Effective date: 12.08.2026
Last updated: 12.08.2026
Version: 1.0

This Privacy Policy explains how we collect, use, share and protect personal data when you visit joinconsistency.com (the "Website"), create an account, purchase our products, or otherwise interact with us (together, the "Services").

Please read it together with our Cookie Policy, Terms of Use and Refund Policy.

1. Who we are

The controller of your personal data is:

Active Life Gyms Spółka z o.o.
ul. Zamknięta 10/1.5
30-554 Kraków, Poland

NIP: 6793283727
KRS: 0001071048
Registered with the District Court for Kraków-Śródmieście in Kraków, XI Commercial Division of the National Court Register
Share capital: PLN 360,000

Email: info@joinconsistency.com

In this Policy, "we", "us" and "our" refer to Active Life Gyms Sp. z o.o.

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Privacy enquiries are handled directly at the address above.

2. Who this Policy applies to

This Policy applies to everyone who uses the Services, wherever they are located. It contains:

• general information relevant to all users;
• Section 10, which sets out additional rights for individuals in the European Union and European Economic Area under the GDPR;
• Section 11, which sets out additional rights for residents of California and certain other US states.

Our Services are intended for adults aged 18 and over. See Section 13.

3. Personal data we collect

3.1 Data you give us

Account data. When you create an account, we collect your first name, last name and email address. Your account and password are managed for us by Memberstack.

Billing and transaction data. When you make a purchase, we collect your billing address, country, and records of your transactions (amounts, dates, products purchased, subscription status, invoices). Payment is processed by Stripe.

We never see or store your full card number. Card details are entered directly into Stripe's payment environment and are processed by Stripe as an independent controller. We receive only a payment confirmation and limited data such as the last four digits, card brand and expiry.

We collect your address because we are legally required to issue invoices and to determine the correct tax treatment of your purchase.

Health and fitness data (Personalized Plans only). If you purchase a Personalized Plan, we ask you to complete an intake form covering matters such as your age, sex, height, weight, training experience, training goals, injuries, medical conditions, medication, surgeries and other factors relevant to safe exercise programming.

This is special category data under Article 9 GDPR and is treated separately — see Section 6.

Communications. If you email us or contact support, we collect your email address, the content of your message and any attachments you send.

Marketing preferences. If you subscribe to our email list, we collect your email address, your consent record, and information about how you interact with our emails (opens, clicks).

Other content you choose to send us. For example, feedback, testimonials, or photos and videos you voluntarily submit. We only use images or testimonials featuring you for marketing purposes if you have given us separate, explicit written consent.

3.2 Data we collect automatically

• Technical data: IP address, browser type and version, operating system, device type, screen resolution, language and time zone settings.
• Usage data: pages viewed, programs and training days accessed, videos played, time spent, referring URL, and the dates and times of your visits.
• Cookies and similar technologies: see Section 4 and our Cookie Policy.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Our prices are the same for all users and are not personalised based on your data.

3.3 Data we do not collect

We do not operate a progress tracker, workout log or user profile beyond your basic account details. We do not ask you to record your weight, measurements or training results on the Website.

4. Cookies and tracking

We use cookies and similar technologies for four purposes: to make the Website work, to remember your preferences, to understand how the Website is used, and to measure and improve our advertising.

Strictly necessary cookies (including those used by Memberstack to keep you logged in and by Stripe for fraud prevention) are set on the basis of our legitimate interest and cannot be disabled.

Analytics, advertising and personalisation cookies — including Google Analytics and, where used, Meta Pixel, TikTok Pixel and Google Ads — are only set after you give consent.

When you first visit the Website, a consent banner lets you accept all cookies, reject all non-essential cookies, or choose individual categories. Non-essential cookies and tracking scripts are blocked until you make that choice — they do not run in the background while the banner is displayed.

You can change or withdraw your consent at any time using the cookie settings link in the Website footer. We keep a record of the consent you gave, so that we can demonstrate compliance.

Full details of each cookie, its provider, purpose and duration are in our Cookie Policy.

Embedded video

Our training content is delivered through video hosted by Vimeo, Inc. We embed all videos in Do Not Track mode, which means Vimeo does not set tracking cookies, does not build a viewing profile of you, and does not use your activity for advertising or third-party analytics.

Vimeo still receives the technical data necessary to deliver the video to your device, including your IP address, browser and device type. This is unavoidable for any video played over the internet and is carried out to perform our contract with you.

5. Why we use your data, and our legal bases

To create and maintain your account and give you access to the content you purchased — we use your account data. Legal basis: performance of a contract, Art. 6(1)(b).

To process payments and manage subscriptions and renewals — we use your billing and transaction data. Legal basis: performance of a contract, Art. 6(1)(b).

To issue invoices, keep accounting records and comply with tax law — we use your billing and transaction data. Legal basis: legal obligation, Art. 6(1)(c).

