withdraw your consent at any time.

Withdrawal does not affect processing that was lawful before consent was withdrawn.

C. Free resources and lead magnets

Requesting a free resource does not automatically mean that you must accept unrelated marketing.

Where marketing consent is required, it will be requested separately or clearly as part of the signup process.

For example, a person requesting a free Training Reset or another free resource may be asked whether she also agrees to receive relevant training, program and product emails from me.

D. People who contact me

If you send me an email, direct message, enquiry or other communication, I may use your contact information to:

• read your message;
• reply to you;
• deal with your enquiry;
• provide information you requested; and
• take steps you asked me to take.

Simply contacting me does not automatically subscribe you to ongoing promotional email marketing.

If I want to use your contact details for marketing and no existing lawful marketing basis applies, I will obtain the appropriate consent first.

8. Unsubscribing and objecting to marketing

You may stop receiving marketing communications at any time.

You can normally do this by:

• using the unsubscribe link in a marketing email; or
• emailing simonepuddupt-help@outlook.com and asking not to receive marketing.

Where you object to direct marketing, I will stop processing your personal data for that marketing purpose.

I may retain limited information on a suppression or do-not-contact list where necessary to ensure that your request continues to be respected.

Marketing opt-out does not prevent necessary service or contractual communications concerning an active product or service.

9. Free resources, forms and email lists

I may use forms to provide free resources, collect enquiries or allow people to subscribe to communications.

Information requested may include:

• first name;
• email address;
• training or product preferences;
• Full Gym/Home Gym preference;
• other relevant choices; and
• marketing consent.

I will only request information that is reasonably useful for the purpose of that form or service.

10. Meta, Facebook and Instagram

I may advertise through Meta platforms such as Facebook and Instagram.

Where you submit information using a Meta lead form, Meta processes information through its own platform and supplies to me the information you choose to submit.

I use that information according to:

• the purpose stated on the relevant form;
• any consent or choices presented to you;
• this Privacy Notice; and
• applicable law.

11. Service providers

I use third-party services to operate my business.

Depending on the product or service, these may include providers for:

• training and client-account management, including Trainerize;
• email marketing and lead management, including SendFox;
• social-media advertising and lead generation, including Meta;
• payment processing, including Stripe where applicable;
• email and communications;
• cloud storage;
• hosting;
• accounting;
• analytics;
• professional services; and
• other technical infrastructure.

These providers may process personal information on my behalf or, in some circumstances, as independent data controllers for their own activities.

I disclose personal data only where reasonably necessary for the relevant purpose or where otherwise required or permitted by law.

I do not sell personal data.

12. International data transfers

Some service providers may process personal data outside Malta or outside the European Economic Area.

Where applicable data-protection law requires safeguards for an international transfer, I will rely on an appropriate lawful mechanism provided for under applicable law, which may include:

• an adequacy decision;
• Standard Contractual Clauses; or
• another legally recognised transfer mechanism.

13. Retention

I retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for legitimate legal, contractual, accounting, taxation or dispute-resolution requirements.

Retention therefore varies according to the type of information.

Generally:

• customer information is retained while needed to provide and administer the service and for an appropriate period afterwards where records may reasonably be required;
• transaction and accounting records are retained for legally required record-keeping periods;
• marketing information is retained while the relevant marketing relationship remains active;
• marketing consent and withdrawal information may be retained as evidence of those choices;
• suppression information may be retained so that an opt-out continues to be respected; and
• information no longer reasonably required will be deleted, anonymised or otherwise appropriately disposed of.

14. Legal obligations and protection of the business

I may process or disclose personal data where reasonably necessary to:

• comply with law;
• meet accounting or taxation requirements;
• respond to lawful requests by authorities;
• prevent or investigate fraud;
• protect my systems and accounts;
• enforce contractual rights;
• handle complaints;
• establish, exercise or defend legal claims; or
• protect legitimate business interests.

The legal basis may include legal obligation or legitimate interests, depending on the circumstances.

