Privacy Policy & Data Protection

1. Data Controller Information

Company Name: FitLife Pro Ltd.
Registration Number: EU-12345678
Registered Address: 123 Health Street, Wellness District, 10115 Berlin, Germany
Email: privacy@fitlifepro.com
Data Protection Officer: dpo@fitlifepro.com
Phone: +49 (0) 30 123 45678

2. Information We Collect

We are committed to minimal data collection. We only collect information you voluntarily provide:

Personal Data Collected:

• Email Address: When you subscribe to our newsletter
• Consent Records: Timestamp and IP address of consent for GDPR compliance
• Language Preference: Stored locally in your browser (not transmitted to our servers)

We Do NOT Collect:

• Full names, surnames, or nicknames
• Physical addresses or phone numbers
• Payment information (our newsletter is free)
• Browsing behavior or cookies (except essential language preference)
• IP addresses for tracking purposes
• Device fingerprints or identifiers
• Social media profiles or connections

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

Consent (Article 6(1)(a) GDPR)

You have given clear, explicit, and informed consent for us to process your email address for newsletter purposes. This consent includes:

• A clear affirmative action (checking the consent box)
• Specific information about what you're consenting to
• The ability to withdraw consent at any time
• Consent is separate from other terms and conditions

Legitimate Interest (Article 6(1)(f) GDPR)

We have a legitimate interest in improving our content and services based on aggregated, anonymized feedback. This does not involve processing personal data.

Your Right to Withdraw Consent

You may withdraw consent at any time by:

• Clicking "unsubscribe" in any newsletter email
• Emailing privacy@fitlifepro.com with your request
• Contacting our Data Protection Officer

Withdrawal does not affect the lawfulness of processing before withdrawal.

4. How We Use Your Information

Your email address is used exclusively for the following purposes:

Primary Purpose:

• Sending weekly fitness and nutrition newsletters
• Delivering expert content and evidence-based advice
• Providing updates on new articles and guides

We Will NEVER:

• Sell your email to third parties
• Rent or lease your data to advertisers
• Share your information for marketing purposes
• Send unsolicited commercial emails beyond what you subscribed for
• Use your data for profiling or automated decision-making
• Create user profiles or behavioral tracking
• Share with social media platforms

5. Data Storage and Security

Storage Location

All personal data is stored on secure servers located within the European Union, ensuring full GDPR compliance. We use EU-based data centers with ISO 27001 certification.

Security Measures

We implement industry-leading security measures:

• Encryption: 256-bit SSL/TLS encryption for all data transmission
• Database Security: Encrypted database storage with AES-256
• Access Controls: Role-based access with two-factor authentication
• Security Audits: Regular penetration testing and vulnerability assessments
• Backups: Automated encrypted backups with 30-day retention
• Monitoring: 24/7 security monitoring and intrusion detection
• Employee Training: Regular GDPR and security training for all staff

Data Retention Period

Your email address is retained only while you remain subscribed. Upon unsubscribing:

• Your email is immediately marked for deletion
• Permanent deletion occurs within 30 days
• Backup copies are overwritten within 90 days
• No data is retained after this period

6. Your Rights Under GDPR

You have comprehensive rights regarding your personal data:

Right of Access (Article 15)

Request a copy of all personal data we hold about you, including how it's being used.

Right to Rectification (Article 16)

Request correction of any inaccurate or incomplete data.

Right to Erasure / "Right to be Forgotten" (Article 17)

Request deletion of your personal data when:

• It's no longer necessary for the purpose collected
• You withdraw consent
• You object to processing and no overriding grounds exist
• Data was unlawfully processed

Right to Restrict Processing (Article 18)

Request limitation of how we use your data in certain circumstances.

Right to Data Portability (Article 20)

Receive your data in a structured, commonly used, machine-readable format (CSV or JSON).

Right to Object (Article 21)

Object to processing based on legitimate interests or for direct marketing.

Rights Related to Automated Decision-Making (Article 22)

We do not engage in automated decision-making or profiling.

How to Exercise Your Rights

To exercise any of these rights:

• Email: privacy@fitlifepro.com
• Contact our Data Protection Officer: dpo@fitlifepro.com
• We will respond within 30 days as required by GDPR
• No fee is charged unless requests are manifestly unfounded or excessive

7. Third-Party Service Providers

We work with carefully selected, GDPR-compliant service providers:

Email Service Provider

• EU-based email infrastructure
• Data Processing Agreement (DPA) in place
• ISO 27001 certified
• GDPR compliant

Web Hosting

• EU-based servers (Frankfurt, Germany)
• ISO 27001 and SOC 2 certified
• Data Processing Agreement in place

All third parties have signed Data Processing Agreements (DPAs) ensuring they handle your data according to GDPR standards. They are prohibited from using your data for their own purposes.

