Privacy Policy

Last updated: June 2026 · Coach Lisa Personal Training · NIF 326 781 617

1. Who we are

This website is operated by Lisa Koivunen, trading as Coach Lisa Personal Training, based in Bonfim, Porto, Portugal (NIF: 326 781 617). References to "I", "me" or "Coach Lisa" in this policy refer to Lisa Koivunen as the data controller.

For any privacy-related queries, contact: lisa.koivunen@gmail.com

2. Legal basis (GDPR & Portuguese Law)

This policy is issued in compliance with Regulation (EU) 2016/679 (GDPR), the Lei n.º 58/2019 (Portuguese data protection law), and the ePrivacy Directive. As a data controller established in Portugal, I comply with the oversight of the Comissão Nacional de Proteção de Dados (CNPD).

3. What personal data I collect and why

I collect only the minimum data necessary for each purpose (data minimisation principle, GDPR Art. 5(1)(c)):

Contact and enquiry data — your name and a description of your goals, sent via WhatsApp. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in responding to your enquiry and providing the requested service.
Client data — for active clients: name, contact details, health background, training notes and progress records. Legal basis: performance of a contract (GDPR Art. 6(1)(b)) and, where health data is involved, your explicit consent (GDPR Art. 9(2)(a)).
Website analytics — if any third-party analytics tools are used in future, this policy will be updated. Currently no analytics cookies are set.

4. Special category data (health information)

Personal training inherently involves health information (injuries, medical conditions, menstrual cycle data, etc.). Under GDPR Art. 9, this is "special category" data requiring explicit consent. Before any health information is collected, I will ask for your clear agreement and explain how it will be used. You may withdraw consent at any time without affecting sessions.

5. How I use your data

To respond to your enquiry and book your free session
To design, deliver and adjust your training programme
To communicate with you about sessions, scheduling and progress
To comply with legal obligations (e.g. invoicing under Portuguese tax law)

I do not use your data for automated decision-making or profiling (GDPR Art. 22).

6. Who I share your data with

I do not sell, rent or trade your personal data. Data may be shared only with:

WhatsApp (Meta Platforms Ireland Ltd) — as the communication platform you use to contact me. WhatsApp processes messages under its own privacy policy. Messages are end-to-end encrypted in transit.
Cloud storage / note tools — if your training notes are stored in a cloud service (e.g. Google Drive), that provider acts as a data processor under a data processing agreement.
Legal or regulatory authorities — only if required by law.

Any third-party processors I use are required to handle your data in compliance with GDPR and to process it only on my documented instructions.

7. International transfers

WhatsApp and some cloud providers may process data outside the European Economic Area (EEA). Where this occurs, I rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent transfer mechanisms under GDPR Chapter V, to protect your data.

8. How long I keep your data

Enquiries that don't become clients — deleted within 6 months of last contact.
Active client records — retained for the duration of our working relationship, plus 5 years thereafter (to comply with Portuguese civil and tax law obligations).
Financial records — retained for 10 years in accordance with Portuguese tax law (Lei Geral Tributária).

9. Your rights under GDPR

You have the following rights. To exercise any of them, contact me at lisa.koivunen@gmail.com. I will respond within 30 days.

Right of access (Art. 15) — to receive a copy of the personal data I hold about you.
Right to rectification (Art. 16) — to have inaccurate data corrected.
Right to erasure (Art. 17) — to have your data deleted, where no legal basis for continued retention exists.
Right to restriction (Art. 18) — to limit how I process your data in certain circumstances.
Right to data portability (Art. 20) — to receive your data in a structured, machine-readable format.
Right to object (Art. 21) — to object to processing based on legitimate interest.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without penalty.
Right to lodge a complaint — with the CNPD (www.cnpd.pt), Portugal's supervisory authority, if you believe your data rights have been infringed.

10. Cookies

This website currently sets no tracking or analytics cookies. Only Google Fonts is loaded from an external server; Google may log your IP address when serving the font files. If cookies are introduced in future, a consent banner will be displayed and this policy updated.

11. Security

I take reasonable technical and organisational measures to protect your data, including using encrypted communication channels and limiting access to your records to myself only. No system is completely secure; in the unlikely event of a data breach, I will notify affected individuals and the CNPD within 72 hours where required by law.

12. Changes to this policy

I may update this policy from time to time. The date at the top of this page will reflect the most recent revision. Continued use of my services after changes constitutes acceptance of the updated policy.

13. Contact

Coach Lisa Personal Training
Bonfim, Porto, Portugal
NIF: 326 781 617
lisa.koivunen@gmail.com
WhatsApp: +61 466 243 806