Privacy
Policy

The data controller is:

• Naiche Hurtado — Tax ID (NIF): 47602670F — Co-founder of HH Athletes
• Eidan Hurtado — Tax ID (NIF): 55605726Y — Co-founder of HH Athletes

Address: Martorell, Barcelona, Spain

Email: hybridhhathletes@gmail.com

Simply browsing this website does not require you to provide any personal data. The only data that may be processed are:

• Access data and server logs — IP address, browser and operating system, date and time of access, pages visited. They are processed automatically by Hetzner (our hosting provider) for technical and security purposes.
• Contact data — if you write to us by email or through the contact form on the website (section 14).
• Answers to our free assessments — if you completed one and gave us your email to receive the result (section 15).
• Campaign data — if you arrive at the website through one of our campaign links (section 16).

Server access data are processed exclusively to:

• Ensure the proper technical operation of the website.
• Prevent and detect unauthorized access or cyberattacks.

They are not used to build user profiles or for advertising purposes.

The processing of server access data is based on the controller's legitimate interest (Article 6(1)(f) GDPR) in ensuring the security and integrity of the service.

We use the following providers which, in their capacity as data processors, may access data on an instrumental basis:

• Hetzner Online GmbH (hetzner.com) — web hosting provider. A German company subject to the GDPR. The servers are located in the European Union.

Data are not disclosed to third parties for commercial or advertising purposes.

Server access data are hosted on Hetzner servers located in the European Union. No international transfers of data to countries outside the European Economic Area take place in the context of simply browsing the site.

For the processing described in sections 10, 13, 14, 15, and 16, some of our providers (such as Clerk, Stripe, Resend, Supabase, or Google) may process data outside the European Economic Area. In those cases, the transfers are covered by the safeguards provided for in the GDPR: the adequacy decision for the EU-U.S. Data Privacy Framework or the standard contractual clauses approved by the European Commission.

Server access logs are kept for the minimum time necessary for the technical and security purposes described, not exceeding 12 months, unless their retention is required by a legal obligation.

Under the GDPR and the LOPDGDD, you have the right to:

• Access — know what data we process about you.
• Rectification — correct inaccurate data.
• Erasure — request the deletion of your data (the “right to be forgotten”).
• Restriction of processing — request that we suspend the processing.
• Objection — object to processing based on legitimate interest.
• Portability — receive your data in a structured format.

To exercise any of these rights, write to us at hybridhhathletes@gmail.com.

If you believe that the processing of your data does not comply with the regulations, you may file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at aepd.es.

We apply the technical and organizational measures necessary to ensure the security of the data and to prevent their alteration, loss, or unauthorized processing or access. All communications between the browser and the server take place over the encrypted HTTPS protocol.

If you become a client of our coaching service and access your Athlete Portal, we process data in addition to those described above, which you provide to us directly: health and fitness data (injuries, sleep quality, eating habits, photographs of your body progress), contact and billing data, and the log of your workouts and check-ins.

Purpose — to design, adapt, and monitor your training and nutrition plan, and to manage the contractual relationship (billing and support).

Legal basis — since these are special categories of data (Article 9 GDPR), this processing is based on your explicit consent, which you give when you complete the portal's initial questionnaire. You may withdraw it at any time without affecting the lawfulness of the processing carried out before its withdrawal.

Data processors — in addition to Hetzner (hosting), we use Supabase (database), Clerk (authentication), Stripe (payment processing), and Resend (transactional email delivery), all subject to the GDPR.

Retention period — for as long as the contractual relationship lasts and up to 5 years after it ends, due to the applicable tax and civil liability obligations.

Your progress photographs are only used publicly (social media, testimonials) if you give us your express and separate authorization to do so.

When you complete the onboarding process, we also generate your HH Athlete Diploma, a personalized document with your name and completion date that is sent to you by email and remains available in your Portal. Please note that this diploma is a symbolic recognition by the brand, with no academic or professional validation (more information in the Legal Notice).

As part of our ecosystem, we use artificial intelligence tools to support content creation and to assist in preparing training and nutrition plans. Their use is always supervised by Naiche and Eidan Hurtado, co-founders of HH Athletes, who review and validate the final result before it reaches you.

We may update this privacy policy to adapt it to legislative or service changes. The current version will always be available on this page, indicating the date of the last update.

HH Athletes uses the Instagram API to manage messaging for the @eidanhurtadoathlete account, through its own management dashboard ("Eidan Cold Blood").

Data we process — when you write a comment or a direct message (DM) to this account, we process the content of that message or comment, your Instagram user identifier assigned to the conversation (Instagram-scoped ID or IGSID), and, where applicable, the multimedia content (audio, image, or video) that the system sends you in response.

Purpose — these data are used exclusively to operate an automated reply system based on predefined keyword rules (with no artificial intelligence or dynamic content generation), which responds to your comments or messages by sending you the information, link, or content you requested.

Legal basis — your consent, given when you voluntarily start the conversation (comment or DM) with the account.

Recipients — they are not disclosed to third parties, except for the technical providers strictly necessary for the service to operate (dashboard hosting and message delivery infrastructure), all of them acting as data processors.

Retention period — for as long as the conversation remains active and up to 12 months after your last interaction, for support and service improvement purposes, unless you request their deletion sooner.

You can request the deletion of these data at any time by following the instructions on our Data Deletion page.

Data we process — the name, email address, and message you enter in the contact form on the website, and the language (Spanish or English) in which you were viewing it.

Purpose — to answer your inquiry. The message is not stored in the website's database: it reaches us by email in the team's inbox.

Legal basis — your consent, which you give by submitting the form (Article 6(1)(a) GDPR), and, if your inquiry is about purchasing coaching, taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).

Recipients — Resend (email delivery) and Google (provider of the team's email inbox), as data processors.

Retention period — for as long as necessary to handle your inquiry and, at most, 12 months from our last communication, unless you purchase coaching (section 10) or ask us to delete it sooner.

Data we process — if you completed one of the guided assessments we have run on the website (for example, the audit of your routine), the answers you gave (name, gender, age, goal, training habits, and available time), the email address you gave us to receive the result, and the plan you were interested in. As you progressed, we also recorded, without identifying data, how far you got and the type of device, to know at which point people left; if you gave us your email at the end, that record was linked to your answers.

Purpose — to send you your personalized result by email and to allow Naiche and Eidan to contact you to offer coaching suited to your answers.

Legal basis — your consent, which you gave by providing your email address to receive the result (Article 6(1)(a) GDPR). You may withdraw it at any time by writing to us, without affecting the lawfulness of the prior processing.

Recipients — Supabase (database), Resend (email delivery), and Google (the team's email inbox), as data processors.

Retention period — up to 12 months from your last interaction, unless you purchase coaching (section 10) or ask us to delete them sooner.

Data we process — if you arrive at the website through one of our campaign links (for example, the one we send you by direct message on Instagram), the source channel, the campaign, and your Instagram user identifier in that conversation (IGSID). They are stored in the hh_attr cookie in your browser for 30 days (see the Cookie Policy).

Purpose — to know which campaigns end in a purchase. If you purchase coaching within those 30 days, these data are attached to the payment record in Stripe. They are not used for advertising or profiling.

Legal basis — our legitimate interest in measuring which acquisition channels work (Article 6(1)(f) GDPR). You may object at any time by writing to us or by blocking cookies in your browser.

Recipients — Stripe, as the data processor for payments.

Retention period — 30 days in your browser; in the payment record, the same period as billing data (section 10).