Skip to main content
NL

Legal / Privacy

Privacy statement

REZA Health & Performance handles your personal data with care, and data about your health in particular. This statement explains which data we process, why, on what legal basis, how long we keep it, with whom we share it and what your rights are.

We do not sell data, do not build advertising profiles and do not use your data for purposes other than those described below. This is a translation; if the Dutch and English versions differ, the Dutch version prevails.

Version 2.4 · last updated on 4 October 2026

1. Who is responsible for your data

The controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR) is Roberto Djaló, sole proprietorship, trading as REZA Health & Performance, registered with the Dutch Chamber of Commerce under number 42121379.

We have not appointed a data protection officer, as this is not required for a business of this size and nature (Article 37 GDPR). You can contact Roberto Djaló directly with any privacy question.

2. Scope

This statement covers the website rezahealthandperformance.nl, contact by email or phone, and the personal coaching we provide (training, nutrition, recovery, behaviour and habits). Third-party websites we link to, such as PubMed or journal websites, are not covered.

The Strength Log app has been announced but is not yet available. When it launches, it will come with its own privacy information before you enter any data.

3. Overview: what, why, on what basis and for how long

Processing
Contact form and email
Data
Name, email address, phone number (optional), topic of interest, your message
Purpose
Answering your question and arranging an introduction
Legal basis (GDPR)
Steps taken at your request before entering into a contract (Art. 6(1)(b))
Retention
12 months after the last contact if no coaching follows
Processing
Confirmation email
Data
Name and email address
Purpose
Letting you know your message was received
Legal basis (GDPR)
As above
Retention
As above
Processing
Performance Profile (when opening the full result)
Data
First name, email address, profile outcome with three priorities, preferred form of coaching and timing, source and campaign data, session reference, consent choices; no individual answers or scores
Purpose
Sending you the result and following up personally
Legal basis (GDPR)
Explicit consent (Art. 6(1)(a) and Art. 9(2)(a))
Retention
90 days after the last contact if no coaching follows
Processing
Personal coaching
Data
Contact details, goals, training plans, progress, appointments
Purpose
Providing the coaching as agreed
Legal basis (GDPR)
Performance of the contract (Art. 6(1)(b))
Retention
12 months after the coaching ends
Processing
Health data during coaching
Data
For example injuries, complaints, relevant medical history or medication you choose to share
Purpose
Training safely and responsibly, tailoring your programme
Legal basis (GDPR)
Your explicit consent (Art. 9(2)(a))
Retention
12 months after the coaching ends, or earlier if you withdraw consent
Processing
Financial records
Data
Name, address, invoices, payments
Purpose
Meeting tax obligations
Legal basis (GDPR)
Legal obligation (Art. 6(1)(c); Section 52 of the Dutch General Tax Act)
Retention
7 years
Processing
Website analytics (Google Analytics 4)
Data
Pseudonymous cookie ID, pages visited, device and browser data, derived region
Purpose
Understanding how the website is used and improving it
Legal basis (GDPR)
Consent (Art. 6(1)(a); Section 11.7a Dutch Telecommunications Act)
Retention
14 months in Google Analytics; cookies at most 13 months
Processing
Visitor statistics for the website and Performance Profile (Vercel Web Analytics)
Data
Page visited, referring website, campaign label in the link, country, region and city, device and browser type; no cookies
Purpose
Measuring use of the website and the profile
Legal basis (GDPR)
Legitimate interest (Art. 6(1)(f))
Retention
No visitor profiles; the daily code expires after 24 hours. We can view totals for 12 months (Vercel reporting window); Vercel may keep aggregated data longer. See section 7
Processing
Security and technical logs
Data
IP address, time, page requested, browser type, error messages
Purpose
Keeping the website secure and working, preventing abuse
Legal basis (GDPR)
Legitimate interest (Art. 6(1)(f))
Retention
At most 30 days

4. The contact form

When you submit the contact form, we send the details by email to REZA Health & Performance. You then receive a short confirmation at the address you entered. That confirmation deliberately does not include your message, so that nobody can use our form to send content of their own to others.

Your complete message exists only in our business mailbox. For timely follow-up, our restricted Lead Desk stores only your name, email address, optional phone number, interest, and the source and time of your request. Your message text is not sent to the Lead Desk. To limit abuse, the server briefly keeps your IP address in memory to cap the number of messages per ten minutes. That IP address is not stored and disappears after ten minutes at the latest.

Please do not include medical details in the form. We prefer to discuss those in person at the intake, where we also ask for your consent (see section 6).

