Privacy Policy

Athlea Ltd is the data controller for personal data processed in connection with the Services.

You have the right to lodge a complaint with the UK Information Commissioner's Office if you are not satisfied with how we handle your data.

Website: www.ico.org.uk

This Privacy Policy applies to all personal data we collect and process when you use:

• the Athlea web application at www.athlea.ai;
• the Athlea mobile applications on iOS and Android;
• the Athlea API and developer tools; and
• any AI-powered features within the above.

This Policy applies to Consumers, Business Users, and Developers. Where Athlea acts as a data processor on behalf of a Business User, that relationship is governed by a separate Data Processing Agreement. To request a DPA, contact legal@athlea.ai.

The table below sets out our purposes for processing and the legal basis under the UK GDPR for each.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object to processing based on legitimate interests at any time.

We do not sell your personal data. We share it only in the following circumstances.

Athlea is based in the United Kingdom. Some service providers, including Microsoft Azure and other technology partners, process personal data in the United States or other countries outside the UK and EEA.

Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including UK Standard Contractual Clauses, UK adequacy regulations where applicable, and technical and organisational measures such as transport encryption, encryption at rest, pseudonymisation, and access controls.

You may request a copy of the relevant transfer safeguards by contacting privacy@athlea.ai.

We retain personal data only for as long as necessary to fulfil the purposes in this Policy, or as required by law.

You have the following rights in relation to your personal data:

• Right of access (Article 15).
• Right to rectification (Article 16).
• Right to erasure (Article 17).
• Right to restriction (Article 18).
• Right to data portability (Article 20).
• Right to object (Article 21).
• Rights relating to solely automated decisions with significant effects (Article 22).
• Right to withdraw consent where processing is based on consent.

To exercise any of these rights, contact privacy@athlea.ai. We will respond within one calendar month and may ask you to verify your identity. There is no charge for most requests.

If you are dissatisfied with our response, you may complain to the ICO:

• Website: www.ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

• Encryption of data in transit using TLS 1.2+ and at rest using AES-256.
• Role-based access controls limiting access to authorised personnel only.
• Regular security assessments and penetration testing.
• Multi-factor authentication for internal systems.
• Incident response procedures aligned with ICO breach notification requirements.

No method of transmission or storage is completely secure. If you suspect a security incident involving your account or personal data, contact admin@athlea.ai immediately.

The Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without appropriate consent, contact privacy@athlea.ai and we will delete it promptly.

The Services may link to or integrate with third-party websites and services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use in connection with Athlea.

Where Athlea processes personal data on behalf of a Business User, Athlea acts as a data processor. In those cases:

• a Data Processing Agreement must be in place between Athlea and the Business User;
• the Business User is responsible for ensuring a valid legal basis for processing;
• Athlea will process data only on the Business User's documented instructions; and
• Athlea will assist the Business User in meeting its obligations under applicable data protection law.

To request a DPA, contact admin@athlea.ai.

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or via in-app notice at least 14 days before they take effect. The effective date at the top of this Policy shows when it was last updated.