TRIVO Platform Privacy Policy
Version 1.0.
This is an English translation of the Polish Privacy Policy. In case of any discrepancy, the Polish version prevails.
1. Controller#
1.1. The controller of your personal data is TRIVO.LIFE Prosta Spółka Akcyjna (a Polish simple joint-stock company) with its registered office in Lublin, ul. Gospodarcza 26, 20-213 Lublin, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001255469 by the District Court Lublin-Wschód in Lublin with its seat in Świdnik, 6th Commercial Division of the National Court Register, tax identification number (NIP) 9462770429, REGON 545290154 ("TRIVO", "we", "us").
1.2. For any matter concerning personal data, write to us at kontakt@trivo.life or by post to our registered office.
2. Scope of this Policy#
2.1. This Policy applies to the TRIVO Platform (the "Platform"), an application in which:
- 1.an Athlete creates an account, connects a sports watch and manages their training, on their own or with an Expert;
- 2.an Expert coaches Athletes in their own panel;
- 3.an Athlete can find an Expert in the directory and propose cooperation.
2.2. This Policy does not apply to other TRIVO services and websites, which are governed by separate privacy policies.
2.3. The Platform is intended for adults only.
2.4. Definitions used in this Policy:
- 1.Athlete: a person who uses the Platform to manage their own training;
- 2.Expert: a coach or a dietitian who works with Athletes through the Platform;
- 3.Manufacturer: Garmin or Suunto; Manufacturer Account: your Garmin Connect account or your Suunto app account;
- 4.Health Data: personal data concerning physical or mental health within the meaning of Article 4(15) GDPR, including heart rate, heart rate variability, sleep, stress, and information about injuries, wellbeing and nutrition where it concerns health;
- 5.GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).
3. Data we process#
3.1. Account data: email address, first name or display name, password (stored only as a cryptographic hash), role in the Platform, account settings, history of accepted documents and consents given.
3.2. Data provided by the Athlete: age, sex, height, body weight, maximum and resting heart rate, goals and planned races, experience level, information about injuries and wellbeing, rating of perceived exertion after training (RPE) and, when working with a dietitian, information about eating habits. Some of this data is Health Data.
3.3. Watch data, if you connect your Manufacturer Account (section 5):
- 1.activities: type, date and time, duration, distance, pace, GPS route, elevation, heart rate, cadence, power and other metrics recorded by the device, including activity files (FIT);
- 2.all-day and recovery data: resting heart rate, heart rate variability (HRV), sleep, stress, energy level indicators, steps;
- 3.device model and your Manufacturer Account identifier.
The scope depends on the Manufacturer, the device model and the permissions you approve. Heart rate and the data listed in point 2 are Health Data.
3.4. Results of TRIVO algorithms (section 7), for example training load and recovery indicators.
3.5. Data from cooperation with an Expert: cooperation requests, training plans and recommendations, comments, notes and messages exchanged in the Platform.
3.6. Expert data: first and last name, photo, description of experience and qualifications, specialisation, town, offer, contact details.
3.7. Payment data: subscription type and period, amounts, payment dates and status, invoicing details. Payment card data is handled by the payment operator (section 9.2); we do not have access to the full card number.
3.8. Technical data: IP address, device and browser type, event logs, error information.
3.9. Correspondence with us: the content of messages and any data you provide in them.
4. Health Data and your consents#
4.1. We process Health Data on the basis of your explicit consent (Article 9(2)(a) GDPR). We ask for it separately from accepting the Platform terms of service, before you connect a watch or first enter such data. The consent also covers storing this data for 12 months after you stop using the Platform (section 11).
4.2. Sharing your data with an Expert requires a separate consent, given to each Expert individually (section 6).
4.3. Consents are voluntary. Without the consent in section 4.1 you can create an account, but you will not be able to use features based on watch data and Health Data.
4.4. You can withdraw any consent at any time in your account settings or by writing to kontakt@trivo.life. Withdrawal does not affect the lawfulness of processing carried out before it. After you withdraw the consent in section 4.1, we disconnect your Manufacturer Account, stop collecting data and delete your Health Data within 30 days, except for the record of giving and withdrawing consent (section 11). After you withdraw the consent in section 4.2, the Expert loses access as described in section 6.3.
5. Watch data: Garmin and Suunto#
5.1. We collect watch data only through the official application programming interfaces of the Manufacturers (Garmin Connect Developer Program and Suunto Cloud API). We do not use intermediaries that pass on data from Manufacturer accounts.
5.2. You authorise the connection in the Manufacturer's window by signing in to your Manufacturer Account. We never learn your Manufacturer Account password. We receive only the data within the scope you approve.
5.3. The Manufacturer sends us data after your device syncs with your Manufacturer Account. The availability of data from before the connection depends on the Manufacturer's rules; for Garmin, we receive data from the moment of connection.
5.4. If you turn on sending plans to your watch, we send planned workouts (name, structure, target pace or heart rate zones) to your Manufacturer Account so that they appear on your device.
5.5. Garmin and Suunto are separate controllers of the data stored in your Manufacturer Account. Their privacy policies describe how they process that data.
5.6. We use data from the Manufacturers solely to provide you with the Platform services and, with your consent, to share it with your Expert. We do not sell this data, we do not use it for advertising and we do not share it with any parties other than those listed in section 9.
5.7. You can end the connection at any time in the Platform settings or in the Manufacturer's app. From that moment we receive no new data. Data collected earlier is retained as described in section 11; you can request its earlier deletion. If your trial period ends without a subscription, we end the connection automatically.
6. Expert#
6.1. The Expert is a separate controller of personal data. If you consent, the Expert gets access in the Platform to your profile, activities, recovery data, results of TRIVO algorithms, exertion ratings and training plan and, in the case of a dietitian, also to information about your nutrition. The Expert processes this data for their own purpose, namely the services they provide to you, under their own responsibility, including in accordance with any rules governing their profession. Before you consent, we show you the Expert's own information on how they process data.
6.2. TRIVO processes the data stored in the Platform, including plans, recommendations and notes entered by the Expert, as a controller, in order to provide the Platform services to you and to the Expert.
6.3. You can revoke the Expert's access at any time in the settings. From that moment the Expert loses access in the Platform to your data, including historical data. The Expert, as a controller, is responsible for any data they have stored outside the Platform; please contact the Expert directly about it.
6.4. When you send an Expert a cooperation request, you share your first name or display name, goal, experience level and message with them. The Expert gets no access to your Health Data until they accept the request and you give the consent in section 4.2. Expert profiles in the directory are visible to Platform users.
6.5. Payment for the Expert's services is settled directly between you and the Expert, outside the Platform.
7. TRIVO algorithms and profiling#
7.1. We analyse watch data and the data you provide using TRIVO's own algorithms, including machine learning methods, running on our infrastructure. The algorithms calculate training indicators, for example training load, your typical values and deviations from them, and recovery status.
7.2. This automated assessment concerns your health and fitness and therefore constitutes profiling within the meaning of Article 4(4) GDPR. It is based on your explicit consent (section 4.1). The results are visible to you and, with your consent, to your Expert.
7.3. Algorithm results are informational and supportive and do not constitute medical advice. Training decisions are made by you or your Expert. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
7.4. The algorithms use your data to calculate your own indicators. We do not use your personal data to develop algorithms on data from multiple users without your separate consent.
7.5. We do not share your data with third parties for the purpose of analysing it, including providers of large language models, and we do not make it available for training other parties' models.
8. Purposes and legal bases#
8.1. We process data for the following purposes:
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and maintaining the account, providing the Platform services | account data, profile, technical data | Article 6(1)(b) GDPR (contract) |
| Collecting, storing and presenting watch data | watch data, Health Data | Article 9(2)(a) and Article 6(1)(a) GDPR (explicit consent) |
| Calculating indicators with TRIVO algorithms (profiling) | watch data, data provided by the Athlete | Article 9(2)(a) and Article 6(1)(a) GDPR (explicit consent) |
| Sharing data with an Expert | scope described in section 6.1 | Article 9(2)(a) and Article 6(1)(a) GDPR (separate consent) |
| Expert directory and cooperation requests | Expert data, content of the request | Article 6(1)(b) GDPR (contract) |
| Storing data for 12 months after you stop using the Platform, so that you can return without losing your history | watch data, Health Data, algorithm results | Article 9(2)(a) GDPR (consent in section 4.1) |
| One trial period per Manufacturer Account | hash of the Manufacturer Account identifier | Article 6(1)(f) GDPR (legitimate interest: preventing abuse) |
| Payments, invoices, accounting | payment data | Article 6(1)(b) and (c) GDPR (contract, tax and accounting laws) |
| Service messages, for example account confirmation, end of trial period | email address | Article 6(1)(b) GDPR (contract) |
| Platform security, detecting and fixing errors | technical data | Article 6(1)(f) GDPR (legitimate interest) |
| Replying to messages | correspondence | Article 6(1)(b) or (f) GDPR |
| Proof of consents; establishing, exercising and defending legal claims | consent register, data needed in the given matter | Article 6(1)(f) and Article 9(2)(f) GDPR |
8.2. To ensure one trial period per Manufacturer Account, we store a cryptographic hash of the Manufacturer Account identifier. The hash does not contain the identifier itself, but it remains personal data in pseudonymised form.
9. Recipients of data#
9.1. We share data with entities that process it on our behalf under a data processing agreement (Article 28 GDPR) and only on our instructions:
- 1.providers of server infrastructure and hosting;
- 2.an email delivery service provider;
- 3.an error monitoring tool provider;
- 4.an email (mailbox) provider;
- 5.an accounting firm.
We will provide the current list of these entities on request.
9.2. Separate controllers to whom data may be disclosed are:
- 1.the Expert, with your consent (section 6);
- 2.Stripe Payments Europe, Limited, Ireland, for payment processing;
- 3.the Manufacturer, as described in section 5.4;
- 4.public authorities, where we are required by law to disclose data.
9.3. We do not sell personal data and we do not share it with advertisers.
10. Transfers outside the European Economic Area#
10.1. We store watch data and Health Data on servers located in the European Economic Area (EEA).
10.2. Some of the providers listed in section 9.1 may be established outside the EEA, in particular in the United States. We transfer data to them only on the basis of a European Commission adequacy decision (for the United States: the EU-US Data Privacy Framework, where the provider participates in it) or standard contractual clauses adopted by the European Commission. We will provide a copy of the safeguards on request.
11. How long we keep data#
11.1. Retention periods:
| Data | Retention period |
|---|---|
| Account data | until the account is deleted; after deletion we erase it within 30 days |
| Watch data, Health Data and algorithm results | for as long as you use the Platform and, after that (end of the trial period without a subscription or end of the subscription), for 12 months so that you can return without losing your history; then we delete it. We delete it earlier at your request, within 30 days of withdrawal of consent, or upon account deletion |
| Hash of the Manufacturer Account identifier | 24 months from the end of the trial period, including after account deletion |
| Plans, recommendations, notes and messages | until the account is deleted |
| Expert profile | until the Expert's account is deleted |
| Payment data and invoices | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Register of consents and accepted documents | for the duration of processing and until the limitation periods for claims expire |
| Logs and technical data | up to 12 months from the date of the event |
| Correspondence | until the matter is closed and, where it may be needed to establish, exercise or defend legal claims, until the limitation period expires |
11.2. Deleted data disappears from backups as part of their rotation cycle. Until then, we do not use it for any purpose.
11.3. Before your trial period ends, we remind you how long we will keep your data and how you can delete it earlier.
12. Your rights#
12.1. You have the right to:
- 1.access your data and obtain a copy of it;
- 2.rectify your data;
- 3.erase your data;
- 4.restrict processing;
- 5.data portability for data processed on the basis of consent or contract, including watch data;
- 6.object to processing based on legitimate interest;
- 7.withdraw consent at any time.
12.2. Deleting your account does not cover the hash of the Manufacturer Account identifier (section 8.2), which we keep on the basis of our legitimate interest in preventing abuse of the trial period. You can object to this processing.
12.3. Send your requests to kontakt@trivo.life. We respond without undue delay and in any event within one month. In particular cases this period may be extended by a further two months, and we will inform you about it.
12.4. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) or with the supervisory authority in the EU Member State of your habitual residence.
13. Security#
13.1. We apply technical and organisational measures appropriate to the risk, including encrypted connections, restricting access to data to people who need it, a consent register, backups and error monitoring.
13.2. In the event of a personal data breach, we notify the President of the Personal Data Protection Office and, where required by law, you.
14. Cookies and similar technologies#
14.1. The Platform uses only cookies and similar technologies that are strictly necessary for it to work, for example to keep you signed in and to secure your session. We do not use analytics or advertising tools. If this changes, we will ask for your consent before using them.
15. Changes to this Policy#
15.1. Each version of this Policy has a version identifier and remains available at a permanent address. Amended versions of this Policy state the date on which they take effect.
15.2. We inform you about material changes, in particular regarding the purposes of processing or recipients of data, in the Platform or by email at least 14 days before they take effect. If a change requires your consent, we will ask for it.
15.3. Version history:
| Version | Changes |
|---|---|
| 1.0 | first version |