To prepare and deliver your Personalized Plan — we use your intake form data, including health data. Legal basis: performance of a contract, Art. 6(1)(b), together with your explicit consent, Art. 9(2)(a).

To provide customer support — we use your communications with us. Legal basis: performance of a contract, Art. 6(1)(b), and our legitimate interest, Art. 6(1)(f).

To send service emails such as receipts, renewal reminders, password resets and content updates — we use your account data. Legal basis: performance of a contract, Art. 6(1)(b).

To send marketing emails and newsletters — we use your email address and marketing engagement data. Legal basis: your consent, Art. 6(1)(a).

For analytics and improving the Services — we use technical and usage data. Legal basis: your consent, Art. 6(1)(a).

For advertising, retargeting and measuring campaigns — we use technical and usage data. Legal basis: your consent, Art. 6(1)(a).

To use your photos, videos or testimonials in marketing — we use the content you submit. Legal basis: your separate explicit consent, Art. 6(1)(a) and Art. 9(2)(a).

To secure the Website and prevent fraud and abuse — we use technical and transaction data. Legal basis: our legitimate interest, Art. 6(1)(f).

To establish, exercise or defend legal claims — we use whichever data is relevant. Legal basis: our legitimate interest, Art. 6(1)(f), and Art. 9(2)(f).

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.

Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You may ask us for details of that assessment, and you have the right to object (Section 10).

6. Health data — Personalized Plans

If you purchase a Personalized Plan, you will be asked to disclose information about your health, injuries and physical condition. We need this to design a program that is appropriate and safe for you.

We apply the following safeguards:

1. Explicit consent. Before you submit the intake form, you must tick a separate, unticked checkbox specifically consenting to our processing of your health data for this purpose. This is separate from accepting our Terms of Use.
2. Purpose limitation. We use this data solely to prepare and adjust your program and to communicate with you about it. We never use health data for marketing, advertising or analytics, and we never sell or share it.
3. Access limitation. Your intake data is accessible only to Serhiy Moroz, who personally prepares the plans.
4. Retention. We delete your health data 12 months after the end of our work together, unless a longer period is required to defend a legal claim. See Section 9.
5. Withdrawal. You may withdraw your consent at any time by emailing info@joinconsistency.com. If you withdraw before or during delivery, we will no longer be able to provide the Personalized Plan, and the consequences for your purchase are set out in our Terms of Use.

Important: Personalized Plans are a fitness coaching service, not a medical, diagnostic, physiotherapy or rehabilitation service. We do not provide medical advice. See our Terms of Use.

7. Who we share your data with

We do not sell your personal data. We share it only with the service providers below, each of which acts on our instructions as a processor, or as an independent controller where indicated.

• Webflow, Inc. (USA) — website hosting and CMS. Receives technical data and form submissions.
• Memberstack, Inc. (USA) — accounts, authentication and content access control. Receives account data and login records.
• Stripe, Inc. and Stripe Payments Europe Ltd. (USA and Ireland) — payment processing, subscriptions, tax calculation and invoicing. Receives billing and transaction data, and card data.
• Google Ireland Ltd. and Google LLC (Ireland and USA) — Google Analytics, and Google Ads where used. Receives technical and usage data.
• Vimeo, Inc. (USA) — video hosting and delivery, with Do Not Track mode enabled. Receives IP address, browser and device type.
• Tally (EU) — intake forms for Personalized Plans. Receives intake form data, including health data.
• Klaviyo, Inc. or MailerLite Ltd. (USA or EU) — email marketing. Receives your email address and marketing engagement data.
• Meta Platforms Ireland Ltd. (Ireland and USA), planned — advertising and retargeting. Would receive technical and usage data.
• TikTok Technology Ltd. (Ireland and USA), planned — advertising and retargeting. Would receive technical and usage data.

Stripe acts as an independent controller in respect of card data and fraud prevention, under its own privacy policy.

We may also share data with our accountants and legal advisers, where necessary and under a duty of confidentiality; with public authorities, where we are legally required to disclose it; and with a successor entity, if our business is sold, merged or reorganised. We will notify you in advance if the last of these happens.

Skool — a separate service

Purchasers of the 8-Week System are invited to join a community hosted on Skool.com. Skool is operated independently. If you choose to join, you create your own account directly with Skool, and Skool acts as an independent controller of the data you provide there.

We can see your public profile and posts within our community, and we may remove members who no longer hold an active purchase. We are not responsible for Skool's own data practices — please review Skool's privacy policy before joining. Joining is optional; you can use the 8-Week System without it.

8. International transfers

Several of our providers are located in, or transfer data to, the United States. Whenever we transfer personal data outside the European Economic Area, we make sure at least one of the following applies:

• the recipient is certified under the EU–US Data Privacy Framework, or the transfer is otherwise covered by an adequacy decision of the European Commission; or
• the transfer is governed by the European Commission's Standard Contractual Clauses, combined with additional technical and organisational safeguards where our assessment shows they are needed.

