DQ Fitness is a strength and conditioning coaching service operated by Daniele Quartana in Surrey, United Kingdom. For the purposes of UK GDPR, DQ Fitness is the data controller. Contact: [email protected].
If you send an enquiry: your name, email address, the discipline you selected and the message you wrote.
If you are a coached athlete: a username and password for the athlete area, and the training data you or your coach record. This can include lifts, loads, repetitions, rating of perceived exertion, session notes, bodyweight, and where you choose to provide it, readiness measures such as sleep.
If DQ sends you a health screening: thirteen yes or no answers about your health and training history, anything you add in the notes box, and the name you give. Your IP address is not recorded against those answers.
Automatically: our hosting provider processes standard technical information such as IP address and browser type in order to serve the site securely.
When you send an enquiry your IP address is recorded with it for one hour, and for one reason: so that a script cannot flood the form. Nothing else ever reads it. It is erased the next time somebody uses the form or DQ opens his queue, whichever comes first, and we would rather describe that than claim a timer we do not have.
Site measurement: we use privacy-preserving analytics to count page views and see which pages are read. It sets no cookies, assigns you no identifier, and does not follow you to any other website. It does not collect anything that identifies you, and we cannot single you out in it. We use it to work out which parts of this site are useful, nothing else. We do not run advertising trackers, and we never sell or share anything for advertising.
Training data can indicate physical health. Where any information you give us amounts to health data under UK GDPR, we rely on your explicit consent, which you can withdraw at any time. On the health screening that consent is a box you tick yourself, unticked to begin with, and the form will not send without it.
If you choose to log symptoms of your menstrual cycle, only you and your coach can see them, and they are deleted when you ask.
These are processors acting on our instructions. We do not sell personal data or share it for advertising.
Passwords are never stored. Each one is put through PBKDF2-HMAC-SHA256 with 15,000 iterations and a unique random salt, and only the resulting hash is kept. That is a one-way function, so nobody can read a password back out of it, including your coach. A forgotten password is reset, never recovered.
Everything is served over HTTPS, so what you type is encrypted before it leaves your device. Passwords are checked on the server, never in the browser.
Staying signed in uses a single cookie that is HttpOnly, Secure, SameSite=Lax and cryptographically signed, valid for 30 days. JavaScript cannot read it and it carries no password. Signing out ends the session on the server.
What you send through a form, whether that is the short enquiry or the longer assessment, is stored in our own private Cloudflare D1 database as well as emailed to us. It is stored first and emailed second, so a problem with the email cannot lose what you wrote. Only your coach can read it.
Health screening answers are held in the same private Cloudflare D1 database as the rest of your training data, in the United Kingdom, against your name. They are not emailed to us. They go straight into that database and nowhere else, and only DQ can read them. If the send fails, the page offers to open your own email app so you can get them to him anyway, and that is your choice rather than something we do.
Training data is held in a private Cloudflare D1 database, encrypted at rest by the provider, readable only by your coach and by you. Every request for an athlete's data is checked against the signed session before anything is returned.
Wearables. Whoop, Polar and Oura are connected by you through their own sign-in screens, using OAuth. DQ Fitness never sees or stores your Whoop or Polar password, and you can disconnect at any time.
No system is perfect. If we ever suffer a breach that is likely to put your rights at risk, we will tell you and the ICO within the time UK GDPR requires.
Enquiries that do not become coaching relationships are deleted within 12 months. Athlete training data is retained for the duration of coaching and for 2 years afterwards, since historical training history has genuine value if you return. You can ask for earlier deletion.
Health screening answers. UK GDPR sets no fixed period for these. It requires that we keep personal data no longer than we need it, and that we tell you either the period or the criteria we use to work it out. These are the criteria. They are kept while DQ is coaching you, because he writes your training around them. Afterwards they are kept only for as long as he may still need to show what he asked before he prescribed anything, and a claim about training would normally have to be brought within three years under the Limitation Act 1980. Ask him to delete them and he will, unless he still needs them to establish, exercise or defend a legal claim, which is a reason UK GDPR specifically allows. He deletes them himself, in one action, rather than waiting for a schedule.
Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable format. Email [email protected] and we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.
We do not use advertising or analytics cookies, and there is nothing here to track you with. The athlete area sets one strictly necessary cookie, so you stay signed in between sessions. Strictly necessary cookies do not require consent under the Privacy and Electronic Communications Regulations.
Our site measurement is deliberately cookieless. That is why you are not being asked to accept anything: there is no consent banner on this site because there is nothing here that needs your consent.
The assessment form saves a draft on your own device so an interruption does not cost you the whole form. It is stored in your browser, never sent anywhere until you press the button, and cleared once the form is sent. Your answers about injuries and anything medical are deliberately never saved, because a device can be shared. Clearing your browser data removes the draft.
Technique review videos stay where you put them. The form takes a link, not a file, so your footage lives on your own YouTube, Drive or Dropbox account and we never hold a copy. We watch it, write the review, and that is the end of our access. If you want it out of our reach entirely, delete the link or change its sharing at your end and it is gone. We never publish, share or use a review video for anything else, including marketing, unless you tell us in writing that we can.
We do not knowingly coach anyone under 16 without the involvement and consent of a parent or guardian. Where a coached athlete is under 18, a parent or guardian must agree to this policy.
If this policy changes materially we will update the date above and, for coached athletes, tell you directly.