PRIVACY POLICY

Last updated: 28.04.26

This Privacy Policy describes how Irina Zelenkova (hereinafter, "we", "us", or the "Data Controller") collects, uses, stores, and protects personal data of Users of this website and clients of our services, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR"), Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD"), and Spanish Law 34/2002 on Information Society Services and Electronic Commerce ("LSSI-CE").

1. Data Controller

Data Controller	Irina Zelenkova (self-employed professional / autónoma)
NIE	Y7411519J
Registered address	Avinguda Diagonal, 336, 1º 2ª, 08013 Barcelona, Spain
Email	dr.irinazelenkova@gmail.com
Telephone	+34 609 452 819
Website	https://en.owntop.world/

We have not appointed a Data Protection Officer (DPO), as this is not required under Article 37 GDPR for our processing activities. For any data protection enquiry, you may contact us using the details above.

2. Categories of Personal Data We Process

2.1 Data collected through the website

When you contact us through the website's contact form or by email, we collect:

Identification data: full name
Contact data: email address, telephone number
Content of the message you send us
Technical data automatically collected through cookies and similar technologies (IP address, browser type and version, operating system, device type, pages visited, time of visit, referring URL). For details, see our Cookie Policy.

2.2 Data collected outside the website (when you become a client)

If, following an initial enquiry, you decide to engage our personal training, hypoxia training, or high-altitude preparation services, additional categories of personal data are collected offline, after the signature of a separate service agreement, and not through this Website. These additional categories include:

Health information (see Section 4 below): pre-existing medical conditions, contraindications, medications, prior injuries, results of physical assessments, fitness data (heart rate, SpO₂, training metrics) — collected through a dedicated written health questionnaire and informed-consent form signed at the start of the engagement.
Emergency contact details: name, relationship, telephone of a contact person.
Training and performance data: training plans, progress logs, performance assessments — generated during the provision of the services.
Billing data: name, address, NIE/NIF or equivalent tax identifier, payment details — collected for invoicing purposes.

These categories of data are governed by the separate service agreement and accompanying consent forms signed by the client. They are described in this Privacy Policy for transparency purposes only. They are not collected through the contact form, newsletter sign-up, or any other functionality of this Website.

2.3 Sources of data

We collect personal data:

Directly from you, when you fill in forms, send us emails or messages, sign up for newsletters, book sessions, or otherwise communicate with us;
Automatically through cookies and analytics tools when you browse the website;
From third-party platforms when you contact us through them (booking platforms, social media, messaging applications including WhatsApp Business).

3. Purposes of Processing and Legal Bases

We process your personal data for the following purposes and on the following legal bases under Article 6 GDPR (and Article 9 GDPR for health data, see Section 4):

Purpose	Categories of data	Legal basis
To respond to your enquiries submitted through the contact form, email, telephone, WhatsApp Business or social media	Identification, contact, message content	Art. 6(1)(b) GDPR — pre-contractual measures at the data subject's request
To provide training, advisory and consulting services	Identification, contact, billing, training data	Art. 6(1)(b) GDPR — performance of a contract
To assess your physical suitability for hypoxia training and high-altitude programmes, and to ensure your safety during the services	Health data	Art. 9(2)(a) GDPR — explicit consent (additional to Art. 6(1)(b))
To issue invoices and comply with tax, accounting and commercial obligations	Identification, billing	Art. 6(1)(c) GDPR — compliance with a legal obligation
To send commercial communications and newsletters about our services	Identification, contact	Art. 6(1)(a) GDPR — consent
To analyse traffic and improve the website (analytics cookies)	Technical data	Art. 6(1)(a) GDPR — consent (via cookie banner)
To display advertising and measure advertising effectiveness (advertising cookies, Meta Pixel)	Technical data	Art. 6(1)(a) GDPR — consent
To prevent fraud and ensure the security of the website	Technical data	Art. 6(1)(f) GDPR — legitimate interest
To respond to requests from public authorities, courts, or to defend legal claims	All categories	Art. 6(1)(c) and Art. 6(1)(f) GDPR

You may withdraw your consent at any time by contacting us using the details in Section 1. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Health Data — Special Category

Given the nature of our services (physical training, hypoxia training, preparation for high-altitude mountaineering), the provision of services to a client requires the processing of information about the client's health, which under Article 9 GDPR constitutes a special category of personal data subject to enhanced protection.

Health data is not collected through this Website. It is collected exclusively offline, after the signature of a separate service agreement, by means of a dedicated written health questionnaire and informed-consent form. The use of the contact form, newsletter, or any other Website functionality does not result in the collection of health data.

