Privacy policy

This is a translation for your convenience. In case of any discrepancy, the German version is binding.

This privacy policy explains how TRUE Training GmbH (“TRUE”, “we”) processes personal data: when you visit this website, contact us or apply for TRUE Individual, when you buy and use our programs, and when you take part in events, camps or athletic training.

It is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, on the EU General Data Protection Regulation (GDPR). For third-party platforms that we use or link to, such as FITR, the app stores, Fitnessholiday, Boxprint, Instagram and YouTube, their own privacy policies also apply.

1. Controller and contact

The controller is:

TRUE Training GmbH
Süsswinkelstrasse 3
8864 Reichenburg
Switzerland
Email: info@truetraining.ch

For questions about data protection and to exercise your rights (section 7), an email to this address is all you need.

2. Principles and legal bases

We only process the personal data we need for the respective purpose, and only for as long as we need it for that purpose or are required to keep it. We do not sell personal data.

Where the GDPR applies, we rely on the following legal bases, which we name for each case in section 3:

Contract: entering into or performing a contract with you, including pre-contractual steps at your request (Art. 6(1)(b) GDPR)
Legal obligation: for example retention obligations (Art. 6(1)(c) GDPR)
Legitimate interest: the interest named in each case (Art. 6(1)(f) GDPR)
Consent: Art. 6(1)(a) GDPR, for health data explicit consent (Art. 9(2)(a) GDPR)

Health data is sensitive personal data (Art. 5(c) FADP). We only process it as described in section 3.5. You can withdraw any consent at any time with effect for the future. Processing carried out before the withdrawal remains lawful.

3. What data we process and when

3.1 Visiting this website

This website is hosted by Cloudflare, Inc., USA. When you open a page, Cloudflare processes technically necessary data, in particular your IP address, the date and time, the requested address, the previously visited page (referrer), information about your browser and operating system, and the status code and amount of data transferred. Cloudflare uses this data to deliver the website and to protect it against attacks and misuse, and may store it briefly for these purposes. Cloudflare acts as our processor. We do not use this data to identify visitors.

Purpose: delivering the website, ensuring security and stability, preventing misuse, fixing errors.
Legal basis: legitimate interest in operating the website securely and reliably.

This website itself does not set cookies or use comparable technologies to recognise visitors. If Cloudflare detects suspicious traffic, it may show a security check and set a technically necessary cookie for it. We load fonts from our own server, not from Google Fonts. Content from Instagram, YouTube or other platforms is not embedded, only linked.

When you go from our website to FITR, we add campaign parameters to the link, such as the page and language you came from. This shows us which content leads to a sign-up. These parameters contain no information about you as a person.

3.2 Audience measurement with Cloudflare Web Analytics

To understand how our website is used, we use Cloudflare Web Analytics by Cloudflare, Inc., USA. The service does not set cookies, stores nothing on your device and does not recognise visitors by their IP address or browser information. It records page views, the page visited without query parameters, the referring page, country, browser, operating system, device type and loading times. We only see aggregated statistics and cannot identify individuals from them.

Purpose: measuring reach, improving the content, usability and loading times of the website.
Legal basis: legitimate interest in a data-minimising analysis of website use.
Recipient: Cloudflare as our processor (USA, Data Privacy Framework).

3.3 Contact by email

When you write to us, we process your email address, your name, the content of your message and any other information you give us. We use Google Workspace (Gmail) for email.

Purpose: answering your enquiry.
Legal basis: contract or pre-contractual steps if your enquiry concerns a contract, otherwise legitimate interest in answering enquiries.
Recipient: Google as our processor.

Please do not send us health information by email unless we ask for it. Emails are usually not encrypted end to end.

3.4 Application for TRUE Individual and initial consultation

In the application form, we ask for your name, your email address, your country, your training experience, your current level (if known), your training days per week, your time per session, where you train and your goal. You can optionally add planned competitions and a message. Please do not include any information about your health in the form.

The form also automatically transmits the language and address of the page on which you submit it, as well as any campaign parameters (UTM) from the link you came through. To prevent spam, we use an invisible field and a time check, not an external spam service.

The form sends your details to an application in our Google Workspace account (Google Apps Script). It stores the application in a spreadsheet (Google Sheets), notifies us by email and sends you a confirmation of receipt by email. When you submit the form, your browser connects directly to Google’s servers. In the process, Google technically also receives your IP address.

If TRUE Individual is a good fit for you, we arrange an initial consultation by video call. We tell you which video service we use in the invitation. We only record calls with your prior consent.

Purpose: reviewing your application, contacting you, preparing the initial consultation and an individual offer, preventing spam. The campaign parameters show us through which channels applications arrive.
Legal basis: pre-contractual steps at your request, for spam protection and the channel analysis legitimate interest.
Recipient: Google as our processor (Google Workspace).
Retention: If no contract is concluded, we delete the application and the related emails no later than 12 months after the last contact. If a contract is concluded, we keep the details as customer data (section 6).

