Privacy notice

Last updated: 12 November 2026

When you contact Next Level Fitness, we use your information to respond to your enquiry, discuss suitable coaching options and arrange a consultation. This notice explains what happens to that information and the choices you have.

1. Who is responsible for your information?

Next Level Fitness is the trading name of Craig Shiach, a sole trader based in Scotland, UK. The individual operating the business is responsible for deciding how personal information collected through this website is used (the data controller).

Business/legal name: Craig Shiach (sole trader)
Trading name: Next Level Fitness
Business contact: nextlevelfitness.contact@gmail.com
Business correspondence address: [INSERT YOUR HOME BUSINESS ADDRESS BEFORE PUBLICATION]

2. What information do we collect?

When you complete our coaching enquiry form, we collect the details you provide, including:

• Your name and email address.
• The coaching programme you're interested in, your broad fitness goal, preferred start time and consultation format.
• Which website page brought you to the form, and any campaign links used to reach that page.
• Your agreement to be contacted about the enquiry, and the date and status of your enquiry.
• Our internal follow-up notes and the progress of conversations about your enquiry.

To help prevent spam, our system also processes technical information used for verification and abuse detection, including a hashed representation of the network IP address associated with an enquiry. Security providers may independently process technical information under their own privacy terms.

Please do not submit medical histories, diagnoses or other sensitive health information through the public enquiry form. If you become a coaching client, additional health or assessment information may need a separate explanation and appropriate safeguards.

3. Why do we use it?

• Respond to your enquiry: acknowledge your message, discuss suitable training programmes and contact you about a consultation. The proposed lawful basis is our legitimate interests in responding to prospective customers, or steps taken at your request before entering a contract, depending on the precise activity; this must be confirmed before publication.
• Arrange a consultation: process the appointment details you choose to give to the booking provider. The proposed lawful basis is taking steps at your request before entering a contract.
• Protect the website and manage enquiries: check spam submissions, keep an internal lead record and follow up on active enquiries. The proposed lawful basis is our legitimate interests in maintaining a secure service and responding efficiently to enquiries.

We do not treat an enquiry or booking as permission to send unrelated promotional emails. Our optional marketing checkbox is separate and unticked by default; subscribers must confirm their email address before being added to our marketing list.

Where we rely on legitimate interests, you can object to that processing and we will consider your request.

4. Who handles your information?

We use specialist service providers to operate our website and respond to enquiries:

• Supabase: hosts the private lead database and the server function that receives enquiries.
• Resend: sends an acknowledgement to you and an enquiry notification to Next Level Fitness.
• Google (Gmail and Google Calendar/Meet): receives business notifications and processes booking details if you schedule a consultation.
• Cloudflare: provides website-related infrastructure and Turnstile anti-spam verification.

These services receive only the information needed for their particular tasks. We do not sell your personal information.

5. Where is your information processed?

Our providers may process information in the UK, the European Economic Area or elsewhere, depending on their services, account configurations and subprocessors. Where a transfer of personal information outside the UK requires safeguards, the applicable UK data-protection transfer mechanism must be verified and documented before publication. [CONFIRM PROVIDER REGIONS AND TRANSFER SAFEGUARDS.]

6. How long do we keep it?

Enquiries that do not lead to a coaching relationship: we will delete or anonymise inactive or unsuccessful enquiries after 12 months from their last meaningful interaction, unless we have a specific lawful reason to keep a record longer.

Active enquiries and coaching clients: information needed to continue providing services may be retained for longer under a separate, documented retention schedule. Accounting and legal obligations may also require some records to be kept for a different period.

Our CRM does not currently delete records automatically. We will need to implement a regular review and deletion process so this policy is followed in practice. Copies of information in email inboxes, provider logs and backups must be covered by our retention arrangements too.

7. How do we protect your information?

Enquiries are recorded in a restricted-access lead database. The management area requires authorised sign-in. Cloudflare Turnstile and server-side checks are used to reduce automated spam. We also limit access to enquiry details to people who need them to respond.

No online service can guarantee absolute security. If you believe your information has been exposed or misused, contact us at the email address above.

8. Cookies, verification and third-party services

Our enquiry form uses Cloudflare Turnstile to verify submissions. The administration system may use essential browser storage to maintain a signed-in session. Booking through Google Calendar, or using links to other services, may involve those providers' own cookies and data-processing practices.

We will confirm which cookies or similar technologies the published website actually sets. We use Cloudflare Web Analytics as described below. We will review any other non-essential tracking technologies for transparency and consent obligations before they are enabled. [COMPLETE COOKIE AUDIT BEFORE LAUNCH.]

9. Your data-protection rights

Depending on the circumstances and applicable law, you can ask to access your information, correct inaccurate information, delete it, restrict its use or object to processing. You may also have a right to data portability. To make a request, email nextlevelfitness.contact@gmail.com. We may need to verify your identity before acting on a request.

You're also entitled to complain to the UK Information Commissioner's Office (ICO). You can find information at ico.org.uk/make-a-complaint.

10. Changes to this notice

We may update this notice if our services, systems or legal obligations change. The latest version will be available on this page, with an updated date.

Optional marketing emails and your choices

If you tick the separate optional marketing checkbox, we record your request and send a confirmation link to the email address you supplied. Only after you click to confirm will we add you to the marketing contact list managed by Resend. We record your consent wording/version and dates to demonstrate when permission was obtained. Marketing emails include ways to unsubscribe or manage topics. Submitting an enquiry without ticking this option does not subscribe you to marketing.

Marketing contact records may need to be retained as suppression records for as long as necessary to honour your decision not to receive further marketing. Unsuccessful or inactive enquiries are ordinarily deleted or anonymised 12 months after their last meaningful interaction, subject to lawful exceptions. A deletion review is required to implement that policy.

Website analytics

We use Cloudflare Web Analytics to understand aggregate traffic, popular pages and referral sources. We do not use it to identify visitors in our Lead Pipeline. Cloudflare's Web Analytics does not use analytics cookies; we still disclose its use and will review other storage or cookie technologies on the published website.