Privacy Policy

1. Data Controller

The entity responsible for processing your personal data is:

• Trade Name: FlexForm Fitness
• Website: https://flexformfitness.com
• Country / Location: Spain (E-Commerce)
• Contact & Privacy Email: info@flexformfitness.com

2. Personal Data We Collect

We process personal data that you provide directly to us during your interaction with our website:

• Account & Identity Data: When registering or logging in (including via Google Sign-In), we collect your name, email address, and profile picture URL.
• Contact and Shipping Information: Full name, email address, physical delivery address, billing address, and phone number when placing an order.
• Payment Information: All payment details are processed and encrypted directly by Stripe. We do not store or have access to your full credit card details.
• Browsing Data: IP address, device/browser type, and navigation logs collected through technical and functional cookies.

3. Google User Data & OAuth Policy (Google Sign-In)

Our application offers Google Sign-In as an optional, secure authentication method. If you choose to log in using Google OAuth:

• Data Accessed & Collected: We access only basic public profile information authorized by you: your Google account name, primary email address, and public profile picture URL. We do NOT request access to your Google contacts, Google Drive, calendar, or any private Google service data.
• Purpose of Processing: This data is solely used to verify your identity, create or access your customer profile on FlexForm Fitness, associate your orders with your account, and deliver transactional notifications (e.g. order confirmations).
• Storage and Security: Authentication credentials and tokens are securely managed via Google Firebase Authentication and Google Cloud Platform, using industry-standard encryption protocols (TLS/HTTPS in transit and AES-256 at rest).
• Data Sharing & Commercialization: We do NOT sell, rent, license, or trade Google user data to any third parties, data brokers, or advertising platforms. Your Google account data is never used for advertising, marketing profiling, or credit scoring.
• Limited Use Compliance: FlexForm Fitness's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Revoking Access & Data Deletion: You can revoke FlexForm Fitness's access to your Google account at any time via your Google Account Permissions page. You can also request the complete deletion of your FlexForm Fitness account and all associated data at any time by emailing us at info@flexformfitness.com.

4. Purposes of Processing

Your personal data is collected and processed for the following purposes:

• Order Fulfillment: To manage, process, and ship the products purchased by you, as well as handling customer service requests, returns, or warranty claims.
• Account Management: To create, authenticate, and maintain your customer profile in our store.
• Transactional Notifications: To send order confirmations, shipping tracking updates, and account security notifications.
• Marketing Communications: To send you newsletters or promotional offers only if you have subscribed and granted explicit consent.
• Security & Anti-Fraud: To prevent unauthorized access, mitigate card testing or cyber threats, and enforce rate limits.

5. Legal Basis for Processing

The legal basis for processing your data depends on each activity:

• Contractual Performance: Processing of shipping, billing, and contact details is necessary to perform the purchase contract.
• Explicit Consent: Social sign-in via Google and promotional email newsletters are based on your voluntary consent.
• Legal Obligation: Retention of billing data for tax and accounting compliance.
• Legitimate Interest: Safeguarding website infrastructure against fraud, abuse, and security threats.

6. Data Sharing and Third-Party Processors

We do not sell your personal data. We only share necessary data with trusted data processors strictly to provide our e-commerce services:

• Firebase / Google Cloud (Google LLC): Used for secure user authentication (Firebase Auth) and database hosting (Firestore) under EU standard contractual clauses.
• Stripe Inc.: Used for PCI-DSS compliant payment processing and fraud prevention.
• Resend / Nodemailer: Used for transactional email delivery.
• Logistics & Couriers: Shipping address and phone number are shared with courier partners solely to deliver your package.

7. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, or to comply with accounting, legal, and tax regulations in Spain (typically up to 5-6 years for tax records).

8. Your Rights (GDPR / ARCO+)

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): Request deletion of your personal data when it is no longer required.
• Right to Restriction: Request limitation of processing under certain circumstances.
• Right to Object: Object to processing for marketing purposes.
• Right to Data Portability: Request transfer of your data in a structured, machine-readable format.

To exercise any of these rights, simply email us at info@flexformfitness.com.

If you believe your rights have not been respected, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.