Carlos Bakker Fitness

Last updated: 24/09/2026

1. Who I am
Carlos Bakker Fitness is run by Carlos Bakker-Noguer, a sole trader trading as Carlos Bakker Fitness (“I”, “me”, “my”). I am the controller of your personal information for the purposes of UK data protection law.

Address: 3, Denmark Avenue, Woodley, Reading, RG5 4RS
Email: carlosbakker.fit@gmail.com
Telephone: 07584 351347
Website: carlosbakker.fit

2. What this policy covers
This policy explains how I collect, use, store and share personal information when you visit my website, or enquire about, buy or receive personal training, courses or online coaching from me, whether in person, by video or phone, or online. Please read it alongside my Terms & Conditions, my health screening (PAR-Q) form and any separate consent form I ask you to complete.

3. The information I collect

• Identity and contact: your name, date of birth, postal address, email address, telephone number, and an emergency contact’s name and number. If you give me an emergency contact, please make sure they’re happy for you to do so.

• Enquiry and consultation: what you put in my website form (name, contact details, the service you’re interested in and your goals) and my notes from consultation calls by video or phone. I don’t record calls unless I tell you first and you agree.

• Booking and service: session dates and times, your goals, training programme, training logs, habit and nutrition tracker entries, progress notes, measurements, assessment results, check-ins, and our correspondence (email, WhatsApp and social media messages).

• Payment and transaction: the amount paid, date, product purchased, receipts, and the last four digits and card type held by my payment processor. I never see or store your full card number, expiry date or security code.

• Health and fitness: your PAR-Q responses, injuries, medical conditions, medication relevant to safe exercise, pregnancy-related information, GP or healthcare clearance where I’ve asked for it, and any physical limitation affecting how you train.

• Video and images: technique or form-check videos you send me, and any photograph you choose to share. I don’t film you without your knowledge and agreement.

• Technical: your IP address, device and browser information, pages viewed and cookie data when you use my website.

• Marketing preferences: whether you’ve opted in to marketing, and any consent you’ve given.
   

Please give me accurate information and tell me if anything changes, particularly anything affecting your health.

4. Why I use your information, and my lawful bases



















5. Health information
Health information is “special category” data under UK GDPR and gets extra protection.

I collect only the health information I reasonably need to decide whether I can coach you safely and how to adapt your training, and I’ll always tell you why I’m asking.

I rely on your explicit consent to use it, which I’ll ask for separately and clearly on the health screening form. You can withdraw that consent at any time by emailing me. If you do, I may not be able to continue coaching you safely, and I’ll discuss that with you before making any decision.

I also keep health and screening records because they may be needed to establish, exercise or defend a legal claim. This is why I keep them after your coaching ends (section 9). In a medical emergency where you can’t give consent, I may share health information to protect your vital interests.

I don’t use health information for marketing. I don’t share it with anyone unless you’ve expressly agreed, it is necessary in an emergency, or the law requires it.

6. Technique videos, images and testimonials
If you send me a video of yourself training, I use it only to assess your technique and give you feedback. Unless you ask me to keep it so we can track your progress over time, I delete form-check video within 90 days of reviewing it. You can ask me to delete any video immediately at any time.

I will never use your video, photograph, testimonial, or results in marketing without asking you separately and getting your written agreement. You can withdraw that agreement at any time, and I’ll stop using the material from then on.

7. Who I share information with
I share information only where it is necessary. My main providers are:









I may also share information with my accountant, my insurer, a professional adviser or a debt recovery provider where reasonably necessary; with regulators or law enforcement where the law requires it; and with emergency or medical services where necessary to protect your vital interests.

I don’t sell your personal information, and I don’t share it for anyone else’s marketing.

JD Gyms is an independent venue operator and a separate controller of its own members’ information. Any membership, guest pass or access arrangement you have with JD Gyms is between you and them and is covered by their own privacy policy. I don’t share your information with JD Gyms unless it is necessary and lawful, for example in an emergency or where you’ve asked me to.

8. Transfers outside the UK
Some of my providers process information outside the UK, as shown in section 7. Where that happens, I rely on UK adequacy regulations (for the EEA and other countries the UK treats as adequate), the UK–US data bridge (for certified US providers), or approved contractual safeguards: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask me for more detail about the safeguards for any particular transfer.

9. How long I keep information

















 
Backups are held on an automated rolling schedule and are overwritten or permanently deleted within 30 to 90 days, in line with my providers’ deletion cycles. When information is no longer needed, I securely delete or anonymise it.

10. Keeping information secure
I use reasonable technical and organisational measures to protect your information, including password-protected and access-controlled accounts, two-factor authentication where available, encrypted storage and devices, and limiting access strictly to what is needed.

No method of transmission or storage over the internet is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, I will report it to the Information Commissioner’s Office within 72 hours where required, and tell you without undue delay where the risk is high.

11. Your rights
Depending on the circumstances, you have the right to:

• ask for a copy of the personal information I hold about you;

• ask me to correct information that is inaccurate or incomplete;

• ask me to erase information where there is no good reason for me to keep it;

• ask me to restrict how I use your information;

• object to processing I carry out on the basis of legitimate interests;

• ask for a portable copy of information you gave me;

• withdraw consent at any time, where consent is my basis for processing; and

• object to direct marketing at any time.
   

I don’t make decisions about you using automated processing or profiling that has legal or similarly significant effects.
To exercise any of these rights, email carlosbakker.fit@gmail.com. I may need to confirm your identity first. I’ll respond within one month, and I’ll tell you if I need longer because your request is complex.

Some rights are limited. For example, I may not be able to erase health and training records before the retention period in section 9 expires, because I may need them to defend a legal claim.

12. Marketing
I will only send you direct marketing by email or text where you have agreed to it, or where you are an existing client and the law otherwise permits it. You can opt out at any time using the unsubscribe link in any marketing email, by replying STOP to a text, or by emailing carlosbakker.fit@gmail.com.

Opting out of marketing will not stop essential messages about your bookings, your programme, payments or changes to a session.

13. Cookies
My website is built on Wix and uses cookies and similar technologies. Essential cookies keep the site working and secure. Others remember your preferences or help me understand how the site is used. I only set non-essential cookies with your consent, and you can change your choice at any time through the cookie settings on my site or in your browser. Embedded content, such as maps, may set its own cookies.

14. Children
My services are for adults aged 18 and over. I don’t knowingly collect personal information from anyone under 18.

15. Complaints
If you’re unhappy with how I’ve used your information, please contact me first at carlosbakker.fit@gmail.com so I can try to put it right.

You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk · 0303 123 1113

16. Changes to this policy
I may update this policy from time to time. The current version is always on my website, with the “last updated” date at the top. If I make a significant change to how I use your information, I’ll tell you directly