Privacy notice
Who we are
Anamaria Vidis, trading as AMV Fitness, is the sole trader responsible for your personal information. Our fitness services are for adults aged 18 and over.
This notice covers the website and general enquiries. Before introducing online client accounts, payment collection, health questionnaires or an external AI chat service, we will explain the additional information handling that applies.
For privacy questions, deletion requests or privacy complaints, email compliance@amvfitness.com. You may also raise a request through another business contact channel; no special wording is needed.
Information we use
You may give us your name, contact details, the service you are interested in and a message through our contact form, email, chat or another contact method you choose. Please provide only what we need to help you. Without a way to reply or enough information about your enquiry, we may be unable to answer it.
The general enquiry form and website chat are not for medical questionnaires, detailed health information, identity documents or payment-card details. If you become a client, we will explain any necessary safety screening and its handling separately before asking for that information.
Our website and embedded features also process technical information, which can include your IP address, browser/device information and the page requested.
Why we use information
| Purpose | Lawful basis |
|---|---|
| Handle an enquiry submitted through our optional HubSpot website form, including the follow-up you request | Your consent |
| Discuss a service and take steps you request by email or telephone before becoming a client | Steps at your request before entering a contract |
| Answer other email or telephone questions and manage that correspondence | Our legitimate interests in answering and managing business enquiries |
| Provide, secure, monitor and troubleshoot the website and its fallback chat feature | Our legitimate interests in providing a reliable, secure service and detecting faults; consent for device storage/access where required |
| Respond to privacy rights and meet applicable record-keeping duties | Compliance with the relevant legal obligation |
| Establish, exercise or defend legal claims | Our legitimate interests in handling claims; an additional applicable condition where necessary health information is involved |
| Send future promotional emails where you separately opt in | Your consent |
Where we rely on legitimate interests, we consider the need for the processing and your rights. A general enquiry, marketing choice or acknowledgement of this notice is not permission to collect health information. Health information needs a separate, appropriate condition as well as a lawful basis.
Enquiries and optional marketing
We currently answer enquiries and send service-related messages. We do not currently run a newsletter or promotional email programme.
Using our HubSpot website form is optional. If you choose it, we ask for consent to use your contact details and message in HubSpot and related enquiry correspondence to answer your enquiry and manage the follow-up you request. The processing checkbox is needed to submit that form. If you prefer not to give it, email contactme@amvfitness.com or telephone us using the number on our Contact page for the same enquiry service.
You may withdraw that form-processing consent at any time by emailing compliance@amvfitness.com or using another business contact channel. No account or special wording is required; we need enough information to identify the enquiry. We will stop the processing and follow-up that rely on that consent. We do not switch the same processing to legitimate interests after withdrawal. Separately necessary records for a legal obligation or a specific claim may be kept only for the distinct legal-duty or legal-claims purposes explained in this notice, under the applicable basis in the table above. This is not a basis for continuing ordinary enquiry follow-up.
The email-marketing choice on our enquiry form is separate, optional and unchecked. Declining it does not prevent an enquiry. If we introduce promotional emails, we will explain the programme and use the permission recorded for that purpose. You can withdraw marketing consent through an unsubscribe link in a promotional email or by contacting compliance@amvfitness.com. Withdrawal does not affect earlier lawful processing. Withdrawing marketing permission does not stop a requested enquiry reply; withdrawing form-processing consent does stop the follow-up based on that consent. Each choice is handled for its own purpose.
Contact form and website chat
Our contact form uses HubSpot and Google reCAPTCHA. Submissions create CRM records; notifications and correspondence can also create email copies. Choose Load contact form to open this optional feature after reading the explanation beside it, or use email/telephone without loading it. That choice is kept only for the current page and does not give marketing permission. HubSpot receives the enquiry details you submit. The embedded form and reCAPTCHA also process technical information when loaded to provide the form and its abuse protection. This is separate from your choice to receive marketing emails.
