Forge Fitness takes your privacy seriously, especially because coaching involves health information. This policy explains what we collect, why, who helps us process it, and your rights.
1. Who is responsible
Forge Fitness is responsible for your personal data (the “controller” under the GDPR).
- Business
- Forge Fitness
- KvK number
- 42179940
- Address
- Noord Brabantlaan 48 A, 5651 LZ Eindhoven, the Netherlands
- VAT number
- NL005557763B02
- [email protected]
- Phone
- +31 6 13 77 93 65
2. What we collect
- Account details: your name, email address and, if you share it, your phone number and goal.
- Coaching information: your workouts, check-in answers, body weight and measurements, progress photos, food diary, habits and messages with your coach.
- Health information: details you share such as injuries, medical conditions or pregnancy. This is a special category of data, and we only process it with your explicit consent, which you give when you first sign in to the app.
- Payment details: your plan, payment status and invoices. Payments are handled by Stripe; we never see or store your full card or bank details.
- Technical details: the information needed to keep you signed in and to protect your account against misuse.
The website forgefitness.nl uses no cookies and no tracking or advertising tools.
3. Why we use it, and on what basis
- To provide your coaching, run the app and stay in touch with you: this is needed to perform our agreement with you.
- To use your health information to coach you safely: based on your explicit consent. You can withdraw it at any time, but we can’t coach you safely without it, so withdrawing means your coaching ends.
- To handle payments and keep our accounts: needed for our agreement and required by Dutch tax law.
- To send reminders and notifications in the app: part of the service. You can turn them off under Profile.
We never sell your data and never use it for advertising.
4. Who helps us
We use a small number of trusted services. They only process your data on our instructions and under data processing agreements.
- Cloudflare: hosts the website and the app, and stores the app’s data and your photos on servers in Western Europe.
- Stripe: processes payments and subscriptions.
- Resend: sends emails such as your account invite and reminders.
- Open Food Facts: when you search for a food in the app, your search words or the scanned barcode are sent, through our server, to this open food database. No account details are sent.
Some of these companies are based outside the EU. Where data leaves the EU, it is protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
5. How long we keep it
- Your coaching and health information: while you are a client, and up to 12 months after your coaching ends, so you can pick up where you left off if you return. You can ask us to delete it sooner.
- Invoices and payment records: 7 years, as Dutch tax law requires.
- Backups: Cloudflare keeps an automatic history of the app’s database for up to 30 days, so it can be restored after a fault. Older history is deleted automatically.
6. How we protect it
Your data is stored in the EU, sent over encrypted connections, stored encrypted, and protected by access rules so that only you and your coach can see your information.
7. Your rights
You have the right to see the data we hold about you, to correct it, to have it deleted, to limit or object to how we use it, to receive it in a portable format, and to withdraw your consent at any time. Email [email protected] and we will respond within one month.
If you’re not happy with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
8. Changes to this policy
If we change this policy in a way that matters to you, we will let you know before the change applies.