Privacy Statement

1. Who I am

I am Claudio Fray, trading as The Fray. I work as a personal trainer and online coach, and I am the controller of the personal data described below, which means I decide what is collected and why.

• The Fray (Claudio Fray), sole proprietorship (eenmanszaak)
• Elizabeth Cady Stantonplein 547, 1102 BL Amsterdam, the Netherlands
• Chamber of Commerce (KvK): 62734636 · VAT (BTW-ID): NL002481815B25
• mail@claudiofray.com · +31 6 11 29 72 14

I have not appointed a Data Protection Officer and I am not required to have one. You can reach me directly with any question about your data.

2. What this statement covers

This statement applies to the personal data I process as your trainer and coach: in-person personal training and classes, online coaching, the Skool community, my digital products, my newsletter and my website.

It does not cover your gym membership. Classes and training sessions take place at TrainMore Koninginneweg. TrainMore is a separate company that decides for itself how it handles your membership data, and it has its own privacy statement. If you have a question about your membership, your access pass or your gym payments, that is a question for TrainMore.

3. What data I collect

Depending on which of my services you use, I may collect:

• Identity and contact details — name, address, email address, phone number, date of birth.
• Health and body data — weight, body fat percentage, muscle mass, body measurements and other InBody scan results, injuries, illnesses, conditions and medication relevant to training safely, dietary requirements and allergies.
• Progress photos — photographs in training clothing, swimwear or underwear, taken only if you have given separate written consent.
• Coaching records — your training programme, logged sets and weights, nutrition plan, session notes, attendance, goals and progress over time.
• Communication — WhatsApp and email messages, and your posts and messages in the Skool community.
• Payment and administration — invoices, amounts, payment dates, and the account details visible on transfers you make. If you pay online, your card details go straight to Stripe and are never held by me.
• Marketing and website data — your email address and how you signed up, whether you open or click my emails, and data about your visit to my website and my ads.

I do not collect biometric data for the purpose of identifying you. Body composition measurements are health data, and I treat them with the extra care set out in Section 5.

4. Why I collect it, and on what legal basis

Under the GDPR I need a lawful basis for everything I do with your data. These are mine:

5. Health data and progress photos

Health data and progress photos are the most sensitive things I hold about you, so they get their own rules.

Where they live. Your training programme, your logged sessions and your body measurements live in Hevy, the coaching app I build your programme in. Body composition is measured on the InBody scanner at the gym and the results reach me through the InBody app. Progress photos reach me through Hevy or by email and are stored in your private folder in my Google Drive. WhatsApp is for communication only — scheduling, check-ins, questions and encouragement. I do not keep health data or photos there.

• I only collect them with your explicit, separate consent, given in writing before we start.
• They are used for one purpose only: building your plan and showing you your own progress.
• They are never published, posted, shown to another client, or used in marketing or testimonials — not anonymised, not cropped, not "just the before shot" — unless you have given a separate, specific consent for that exact use, which you can withdraw at any time.
• You can withdraw your consent at any moment. I will delete the photos and any progress reports built from them without undue delay, and in any case within one month.
• Refusing photos or refusing to share a health detail never costs you anything, other than that I may not be able to train you safely around a condition I don't know about.

6. Where your data is stored, and who else touches it

I run a small business on ordinary software, so your data sits on platforms operated by other companies. They act on my instructions and may not use your data for their own purposes. Each one is bound by a data processing agreement.

Your private client folder in Google Drive is shared with you and me only. No other client can see it.

My bank. Payments you make by transfer reach my business account at ABN AMRO. A bank is not acting on my instructions — it handles your payment data under its own legal duties and its own privacy statement.

7. Data outside the European Union

Several of the platforms above are American. Where your data leaves the EU, the transfer is covered either by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

InBody is South Korean. South Korea has an adequacy decision from the European Commission, which means the Commission considers its data protection level equivalent to the EU's and no further safeguard is needed.

You can ask me for a copy of the safeguards that apply to any specific provider.

8. Newsletter, website and advertising

If you download a free guide, book a free InBody scan or sign up to my list, I add you to my mailing list and send you training tips and occasional offers. You consent to that when you sign up, every email carries an unsubscribe link, and unsubscribing takes effect immediately. Unsubscribing from the newsletter does not affect any coaching you have booked.

My website and my ads use cookies and similar technology to see which campaigns work. Anything beyond what is strictly necessary to make the site function only runs if you accept it in the cookie banner, and you can change your mind at any time.

I never add coaching clients to a marketing list automatically, and I never upload health data or progress data to an advertising platform.

9. How long I keep your data

At the end of that year everything in the first five rows is deleted — from Hevy, from your Drive folder, from the InBody app and from my mailbox. You do not need to ask.

If you would rather I kept your file longer, because you plan to come back, tell me and I will note the request and keep it.

10. How I keep it secure

• Every account is protected by a unique password in a password manager and two-factor authentication where the platform supports it.
• Your client folder is shared with you and me only, with link sharing switched off.
• My laptop and phone are encrypted and lock automatically.
• I keep the number of places your data sits as small as I can, and I delete what I no longer need.

No system is perfect. If something does go wrong, Section 14 explains what happens.

11. Sharing with others

I do not sell your data and I do not trade it. Beyond the platforms listed in Section 6, your data is shared only when:

• you have asked me to — for example, sending your plan to your physiotherapist or doctor; or
• the law requires it.

I do not pass your health data, measurements or photos to TrainMore, to other clients, or to anyone else without your explicit consent.

12. Your rights

You can ask me, at any time, to:

• See the data I hold about you, and get a copy.
• Correct anything that is wrong or out of date.
• Delete your data.
• Restrict what I do with it while a question is being sorted out.
• Object to processing based on my legitimate interest.
• Take it with you — receive the data you gave me in a common file format, or have it sent to another coach.
• Withdraw consent — see Section 13.

Email me at mail@claudiofray.com and I will respond within one month. There is no charge. I may ask you to confirm who you are before I send data anywhere.

I do not make automated decisions about you and I do not profile you in any way that has a legal or similarly significant effect.

13. Withdrawing your consent

Where I rely on your consent — health data, progress photos, the newsletter, advertising cookies — you can withdraw it at any time, in writing, without giving a reason. Withdrawing consent does not make what I did before that moment unlawful, and it does not cancel a coaching agreement you have already entered into.

14. If something goes wrong

If there is a data breach, I record it. Where the breach is likely to pose a risk to you, I report it to the Dutch Data Protection Authority within 72 hours of becoming aware of it. Where the risk to you is high, I tell you directly and without delay, in plain language, including what happened and what you can do.

15. Under-18s

I train clients aged 18 and over. I do not train children or under-18s, and I do not knowingly collect data about anyone under 18.

16. Complaints

If you think I am handling your data badly, tell me first — most things are fixed in a single email. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) at any time, without going through me first.

17. Changes to this statement

If I make a material change — a new purpose, a new platform holding your data, a longer retention period — I will tell you by email and in the Skool community at least 14 days before it takes effect. Smaller corrections are published here with an updated date. The current version always lives on my website.

Last updated: 26 August 2026.

This statement is published in English. If you would prefer it in Dutch, ask me and I will send you a Dutch translation — the English text remains the binding one.