Privacy Policy

Last updated: 7 September 2026. · Document version: 2026-09-07

FITOOX ("we", "us") respects your privacy. This policy explains what data we collect through the FITOOX app and the fitoox.com website, why, on what legal basis, how long we keep it, who we share it with, and what rights you have regarding your data. We process data in accordance with Serbia's Personal Data Protection Act and, where applicable, the European Union's General Data Protection Regulation (GDPR, 2016/679).

For privacy questions and to exercise your rights, write to us at info@fitoox.com.

1. Controller and processor - who is responsible for what

• For trainer and website-visitor data (account data, technical data), the controller is FITOOX. Contact: info@fitoox.com.
• For the data a trainer enters about their clients (measurements, goals, questionnaire answers, plans, messages, progress photos, payments), the trainer is the controller - they decide what data is collected and for what purpose. FITOOX processes that data solely as a processor, on the trainer's instructions and for the purpose of providing the service. The trainer is responsible for having a valid legal basis (e.g. the client's consent) to process that data through FITOOX.

2. What data we collect

• Trainer data (account owner): name, email address, password (stored only in hashed form), profile name and code, chosen currency, plan and billing details.
• Trainer's client data: name, date of birth, phone number, weight and other body measurements, goals, questionnaire answers, training and nutrition plans, messages with the trainer, progress photos, payment history. This data is entered by the trainer or by the client themselves, as part of using the app. Some of it may be sensitive in nature (e.g. data about health, injuries or conditions) - it is processed only when the trainer or the client enters it, in order to manage training and nutrition.
• Technical data: basic data needed for the app's operation and security - login times, the IP address at the time of a request, and basic device/browser information sent by the browser itself.

3. Cookies

The app uses only essential technical items in the browser (a login token and basic display settings) without which sign-in would not work. The fitoox.com website does not use tracking cookies, marketing cookies, or third-party analytics. That is why we do not show a cookie-consent banner.

4. Why we process data and on what basis

We process data on the following legal bases:

• Performance of a contract - to provide the service you accessed by registering or using the app: managing clients, plans, progress and billing, sign-in, and in-app reminders.
• Legitimate interest - keeping the app working correctly, stably and securely (e.g. preventing abuse, diagnosing errors).
• Legal obligation - retaining certain records (e.g. financial) for as long as the law requires.
• Consent - where processing is exceptionally based on consent; you can withdraw consent at any time.

We do not sell or rent your data. We do not use it for advertising or for marketing profiling.

5. Who we share data with (processors)

A client's data is visible to their trainer (within the same profile) and to the client themselves. To run the service we use a small number of trusted service providers who process data solely on our instructions, under a contractual duty of confidentiality and protection:

• Hosting and database - servers and the database are located in the European Union.
• File storage - progress photos and documents are stored with a storage provider in the European Union.

We do not share data with anyone else, except where explicitly required by law or on the request of a competent authority.

6. Transfers outside the EU / EEA

Data is primarily processed and stored in the European Union. If at any point a transfer outside the EU/EEA became necessary, we would carry it out only with appropriate safeguards (e.g. the European Commission's Standard Contractual Clauses) and would update this policy accordingly.

7. How long we keep data

• We keep account data and client data while the account is active.
• After a request to delete an account, data is permanently deleted from the active database within a reasonable period; backups are rotated and deleted within 30 days at the latest.
• Records we are legally required to keep longer (e.g. financial/accounting) are kept for as long as the law requires and then deleted.

8. Security

Passwords and PINs are stored exclusively in hashed form and cannot be read back. All communication with the app runs over an encrypted (HTTPS) connection. Access to data is scoped per organization (each trainer sees only their own profile). We regularly monitor and improve our security measures. No system is completely impenetrable, but we work to reduce the risk to the lowest reasonable level.

9. Data breaches

In the event of a security breach likely to affect the rights and freedoms of individuals, we will notify the competent supervisory authority without undue delay (where required, within 72 hours of becoming aware), and we will notify affected users where the law requires it.

10. Your rights

At any time you have the right to:

• request access to the data we hold about you and a copy of it;
• request correction of inaccurate or incomplete data;
• request deletion of your data ("right to be forgotten");
• request restriction of processing or object to processing;
• request data portability (in a structured, commonly used format);
• withdraw consent, where processing is based on consent.

Send requests to info@fitoox.com. If you believe your rights have been infringed, you may contact the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs) or the supervisory authority competent for you. If you are a trainer's client, for data the trainer entered about you, contact your trainer first as the controller; we will support them in fulfilling your request.

11. Children and minors

The app is not intended for independent use by anyone under 16. If a trainer manages a minor client through FITOOX, the trainer is responsible for having the consent of a parent or guardian to process that client's data, as required by law.

12. Changes to this policy

This policy carries a version tag (see the top of the page). If we change it, the new version will be published on this page with an updated date and tag. For material changes, at your next sign-in the app will ask you to confirm again that you are aware of the current version.

13. Contact

For any questions about privacy and data protection: info@fitoox.com.