Unload contact form removes the form from the page and its visible unsent entries. It does not undo information already sent, withdraw an enquiry or marketing permission, or erase provider cookies/storage. Contact compliance@amvfitness.com for a withdrawal request; browser settings can clear stored site data.
The website chat uses predefined fallback replies. Messages are sent to our website server to produce a response. In this mode the application does not save a server-side chat transcript or send messages to an external AI provider. A short-lived request counter helps limit abuse; technical logs are separate from transcripts. Chat is not a medical assessment or an emergency service, and its fallback replies do not decide eligibility for services, pricing or other matters with legal or similarly significant effects.
Your conversation stays in page memory unless you choose Remember this chat. No chat storage is accessed before you open chat. Remembering saves the conversation in that browser with an expiry 30 days after your last message; opening, reloading and automated replies do not renew the period. Turning remembering off removes saved history. Clear also resets the conversation and turns remembering off.
Expired history is not reused. Cleanup runs when chat next opens or an active page checks expiry, where the browser permits removal. A closed or suspended browser cannot run that cleanup. Controls apply only to that browser and website address; we cannot remotely erase another device's storage. If storage is unavailable, chat stays in memory; if removal is blocked, the interface explains how to clear browser storage. Remembering does not give marketing permission or enable an external AI service.
Cookies, browser storage and external features
Google Analytics, Google Tag Manager and Microsoft Clarity are disabled in our launch configuration. Other features still process information:
- Chat: optional remembered history follows the period and controls above.
- App-install preference: dismissing the install prompt remembers that choice for 30 days from dismissal. Page visits do not renew it. Reset app install preference removes the saved choice. Expiry cleanup needs an active page and permitted browser storage; if storage is unavailable, dismissal lasts only for the current page. Old indefinite preferences are discarded rather than adopted.
- Embedded services: HubSpot and reCAPTCHA make requests when loaded and can use device storage or access technologies under their own settings and purposes.
- Offline support: the WordPress app uses a service worker to show a basic connection-failure page. That worker does not cache visited pages, form/chat submissions, credentials, administrator pages or API responses for offline use.
- Administration: WordPress login/session features are used by authorised administrators. Public client registration and comments are disabled.
The contact page offers an Open Google Maps link; the map service opens only when you follow it. Following our external WhatsApp link opens WhatsApp. Those services apply their own privacy terms. You may contact us by email instead.
Who receives information
Anamaria handles customer enquiries and privacy requests within AMV Fitness. Slavko provides technical maintenance and marketing support. Business email distribution forwards messages to the relevant mailboxes. Service providers receive information for the following purposes:
| Recipient | Purpose and role |
|---|---|
| HubSpot | Supplies the contact form, CRM and related notifications on our behalf; its own privacy terms also describe any separate provider uses |
| Zoho Mail | Supplies business email and distribution/forwarding |
| Google consumer Gmail | Authorised team mailboxes receive forwarded messages and correspondence under Google's consumer-service privacy terms; these internal destinations are not public contact addresses |
| Hostinger | Hosts the WordPress website and database; our VPS is in Manchester, UK |
| Google Cloud Storage | Stores encrypted WordPress recovery backups in South Carolina, United States, separately from Gmail |
| Google Cloud Monitoring | Checks availability, certificates and minimal application/backup health, and sends operational alerts to authorised administrators; the health response does not contain enquiry or chat content |
| Google reCAPTCHA | Supplies embedded abuse protection under the applicable Google terms |
| Google Maps | Receives information when you follow the external map link |
| WhatsApp/Meta | Receives information when you choose that external contact method |
We may share relevant information with an adviser, insurer or public authority where needed for a legal obligation or a claim. We do not routinely send all enquiries to those recipients.
Processing outside the UK
Our WordPress server is in the UK, our HubSpot account's primary hosting location is the European Union (Germany), and encrypted recovery backups are stored in South Carolina, United States. Those locations do not determine where every provider processes data. Email, CRM and embedded-service providers can also process information in the United States and other countries where they or their suppliers operate.
