Privacy Notice

This notice explains how personal data is processed when you visit strengthcoaching.online, contact us, subscribe for free resources or buy and use coaching services.

1. Controller

Luke Selway, trading as Strength Coaching Online, is responsible for the processing described here. Further contact information is available in the Legal Notice.

Email: luke@strengthcoaching.online

2. Website delivery and security

Cloudflare delivers and protects this website. To do so, Cloudflare and the website infrastructure can process technical connection data, including IP address, requested URL, time, device/browser information and security signals. Cloudflare Turnstile is used on contact and resource forms to reduce automated submissions. Security records may be used to investigate misuse and protect the service.

The legal basis is our legitimate interest in securely operating the website and preventing misuse (Article 6(1)(f) GDPR). Processing required to provide a service you request may also fall under Article 6(1)(b) GDPR.

3. First-party conversion measurement

The website records limited first-party events such as resource views, resource requests, coaching-link clicks and similar conversion actions. These events may carry a page or destination path, selected resource, bounded campaign parameters, the landing path and the hostname of an external referring website.

These records are intended to exclude names, email addresses and other direct identifiers. The attribution values are browser-supplied and are not independently verified. The measurement does not use general-purpose analytics cookies, localStorage or sessionStorage. It is processed under our legitimate interest in understanding and improving the business website (Article 6(1)(f) GDPR).

Where somebody purchases coaching, the website may also associate limited source/campaign attribution with the Stripe Checkout Session or subscription and store a minimal record of the purchase event in private Cloudflare storage. Such records may include transaction identifiers, the selected coaching option, time and source/campaign information; they are not intended to contain payment-card details or the customer’s email address. The purposes are contract and financial administration (Article 6(1)(b) and (c) GDPR, where applicable) and measuring how the website supports sales (Article 6(1)(f) GDPR).

Optional analytics and advertising tracking

If you choose Allow all, you consent to the website’s optional analytics and advertising measurement. We use Umami Cloud (Umami Software, Inc.) to measure visits, campaign sources, navigation, selected resource/coaching actions and website performance. The website is configured in Umami’s EU dashboard region. Umami processes technical connection information, including IP address, browser and device information, to derive visits and location statistics; its policy says IP addresses are not stored in analytics event records. Processing and international transfers are subject to the provider’s data-processing safeguards.

With the same Allow all choice, we also use Meta Pixel for Meta/Facebook/Instagram advertising measurement and audience building. Meta Pixel may process browser/device information, IP address, page/referrer information and Meta/browser identifiers so visits and selected funnel actions can be attributed to campaigns and used for relevant advertising audiences. Browser-side Meta events are limited to the site’s centrally defined page/funnel events. We do not intentionally send names, email addresses, form messages, Stripe session IDs, signed resource URLs or payment-card details through the browser Pixel.

Only after you choose Allow all, the site may store or read optional browser identifiers for these services. Umami uses a random site-specific pseudonymous Distinct ID so repeat visits from the same browser can be linked. Meta may use its own first-party identifiers for advertising measurement. Linked behaviour and pseudonymous identifiers can still be personal data.

The legal basis for optional analytics and advertising tracking is your consent under Article 6(1)(a) GDPR and the applicable requirements of section 25 TDDDG. Until you consent, neither Umami nor Meta Pixel is loaded. You can decline without affecting the site and may withdraw consent through Privacy choices in the footer. The site’s consent preference and Umami browser identifier expire after at most 180 days unless you make a new choice. Withdrawing consent stops future site-initiated optional tracking and removes known local optional identifiers where technically possible; earlier provider records may require a separate erasure request. The free Umami Cloud plan has a six-month rolling data-retention limit; Meta applies its own provider/account retention rules. Any private exports are subject to our separate retention and deletion policy.

4. Free resources and email subscriptions

The five active free resources are offered as benefits for people who subscribe to Strength Coaching Online emails about strength training, free resources and coaching. On the signup form, you are asked for your email address and your explicit consent to those emails. The requested resource, signup page and bounded campaign information may also be recorded. You receive a double opt-in confirmation email; the resource is delivered only after confirmation. You can withdraw that consent later.

EmailOctopus manages mailing-list subscriptions, double opt-in confirmations, preferences and unsubscribe status. Resend sends the requested resource email after confirmation. Cloudflare private infrastructure temporarily stores the pending resource request and processing/delivery status. The mailing-list service may also retain limited consent and suppression evidence to respect unsubscribe requests.

If you use the contact form, you can separately and optionally subscribe to these emails. Refusing that optional subscription does not prevent us from replying to your enquiry.

Emails about strength training, free resources and coaching rely on your consent (Article 6(1)(a) GDPR). You may withdraw consent at any time using an unsubscribe link or by contacting us. Withdrawal does not affect lawful processing carried out before withdrawal. Processing necessary to send the resource you requested may also be necessary to fulfil that specific request (Article 6(1)(b) GDPR).