3.5 Health data in TRUE Individual and TRUE Pregnancy

We never collect information about your health through a form on this website. If we need health information for TRUE Individual or TRUE Pregnancy, for example about injuries, complaints, medical instructions or a pregnancy, we ask for it in a separate onboarding step. At that point we inform you separately about the purpose, access, storage location and retention, and ask for your explicit consent (Art. 6(7)(a) FADP; Art. 9(2)(a) GDPR).

The information is voluntary. Without it, however, we can only tailor your training to your situation to a limited extent. Only the coaches who work with you and the service providers we name in the consent text have access. We use health information and training videos only for your coaching, not for advertising, and we do not publish them without your separate consent. You can withdraw your consent at any time by email to info@truetraining.ch.

If you buy TRUE Pregnancy, that alone suggests a pregnancy. We use this information only to provide the program to you and to answer your questions about it. We do not pass it on to third parties and do not use it for advertising.

3.6 Programs via FITR and the TRUE Training App

You buy and use our programs via the FITR platform, on the web or in the TRUE Training App for iOS and Android, which is built on FITR. FITR is operated by Fitr. Holdings Limited, Richmond House, Walkern Road, Stevenage, Hertfordshire, SG1 3QP, United Kingdom. Your contracting party for the programs is TRUE (see terms and conditions).

In particular, we process your name, your email address, the program you bought, your subscription and payment status, the information in your profile, your training results and comments, and your messages to us. If you use community features such as leaderboards or comments, other participants see the information you share there, for example your name and your results.

Purpose: entering into and performing the contract, providing programs, supporting your progress, providing support, running community features.
Legal basis: contract, for accounting and retention legal obligation.

Role of FITR: FITR processes its users’ data under its own terms as a separate controller, for example for your account, the app, notifications, and analytics and advertising services on the platform. FITR’s privacy policy applies to this. According to FITR, it stores data in the EEA and uses further service providers, including in the USA.

Payments: Payments are processed by the payment service provider Stripe via our Stripe account. We do not receive your card details. We see information such as name, email address, amount, date and status of the payment, and the type and country of the payment method. Stripe processes payment data partly on our behalf and partly under its own responsibility, for example to prevent fraud and to comply with legal obligations. Stripe’s privacy policy applies to this.

App stores: If you download the TRUE Training App, Apple or Google processes data under its own responsibility.

You cannot currently sign up for a newsletter on this website. If you receive a newsletter from us because you signed up earlier, we process your email address and any voluntary details such as your first name for this purpose.

Purpose: sending the newsletter.
Legal basis: your consent. You can unsubscribe at any time via the link in every newsletter or by emailing us.

3.8 Events and Performance Camps

Our own events: If you register for a TRUE event, we process your name, your contact details, information about your performance level and participation, and payment information. The purpose is organising and running the event, the legal basis is the contract.

Performance Camps: Booking, payment and travel are organised by our partner Fitnessholiday under its own responsibility and in accordance with its own privacy policy. For training on site, we receive the necessary information from Fitnessholiday or from you, for example your name and your performance level. The purpose is planning and running the training, the legal basis is our legitimate interest in doing so.

Photos and videos: At our events and camps we take photos and videos and use selected footage for our communication, including on our website and on social media. We point this out on site. If you do not want to be recognisable in our footage, tell us on site or by email. We take this into account when selecting footage and remove published footage on request where we can. The legal basis is our legitimate interest in reporting on our events. For portraits we ask for your consent.

3.9 Athletic training for clubs and associations

In athletic training, we process contact details of the contact persons and data of the athletes, for example name, year of birth, test and performance data, attendance and training-relevant injuries. Some of the athletes are minors. We receive the data from the club or association or from the athletes themselves.

Purpose: planning, running and evaluating training.
Legal basis: contract with the club or association, or legitimate interest in running the training. We only process health information with explicit consent, for minors, where necessary, with the consent of their legal guardians.

Where we process data on behalf of a club or association, we set this out in the respective contract.

3.10 Merchandise shop

Our merchandise shop at boxprint.store/truetraining is operated by Boxprint (Limitless Power GmbH, Kriens). Boxprint processes order, payment and delivery data in accordance with its own privacy policy. If we receive information about an order, for example for a query, we only use it to handle that order.

On this website we link to our profiles on Instagram and YouTube. Data is only sent to the platform when you click a link. There, Meta (Instagram) and Google (YouTube) process your data in accordance with their own privacy policies, including in the USA. If you interact with our profiles or message us there, we see your profile and your message. We also receive aggregated statistics from the platforms. For these, we may be jointly responsible with the respective platform. You can direct requests about this to us or directly to the platform.

Purpose: communicating with our community, answering messages, understanding the reach of our posts.
Legal basis: legitimate interest in communicating with interested people and our community.

3.12 Accounting and legal obligations

We keep contracts, invoices and payment records as required by law. Where necessary, we pass them on to our fiduciary or accountants, auditors and authorities.

Legal basis: legal obligation.

4. Recipients

Within TRUE, only the people who need personal data for their tasks have access to it. They are bound to confidentiality.

