Valeriia Fit
Privacy policy
Last updated: 21 August 2026.
This Privacy Policy explains how the Valeriia Fit website processes personal data when you use the site, in particular when you submit the contact form.
1. Data controller and contact
The data controller for personal data processed in connection with the Valeriia Fit website is the person operating under the Valeriia Fit brand, based in Krakow, Poland (the “Controller”). For privacy matters, including requests to exercise your rights, contact the Controller at valeriia.fit92@gmail.com.
2. Scope and source of data
This policy covers the public Valeriia Fit website, its language versions, service pages and contact form. You provide data directly when you submit the form. Some technical information is generated automatically by hosting, anti-spam protection and analytics services.
3. Data we process
Through the contact form we process your name, email address, selected service, message, website language, submission date and time, and information about your marketing choices. To protect the form against abuse, the server uses your IP address and browser information to create a one-way rate-limit key; the raw IP address is not stored in the submissions table. Cloudflare Turnstile sends Cloudflare the technical data needed to assess whether a human, rather than an automated system, is submitting the form. Vercel Web Analytics may receive aggregated page-view data such as the page URL, referrer, country, operating system, browser and device type.
4. Purposes and legal bases
We use contact-form data to communicate between the trainer and the client, respond to your enquiry, discuss your goal and selected service, and prepare or perform an agreement. The legal basis is Article 6(1)(b) GDPR — taking steps at your request before entering into an agreement or performing an agreement. We may also retain data as necessary to demonstrate proper handling, establish, exercise or defend legal claims, under Article 6(1)(f) GDPR, and to protect the form, limit spam and secure the website on the same basis. If you select the separate marketing option, information about services is sent on the basis of your consent under Article 6(1)(a) GDPR.
5. Contact form and marketing
The required acknowledgement that you have read this Privacy Policy is needed to submit the form because information about processing must be available when data is collected. It is not marketing consent. Marketing consent is separate, voluntary and does not affect your ability to send an enquiry or receive a reply. You may withdraw marketing consent at any time by writing to valeriia.fit92@gmail.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
6. Recipients of data
The message may be shared with the trainer or a person authorised to handle client enquiries so that trainer–client communication can take place. To operate the website, we use technology providers and recipients: Vercel for hosting and application infrastructure, Supabase for the database, Cloudflare Turnstile for anti-spam protection, and the Telegram Bot API, to which we send the trainer a notification containing the form data. Statistical data may be processed by Vercel Web Analytics. Data may also be disclosed to public authorities where required by law.
7. Transfers outside the EEA
Some technology services may use infrastructure outside the European Economic Area, in particular the Telegram Bot API and infrastructure used by hosting or analytics providers. Where such a transfer takes place, the Controller uses a mechanism required by Chapter V GDPR, such as an adequacy decision or standard contractual clauses together with supplementary safeguards where required. You may request information about the current Supabase project region and the basis for a particular transfer by contacting the Controller.
8. Retention period
If an enquiry does not lead to cooperation, we retain it for as long as needed to handle the correspondence, generally no longer than 12 months after the contact ends, and then delete or anonymise it unless further retention is needed for claims or required by law. If cooperation begins, we retain data for the duration of the agreement and for periods required for accounting and potential claims. Records of marketing consent or withdrawal are kept for as long as needed to demonstrate compliance. Rate-limit keys are intended for short-term anti-spam protection and are removed during cleanup after the limit expires. Data held by external services is subject to their retention periods and the applicable processing agreements.
9. Your rights
You may request access to your data, rectification, erasure, restriction of processing and, where provided by the GDPR, data portability. You may also object to processing based on legitimate interests and withdraw consent where processing is based on consent. Send a request to valeriia.fit92@gmail.com. We will respond without undue delay, generally within one month; we may ask for information needed to verify your identity.
10. Complaints to a supervisory authority
If you believe that processing violates the GDPR, you may lodge a complaint with the supervisory authority in your habitual residence, place of work or place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
11. Security and automated decisions
We use encrypted connections, server-side validation, rate limiting, anti-spam protection and access controls that limit submissions to authorised persons. We do not sell data, use it for advertising profiling or make decisions about you producing legal or similarly significant effects solely by automated means. An automated security assessment by Turnstile or a rate limit may temporarily prevent a form submission; in that case you can contact the Controller directly.
12. Health data, cookies and policy changes
The form is not intended for diagnoses, test results or other health information. Such information may be special-category data, so do not include it in a message unless the Controller has first provided a secure and appropriate way to submit it. The website uses technical mechanisms necessary for operation, security and the administrator session; it does not use advertising cookies or marketing profiling. Vercel Web Analytics operates without cookies and is used for aggregated statistics according to the service configuration. If the technologies or processing purposes change, this Privacy Policy will be updated. For privacy questions, email valeriia.fit92@gmail.com.