Privacy policy
This English version is a translation provided for convenience. In case of any discrepancy, the French version prevails.
This policy explains what personal data we collect, why, how long we keep it and what your rights are, in accordance with the General Data Protection Regulation (GDPR) and the Belgian Act of 30 July 2018.
1. Who is responsible for your data?
Cindy Lefebvre and Gino Panepinto, part-time self-employed professionals working together under the Endurance Pace brand, are joint controllers. They have signed a written agreement setting out their respective roles (Article 26 GDPR). In short: each coach manages the data of the athletes they follow, and a single address lets you exercise your rights with both: endurance.pace.belgium@gmail.com. Full details: see the legal notice.
2. What data do we collect?
- First contact and discovery call (website form, e-mail, Instagram, Facebook): surname, first name, e-mail, phone number if you give it, discipline, plan considered, goal, name of the person who referred you.
- Clients: surname, first name, date of birth, address, e-mail, phone; goals, availability and sports history; training data (sessions, pace, power, heart rate, sleep…) sent by your watch or apps via Nolio.
- Health data: PAR-Q+ questionnaire, medical certificate of fitness, injuries, pain and any medical information you choose to share with us.
- Minors: in addition, the name and contact details of the parent or legal guardian, and their written consent.
- Invoicing: plan, amounts, payment dates, invoices and bank transfer details.
- Community: phone number and first name in the private WhatsApp group; photos taken during activities, only if you agree.
- Website visits: anonymous, aggregated statistics (pages viewed, country, device type), without cookies.
3. Why, and on what legal basis?
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your request and organising the discovery call | Pre-contractual steps (Art. 6.1.b) |
| Building and adjusting your plan, following up, managing your subscription | Performance of the contract (Art. 6.1.b) |
| Processing your health data to keep your training safe | Explicit consent (Art. 9.2.a) – of the parent for a minor |
| Invoicing and accounting | Legal obligation (Art. 6.1.c) |
| Private community group, publication of photos | Consent (Art. 6.1.a) |
| Newsletter or news about our offers (if you sign up) | Consent (Art. 6.1.a) |
| Anonymous website traffic measurement | Legitimate interest (Art. 6.1.f) |
| Handling complaints and legal claims | Legitimate interest (Art. 6.1.f) |
4. Your health data
Your health data is only accessed by your two coaches, solely to adapt your training and keep you safe. Send it via Nolio or e-mail, never via WhatsApp, Instagram or Messenger. You can withdraw your consent at any time; we will then no longer be able to coach you safely and the contract will end, at no cost for the period not yet started. Your data is never sold or used for advertising.
5. Who do we share your data with?
We use service providers who process some of your data:
- Nolio (training platform) – plans, training data and messaging; data hosted on AWS servers in Paris, with HDS certification (according to Nolio’s policy).
- Meta (WhatsApp, Instagram, Messenger) – messaging, video calls, private community group and first contacts.
- Google (Gmail) – e-mails, sending invoices and documents.
- Cloudflare – website hosting, delivery of contact form messages and cookie-free visit statistics.
- Our accountant – invoicing data only.
Meta, Google and Cloudflare may transfer data to the United States. These transfers are covered by the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission) or by standard contractual clauses. For WhatsApp, Instagram and Messenger, Meta partly acts as controller of its own processing, under its own privacy policy.
6. How long do we keep your data?
| Data | Retention period |
|---|---|
| Contact requests not followed up | 12 months after the last exchange |
| Training and follow-up data | Duration of the contract, then 1 year |
| Health data (PAR-Q+, certificate, injuries) | Duration of the contract, then deleted within 3 months |
| Proof that a certificate was provided (date and validity, no medical content) | 5 years after the end of the contract |
| Invoices and accounting records | 10 years (legal obligation) |
| Published photos | Until you withdraw your consent |
7. Security
We take reasonable measures to protect your data: access limited to the two coaches, strong passwords and two-factor authentication on our tools, no health data exchanged via instant messaging, deletion of medical documents at the end of the contract.
8. Your rights
You can at any time ask to access your data, have it corrected or erased, restrict its processing or receive it in a portable format, object to processing based on our legitimate interest, and withdraw your consent. Write to us at endurance.pace.belgium@gmail.com; we reply within one month. You can contact either of your coaches: your request applies to both.
If you believe your rights are not respected, you can lodge a complaint with the Belgian Data Protection Authority (rue de la Presse 35, 1000 Brussels – dataprotectionauthority.be).
9. Cookies
The website sets no advertising or analytics cookies. We measure traffic with Cloudflare Web Analytics, which uses no cookies or local storage and does not track individual visitors. If we ever add a tool that sets cookies, we will ask for your consent first.
10. Minors
We coach young people under 18 only with the written consent of a parent or legal guardian, who consents to the processing of health data and exercises the young person’s rights together with them.
11. Changes
We may update this policy. The date of the latest version appears at the top of the page. If there is a significant change, we will let you know by e-mail.