5. Enquiries and communications

If you send an email, Google Workspace receives and stores it. Website contact forms use Cloudflare to submit a message to the same mailbox; there is no separate general enquiry database. The information normally includes your name, email, message and any voluntary details you add.

We use it to answer your request and discuss potential coaching (Article 6(1)(b) GDPR where you request pre-contract steps, or Article 6(1)(f) GDPR for ordinary business correspondence). Please avoid putting unnecessary medical or highly sensitive information in general website enquiries.

6. Coaching, payment and client administration

When you purchase coaching, Stripe processes payment and billing details, payment status and transaction identifiers. We receive the information needed to identify the purchase, provide access, manage the coaching relationship, record invoices, handle cancellations/refunds and meet financial obligations; we do not receive full payment-card details.

Depending on your chosen service, coaching onboarding, communications, programmes, shared training records and membership may be managed in Google Workspace, Google Drive/Sheets and Skool. The website or private Cloudflare storage may also process limited customer/subscription identifiers needed for onboarding, purchase attribution and lifecycle status.

This processing normally relies on performance of or steps towards the coaching contract (Article 6(1)(b) GDPR) and legal accounting/tax obligations (Article 6(1)(c) GDPR). Where we use proportionate security or service-quality records for a legitimate interest, Article 6(1)(f) GDPR may apply.

Health, injury or medical information can be sensitive under Article 9 GDPR. Such information is not required merely to browse this website. If it is necessary for individual coaching, its collection, access and lawful special-category basis must be addressed in the relevant coaching/onboarding process rather than inferred from an ordinary website signup.

7. External services, recipients and transfers

The relevant providers may include Cloudflare (hosting, forms, security and private storage), Umami (consent-based visitor analytics), EmailOctopus (subscriptions and marketing), Resend (requested resource and coaching emails), Google (email, documents and shared training files), Stripe (payments), and Skool (membership and coaching community). A provider receives information only where the relevant website or coaching function requires it.

Opening externally hosted resource files or embedded third-party content may also cause your browser to connect to that provider and share technical connection information. Stripe payment interfaces and Cloudflare Turnstile load provider functionality where their relevant forms are used.

Some providers may process information outside the European Economic Area. Where a transfer requires a GDPR transfer mechanism, it must be covered by the provider’s applicable adequacy framework or appropriate safeguards such as standard contractual clauses. You can contact us to request further information about applicable safeguards.

8. Data retention

We retain data only while needed for the particular purpose and according to applicable provider settings and legal requirements.

Website and security data is kept for operational and security needs, then deleted or anonymised according to the relevant infrastructure settings.
Optional Umami Cloud Hobby analytics have six-month rolling retention; the analytics preference and pseudonymous browser identifier expire after at most 180 days.
Pending resource requests and technical delivery status are retained for the time necessary to deliver, troubleshoot or safely prevent duplicate delivery; mailing-list consent and suppression records may need to be kept to respect your preferences.
Correspondence and coaching records are kept for the relationship and any reasonable follow-up or legal claims.
Payment, invoice and tax records are kept for legally prescribed retention periods.
Temporary checkout handoff data is subject to the website’s specific expiry process; permanent purchase records are limited to the documented administration and attribution purposes.

We delete or restrict records when the relevant purpose ends unless another lawful obligation requires continued retention.

Subject to the applicable conditions, you may request access to your information, rectification, erasure, restriction of processing and data portability. You can object to processing based on our legitimate interests and can object at any time to processing for direct marketing. Where processing relies on consent, you can withdraw it at any time.

Contact luke@strengthcoaching.online to exercise your rights. You also have the right to complain to a competent data-protection supervisory authority, including the relevant authority for our business establishment in Germany.

10. Cookies, terminal access and optional advertising

The first-party conversion collector does not use a general-purpose analytics cookie, localStorage or sessionStorage. Optional Umami analytics and Meta Pixel advertising measurement, with consent, may use browser-stored identifiers plus a necessary preference cookie recording your choice. Some essential website and security functions or third-party payment and anti-bot services may use device information or technically necessary storage. Under section 25 TDDDG, non-essential storage or access to information on your device generally requires prior consent; an exception may apply where access is strictly necessary to provide a service you requested.

The current optional advertising integration is Meta Pixel. Google Ads, TikTok and comparable additional advertising trackers are not enabled on the public site unless and until they are added to this consent mechanism and this notice is updated.

11. Updates and contact

We may update this notice when our website services, providers or legal duties change. Questions and privacy requests can be sent to luke@strengthcoaching.online.

Updated 21 October 2026 (consent-based Umami analytics and Meta Pixel advertising measurement).