Privacy policy

Draft of 22 October 2026

Who is responsible for your data

The controller of your personal data is Company d.o.o., Street 1, 1000 Ljubljana, Slovenia, registration number 0000000000, VAT ID SI00000000. It runs jakamarinko.com, the coaching and lab testing of Jaka Marinko and its coaches.

For anything about your data, write to [email protected]. We answer within one month.

What data we collect and why

Account: your name, email address, language, how you sign in (email link or Google) and the consents you gave, with their dates. We need it to give you an account.
Bookings: the test or session you booked, date, time and location, your name, email and phone number, payment status and the link or ad that brought you to us. We need it to carry out the booking.
Payments: amount, status and invoice. Card details go directly to Stripe; we never see your full card number.
Health data: your answers to the health questionnaire (PAR-Q+) and the informed consent form before a lab test; test measurements such as blood lactate, heart rate, power and speed, VO₂max and body measurements; training files you upload (heart rate, power, pace, route); daily check-ins (sleep, fatigue, soreness, illness); and the plans, analyses, reports and training zones made from them. This is a special category of data under GDPR art. 9 and we use it only with your explicit consent.
Messages: what you write to your coach or through the contact form.
Technical data: IP address and browser details in server logs, to keep the site secure, and the cookies described in the cookie policy.

Legal bases

Contract (GDPR art. 6(1)(b)): account, bookings, payments, packages and messages.
Legal obligation (art. 6(1)(c)): invoices and accounting records.
Explicit consent (art. 9(2)(a)): health data. You give it when you create an account or fill in the health questionnaire before a test.
Consent (art. 6(1)(a)): marketing cookies and ad measurement, and marketing emails.
Legitimate interest (art. 6(1)(f)): security, server logs and visit statistics without cookies.

How plans, analyses and reports are made

Training plans, workout analyses, lab reports and training zones are produced automatically by software from your data. Part of that software is a service of an AI service provider (see Processors), which writes the plans and texts within fixed rules.

The logic, in plain words: the software takes your lab results, goals, available time, the training you upload and your check-ins. From them it calculates your training zones and builds or adjusts your plan according to the coaching method of our head coach, Jaka Marinko, who is responsible for that method. Before you see anything, the result is checked against fixed safety rules, for example how quickly weekly training volume may grow and how much rest follows an illness. If a check fails, or your data shows a warning sign such as illness, pain or unusual heart rate, nothing is sent to you automatically: a coach is alerted and takes it over.

This processing sets your training content. It is not a medical assessment and decides nothing about your contract, price or access to our services. Messages you write to a coach are answered by a person.

You can ask at any time for a coach to review a plan, analysis or report, tell us your view and contest the result (GDPR art. 22(3)). You can also object to this processing (art. 21) by writing to [email protected]. We then stop it for your data. Because the plans, analyses and reports in our packages are produced this way, your package ends at the end of the paid period, without the minimum term.

Who sees your data

Your data is seen by the coaches assigned to you, the head coach, and the people who run the service when it is needed for support or security. We do not sell personal data.

Processors handle data for us, only on our instructions and under a data processing agreement. They are listed in the next section.

Processors

Hetzner Online GmbH (Germany): servers, database and encrypted backups (Storage Box). All in Germany.
Cloudflare, Inc. (USA, global network): delivers the website and protects it from attacks. It sees IP addresses and page requests.
Stripe Payments Europe, Ltd. (Ireland): online payments and invoices.
Email delivery provider: sends account and booking emails. It will be named here before this policy takes effect.
Anthropic, PBC (USA): AI service provider that produces plans, analyses and reports from your data (see above).
Google Ireland Limited: sign-in with Google, if you choose it, and the coach's calendar, which receives the time, type and your name for each booking.
Meta Platforms Ireland Ltd. and Google Ireland Limited: measuring our ads, only with your marketing consent (see the cookie policy).

Visit statistics come from Umami, which runs on our own server in Germany, sets no cookies and shares nothing with anyone.

Where your data is

Our servers and backups are in Germany, in the EU. Data leaves the EU only through processors based outside it (Cloudflare and Anthropic, and Meta and Google for ads with your consent). Those transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep data

Account, health and training data: while your account exists. After you delete the account it is removed within 30 days.
Health data after consent is withdrawn: deleted within 30 days, unless you give consent again.
Invoices and accounting records: 10 years after the end of the year they were issued, as tax law requires.
Bookings without an account, including the health questionnaire: 2 years after the test.
Contact form messages: 12 months after our last reply.
Server logs: 30 days.
Backups: deleted data stays in encrypted backups for up to 6 months, until they rotate out.

Your rights

You have the right to access your data, correct it, have it deleted, restrict its processing, receive it in a machine-readable format (portability) and object to processing. You can export your data and delete your account yourself in your account settings (Privacy); for anything else write to [email protected].

If you think we handle your data unlawfully, you can complain to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si) or the authority where you live.

Young athletes

Our services are for people aged 15 and over. For younger athletes a parent or guardian creates the account, gives the consents and signs the consent form for a test.

Security

Data travels encrypted (HTTPS), backups are encrypted, and each coach sees only their own athletes.

Changes

If this policy changes, we publish the new version here with its date. If a change affects how we use data you already gave us, we tell you by email first.