Privacy Notice

This notice explains how personal data is processed when you visit strengthcoaching.online, contact us, subscribe for free resources or buy and use coaching services.

1. Controller

Luke Selway, trading as Strength Coaching Online, is responsible for the processing described here. Further contact information is available in the Legal Notice.

Email: luke@strengthcoaching.online

2. Website delivery and security

Cloudflare delivers and protects this website. To do so, Cloudflare and the website infrastructure can process technical connection data, including IP address, requested URL, time, device/browser information and security signals. Cloudflare Turnstile is used on contact and resource forms to reduce automated submissions. Security records may be used to investigate misuse and protect the service.

The legal basis is our legitimate interest in securely operating the website and preventing misuse (Article 6(1)(f) GDPR). Processing required to provide a service you request may also fall under Article 6(1)(b) GDPR.

3. First-party conversion measurement

The website records limited first-party events such as resource views, resource requests, coaching-link clicks and similar conversion actions. These events may carry a page or destination path, selected resource, bounded campaign parameters, the landing path and the hostname of an external referring website.

These records are intended to exclude names, email addresses and other direct identifiers. The attribution values are browser-supplied and are not independently verified. The measurement does not use general-purpose analytics cookies, localStorage or sessionStorage. It is processed under our legitimate interest in understanding and improving the business website (Article 6(1)(f) GDPR).

Where somebody purchases coaching, the website may also associate limited source/campaign attribution with the Stripe Checkout Session or subscription and store a minimal record of the purchase event in private Cloudflare storage. Such records may include transaction identifiers, the selected coaching option, time and source/campaign information; they are not intended to contain payment-card details or the customer’s email address. The purposes are contract and financial administration (Article 6(1)(b) and (c) GDPR, where applicable) and measuring how the website supports sales (Article 6(1)(f) GDPR).

4. Free resources and email subscriptions

The five active free resources are offered as benefits for people who subscribe to Strength Coaching Online emails about strength training, free resources and coaching. On the signup form, you are asked for your email address and your explicit consent to those emails. The requested resource, signup page and bounded campaign information may also be recorded. You receive a double opt-in confirmation email; the resource is delivered only after confirmation. You can withdraw that consent later.

EmailOctopus manages mailing-list subscriptions, double opt-in confirmations, preferences and unsubscribe status. Resend sends the requested resource email after confirmation. Cloudflare private infrastructure temporarily stores the pending resource request and processing/delivery status. The mailing-list service may also retain limited consent and suppression evidence to respect unsubscribe requests.

If you use the contact form, you can separately and optionally subscribe to these emails. Refusing that optional subscription does not prevent us from replying to your enquiry.

Emails about strength training, free resources and coaching rely on your consent (Article 6(1)(a) GDPR). You may withdraw consent at any time using an unsubscribe link or by contacting us. Withdrawal does not affect lawful processing carried out before withdrawal. Processing necessary to send the resource you requested may also be necessary to fulfil that specific request (Article 6(1)(b) GDPR).

5. Enquiries and communications

If you send an email, Google Workspace receives and stores it. Website contact forms use Cloudflare to submit a message to the same mailbox; there is no separate general enquiry database. The information normally includes your name, email, message and any voluntary details you add.

We use it to answer your request and discuss potential coaching (Article 6(1)(b) GDPR where you request pre-contract steps, or Article 6(1)(f) GDPR for ordinary business correspondence). Please avoid putting unnecessary medical or highly sensitive information in general website enquiries.

6. Coaching, payment and client administration

When you purchase coaching, Stripe processes payment and billing details, payment status and transaction identifiers. We receive the information needed to identify the purchase, provide access, manage the coaching relationship, record invoices, handle cancellations/refunds and meet financial obligations; we do not receive full payment-card details.

Depending on your chosen service, coaching onboarding, communications, programmes, shared training records and membership may be managed in Google Workspace, Google Drive/Sheets and Skool. The website or private Cloudflare storage may also process limited customer/subscription identifiers needed for onboarding, purchase attribution and lifecycle status.

This processing normally relies on performance of or steps towards the coaching contract (Article 6(1)(b) GDPR) and legal accounting/tax obligations (Article 6(1)(c) GDPR). Where we use proportionate security or service-quality records for a legitimate interest, Article 6(1)(f) GDPR may apply.

Health, injury or medical information can be sensitive under Article 9 GDPR. Such information is not required merely to browse this website. If it is necessary for individual coaching, its collection, access and lawful special-category basis must be addressed in the relevant coaching/onboarding process rather than inferred from an ordinary website signup.

7. External services, recipients and transfers

The relevant providers may include Cloudflare (hosting, forms, security and private storage), EmailOctopus (subscriptions and marketing), Resend (requested resource and coaching emails), Google (email, documents and shared training files), Stripe (payments), and Skool (membership and coaching community). A provider receives information only where the relevant website or coaching function requires it.

Opening externally hosted resource files or embedded third-party content may also cause your browser to connect to that provider and share technical connection information. Stripe payment interfaces and Cloudflare Turnstile load provider functionality where their relevant forms are used.

Some providers may process information outside the European Economic Area. Where a transfer requires a GDPR transfer mechanism, it must be covered by the provider’s applicable adequacy framework or appropriate safeguards such as standard contractual clauses. You can contact us to request further information about applicable safeguards.

8. Data retention

We retain data only while needed for the particular purpose and according to applicable provider settings and legal requirements.

Website and security data is kept for operational and security needs, then deleted or anonymised according to the relevant infrastructure settings.
Pending resource requests and technical delivery status are retained for the time necessary to deliver, troubleshoot or safely prevent duplicate delivery; mailing-list consent and suppression records may need to be kept to respect your preferences.
Correspondence and coaching records are kept for the relationship and any reasonable follow-up or legal claims.
Payment, invoice and tax records are kept for legally prescribed retention periods.
Temporary checkout handoff data is subject to the website’s specific expiry process; permanent purchase records are limited to the documented administration and attribution purposes.

We delete or restrict records when the relevant purpose ends unless another lawful obligation requires continued retention.

Subject to the applicable conditions, you may request access to your information, rectification, erasure, restriction of processing and data portability. You can object to processing based on our legitimate interests and can object at any time to processing for direct marketing. Where processing relies on consent, you can withdraw it at any time.

Contact luke@strengthcoaching.online to exercise your rights. You also have the right to complain to a competent data-protection supervisory authority, including the relevant authority for our business establishment in Germany.

10. Cookies, terminal access and optional advertising

The V1 website does not use a general-purpose analytics cookie, localStorage or sessionStorage for its first-party measurement. Some essential website and security functions or third-party payment and anti-bot services may use device information or technically necessary storage. Under section 25 TDDDG, non-essential storage or access to information on your device generally requires prior consent; an exception may apply where access is strictly necessary to provide a service you requested.

Meta Pixel and comparable optional advertising trackers are not enabled in the current V1 configuration. If any are enabled later, we will update this notice and introduce an appropriate prior-consent mechanism first.

11. Updates and contact

We may update this notice when our website services, providers or legal duties change. Questions and privacy requests can be sent to luke@strengthcoaching.online.

Updated 18 October 2026.