Privacy Policy

Version 1.1 — Effective June 1, 2026 — GDPR (EU 2016/679)

FitDesk (Simplified Joint-Stock Company (SAS), Montpellier Trade Register (RCS) 104 196 233, 118 Rue des Roselières, 34970 Lattes, France) is committed to protecting your personal data in accordance with the GDPR and French Data Protection Act.

Article 1 — Data controller

FitDesk, Simplified Joint-Stock Company (SAS), Montpellier Trade Register (RCS) 104 196 233, 118 Rue des Roselières, 34970 Lattes, France.

Contact: a.machabert@fitdesk.io

Article 2 — Data collected

• Identification data : first name, last name, email address, phone number.
• Professional data : business name, specialty, country.
• Billing data : billing details (processed by Stripe, not stored by FitDesk).
• Coaches' client data : data entered by the coach for their own clients (coach = data controller).
• Browsing data : IP address, browser type, pages visited, session duration.
• Communication data : messages exchanged via the integrated messaging system.

Article 3 — Purposes and legal bases

• Provision of FitDesk service : contract performance (GDPR Art. 6.1.b).
• Billing and subscriptions : contract performance + legal obligation (Art. 6.1.b/c).
• Service improvement : legitimate interest (Art. 6.1.f GDPR).
• Service communications : legitimate interest / consent (Art. 6.1.a/f).
• Legal obligations : legal obligation (Art. 6.1.c GDPR).

Article 4 — Retention periods

• Active account data : throughout the subscription.
• After cancellation : 3 years (commercial limitation period).
• Billing data : 10 years (accounting obligation).
• Browsing data : maximum 13 months.

Article 5 — Data recipients

• Stripe Inc. : payment processing — USA. Transfer governed by Standard Contractual Clauses (SCCs) approved by the European Commission (post-Schrems II, July 16, 2020).
• OVH SAS : data hosting — France (Roubaix).
• Internal mail service (eudora) : transactional notification delivery — hosted in France.

FitDesk does not sell or rent your personal data to third parties.

Article 6 — Transfers outside the European Union

Data processed by Stripe may be transferred to the United States. These transfers are governed exclusively by Standard Contractual Clauses (SCCs) adopted by the European Commission under GDPR article 46. No other transfers outside the EU are made.

Article 7 — Cookies and trackers

FitDesk does not use third-party cookies, analytics trackers or advertising pixels.

The platform uses only strictly necessary technical cookies for service operation (authentication, session maintenance, language preference). These cookies are exempt from consent requirements under CNIL guidelines of 17 September 2020. No cookie banner is required.

• Session cookie : maintains authentication — duration: browser session.
• Language preference : stores chosen language (localStorage) — duration: 1 year.

Article 8 — Automated decision-making and profiling

Pursuant to GDPR article 13.2.f, FitDesk informs you that no automated decision-making or profiling within the meaning of GDPR article 22 is carried out in respect of you. No decision affecting you is made solely on the basis of automated processing.

Article 9 — Your rights

• Access — obtain a copy of your data.
• Rectification — correct inaccurate data.
• Erasure — request deletion.
• Objection — object to certain processing.
• Portability — receive your data in a structured format.
• Restriction — restrict certain processing.

To exercise these rights: a.machabert@fitdesk.io. Response within 30 days. Complaint possible with the CNIL (www.cnil.fr, 3 place de Fontenoy, 75007 Paris).

Article 10 — Security

FitDesk implements: data encryption in transit (TLS 1.3), encryption at rest, restricted access to production data, access logging, regular backups.

Article 11 — Updates

This policy may be updated at any time; the revision date appears in the header. Users will be notified by email of material changes.