Privacy policy

Data controller

Romain Gendry, 23 rue de Bretagne, 53320 Saint-Cyr-le-Gravelais, France. Contact about your data: [email protected].

Data we collect

Account: email address, first name, language, your newsletter choice (and when you made it). If you sign in with Google, Google sends us your email address and name. No password is stored: you sign in with a link sent by email or through Google.

Purchases: order contents, amount, currency, payment identifiers and invoices (Stripe). We never receive your full card number.

Tracking: completed sessions, progress, training log (the weights and reps you record).

Ultra questionnaire, if you fill it in: goal, level, equipment, availability, any injuries or pain, comments.

Technical data: IP address and connection logs, needed to keep the site secure.

Why, and on what legal basis

Performance of the contract: creating and managing your account, processing your purchases, giving you access to the content and the ROM Club, showing your progress, sending you service emails.

Legal obligation: keeping invoices and accounting records.

Consent: playback of videos hosted by YouTube or Vimeo, health data in the Ultra questionnaire, and Romain's newsletter.

The free guide is sent in exchange for signing up to Romain's newsletter (tips and offers). You can unsubscribe at any time from the Account page or through the link in every email, and you keep access to the guide.

Waiting list (before the site opens): your email and, if you give it, your first name, with your consent, to tell you about the launch, give you early access and send you the promised discount code, then Romain's newsletter. Unsubscribe at any time through the link in every email.

Legitimate interest: site security, fraud and bot prevention (Cloudflare Turnstile on the free guide form).

Your data is never sold or used for targeted advertising.

Health data

The training log and the Ultra questionnaire may reveal information about your physical condition. This information is used only to provide the follow-up you ask for, is never used for advertising and is deleted along with your account.

The "injuries / pain" field of the Ultra questionnaire is optional. If you fill it in, it is health data: it is processed only with your explicit consent (Article 9(2)(a) GDPR), collected through a mandatory checkbox before sending. The questionnaire is emailed to Romain so he can tailor your follow-up.

You can withdraw this consent at any time by writing to us; the information concerned is then deleted.

Recipients and processors

Your data can be accessed by the publisher and by Romain for your follow-up, and by the providers below, each for its own task.

WhatsApp (Meta) is not a processor of this site: you join the ROM Club groups voluntarily, with your own WhatsApp account, and accept its terms when you do. The site does not collect your phone number; it is visible to the other members of the group.

Transfers outside the European Union

Some providers (Stripe, Cloudflare, Google, Vimeo, Meta) may process data in the United States. These transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.

How long we keep data

Account and progress: for as long as you use the service, then 3 years after your last activity, or until you delete your account.

Orders and invoices: 10 years (accounting obligation), even after the account is deleted.

Newsletter for people who have not bought anything: 3 years after you last contacted us.

Waiting list: until the site opens, then like the newsletter (3 years after you last contacted us), unless you unsubscribe.

Technical logs: 12 months.

Consent cookie: 6 months.

Your rights

You have the right to access, rectify, erase and port your data, to object to and restrict its processing, to withdraw your consent at any time, and to set instructions for what happens to your data after your death.

You can delete your account yourself from the Account page of your member area: your account, progress and questionnaires are erased, any ROM Club subscription is stopped and you are removed from the mailing list. Orders and invoices are kept for our accounting obligations.

To exercise your other rights: [email protected]. We reply within one month. You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

If you live in Brazil, you also have the rights set out in the LGPD (Law No. 13,709/2018) and can contact the ANPD.

Security

All traffic is encrypted (HTTPS). Access to the data is restricted by database access rules: each member can only see their own data. Session cookies can't be read by page scripts. Payments take place exclusively on Stripe's secure page.

Minors

The programs are designed for adults. If you are under 15, you need the consent of a parent or legal guardian to create an account. If we learn that an account was created without it, we delete it.

Contact

For any question about your data: [email protected].