8. Cookies and Tracking Technologies

Essential Cookies Only

We use only one essential cookie via browser localStorage to remember your language preference. This cookie:

• Does not track your behavior
• Does not leave your device
• Is not used for advertising
• Cannot identify you personally

No Tracking or Analytics Cookies

We do NOT use:

• Google Analytics or similar tools
• Advertising cookies or pixels
• Social media tracking pixels
• Cross-site tracking
• Behavioral analytics

TikTok Pixel

If you arrive from a TikTok advertisement, TikTok may place cookies according to their privacy policy. We do not control third-party cookies. You can:

• Opt out through TikTok's privacy settings
• Block third-party cookies in your browser
• Use privacy-focused browsers or extensions

9. International Data Transfers

Your data remains within the European Union at all times. We do not transfer data outside the EU/EEA.

If future transfers become necessary, we will:

• Notify you in advance via email
• Use Standard Contractual Clauses (SCCs) approved by the European Commission
• Ensure adequate safeguards are in place (GDPR Article 46)
• Obtain your explicit consent where required
• Conduct transfer impact assessments

10. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children under 16 without verifiable parental consent.

If you are a parent or guardian and believe we have collected data from your child, please contact us immediately at privacy@fitlifepro.com. We will delete the information within 48 hours.

For users aged 13-15 in jurisdictions where this is permitted, parental consent is required before subscribing.

11. Automated Decision-Making and Profiling

We do NOT engage in:

• Automated decision-making that produces legal effects
• Profiling for marketing or advertising purposes
• AI-based processing of personal data
• Behavioral tracking or analysis
• Credit scoring or risk assessment

All newsletter content is curated by human editors based on scientific research, not algorithms or user profiling.

12. Data Breach Notification

In the unlikely event of a data breach affecting your personal data:

Our Obligations:

• We will notify the relevant supervisory authority within 72 hours (GDPR Article 33)
• If there is high risk to your rights and freedoms, we will notify you without undue delay (GDPR Article 34)
• Notification will include the nature of the breach, likely consequences, and measures taken

What We Will Tell You:

• What data was affected
• When the breach occurred
• What we're doing to mitigate harm
• Steps you can take to protect yourself
• Contact information for further inquiries

13. Marketing Communications

Opt-In Only

You will only receive marketing emails after explicitly opting in through our newsletter form. Pre-checked boxes are never used.

Content and Frequency

• Frequency: One newsletter per week (typically Sunday)
• Content: Fitness tips, nutrition guides, new articles, exclusive content
• No spam: We will not exceed this frequency without your permission

Unsubscribe

Every email contains a prominent unsubscribe link. Clicking it will:

• Immediately remove you from our mailing list
• Stop all future emails within 24 hours
• Mark your data for deletion within 30 days

You can also unsubscribe by emailing unsubscribe@fitlifepro.com

14. Supervisory Authority & Complaints

If you believe we have not handled your data properly, you have the right to lodge a complaint with a supervisory authority.

Lead Supervisory Authority (Germany):

Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI)
Graurheindorfer Str. 153
53117 Bonn, Germany
Phone: +49 (0)228 997799-0
Email: poststelle@bfdi.bund.de
Website: www.bfdi.bund.de

Your Local Authority:

You may also file a complaint with the data protection authority in your country of residence or where an alleged infringement occurred.

Contact Us First:

We encourage you to contact us first at privacy@fitlifepro.com. We commit to resolving any concerns within 30 days.

15. Changes to This Privacy Policy

We may update this policy to reflect changes in law or our practices.

When We Update:

• The "Last Updated" date at the top will change
• Version number will increment
• Significant changes will be communicated via email to subscribers
• You will have the opportunity to review and accept changes
• Continued use after notification constitutes acceptance

Material Changes:

For material changes affecting your rights, we will:

• Send email notification 30 days before changes take effect
• Require re-consent if legal basis changes
• Provide option to opt-out if you disagree

16. TikTok Ads Compliance

This website may be advertised on TikTok. We comply with all TikTok advertising policies:

Transparency:

• Clear disclosure of data collection practices
• Honest representation of services (our newsletter is FREE)
• No misleading claims or deceptive practices
• Accurate description of content and benefits

TikTok User Data:

When you click our TikTok ads:

• TikTok may share limited information (e.g., ad click event)
• We do not receive personally identifiable information from TikTok without your consent
• TikTok's privacy policy governs their data practices
• You can opt out through TikTok's privacy settings

Age-Appropriate Content:

Our ads and content are suitable for ages 18+ and comply with TikTok's content policies.

17. Certifications and Compliance

FitLife Pro is committed to the highest standards of data protection:

Regulatory Compliance:

• ✅ GDPR Compliant (EU Regulation 2016/679)
• ✅ ePrivacy Directive (Directive 2002/58/EC)
• ✅ TikTok Advertising Policies
• ✅ CAN-SPAM Act (USA)
• ✅ CASL Compliant (Canada)

Security Standards:

• ✅ ISO 27001 (Information Security Management)
• ✅ SOC 2 Type II (Service Organization Controls)
• ✅ SSL/TLS Encryption (256-bit)