Privacy Policy

1. Who this policy covers

This Privacy Policy explains how Fitness by Freddy collects, uses, stores and protects personal information belonging to website visitors, applicants, clients, parents/guardians of minor clients, and Fitness by Freddy Academy learners, in line with the Protection of Personal Information Act 4 of 2013 (POPIA).

2. Information we collect

Depending on your relationship with Fitness by Freddy, this may include:

• Contact details (name, email, phone number)
• Emergency contact information
• Health, injury, medical and medication information you disclose
• Training goals, preferences and progress information
• Progress photos and body analysis materials, where you consent to provide them
• Payment and contract records (card payment details themselves are handled directly by our payment processors — see section 6)
• Parent/guardian details for clients under 18

3. Why we collect it, and our lawful basis

Information is collected to provide coaching services safely, verify identity for contracts and payments, communicate with you, and comply with legal and safety obligations. Each of POPIA's conditions for lawful processing applies: we only collect what is adequate and relevant (processing limitation), for the specific purposes described here (purpose specification), and we don't use it for an unrelated purpose without your consent (further processing limitation).

Health, injury and medical information is "special personal information" under POPIA section 26. We only process it with your explicit consent, captured during onboarding, and because it is necessary for Coach Freddy to plan training safely around your condition — the exact purpose POPIA section 32 allows this category of information to be processed for.

4. How we protect it

Sensitive information — including health records, progress photos, contracts, payment records and information relating to minors — is treated as confidential. Access is restricted by role (coach-only or client-only access), files are stored using private, non-public storage rather than public links, and access to sensitive records is logged for audit purposes.

5. Minors

Fitness by Freddy trains clients under 18. Under POPIA sections 34 and 35, processing a child's personal information generally requires the consent of a parent or guardian (a "competent person"). Where a client is a minor, parent/guardian consent is required before any account, contract or payment is activated, and a minor's personal and health information is treated with the same or greater care as any other sensitive information collected.

6. Who we share information with

We don't sell your information. It is shared only with service providers who help us run the platform, each acting under confidentiality and security obligations, including:

• Yoco and Paystack — to process card payments
• Our database, hosting and email-delivery providers — to run the website and deliver programmes, receipts and notifications
• AI tools used to help draft training programmes, meal plans and reports, which Coach Freddy always reviews and approves before anything reaches you

Some of these service providers process data on servers located outside South Africa. Where that happens, POPIA section 72 is satisfied because those providers are contractually bound to protect your information to a standard consistent with POPIA, or the transfer is necessary to perform our agreement with you (for example, processing your card payment).

7. How long we keep it

We keep personal information only for as long as it's needed for the purpose it was collected for, or as required by law — for example, financial and contract records are generally kept for 5 years to meet South African tax and record-keeping obligations. When information is no longer needed, we securely delete or de-identify it.

8. Your rights

Under POPIA, you have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or outdated information
• Request deletion of information we no longer have a lawful reason to keep
• Object to processing of your information, including for direct marketing
• Withdraw consent you previously gave, at any time, without affecting processing already carried out
• Lodge a complaint with the Information Regulator (South Africa) if you believe your information has been mishandled — complaints can be lodged at POPIAComplaints@inforegulator.org.za

To exercise any of these rights with Fitness by Freddy directly, contact admin@fitnessbyfreddy.com. We'll respond within a reasonable time and in any event within the timeframes POPIA requires.

9. Information Officer

Under POPIA, in the absence of a separately designated Information Officer, the head of a private body is automatically its Information Officer. For Fitness by Freddy, operated by WARPHX NUTRITION (PTY) LTD, that is the entity's responsible director, reachable at admin@fitnessbyfreddy.com. Formal registration of the Information Officer with the Information Regulator, where still outstanding, does not change who you should contact with a privacy request today.