5. The Performance Profile (profiel.rezahealthandperformance.nl)

The Performance Profile is an online questionnaire by REZA Health & Performance that takes about four minutes (currently available in Dutch only). You answer questions about training, nutrition, habits, performance and recovery, including your sleep. Based on this, you see which factor currently limits your progress most, with three priorities and a suitable first step.

Your individual answers and the scores per area are only used to calculate your profile: in your browser and, if you open the full result, briefly on the profile's server. They are not stored and not forwarded to REZA.

If you open the full result, we only receive the minimum set of data needed to send you the result and follow up personally:

  • your first name and email address;
  • the profile outcome: the profile name, the three priorities and the recommended first step;
  • your preferred form of coaching (1-on-1, 1-on-2 or to be discussed) and when you would like to start;
  • which page or campaign brought you to the profile (UTM data and the name of the referring website) and a random session reference;
  • your consent choices, with the version of the consent text and the time.

Purpose: sending you the result you requested and following up with a suitable introductory meeting. Because a profile outcome may say something about, for example, your recovery or sleep, we ask for your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You can withdraw that consent at any time via info@rezahealthandperformance.nl; we will then delete your data.

The profile sends this data through a secure server-to-server connection to our business mailbox at Zoho. You then receive a one-off confirmation with your outcome; this is not a newsletter. For follow-up, our restricted Lead Desk stores only your name, email address, chosen coaching format and timing, source data, session reference and consent choices. Your individual answers, scores and free text are not stored there.

You only receive messages about relevant insights and offers if you tick the separate, optional box. That choice is independent of your result and can be withdrawn at any time.

To see how many people start, complete and open a result, the profile uses Vercel Web Analytics, without cookies. Only steps, the type of profile, the priority and the chosen route are measured; never your name, email address, answers or free text.

If the profile does not lead to coaching, we delete your data no later than 90 days after the last contact, unless a client relationship or a legal obligation requires a different period. You can always request access, correction or deletion (see the section on your rights).

The Performance Profile provides general lifestyle and training insights. It is not a medical diagnosis or treatment. If you have pain, complaints or medical questions, please discuss them with your GP or another qualified healthcare professional.

6. Personal coaching and health data

If you start coaching with us, we process the data needed to coach you well: your goals, training plans, progress and our appointments. To train responsibly, we sometimes need to know something about your health, such as an injury, a complaint or medication that affects exercise. That is special category data.

  • We only process health data with your explicit consent (Article 9(2)(a) GDPR). We ask for that consent in writing at the intake and explain what we use the data for.
  • You can withdraw your consent at any time. We will then delete the health data. We may no longer be able to continue the coaching responsibly; if so, we will discuss this with you.
  • We only ask for what the coaching requires, share it with no one without your consent and never use it for marketing.
  • We do not diagnose or treat medical conditions. If you have complaints, we refer you to your GP or another healthcare professional.

After the coaching ends, we keep your training and health data for at most 12 months, so we can help you properly if you come back. After that we delete it. We keep invoices for 7 years, as required by Dutch tax law.

7. Website analytics

On your first visit we ask whether you allow analytics. Only if you click 'Allow analytics' does the website load Google Analytics 4. If you decline or make no choice, Google Analytics is not loaded and no analytics cookies are set.

In addition, this website counts visits with Vercel Web Analytics. This happens without cookies and without any other storage on your device: a visit is recognised by a temporary, irreversibly converted code (a hash) that expires after 24 hours. We only see aggregated figures, not individual visitors: for example pages visited, the referring website, the campaign label in a link, country, region and city and the type of device. We do not ask for consent for this; the legal basis is our legitimate interest in knowing how the website is used (Article 6(1)(f) GDPR).

  • Google signals and ad personalisation are switched off; no advertising profiles are created.
  • According to Google, Google Analytics 4 does not store IP addresses; a region is derived and the IP address is then discarded.
  • We measure which pages are visited and whether someone submits the contact form. The content of the form is never sent to Google.
  • Data is kept in Google Analytics for 14 months; the cookies expire after at most 13 months.

You can withdraw your consent at any time via 'Cookie settings' at the bottom of every page. Measurement stops immediately and the Google Analytics cookies are removed. See also the cookie statement.

8. Hosting, security and logs

The website is hosted by Vercel. Server functions, including processing of the contact form, run in Frankfurt (Germany). Pages are delivered through Vercel's global network, so a visitor from the Netherlands is normally served by a server in Europe. We use technical logs (such as IP address, time and page requested) only to keep the website secure and working, and keep them for at most 30 days.

