Privacy Policy

Introduction

QuantumHarbor S.A. ("we", "us", or "our") operates the quantumharbor.world website and provides boutique fitness studio services. This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of personal data when you use our service and the choices you have associated with that data.

Data Controller Information

The data controller responsible for your personal information is QuantumHarbor S.A., a company registered in Spain with registration number B35846971. Our registered address is Avenida de España 8, 08733 Barcelona, Catalonia, Spain. For privacy-related enquiries, please contact us at privacy@quantumharbor.world or call +34 931 136 853.

Data We Collect

We collect several different types of information for various purposes to provide and improve our service to you. The data we collect includes:

• Personal Information: When you contact us or book our services, we may collect your name, email address, phone number, and fitness goals.
• Health Information: With your consent, we may collect health and fitness-related information necessary for providing personalised training services.
• Usage Data: Information about how you access and use our website, including your IP address, browser type, pages visited, and time spent on pages.
• Communication Data: Records of your communications with us, including emails, phone calls, and messages through our website.

How We Use Your Information

We use the collected data for various purposes, including how we use your information to provide and maintain our services:

• To provide and maintain our fitness services and respond to your enquiries
• To personalise your training programmes and wellness recommendations
• To communicate with you about appointments, services, and important updates
• To improve our website functionality and user experience
• To comply with legal obligations and protect our legitimate business interests
• To send you marketing communications (only with your explicit consent)

Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds: performance of a contract when providing our services, legitimate interests for improving our services and website functionality, consent for marketing communications and health data processing, and legal obligation for compliance with applicable laws and regulations.

Cookies and Tracking Technologies

We may use cookies and tracking technologies for analytics, advertising, and remarketing purposes, including Google Ads. These technologies help us measure campaign effectiveness, deliver relevant advertisements, and improve our services. You can manage your cookie preferences at any time through our cookie consent banner. For more detailed information about our use of cookies, please refer to our Cookie Policy.

Data Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as described in this policy. We may share your information with trusted service providers who assist us in operating our website and conducting our business, provided they agree to keep this information confidential. We may also disclose your information when required by law or to protect our rights and safety.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy. Personal information collected for service provision is retained for the duration of our relationship and up to 7 years thereafter for legal and business purposes. Health and fitness data is retained for 3 years after your last service appointment. Marketing consent records are kept until you withdraw consent. Website usage data and cookies are typically retained for 26 months unless you withdraw consent earlier.

Your Rights

Under GDPR, you have several rights regarding your personal data:

• Right of Access: You can request copies of your personal data
• Right to Rectification: You can request correction of inaccurate or incomplete data
• Right to Erasure: You can request deletion of your personal data in certain circumstances
• Right to Restrict Processing: You can request limitation of how we process your data
• Right to Data Portability: You can request transfer of your data to another organisation
• Right to Object: You can object to our processing of your personal data
• Right to Withdraw Consent: You can withdraw consent for processing based on consent

Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of sensitive data, secure data storage systems, regular security assessments, staff training on data protection, and access controls limiting data access to authorised personnel only.

International Data Transfers

Your personal data is primarily processed within the European Union. If we need to transfer data outside the EU, we ensure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses approved by the European Commission.

Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "last updated" date. You are advised to review this Privacy Policy periodically for any changes.

Contact Information

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us using the following information:

Supervisory Authority

If you believe we have not handled your personal data in accordance with this policy or applicable data protection laws, you have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos) or your local supervisory authority.