Outside TRUE, we disclose data to:

Processors who process data on our behalf: Cloudflare (hosting, audience measurement), Google (Google Workspace: email, applications). Contracts with them ensure data protection.
Third parties who process data under their own responsibility, for example FITR, Stripe, Apple and Google (app stores), Fitnessholiday, Boxprint, social media platforms and our fiduciary.
Authorities, where we are legally obliged to do so.

5. Disclosure abroad

Some recipients are based abroad or process data there. The Swiss Federal Council recognises, among others, the EU and EEA states and the United Kingdom as providing adequate data protection, and the USA for companies certified under the Swiss-U.S. Data Privacy Framework (Annex 1 of the Swiss Data Protection Ordinance). For disclosures from the EU, the corresponding adequacy decisions of the European Commission apply.

We only disclose data to countries without adequate data protection if appropriate safeguards are in place, in particular standard contractual clauses (Art. 16(2)(d) FADP; Art. 46 GDPR), or if a statutory exception applies, for example because the disclosure is necessary to perform your contract (Art. 17 FADP; Art. 49 GDPR). You can request a copy of the safeguards from us.

Recipient	Purpose	Country or data location	Basis
Cloudflare, Inc.	Hosting, security, audience measurement	USA, global server network	Data Privacy Framework (certified), contractual safeguards for other countries
Google (Google Workspace)	Email, applications	USA and other countries	Data Privacy Framework (Google LLC, certified) and standard contractual clauses
Fitr. Holdings Limited	Platform and app	United Kingdom, storage in the EEA according to FITR, service providers including in the USA	adequate data protection (United Kingdom, EEA); USA according to FITR: Data Privacy Framework or standard contractual clauses
Stripe	Payments	Europe and USA	Data Privacy Framework (Stripe, LLC, certified) and standard contractual clauses
Apple, Google (app stores), Meta (Instagram), Google (YouTube)	under their own responsibility	including USA	in accordance with the terms of the respective provider

6. Retention

We keep personal data for as long as the purpose requires, as legal obligations demand or as we need it to establish or defend legal claims. We then delete or anonymise it.

Data	Retention
Technical data when visiting the website	briefly at Cloudflare for delivery and security; we do not keep our own log files
Audience measurement	aggregated statistics only, without personal reference
Email correspondence	as long as necessary for the enquiry, business-relevant correspondence up to 10 years
Application without a contract	up to 12 months after the last contact
Health information and training videos	until the end of the coaching, then no longer than 12 months; earlier if you withdraw your consent
Contract, customer and billing data	duration of the contract, accounting records 10 years
Data in FITR	in accordance with FITR’s terms; after your account is closed, FITR deletes your training history in accordance with its own terms
Event registrations	up to 12 months after the event, payment records 10 years
Athletic training	duration of the contract plus 12 months, unless otherwise agreed with the club
Newsletter	until you unsubscribe
Photos and videos from events	as long as they are relevant for our communication, shorter on request

7. Your rights

Within the scope of the applicable law, you have the following rights:

Access to your personal data (Art. 25 FADP; Art. 15 GDPR)
Delivery or transfer of your data in a common electronic format (Art. 28 FADP; Art. 20 GDPR)
Rectification of inaccurate data (Art. 32(1) FADP; Art. 16 GDPR)
Erasure and restriction of processing (Art. 32(2) FADP; Art. 17 and 18 GDPR)
A note of dispute if neither the accuracy nor the inaccuracy of data can be established (Art. 32(3) FADP)
Withdrawal of consent, at any time with effect for the future

Right to object: If we process your data based on a legitimate interest, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to processing for advertising purposes, for example for the newsletter, at any time without giving reasons (Art. 21(2) GDPR).

For all requests, an email to info@truetraining.ch is all you need. We may ask for proof of your identity. We usually respond within 30 days and free of charge. Your rights may be restricted, for example where legal retention obligations apply.

You can lodge a complaint with a supervisory authority. We recommend that you contact us first.

Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch
EU and EEA: the supervisory authority in the state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR)

8. Data security

We protect personal data with appropriate technical and organisational measures, for example encrypted transmission (TLS) on this website, access restrictions so that only authorised persons have access, and the careful selection of our service providers. Nobody can guarantee complete security, especially with unencrypted emails.

9. Do you have to provide data?

You do not have to provide any personal data to visit this website. For an application or a contract, we need the information marked as mandatory. Without it, we cannot review the application or conclude the contract. Health information is voluntary (section 3.5).

10. No automated individual decisions

We do not make decisions based solely on automated processing that have legal effects for you or significantly affect you (Art. 21 FADP; Art. 22 GDPR). Our coaches decide on admission to TRUE Individual and on your programming.

11. Children and young people

Our online programs are intended for people aged 18 and over. Young people aged 16 and over need the consent of their legal guardians (see terms and conditions). Section 3.9 applies to athletic training with youth teams.

12. Changes and language versions

We update this privacy policy when our data processing or the law changes. The version published on this website applies.

This privacy policy is available in German, English and French. The German version is binding.