You can request a copy of the relevant safeguards by emailing info@joinconsistency.com.

9. How long we keep your data

• Account data — for as long as your account is active, then 12 months after closure or last login.
• Billing, transaction and invoice data — 6 years from the end of the calendar year in which the transaction occurred, as required by Polish accounting and tax law.
• Health data from Personalized Plan intake forms — 12 months after the end of the engagement.
• Support and email correspondence — 24 months from the last message.
• Marketing list data — until you unsubscribe, after which we keep a minimal suppression record so that we do not contact you again.
• Photo, video and testimonial consents — until consent is withdrawn, plus a record of the consent itself for evidentiary purposes.
• Analytics and advertising data — as set out in our Cookie Policy, and generally no longer than 14 months.
• Records relating to a legal claim — until the claim and any applicable limitation period ends.

After these periods, data is deleted or irreversibly anonymised.

10. Your rights under the GDPR

If you are in the EU or EEA, you have the following rights:

• Access — obtain confirmation of whether we process your data, and a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted, where one of the grounds in Art. 17 GDPR applies.
• Restriction — have processing limited in certain circumstances.
• Portability — receive data you provided to us, based on consent or contract, in a structured, machine-readable format, and have it transmitted to another controller where technically feasible.
• Objection — object at any time to processing based on our legitimate interests. You may object to direct marketing at any time, and we will stop immediately, without exception.
• Withdraw consent — at any time, where processing is based on consent.
• Lodge a complaint — with a supervisory authority.

To exercise any of these rights, email info@joinconsistency.com. We will respond within one month. If your request is complex, we may extend this by up to two further months and will tell you if we do.

We may ask you to confirm your identity before acting on a request. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

Supervisory authority in Poland:
Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl

If you live in another EU/EEA country, you may also complain to your local authority.

11. Your rights in the United States

If you are a resident of California, or of another US state with comprehensive privacy legislation (including Virginia, Colorado, Connecticut, Utah and Texas), you have rights broadly equivalent to those below.

Categories of personal information we have collected in the past 12 months: identifiers (name, email, IP address); commercial information (purchase and subscription records); internet and network activity; geolocation inferred from IP address; and, for Personalized Plan customers only, health information.

We do not sell your personal information, and we have not sold or shared personal information for cross-context behavioural advertising in the past 12 months, except to the extent that the use of advertising cookies — where you have consented to them — is treated as "sharing" under California law. You can opt out at any time through our cookie banner or by emailing us.

We do not knowingly collect or sell the personal information of anyone under 16.

Your rights:

• Know and access the categories and specific pieces of personal information we have collected.
• Delete personal information we hold about you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing for targeted advertising.
• Limit the use of sensitive personal information. We already limit our use of health data to delivering the service you purchased.
• Non-discrimination — we will not deny you service, charge you a different price or provide a lower quality of service because you exercised your rights.

To exercise these rights, email info@joinconsistency.com. We will confirm receipt within 10 business days and respond within 45 days, with one possible 45-day extension. You may use an authorised agent, in which case we will require proof of their authority.

We honour Global Privacy Control signals as a valid opt-out request for the browser sending them.

12. Security

We protect your data using measures appropriate to the risk, including encryption in transit (HTTPS/TLS), access controls and strong authentication on all administrative accounts, restriction of access to health data to a single named individual, use of established providers that maintain their own recognised security certifications, and no storage of payment card data on our systems.

No system is completely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and report it to the supervisory authority as required by Articles 33 and 34 GDPR.

13. Age requirement

The Services are intended solely for individuals aged 18 or over. We do not knowingly collect personal data from anyone under 18, and accounts may not be created by minors.

If we learn that we have collected data from a person under 18, we will delete that data and close the account promptly. If you believe a minor has provided us with personal data, contact info@joinconsistency.com.

14. Third-party links and platforms

The Website and our content may link to third-party platforms, including YouTube, Skool and social media. Those platforms have their own privacy policies, and we are not responsible for their practices. Embedded content may allow those platforms to collect data about you.

If you interact with us on YouTube or social media, the relevant platform is the controller of the data it collects. We may see and use public interactions such as comments and messages, but we do not import or store follower data.

15. Changes to this Policy

We may update this Policy from time to time. The current version, and the date it took effect, will always be shown at the top of this page.

If we make material changes — for example, adding a new purpose for processing or a new category of recipient — we will notify registered users by email at least 14 days before the change takes effect. Where a change requires your consent, we will ask for it separately.

16. How to contact us

Active Life Gyms Spółka z o.o.
ul. Zamknięta 10/1.5, 30-554 Kraków, Poland
NIP: 6793283727 · KRS: 0001071048
District Court for Kraków-Śródmieście in Kraków, XI Commercial Division of the National Court Register
Share capital: PLN 360,000

All enquiries, including privacy and data rights requests: info@joinconsistency.com

We respond to enquiries within 2 business days, Monday to Friday. Support is provided in English.

‍