Privacy policy
In force since November 8, 2026
This is a translation. If it differs from the Spanish version, the Spanish one prevails. Versión en español
1. Who the controller is
Mihai Stana Ionescu, tax ID 03236201D, address Ana Frank, 20, Valdemoro, Madrid, España. For any privacy matter: [email protected].
2. Two different roles
We are the controller of the data of people who subscribe to the service on behalf of a box (owners, administrators and staff), of anyone who signs up or writes to us, and of visitors to this website.
We are also the controller of what each athlete logs on their own in «Train» (their routines, sessions and sets), because it is theirs and follows them if they change box. Their box does not see it.
We are the processor of the data each box keeps in Wodmark about its athletes: bookings, attendance, fees, payments, direct debit details, marks and results. The controller of that data is the box, and that is who the athlete should contact to exercise their rights. We process that data only to deliver the service to the box and on its instructions, under the Data processing agreement.
3. What data we process as controller, why and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, e-mail, hashed password, language | Creating and keeping your account | Performance of the contract |
| Box details, billing details and number of active athletes | Charging the subscription and issuing invoices | Performance of the contract and legal obligation (tax) |
| Messages you send us | Answering questions and giving support | Performance of the contract or legitimate interest in replying |
| Technical logs (IP, dates, errors) | Security of the service and abuse prevention | Legitimate interest |
| Your profile photo, short line and Instagram, TikTok or X usernames, if you add them | Showing them to you and to the athletes of your boxes | Consent (you add and remove them) |
| Your bodyweight, if you add it | Working out your relative strength (max divided by weight) in your box's ranking; nobody sees the weight, only the result | Consent (you add and remove it) |
| Your routines, sessions and sets in «Train» (the ones you create, not the box's programming) | Keeping them and showing your progress, at any box where you train | Performance of the contract (the service you use) |
| Visits to the public website (page, the site or search engine you came from, campaign, device type, language and country). No cookies and your IP is not stored: each visitor is a code that changes every day. Also measured with Statsdot (statsdot.com), which works the same way | Knowing which pages are read and where visits and sign-ups come from | Legitimate interest |
| The box owner's e-mail | Service notices: band changes, invoices, incidents | Performance of the contract |
We do not take automated decisions with legal effects on you or build marketing profiles.
4. Who it is shared with
Only with providers we need to deliver the service, under a processing agreement: hosting (Contabo GmbH), e-mail delivery and, to charge the subscription, Stripe. Stripe processes the payment details of the box's subscription; cards never pass through our servers. The full list is in Sub-processors. We will also disclose data to authorities when a law requires it.
5. Transfers outside the European Economic Area
Some providers may process data outside the EEA. When they do, it is under an adequacy decision of the European Commission or standard contractual clauses, and we say so in the list of sub-processors.
6. How long
As long as you have an account or the box has the service. After that, blocked for the periods the law requires (tax periods, for example) and then deleted. Encrypted backups are overwritten within 30 days at most. Website visits are deleted after 400 days.
7. Your rights
You can ask for access, rectification, erasure, objection, restriction and portability by writing to [email protected]. If you are a box's athlete, go to your box first; if you write to us, we will pass your request on. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).
8. Security
Encrypted connections, hashed passwords, access separated by box and by role, encrypted backups and access logs. If a breach affects your data, we will tell you and notify the authority where required.