Privacy policy

Data controller: Jaume Joan Cantallops Bennàssar (trading name ‘Jaume Joan’), NIF (tax ID) 41523792Y, address Carrer Palou, 100, 07420 Sa Pobla, Mallorca. For any question about your data, write to info@jaumejoanentrenamiento.com.

Sign-up form: name, ID or NIE number, date of birth, email, phone, address, Instagram if you give it, an emergency contact, your goals, your experience and your plan and schedule preferences.

Free assessment request: name, phone, your goal, your preferred format and, if you chose one, the plan you are interested in.

Health data: injuries or illnesses, medication, allergies or intolerances, family history and sleep. These are a special category of data (art. 9 GDPR) and we only process them with your explicit consent.

Messages: whatever you tell us by email or WhatsApp.

Browsing: data on how the site is used (pages viewed, device type and approximate location). With cookies, only if you accept them in the cookie banner; otherwise Google Analytics only receives technical signals without cookies or a stable identifier. The details are in the cookie policy.

To handle your request and, if you sign up, to provide the training and nutrition service and manage bookings, cancellations and payments. Legal basis: performance of the contract or of pre-contractual steps you ask for (art. 6.1.b GDPR).

To assess, with your health data, whether training is safe for you and to adapt it. Legal basis: your explicit consent (art. 9.2.a GDPR), given through a dedicated checkbox in the form. Without this data we cannot design a safe plan, so the checkbox is required to sign up. You can withdraw your consent at any time; if you do, we will stop using that data, although that may prevent us from continuing to offer a personalised service.

To invoice and meet tax and accounting obligations. Legal basis: legal obligation (art. 6.1.c GDPR).

To publish photos or videos of your progress for promotional purposes, only if you authorise it in the form. Legal basis: your consent (art. 6.1.a GDPR).

To measure how the site is used with analytics cookies, only if you accept them in the cookie banner. Legal basis: your consent (art. 6.1.a GDPR). If you do not accept them, Google Analytics receives technical signals without cookies or a stable identifier to estimate overall visits. Legal basis: legitimate interest in knowing how the site is used (art. 6.1.f GDPR).

To protect the form from automated submissions. Legal basis: legitimate interest in the security of the site (art. 6.1.f GDPR).

Vercel Inc. (United States): hosts the site and, if you accept it, counts visits and measures loading speed without cookies (Vercel Web Analytics and Speed Insights).

Resend (United States): sends the trainer the email with your sign-up or your assessment request.

Google (Google Ireland Limited and Google LLC): keeps a copy of your sign-up in Google Forms and Google Sheets; if you accept it, measures how the site is used with Google Analytics 4; and shows Google Maps if you click to load the map.

Cloudflare, Inc. (United States): checks with Cloudflare Turnstile that the form is sent by a person and not by an automated program.

The trainer’s email provider, where your sign-up, your assessment request and your messages are received.

We do not sell your data or pass it on to other companies. It is only disclosed to public authorities when the law requires it, for example to the Spanish Tax Agency.

If you write to us on WhatsApp, WhatsApp Ireland Limited processes your messages under its own privacy policy.

Some of these providers are in the United States or may access the data from there; Resend, for example, stores data in the United States. They are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection, or they commit to the standard contractual clauses approved by the Commission.

If you do not go on to sign up, we delete your form or your assessment request within 12 months of our last contact at the latest.

If you are a client, for as long as the relationship lasts. When it ends, we delete the health data and keep the rest, blocked, only for the legal periods: up to 6 years for invoices and accounts (art. 30 of the Spanish Commercial Code).

Promotional photos and videos, until you withdraw your authorisation.

The retention periods for analytics are in the cookie policy.

You can request access, rectification, erasure, objection, restriction of processing and portability of your data, and withdraw any consent you have given at any time, without affecting what was processed before. Write to the contact email saying which right you want to exercise; if we have doubts about your identity, we will ask you to prove it.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

The site uses an encrypted connection (HTTPS). Within the business only the trainer accesses your sign-up; the providers in section 4 process it on our behalf with security guarantees.

If you are under 14, your mother, father or legal guardian must sign you up (art. 7 of the Spanish data protection act, LOPDGDD).