Legal djordjecoaching.com

Privacy Policy

Last updated: 11 October 2026

This website, djordjecoaching.com, is operated by Đorđe Đorđević, a part-time self-employed fitness and nutrition coach based in Malta ("I", "me"). I am the data controller for the personal data described below. This page explains what personal data is collected when you use this site, why, how long it is kept, and what your rights are under the EU General Data Protection Regulation (GDPR).

You can reach me about anything on this page at djordje@djordjecoaching.com.

No cookies, no tracking

This site sets no cookies. There is no Google Analytics, no advertising pixel, no social media tracker, and nothing is stored in your browser's local storage. That is why you are not seeing a cookie banner. There is nothing to consent to. I do not profile visitors, and I never sell or share data for advertising.

What data I collect, and why

• Your email address, only if you choose to give it, to receive the free recipe pack, join a waitlist, or apply for coaching. Legal basis: your consent. You confirm your subscription by clicking a link in a confirmation email, and you can withdraw consent at any time via the unsubscribe link in any email.
• Macro calculator inputs (sex, age, height, weight, activity level). I treat these as health-related data, which the GDPR protects as a special category. They are therefore only processed after you give explicit consent by ticking the box on the calculator. Legal basis: explicit consent, Article 9(2)(a) GDPR. See the dedicated section below for exactly what happens to them.
• Application and waitlist answers: if you apply for coaching or join a waitlist, the information you submit in that form. Legal basis: steps taken at your request before entering into a contract.
• Testimonial material (a quote, a photograph, your name or initials, your numbers), only if you are a client and you say yes when I ask, after your programme has finished. I treat before-and-after photographs and body measurements as health-related data. Legal basis: your explicit consent, Article 9(2)(a) GDPR. See "Publishing your results" below.
• Technical data: when you visit any website, the hosting provider automatically processes your IP address, browser type and the time of the request, in server logs. This is needed to deliver the site and protect it from abuse. Legal basis: my legitimate interest in operating a secure, working website.

The macro calculator: exactly what happens

Body measurements can say something about a person's health, so I treat them as special category (health) data and ask for your explicit consent before anything is processed. Nothing is sent until you tick the consent box.

When you submit the calculator, the values you entered (sex, age, height, weight, activity level) are sent to my server so the calculation can run there. This is deliberate: the calculation method is my own work and is not exposed in the browser.

On the server, those values are used to compute your result and are then discarded immediately. They are not saved to any database, not written to any log, and not linked to your name or email address, even if you later enter your email on the results screen. I keep no record of anyone's body measurements.

The calculator gives you a general starting estimate. It is not medical advice and is not a decision that produces any legal or similarly significant effect for you.

Publishing your results

If you finish a programme with me, I may ask whether I can show your result, on this site or on social media. That question is separate from the coaching and comes after it. It is never a condition of a place, a price or a free place, and saying no changes nothing about what you received. I do not ask twice.

The consent is granular: you answer for each part on its own: your photograph, your name (initials instead, if you prefer), your numbers, and the wording of your quote. A yes to one is not a yes to the others, and I publish only the parts you said yes to.

You can withdraw it at any time, by email, without giving a reason. I take the material off this site and off my own social media accounts without undue delay. What other people have already saved, screenshotted or reshared is outside my reach, and I will tell you that plainly rather than promise otherwise. Withdrawing does not make the earlier publication unlawful, and it never affects your coaching.

How long this one is kept. Your permission, the message where you said yes and to which parts, is kept for as long as the consent stands, that is, until you withdraw it. It does not expire with the retention periods listed below and it is not deleted together with your group programme data: if it were, I would have nothing left to show that you ever agreed. After you withdraw it, I keep only the short record that you withdrew and that I acted on it, and delete the rest.

The group programme

If you join one of my group programmes, you sign up through a short form and check in with me once a week. This runs on my own web app at challenge.coachconsole.coach, through the links in my emails. You do not need to install anything. Here is what the app keeps about you:

• From the sign-up form: your name, email address and, if you give it, your phone number. Also your sex, age, height and weight, your goal, how active you are, how you eat and the foods you don't eat.
• Allergies and intolerances, including any you describe yourself and whether a reaction would be severe. I use them to keep those foods out of your plan.
• Your weekly check-ins: body weight, waist, hips, chest and thigh, your scores for the week (sticking to the plan, energy, hunger, digestion), foods you want removed or added, ratings of your meals if you give them, and your note to me.
• Training that week, if you tell me: the type of training and how many sessions. The app turns that into a rough estimate of the energy you used. It is there for me to read, and it never changes your plan by itself.
• Progress photos, if you add them. Your phone makes each photo smaller and removes location data before it is sent. Only I can see them.
• Your meal plans, with the shopping lists and PDFs made from them.
• A record of the emails the app sent you: which one, when, and whether it was delivered.
• Your consent: that you gave it, when, and which version of the wording you agreed to.
• After the programme, only if you answer them: a short feedback form and your answers about publishing your result.

