Legal

GDPR & Data Protection

Last updated: 1 January 2026

Ironwood Fitness LLC serves clients in Kharkiv, Ukraine, and accepts online coaching enquiries from individuals based in European Union member states and other countries. Where we process personal data of individuals in the EU or individuals whose data is otherwise subject to the EU General Data Protection Regulation (Regulation 2016/679, "GDPR"), we do so in full accordance with the GDPR's requirements. This page describes the applicable lawful bases for processing and the full range of data-subject rights you may exercise.

This page should be read together with our Privacy Policy, which provides additional detail on what data we collect, how we use it, and how long we keep it.

1. Data controller

The controller of your personal data is:

  • Company: Ironwood Fitness LLC
  • Address: 14 Akademika Pavlova St, Kharkiv 61000, Ukraine
  • Data protection contact: privacy@ironwoodfitnessie.com
  • Phone: +380 57 714 22 80

We have not appointed a formal Data Protection Officer, as we are a small organisation and are not required by the GDPR to do so. However, our data protection contact above handles all privacy-related requests and can be reached at any time.

2. Lawful bases for processing

The GDPR requires that every processing activity has a defined lawful basis. We rely on the following bases:

2.1 Consent (Article 6(1)(a))

We process your contact form data on the basis of your explicit consent, which you give when you tick the consent checkbox before submitting the form. You also give consent when you accept analytics cookies via the cookie banner on your first visit. Consent is always freely given, specific, informed and unambiguous. You can withdraw consent at any time — see Section 5 below.

2.2 Performance of a contract (Article 6(1)(b))

Where you have entered into a membership or coaching agreement with Ironwood Fitness, we process the personal data necessary to deliver the service, manage your membership, schedule sessions, and communicate with you about your training. This processing is necessary to fulfil our contractual obligations to you.

2.3 Legitimate interests (Article 6(1)(f))

We process technical data (such as server logs and usage analytics, where you have accepted cookies) on the basis of our legitimate interest in operating a secure, functional and improving website. We have conducted a balancing test and are satisfied that this interest is not overridden by your privacy interests, rights or freedoms, given that we collect only what is strictly necessary and implement appropriate security measures.

2.4 Legal obligation (Article 6(1)(c))

Where applicable Ukrainian law or regulation requires us to process or retain personal data, we do so on the basis of our legal obligation.

3. Special categories of personal data

Fitness and health information shared voluntarily by a client (such as pre-existing medical conditions or injury history) may constitute "special category" data under Article 9 of the GDPR. We process such data only where you have given explicit consent (Article 9(2)(a)) for the purpose of providing you with a safe and suitable training programme. You are never required to share health information with us, but where you choose to do so to enable safer coaching, we treat that data with the highest level of care and confidentiality.

4. Your rights under the GDPR

Individuals whose data is subject to the GDPR have the following rights. We respect and uphold these rights for all our clients and website visitors, regardless of where they are located.

4.1 Right of access (Article 15)

You have the right to obtain confirmation from us as to whether we process personal data about you, and if so, to receive a copy of that data along with information about the categories of data processed, the purposes of processing, the recipients, the retention period, and your rights. We will respond within one month of receiving a valid request.

4.2 Right to rectification (Article 16)

You have the right to have inaccurate personal data corrected without undue delay, and to have incomplete data completed. If you believe we hold incorrect information about you, please contact us at privacy@ironwoodfitnessie.com.

4.3 Right to erasure ("right to be forgotten") (Article 17)

You have the right to request deletion of your personal data in the following circumstances:

  • The data is no longer necessary for the purpose for which it was collected.
  • You withdraw consent and there is no other lawful basis for processing.
  • You object to processing and there are no overriding legitimate grounds.
  • The data has been unlawfully processed.
  • Erasure is required to comply with a legal obligation under Ukrainian or EU law.

Note that we may retain some data for the period required by law even after a deletion request, and we will inform you of any such retention.

4.4 Right to restriction of processing (Article 18)

You have the right to request that we restrict processing of your personal data where: the accuracy of the data is contested; the processing is unlawful but you prefer restriction to erasure; we no longer need the data but you require it for the establishment, exercise or defence of legal claims; or you have objected to processing under Article 21 and a determination of overriding grounds is pending.

4.5 Right to data portability (Article 20)

Where processing is based on your consent or the performance of a contract, and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format (such as CSV or JSON), and to transmit that data to another controller. This right applies to data you have actively provided (e.g. your contact form submission); it does not apply to inferred or derived data.

4.6 Right to object (Article 21)

You have the right to object at any time to the processing of your personal data where that processing is based on our legitimate interests (Article 6(1)(f)). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims. You also have the unconditional right to object to processing for direct marketing purposes at any time.

4.7 Right to withdraw consent (Article 7(3))

Where processing is based on your consent, you have the right to withdraw that consent at any time without detriment. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. To withdraw consent, email privacy@ironwoodfitnessie.com or, for cookie consent, clear your browser's local storage for ironwoodfitnessie.com.

4.8 Rights related to automated decision-making and profiling (Article 22)

Ironwood Fitness does not make any decisions based solely on automated processing — including profiling — that produce legal effects or similarly significantly affect you. All coaching recommendations and programme decisions involve human judgement from a certified coach.

5. How to exercise your rights

To exercise any of the rights described above, please contact our data protection contact:

  • Email: privacy@ironwoodfitnessie.com — preferred method for fastest response
  • Post: Ironwood Fitness LLC, 14 Akademika Pavlova St, Kharkiv 61000, Ukraine (marked "Data Protection Request")

We will respond within one calendar month of receiving your request. If a request is complex or we receive a high volume of requests, we may extend this period by a further two months; in that case, we will notify you within the initial one-month period and explain the reason for the extension. We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

We may need to verify your identity before acting on your request. We will ask for the minimum information necessary to confirm you are the person whose data we hold.

6. International data transfers

Ironwood Fitness is based in Ukraine. Where we use service providers — such as website hosting or email infrastructure — whose servers may be located outside Ukraine, including potentially in countries outside the European Economic Area, we ensure appropriate safeguards are in place. These may include the European Commission's Standard Contractual Clauses, reliance on adequacy decisions, or other legally recognised transfer mechanisms. If you would like information about the safeguards applied to a specific international transfer, contact us at privacy@ironwoodfitnessie.com.

7. Data retention

We retain personal data only as long as necessary for the purpose for which it was collected, or as required by Ukrainian law. Contact form submissions are typically retained for up to 24 months. Membership and client coaching data is retained for the duration of the membership plus a reasonable period thereafter, generally not exceeding five years unless a legal obligation requires longer retention. Full details are in our Privacy Policy.

8. Supervisory authority and the right to complain

If you are located in the European Union and believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the data protection supervisory authority in the EU member state where you habitually reside, work, or where the alleged infringement took place.

If you are located in Ukraine, oversight of personal data protection is provided by the Ukrainian Parliament Commissioner for Human Rights (Ombudsperson), who may be contacted at the Commissioner's official website.

We would, however, encourage you to contact us directly first at privacy@ironwoodfitnessie.com so that we have the opportunity to address your concern promptly and directly.

9. Changes to this page

We may update this GDPR & Data Protection page to reflect changes in law or our practices. Material changes will be reflected in the "last updated" date at the top of this page. We recommend reviewing this page periodically.

10. Contact

For any data protection matter, question or request: