Privacy Policy

1. Controller

Gabriel Neshto, Boost Club, Strada Sevastopol 24, Sector 1, Bucharest. Contact: gneshto@gmail.com, +40 726 205 752.

2. Data we collect

Via the booking form

Name, phone number, the date and time you choose (or your preferred day and time window), main wellness goal, language and an optional message. For the Partner Program we also ask for your country. With each request we store the page you sent it from and how you found us (for example, a campaign link). We use this data solely to confirm and manage your consultation or request.

Bioimpedance data (at the consultation)

Body composition results (muscle mass, fat mass, water, visceral fat, metabolic age) are special-category health data under GDPR Article 9. We process them only with your explicit consent, given verbally at the time of the consultation, and solely for the purpose of explaining your results and personalising our recommendations.

Analytics cookies

Only with your consent (via the cookie banner): anonymised visitor statistics via Google Analytics 4 (IP masked).

3. Legal bases for processing

• Booking form data: legitimate interest (confirming and managing the free consultation)
• Bioimpedance data: explicit consent (Article 9(2)(a) GDPR)
• Analytics cookies: consent

4. Data retention

Booking form data: 12 months or until you request deletion. Bioimpedance data: retained only for the duration of the coaching relationship or until you request deletion. Analytics data: 14 months (Google Analytics default).

5. Your rights

Under GDPR you have the right to: access your data, rectify it, erase it ("right to be forgotten"), restrict or object to processing, and data portability. To exercise any of these rights, email gneshto@gmail.com. We will respond within 30 days.

6. Third parties

We do not sell or share your personal data with third parties for marketing purposes. Form submissions are processed by Netlify (USA, Standard Contractual Clauses apply). Bookings and consultation history are stored in Supabase, our database provider, and appointments are scheduled in Google Calendar; both act only on our behalf. If you message us or we confirm your booking on WhatsApp, messages pass through WhatsApp (Meta) under its own privacy policy. Analytics data is processed by Google (USA, Standard Contractual Clauses apply) only with your consent.

7. Supervisory authority

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): www.dataprotection.ro.