We take appropriate technical and organisational measures (Article 32 GDPR), including encrypted connections (HTTPS), access to data only for those who need it, data processing agreements with our processors and abuse limits on the form. In the event of a data breach we act in accordance with Articles 33 and 34 GDPR.

9. Who we share data with

We use the following parties. They process personal data only on our instructions, as processors within the meaning of Article 28 GDPR, under a data processing agreement.

Party
Zoho Corporation B.V. (Utrecht)
Purpose
Business email, sending the contact form and the Performance Profile outcome
Location
Zoho data centres in the EU
Basis for transfers outside the EEA
Not applicable (processing in the EU)
Party
Vercel Inc.
Purpose
Hosting of the website and the Performance Profile, server functions, visitor statistics for the website and the profile (without cookies)
Location
Server functions in Frankfurt; global delivery network
Basis for transfers outside the EEA
EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795); Vercel is certified
Party
Supabase Inc.
Purpose
Restricted Lead Desk for following up requests
Location
Ireland (EU)
Basis for transfers outside the EEA
Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) for any access from the US
Party
Google Ireland Limited
Purpose
Website analytics, only with your consent
Location
EU and US (Google LLC as sub-processor)
Basis for transfers outside the EEA
EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795); Google LLC is certified

Otherwise we share data only at your request or with your agreement, for example with your physiotherapist, or where the law requires us to. Transfers outside the European Economic Area take place only on a valid basis under Chapter V GDPR, as listed per party above. We do not store health data with parties outside the EEA.

10. Retention periods

Data
Message or enquiry with no follow-up
Maximum retention
12 months after the last contact
Data
Performance Profile with no follow-up
Maximum retention
90 days after the last contact
Data
Coaching data (goals, plans, progress)
Maximum retention
12 months after the coaching ends
Data
Health data
Maximum retention
12 months after the coaching ends, or earlier if consent is withdrawn
Data
Invoices and other financial records
Maximum retention
7 years (Section 52 Dutch General Tax Act)
Data
Technical logs
Maximum retention
30 days
Data
Google Analytics data
Maximum retention
14 months

After that, we delete the data or irreversibly anonymise it.

11. Automated decision-making

We do not take decisions about you based solely on automated processing (Article 22 GDPR) and do not build advertising profiles of visitors. The Performance Profile outcome is an indicative starting point based on your own answers; no decision about you is based on it. Your programme is put together by a person.

12. Your rights

  • Access to the data we hold about you and a copy of it (Article 15 GDPR).
  • Rectification of inaccurate or incomplete data (Article 16).
  • Erasure of your data, unless we are required to keep it (Article 17).
  • Restriction of processing (Article 18).
  • Portability of data you provided yourself, such as your training history (Article 20).
  • Objection to processing based on our legitimate interest (Article 21).
  • Withdrawal of consent at any time, with effect for the future (Article 7(3)).

Send your request to info@rezahealthandperformance.nl. We may ask you to verify your identity; please do not send a copy of your ID unless we ask for it. We respond without undue delay and within one month at the latest. For complex requests this may be extended by two months, in which case we will tell you within the first month (Article 12(3) GDPR). Exercising your rights is free of charge.

If you disagree with how we handle your data, please contact us first. You can always lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (Article 77 GDPR), or go to court (Article 79 GDPR).

13. Obligation, minors and changes

You are not legally required to provide personal data. Without contact details we cannot answer your message, and without the information needed for coaching we cannot coach you responsibly.

Our coaching is aimed at adults. We only process data of young people under 16 with the consent of a parent or guardian (Article 8 GDPR and Article 5 of the Dutch GDPR Implementation Act).

We update this statement when our services or the law change; the version and date at the top show when that last happened. Version 2.4 of 4 October 2026 adds that minimum contact and source details from the contact form and Performance Profile are kept in the restricted Lead Desk for follow-up; free text, individual answers and scores are not stored there. Version 2.3 of 2 October 2026 corrects the description of those statistics (location down to city level, aggregated figures rather than totals, reference to section 7). Version 2.2 of 2 October 2026 adds cookieless Vercel visitor statistics for the whole website (section 7). Version 2.1 of 24 September 2026 adds the Performance Profile (section 5). Version 2.0 of 24 September 2026 replaces version 1 of 23 September 2026 and adds, among other things, the confirmation email, coaching and health data, processors and retention periods.