Your measurements, allergies, photos and training are health-related data. They are processed only because you gave explicit consent on the sign-up form. Legal basis: Article 6(1)(a) and Article 9(2)(a) GDPR. You can withdraw that consent at any time by email, and I will then delete your programme data.

To protect the app from abuse, it also counts sign-in and form attempts per IP address for a short time. Those counters are not linked to your name and expire on their own.

Who else processes the data

I use the following service providers, who process data on my behalf under data processing agreements:

• Kit (kit.com, United States): email list management and sending emails.
• Vercel (vercel.com, United States): website hosting and the calculator function, and the group programme app, which runs on its servers in Paris, France (EU); processes server logs including IP addresses.
• Supabase (supabase.com, United States): the database and photo storage of the group programme app. The data itself is stored in Paris, France (EU).
• Resend (resend.com, United States): sending the group programme emails, such as check-in links, plans and reminders.
• Upstash (upstash.com, United States): the short-lived attempt counters that protect the group programme app.
• Tally (tally.so, Belgium, EU): application and waitlist forms.
• ImprovMX (improvmx.com, France, EU): forwarding email sent to my contact address.
• WhatsApp (Meta, United States): only if you are an Elite 1:1 client and choose to message me there. Messages are end-to-end encrypted, but Meta still processes your phone number and metadata. If you would rather not use it, tell me and we will use email or the platform instead. I keep detailed health information out of WhatsApp.

Transfers outside the EU

Kit, Vercel, Supabase, Resend, Upstash and WhatsApp (Meta) are based in the United States, so some data is transferred outside the European Economic Area. The group programme app, its database and the photos are hosted in Paris, France (EU). Vercel and Supabase are still US companies, so the safeguards below apply to them as well. These transfers are covered by the safeguards required under Chapter V of the GDPR: the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as set out in each provider's data processing terms. Tally and ImprovMX are based in the EU.

How long I keep it

• Email address: until you unsubscribe or ask me to delete it, and then removed without undue delay.
• Application and waitlist answers: up to 24 months after our last contact if we do not work together, so I can follow up if you asked me to; if we do work together, for the duration of our coaching plus any period required by law (for example tax records).
• Macro calculator inputs: not retained at all, discarded as soon as the result is calculated.
• Group programme data (everything listed under "The group programme"): kept until you ask me to delete it, which is what you agree to on the sign-up form. When you ask, I delete it from the app, photos included, without undue delay.
• Testimonial material and the consent behind it: kept for as long as the consent stands, until you withdraw it. This one does not run on the same clock as anything else on this list; see "Publishing your results" above.
• Server logs: kept short-term by the hosting provider for security and diagnostics, per their retention policy.

Your rights

Under the GDPR you have the right to:

• Access the personal data I hold about you, and get a copy of it.
• Correct data that is wrong or incomplete.
• Erase your data ("right to be forgotten").
• Restrict or object to processing, including direct marketing.
• Portability: receive your data in a structured, commonly used format.
• Withdraw consent at any time, without affecting processing that already happened.

To use any of these rights, email me at djordje@djordjecoaching.com. I will respond within one month. There is no charge, and you do not need to give a reason.

Automated decision-making

I do not carry out automated decision-making or profiling that produces legal effects or similarly significantly affects you. The macro calculator performs an automated calculation, but its output is only an informational estimate for you.

Age

This site, the calculator and my coaching services are intended for people aged 16 and over. I do not knowingly collect personal data from anyone under 16, and I do not take on coaching clients under 16. If you believe someone under 16 has submitted data to me, email me and I will delete it.

Complaints

If you are not satisfied with how I handle your data, please contact me first. I would rather fix it directly. You also have the right to lodge a complaint with a supervisory authority. In Malta this is the Office of the Information and Data Protection Commissioner (IDPC), idpc.org.mt. You may also complain to the authority in your own EU country of residence.

Changes to this policy

If I change how data is handled, I will update this page and the "last updated" date above.

Contact

Đorđe Đorđević · part-time self-employed coach, Malta · djordje@djordjecoaching.com