Published provider arrangements include the HubSpot data-processing agreement, Hostinger data-processing addendum, Zoho UK privacy information and Google's transfer frameworks. These describe different roles and mechanisms, including contractual clauses and UK addenda where applicable. These provider links are background information, not proof that a particular safeguard covers every AMV account. Consumer Gmail and Google Cloud are separate services with different terms. Contact compliance@amvfitness.com for information about the destinations and safeguards applicable to your information and how to obtain a copy.
How long we keep information
| Information | Policy period |
|---|---|
| Enquiries that do not become client relationships | Normally no more than 12 months after the last meaningful contact; remove earlier where appropriate, including following consent withdrawal unless a separate lawful reason requires particular records |
| Obvious spam | 30 days after identification |
| Marked operational test messages | 30 days after the check closes; retain only a minimal sanitised result where needed |
| Unused optional marketing permission before a programme starts | Review 12 months after the original opt-in, without automatic renewal; remove unused information where no longer justified and keep any necessary minimal consent/suppression evidence separately |
| Minimal marketing suppression records | While needed to prevent unwanted contact, with annual review; these records are not permission to send marketing |
| AMV-controlled website/application security and operational logs | Normally no longer than 90 days; a justified incident-specific hold may apply |
| Essential adult-client contract, safety, consent, session and incident evidence | A limited six-year archive after the last session or service end, whichever is later; review necessity and access annually |
| Sole-trader tax-supporting records | Where the Self Assessment rule applies, at least five years after the relevant 31 January filing deadline; applicable tax requirements may differ |
| Complaint or legal-claim records | Relevant information only, for as long as needed for the particular matter and applicable duties, with review dates |
The client file is reviewed within 90 days after the last session or service end, whichever is later. Routine material and unnecessary duplicates are not kept simply because a limited evidence archive is needed. The six-year period is our business policy for necessary evidence, not a statutory period for every health record or a guarantee that all claims expire then. Client safety and health handling will be explained separately before collection.
The ordinary enquiry period is a maximum, not permission to continue consent-based processing after withdrawal. We do not keep all non-client enquiries for six years in case of a claim. Any separately necessary legal or claim record is limited to the particular purpose, with its own review date.
Retention applies to relevant CRM, email and attachment copies. Moving something to Trash does not necessarily erase it immediately. Providers can retain copies in recovery and backup systems for additional limited periods. Their own security and delivery-trace records can have separate periods; AMV's 90-day log rule does not control all provider records.
WordPress recovery copies have separate backup review and rotation controls. The cloud backup bucket has an existing deletion rule for objects at 60 days and seven days of soft-delete recovery after actual deletion; provider execution is asynchronous. Our ordinary policy maximum for local encrypted recovery copies is 60 days, including copies whose cloud counterpart has already expired. Completed raw, downloaded or extracted rehearsal copies are reviewed for removal seven days after a verified replacement recovery point. A still-needed rollback exception has a specific purpose, named reviewer and dated hold. These review controls do not promise immediate physical erasure. Recovery copies are for recovery rather than ordinary enquiry follow-up. Relevant deletions must be reapplied before restored data returns to ordinary use. Browser chat history follows the device controls described above.
Your rights and complaints
Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your information. Where processing relies on consent, you can withdraw it. A duty or justified claim may require particular records to be kept; we will explain our response.
Your right to object: you can object to processing based on our legitimate interests for reasons relating to your situation. We must stop that processing unless we can demonstrate overriding compelling grounds or need the information for legal claims. You can object to direct marketing at any time; we will stop using your information for that purpose. Contact compliance@amvfitness.com.
Contact compliance@amvfitness.com. We check identity proportionately and normally respond to rights requests without undue delay and within one calendar month. If a permitted extension is needed, we explain why within the initial period. Exercising your rights is normally free of charge.
We acknowledge privacy complaints within 30 days, investigate and respond without undue delay, and keep you informed. This is separate from the rights-request deadline. You also have the right to complain to the UK's Information Commissioner's Office.
Effective date: 2026-10-25.