Ordo Gym Privacy Policy

1. Controller and contact

1. The Ordo Gym app (the App) is published by POKO Adam Rokita, Działkowa 127/11, 05-808 Parzniew, Poland, tax ID (NIP) 534-22-67-654 (the Publisher).
2. For personal data matters write to support@ordogym.com. Questions about how the App works are also welcome at app@ordogym.com.
3. The Publisher has not appointed a data protection officer; the scale of processing does not require it.

2. Two roles: trainer data and client data

In short: for your own data (account, settings, achievements, purchases) the Publisher is the controller. For your clients’ data, which you enter into the App yourself, you are the controller and the Publisher only stores and synchronises it for you as a processor (Section 9).

1. User (trainer) data: the Publisher decides on the purposes and means of processing to the extent needed to run the account and provide the service.
2. Client data: the User decides what data to enter and why. The Publisher does not use it for its own purposes, does not analyse its content and does not combine it with other data sets; it performs only technical operations: storage, synchronisation, backup, deletion.

3. What data we process

3.1. User data

3.2. Client data entered by the User

1. Name; optionally phone number, e-mail address and a trainer’s note.
2. Date of birth, sex, height, body weight and its history, target weight, goal and goal description, activity level, gym.
3. Training packages: number of sessions, price, purchase, validity and payment dates, payments (amounts and dates), paid status.
4. Workouts: dates, place, exercises, sets (weight, repetitions, time), comments; progress reports generated from them.
5. Body weight and other body parameters may be treated as health data (Article 9 GDPR). The Publisher does not use them for any purpose of its own; the User, as controller, is responsible for the legal basis of their processing.

3.3. What we do not collect

1. The App does not collect location, address book contacts, photos or Apple Health / Health Connect data. Quick contact with a client (call, SMS, e-mail) opens the system app; the content of the conversation never reaches the App.
2. We do not use advertising identifiers (IDFA, Advertising ID), ad networks or cross-app tracking. The App does not ask for App Tracking Transparency consent because it does not track users.
3. The Publisher does not receive card details or billing addresses; payments are handled by Apple.

4. Purposes and legal bases

1. We do not send marketing newsletters without separate, voluntary consent, which can be withdrawn at any time. Creating an account is not such consent.
2. We make no automated decisions with legal effects and do not profile users for marketing.

5. Where data is stored

1. Account data and all data entered in the App are stored in Google Firebase services (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging) provided by Google Ireland Limited and Google LLC. The App’s database is hosted in a European region; backups are made by Google within that service.
2. Google acts as a processor under the Google Cloud data processing terms, which include the EU standard contractual clauses in case data is transferred outside the EEA (e.g. for technical support). More at firebase.google.com/support/privacy.
3. A copy of the data is also kept on your signed-in devices so that the App is fast and works briefly without a network.

6. Recipients and sub-processors

1. RevenueCat is based in the United States; transfers rely on the EU standard contractual clauses in the agreement with that provider. See revenuecat.com/privacy.
2. We do not sell data or share it with third parties for marketing. Data may be disclosed to competent authorities where required by law.

7. Notifications

1. Workout reminders are scheduled locally on the device. Reminders about expiring packages and overdue payments (a PRO feature) are generated by the Service’s server (Cloud Functions) from package data and delivered through Firebase Cloud Messaging to your devices.
2. A notification may contain a client’s name and an amount. You can withdraw the notification permission in system settings; the App then works without reminders.

8. Retention

1. Account and App data: until the User deletes the account or the agreement ends.
2. After account deletion, data is removed from the database immediately and from the provider’s backups in their rotation cycle, no longer than 30 days.
3. Diagnostics (Crashlytics, Analytics): up to 90 days, then only in aggregated form.
4. Subscription status in RevenueCat: for the life of the account and the period required for Store settlements.
5. Correspondence and complaints: for the duration of the case and then until claims become time-barred.

9. Data processing agreement for trainers

This Section constitutes a data processing agreement (Article 28 GDPR) between the User as controller and the Publisher as processor for Clients’ personal data. It is concluded when the account is created; on request the Publisher provides it as a separate signable document.

1. Subject and duration: storage, synchronisation, backup and deletion of the Client data described in Section 3.2, for as long as the account exists.
2. Nature and purpose: only technical operations necessary to provide the Service; the Publisher does not process Client data for other purposes.
3. Instructions: the Publisher processes data only on the User’s documented instructions, which are the actions performed in the App and the provisions of the Terms and this Policy.
4. Confidentiality and security: only authorised persons bound by confidentiality have access; the measures are described in Section 12.
5. Sub-processors: the User gives general consent to the sub-processors listed in Section 6. The Publisher announces additions or changes in the App or by e-mail 14 days in advance; the User may object by deleting the account.
6. Assistance: the Publisher assists the User in fulfilling data subjects’ rights (e.g. exporting or deleting a specific Client’s data; deleting a Client in the App removes their packages and workouts), in breach notification and in impact assessments where needed.
7. Breaches: the Publisher notifies the User of a breach concerning Client data without undue delay, no later than 48 hours after becoming aware of it.
8. Termination: after account deletion the Publisher deletes Client data under Section 8; before that the User may export it (Section 11).
9. Audit: the User may request information necessary to demonstrate compliance with Article 28 GDPR; the Publisher provides it by e-mail, referring where appropriate to sub-processors’ certifications and reports (Google Cloud, RevenueCat).

10. Your rights

1. You have the right to access, rectify, erase and restrict the processing of your data, to data portability and to object to processing based on legitimate interest, as well as to withdraw consent (e.g. to notifications) without affecting the lawfulness of prior processing.
2. You exercise these rights yourself in the App (editing your profile and client data, deleting the account) or by writing to support@ordogym.com. We respond within one month.
3. You have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with your local supervisory authority.
4. A trainer’s client who wishes to exercise their rights should contact their trainer as controller. If they contact the Publisher, the Publisher forwards the request to the trainer and assists in fulfilling it.

11. Export and deletion

1. Account deletion: More → My profile → Delete my account. The operation is irreversible and deletes all client, workout, package and achievement data. Turn off the PRO subscription in the Store first (Section 15 of the Terms).
2. Deleting a single client in the App also deletes their packages and workouts.
3. Export: on request sent from the account’s e-mail address, the Publisher delivers within 14 days an archive of the account data in JSON format (clients, packages, payments, workouts, templates).

12. Security

1. Data in transit between the App and the servers is encrypted (TLS); data in the database is encrypted at rest by Google.
2. Access to account data is protected by Firestore security rules: each User can access only their own documents. The ranking stores only the account ID and EXP points.
3. Firebase App Check restricts server access to genuine builds of the App.
4. Passwords are never stored in plain text; they are handled by Firebase Authentication. We recommend signing in with Apple or Google and using a device lock on any device holding client data.

13. The ordogym.com website and cookies

1. ordogym.com is a static website. It uses no cookies, analytics tools or advertising pixels. Fonts may be loaded from Google Fonts servers, which involves passing your browser’s IP address to Google to deliver the font file.
2. The hosting server keeps standard logs (IP address, time, requested URL, browser) for security and diagnostics for the period set by the hosting provider, no longer than 90 days.

14. Children

1. The App is intended for persons aged 16 or over. It is not directed at children and we do not knowingly collect their data as users.
2. A trainer may keep records of minor trainees in the App only with their guardians’ consent, which the trainer obtains independently as controller.

15. Changes to this Policy

1. This Policy may be updated as the App evolves or the law changes. We announce material changes in the App or by e-mail at least 14 days before they take effect.
2. The current version is always available at ordogym.com/privacy-policy; the date and version number are at the top of the document.