Privacy notice

1. Who is responsible

• Controller: Performance Unit Oy (2742495-4)
• Address: Pursimiehenkatu 26 C, 00150 Helsinki
• Contact for privacy questions: info@performanceunit.com

2. What we collect

If you are a member:

• Account details: name, email address, phone number (optional) and preferred language.
• Membership details: your PU coach's name (from the coach list), whether you signed up yourself, and whether your membership is active.
• Bookings: which events you booked, joined the waitlist for or cancelled, when, and whether you attended (check-in) or didn't show up.
• Guests you save: the name and email of people you want to bring as your +1.
• Emails we send you: a log of booking emails (type, time, delivery status).
• Technical data: a login session cookie, a language cookie, and the IP address of sign-up attempts that fail (to block guessing).

3. If you were added as someone's +1

A member gave us your name and email so they could bring you to an event. We use them to:

• create a guest login for you, so you can see the events you've been booked into;
• email you booking confirmations, calendar invites, changes, cancellations and reminders for those events;
• record whether you attended.

We don't use guest details for marketing. You can ask us to delete your details at any time (see section 8), or ask the member to remove you from their guest list.

4. Why we use your data, and on what basis

• Providing the events service (accounts, bookings, waitlists, check-in, booking emails and calendar invites): necessary to provide the service included in your membership (GDPR art. 6(1)(b), contract).
• Checking that new sign-ups are PU clients by matching the coach's name: contract, and our legitimate interest in keeping the service for clients (art. 6(1)(f)).
• Guests (+1s): our and the member's legitimate interest in letting members bring a guest (art. 6(1)(f)).
• Attendance records and planning sessions: legitimate interest in running and improving group training (art. 6(1)(f)).
• Security (limiting sign-up attempts, keeping logs): legitimate interest in protecting the service (art. 6(1)(f)).

5. Who processes the data for us

We use these service providers, bound by data processing agreements:

• Supabase: database and logins. Data is stored in the EU (Ireland).
• Vercel: hosts the website. Its server functions run in the EU (Dublin); Vercel is a US company.
• Resend: sends our emails. Resend is a US company.

Where a provider is based in or may access data from outside the EU/EEA, the transfer is covered by the EU's standard contractual clauses and/or the EU–US Data Privacy Framework under that provider's data processing agreement. We don't sell your data or use it for advertising.

6. Cookies

• Login cookies: keep you signed in.
• Language cookie (NEXT_LOCALE): remembers English or Finnish.

Both are strictly necessary for the service, so we don't ask for consent. We don't use analytics or advertising cookies on this site.

7. How long we keep it

• Your account and booking history: while you are a client. When your membership ends your account is deactivated, and it is deleted on request or when we remove inactive accounts.
• Guest details: while a member keeps you on their guest list; removed on request.
• Email log: 12 months, then deleted automatically.
• Failed sign-up attempts (IP address): deleted automatically after 24 hours.

8. Your rights

• See the data we hold about you, and get a copy (access and portability).
• Correct it: you can edit your name, phone, language and coach yourself in your account.
• Have it deleted, or restrict or object to its use.
• To use these rights, email info@performanceunit.com. We reply within one month.
• Complaints: you can contact the Data Protection Ombudsman (Tietosuojavaltuutettu), tietosuoja.fi.

9. Changes

We update this notice when the service changes. The date at the top shows the latest version.