15. Your rights

Subject to applicable conditions and exceptions, you may have the right to:

• obtain information about the processing of your personal data;
• access your personal data;
• correct inaccurate or incomplete information;
• request deletion;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing depends on consent; and
• lodge a complaint with a data-protection supervisory authority.

Direct marketing

You have the right to object to the processing of your personal data for direct marketing at any time.

If you object, your personal data will no longer be processed for that direct-marketing purpose.

To exercise your rights, contact: simonepuddupt-help@outlook.com

I may need to verify your identity before completing certain requests.

16. Data security

I take reasonable technical and organisational measures appropriate to the information being processed and the associated risk to protect personal data against:

• unauthorised access;
• accidental loss;
• unlawful disclosure;
• alteration;
• destruction; and
• misuse.

Third-party providers used to deliver my services maintain their own technical and security systems.

No internet-based service can guarantee absolute security.

17. Automated decision-making

I do not currently use personal data supplied directly to me to make solely automated decisions that produce legal or similarly significant effects on individuals.

Third-party advertising and technology providers may use automated technologies as part of their own services under their own privacy policies.

18. Third-party services and websites

My services may operate through or link to third-party websites, applications and platforms.

Those third parties may process personal information according to their own privacy notices.

This Privacy Notice explains my processing and does not replace the privacy information supplied by those providers.

19. Changes to this Privacy Notice

I may update this Privacy Notice when:

• my services change;
• technology or service providers change;
• my processing activities change; or
• legal requirements change.

The current version will be made available through the public Privacy Notice URL.

Where required, material changes will be communicated appropriately.

20. Complaints

If you have concerns about how I process your personal data, please contact me first: simonepuddupt-help@outlook.com

You also have the right to complain to the competent data-protection supervisory authority.

As I am established in Malta, the relevant supervisory authority is the Office of the Information and Data Protection Commissioner (IDPC), Malta.

21. Contact details

Data controller: Simone Puddu
Business status: Sole trader
Established in: Malta
Email: simonepuddupt-help@outlook.com

22. This website: bookings, cookies and ad measurement

Hosting

This website is hosted by Hostinger. When you visit, the hosting servers process technical information such as your IP address, browser type, the pages requested and the date and time, to deliver the website and keep it secure. The legal basis is my legitimate interest in operating a secure website.

Booking a call

Calls are booked through TidyCal, a scheduling service. When you book, TidyCal processes your name, email address, WhatsApp number, time zone, the time you choose and your answers to the booking questions, and sends the booking emails. I use this information to arrange and prepare the call. I use your WhatsApp number only to confirm the call with you on WhatsApp, a service provided by Meta. The call itself takes place on Google Meet. The legal basis is taking steps at your request before a possible contract. Please don’t include health information in the booking form; if something health-related matters for your training, we can talk about it on the call. TidyCal may process data outside the European Economic Area (see section 12).

Cookies and similar technologies

Strictly necessary. One item stored in your browser (sp_consent_v1) remembers your cookie choice so the website doesn’t ask again on every page. It contains no personal details.

Advertising measurement, only with your consent. If you click “Accept”, the website loads OpenAI’s ChatGPT Ads measurement pixel. If you arrived from an ad in ChatGPT, the pixel reads the click reference in the page address and stores it in a first-party cookie (for example __oppref), so OpenAI can report to me whether the ad led to a visit, a click on “Book” or a booked call. The pixel also sends technical information such as the page address and browser details to OpenAI. I don’t send your name or email address to OpenAI. OpenAI may process this data outside the European Economic Area (see section 12). The legal basis is your consent.

If you click “Reject”, the pixel isn’t loaded and no measurement cookie is set. You can change your choice at any time with Cookie settings, which also appears at the bottom of every page.

This website uses no other analytics or advertising trackers.

Checkout and coaching app

If you decide to join after the call, checkout, payments and the coaching app run on Trainerize and its payment providers, as described in sections 6 and 11.