Legal
Privacy Notice
Platform controller: Ecnecil s.r.o. · [email protected]
This notice is for Clients, Trainers, Operators and visitors to fibrz.app.
1. Who processes your data
Ecnecil s.r.o., Company ID 03165914, VAT ID CZ03165914, Lýskova 2072/55, Stodůlky, 155 00 Prague 5, Czech Republic, registered with the Municipal Court in Prague, Section C, File 227920; [email protected].
Ecnecil is a controller for accounts, platform operation, bookings and sales made by Ecnecil, invoicing, security and its own marketing. The relevant Trainer or practice is an independent controller for the professional content of a Client's record and its use in that practice. Ecnecil provides the technical environment as a processor for that purpose. If Ecnecil also uses record data for its own purposes, it is an independent controller for those purposes. Jointly determined purposes and means are governed by GDPR Article 26.
For platform-related requests, contact Ecnecil. A Trainer or practice can also be contacted about their independent professional practice. We will route requests to the responsible party where necessary; rights may also be exercised against either joint controller.
2. Data collected and sources
- Account and contact: name, email, telephone, language, role, protected authentication data and record of acceptance of terms.
- Bookings and payments: time, service, practice, booking note, amount, tax information and bank transfer matching details. Please avoid adding health information to a booking note unless needed.
- Professional record: answers concerning health and lifestyle, muscle test results, body map, activation score, notes and Visit history. These may be health data, a special category under GDPR Article 9.
- Trainer / Operator: profile, qualifications, practice, bank details and settlement information.
- Courses and forms: enrolment or campaign response, contact details and records of any consent.
- Technical data: IP address, security logs, sign-in details, cookies and data sent to Vimeo when an embedded video is started.
Data comes from you, your Trainer or practice and, for payments, the bank. Required fields are indicated in the relevant form. We cannot process an Order without contact and booking details; health data is collected only for a professional Visit.
3. Purposes and legal grounds
| Purpose | GDPR Article 6 basis | Additional condition |
|---|---|---|
| Account, bookings, sales, delivery and transactional messages | 6(1)(b), contract | Only data needed for the step concerned |
| Payment, accounting and tax | 6(1)(b) and (c) | Statutory retention applies |
| Security, disputes and legal claims | 6(1)(f), legitimate interests | You may object to this processing |
| Professional record where Ecnecil is controller | 6(1)(b), contract, to the extent necessary | Health data also requires a separate Article 9 condition, including explicit consent under 9(2)(a) where required for the particular processing |
| Professional record where Ecnecil acts on Trainer instructions | Controller determines the Article 6 basis and Article 9 exception | Ecnecil acts on the relevant controller's instructions |
| Marketing forms and offers | 6(1)(a), consent, or legitimate interests where comparable own services to existing customers are permitted by law | Easy opt-out when collecting details and in each email |
Explicit consent to processing health data is separate from acceptance of Terms and marketing consent. Before collection we explain the purpose, access and effect of refusal or withdrawal. Withdrawal has no retroactive effect. If the processing requires consent and no other valid basis and Article 9 exception apply, the relevant processing stops upon withdrawal.
4. Who can access records
A Client sees their record as enabled by the application. An authorised Trainer and practice access only data needed to deliver and document a particular service; Ecnecil staff have limited support and security access. Operator access and sharing between Trainers follow the permissions displayed in the application. Revoking in-app access does not automatically erase records another independent controller must or may lawfully keep; we explain any lawful continued retention when access is revoked.
5. Recipients and international transfers
In operating the Service, we may use Railway (hosting), Resend (email), Cloudflare / Turnstile (website protection), Vimeo (video) and banks. Banks generally act as independent controllers. We do not sell data for third-party advertising.
Bot protection on forms. Forms on third-party websites that send us contacts use Cloudflare Turnstile. In doing so Cloudflare receives your IP address, your TLS connection fingerprint, browser details, and the identifier of our verification widget together with the domain it sits on. The details are described in the Turnstile Privacy Addendum.
Where a recipient processes data outside the EEA or accesses it from there, transfers require a valid GDPR Chapter V mechanism, such as an adequacy decision for a specifically certified recipient or standard contractual clauses with any necessary supplementary measures. Ask [email protected] for a copy of the relevant safeguards.
6. Retention and erasure
Accounts are retained while active. Accounting and tax documents are retained for the statutory period applicable to each document and duty, in some cases up to 10 years. Security logs are retained no longer than 12 months unless an incident or claim requires longer. Unconfirmed campaign contacts are erased within 90 days. The relevant controller retains professional records for the time needed to deliver the service, maintain Visit history and meet any applicable professional or legal duties. Closing an account does not automatically erase records another controller is entitled or required to retain.
When an erasure request is justified, we remove data no longer needed or explain a lawful reason for continued retention. Statistics fall outside the GDPR only if genuinely and irreversibly anonymised; pseudonymisation alone is insufficient.
7. Your rights
You may request access, correction, erasure, restriction and portability where applicable; object to legitimate-interest processing; and withdraw consent. Email [email protected]. We respond without undue delay, normally within one month; the GDPR allows an extension in justified cases. We may reasonably verify identity. You may complain directly to the Czech Data Protection Authority (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, https://uoou.gov.cz. Contacting us first is not required.
8. Children
An independent account is intended for people aged 18 or older. A minor's legal representative orders the service. We process the minor's data, including health data, under the rules applicable to the particular purpose.
9. Security and automated decision-making
Access is role limited and we apply appropriate technical and organisational safeguards. The activation score informs a Trainer's human assessment; the score alone does not determine the next steps for a Client.
10. Changes and contact
We communicate material changes to this notice appropriately. Contact Ecnecil s.r.o. at [email protected].
Version 2.