Privacy Policy

1. Data controller

Legal form: Small Partnership (MB)

Legal entity name: MB Treniruoteka

Company registration number: 308116376

Registered office address: Europos pr. 34-47, LT-46370 Kaunas

Contact email: info@treniruoteka.lt

Data are collected and stored in the Register of Legal Entities of the Republic of Lithuania.

Privacy questions and requests can currently be sent to info@treniruoteka.lt.

2. Data we may process

• Account data: name, email address, phone number, user role, account status and login security information.
• Trainer profile data: name, photo, description, city, training location, services, prices, availability, experience, languages, verification status and qualification documents submitted to the administrator.
• Booking data: selected trainer, service or sport, date, time, duration, price, status, cancellation information and user notes.
• Payment data: amount, currency, payment, refund or dispute status and payment service provider identifiers. The platform does not store full card details.
• Chat and support information when a client, trainer or administrator communicates about a booking, safety issue or dispute.
• Technical data: notification tokens, app version, device and security information, error logs and operational logs where collected to ensure the platform works properly.
• Preferences: language, notification settings, favourite trainers, sport and city filters and loyalty status where those features are used.

3. Why we process data

• To create, administer and protect the user account.
• To display trainers, their public profiles, services and real availability.
• To create, perform and administer bookings, cancellations, refunds and Rewards progress.
• To process payments and, where applicable, trainer payout accounting.
• To allow the client and trainer to communicate about a specific booking.
• To send selected booking, cancellation, message and other service notifications.
• To protect platform security, prevent fraud, investigate errors and resolve disputes.
• To comply with legal, tax, accounting and lawful authority requirements.

4. Legal bases

• Performance of a contract or steps prior to entering into a contract – for accounts, bookings, payments and core communication.
• Legal obligation – for accounting, tax, lawful authority requests and mandatory retention.
• Legitimate interests – for platform and user security, fraud prevention, dispute resolution and service improvement where the user’s rights do not override those interests.
• Consent – where it is explicitly requested for optional features, marketing or other processing that requires consent. Consent can be withdrawn.

5. Health information

Treniruoteka is not a medical records system and at the MVP stage does not request diagnoses or detailed medical documents.

Users should not send medical records or excessive health data through booking notes or chats. Information necessary for safe training should be provided only to the minimum extent required and only to the trainer.

6. Who data may be shared with

• The selected trainer or client – only to the extent necessary for the booking and communication.
• Supabase – for authentication, database and backend infrastructure functions.
• Stripe – for payments, refunds, disputes and related payment functions.
• Google Firebase – for technical notifications and related app infrastructure.
• Website, email and other infrastructure service providers to the extent necessary for the service to operate.
• Professional advisers, insurers, law enforcement or other authorities where necessary to comply with a legal obligation or lawful request.

7. Transfers outside the EEA

Where a technology service provider processes data outside the European Economic Area, a lawful transfer mechanism and appropriate safeguards must apply, such as an adequacy decision by the European Commission or Standard Contractual Clauses.

8. Retention periods

• Account data are stored while the account is active and, after closure, for as long as necessary for legal, security, accounting or dispute purposes.
• Booking, payment, refund and payout information is retained in accordance with applicable accounting, tax and limitation-period requirements.
• Chats and support information are retained for as long as necessary for bookings, customer support, security and potential disputes.
• Inactive technical tokens and logs are retained only for as long as reasonably necessary for technical and security purposes.

9. Data security

We use access controls, authentication, database permission rules, encrypted connections, payment separation and other reasonable technical and organisational measures.

No system is completely secure. If a personal data breach is identified, necessary action will be taken and, where required by law, the supervisory authority and affected individuals will be notified.

10. Your rights

• To receive information about the processing of your personal data.
• To access the personal data being processed and obtain a copy.
• To request correction of inaccurate data or completion of incomplete data.
• In certain cases, to request erasure of data or restriction of processing.
• Where applicable, to receive the data you provided in a structured, commonly used and machine-readable format.
• To object to processing based on legitimate interests and to opt out of direct marketing at any time.
• To withdraw consent where processing is based on consent.
• To lodge a complaint with a competent data protection supervisory authority.

11. Notifications and device permissions

Notifications can be enabled or disabled in the app. Operating system permissions are also managed in the settings of the phone or other device.

If notifications are disabled, the platform may mark the relevant notification token as inactive and later remove it under the technical cleanup process.

12. Automated decision-making and advertising

The platform currently does not use decisions based solely on automated processing of personal data that produce legal or similarly significant effects for the user.

Users’ personal data are not sold to advertisers. If direct marketing or personalised advertising is used in the future, it will be implemented in accordance with applicable legal requirements and, where necessary, only with consent.

13. Changes to this policy

This Privacy Policy may be updated when features, service providers, data flows or laws change. Material changes will be clearly announced on the website, in the app or by another appropriate means.