When health data is collected through the separate offline procedure, it is processed exclusively on the basis of the client's explicit, free, specific and informed consent (Art. 9(2)(a) GDPR), obtained in writing before the commencement of any training programme. The client is not obliged to provide health data; however, refusal may make it impossible for us to provide certain services safely, in which case we may decline to provide them.

Where collected, health data is processed exclusively for the following purposes:

To assess the client's medical suitability for the training programme;
To design a training plan adapted to the client's health status;
To monitor the client's physiological responses during sessions and ensure their safety;
To act in case of a medical emergency during a session.

We apply enhanced security measures to health data, including restricted access (only the Data Controller and personnel strictly necessary to provide the service), encrypted storage, and confidentiality undertakings. Health data is not shared with marketing platforms, advertising networks, or analytics providers, nor is it discussed through WhatsApp Business or other instant-messaging channels, which are used only for non-sensitive communications.

5. Recipients of Personal Data

We share personal data only when necessary for the purposes set out above, and only with the following categories of recipients, all of whom act as data processors under written agreements that comply with Article 28 GDPR (except where they act as independent controllers, which we will indicate).

5.1 Service providers (data processors)

Website hosting: Hetzner Online GmbH (Germany / Finland, EEA)
Email service / corporate inbox: Google LLC (Gmail / Google Workspace)
Email marketing: Mailchimp (Intuit Inc.)
Online booking and scheduling: booking is made by email, so no third-party processor is involved.
Payment processing: Stripe Payments Europe Ltd. and/or PayPal (Europe) S.à r.l. et Cie, S.C.A. — these providers act as independent controllers for the payment data they process.
Bank transfer payments: processed through your and our respective banking institutions, which act as independent controllers under banking law.
Analytics: Google LLC (Google Analytics)
Advertising and social media tracking: Meta Platforms Ireland Ltd. (Meta Pixel / Facebook / Instagram)
Business messaging: WhatsApp Business — operated by WhatsApp Ireland Ltd. (Meta Platforms group). When you contact us via WhatsApp Business, your phone number, profile name, and the content of your messages are processed under WhatsApp's own Business Terms of Service and Privacy Policy. We use WhatsApp Business solely for general communication and do not exchange health information or other special-category data through this channel.

5.2 Independent third parties (with your consent)

Where you instruct us to do so, or where it is necessary to provide services you have requested, we may share your data with:

Expedition organisers with whom you intend to participate in mountaineering or high-altitude programmes — for the purpose of registering you, confirming your medical fitness, and coordinating logistics;
Hypoxia-equipment providers and clinical hypoxia centres — for the purpose of arranging access to hypoxia chambers, simulators, or related equipment.

In each case we will inform you of the specific recipient and request your specific consent before transferring your data.

5.3 Public authorities and professional advisors

Spanish Tax Agency (AEAT) and other public authorities, when required by law;
External accountant / gestoría declarando SL, for the management of accounting and tax obligations;
Legal advisors, where necessary for the establishment, exercise or defence of legal claims;
Insurance providers, where relevant to claims.

5.4 No sale of personal data

We do not sell personal data to third parties.

6. International Transfers

Some of the service providers listed in Section 5 are based outside the European Economic Area (EEA), in particular in the United States (Google, Meta, Stripe, Mailchimp, etc.). When personal data is transferred to such countries, we ensure that appropriate safeguards under Chapter V of the GDPR are in place, namely:

EU–U.S. Data Privacy Framework (where the recipient is certified): Adequacy Decision of the European Commission of 10 July 2023;
Standard Contractual Clauses (SCCs) approved by the European Commission, where the Data Privacy Framework does not apply;
Where appropriate, supplementary technical and organisational measures.

You may request a copy of the safeguards applied to international transfers by contacting us at the address in Section 1.

7. Retention Periods

We retain personal data only for as long as necessary for the purposes for which it was collected, and in accordance with the following criteria:

Category of data	Retention period
Contact-form enquiries that do not lead to a contractual relationship	Up to 1 year from the last contact, then deleted
Client records (identification, contact, training and performance data)	Duration of the contractual relationship + 5 years (statute of limitations for civil claims under Article 1964 of the Spanish Civil Code)
Health data	Duration of the contractual relationship + 5 years thereafter, unless you withdraw your consent earlier (in which case data is deleted, except where its retention is required by law)
Invoicing and accounting records	6 years (Article 30 of the Spanish Commercial Code)
Tax records	4 years as a minimum (Article 66 of the Spanish General Tax Law) — applied jointly with the 6-year accounting period
Marketing consents and communications	Until you withdraw consent or unsubscribe; subscription history retained for 3 years as proof of consent
Cookies and analytics data	As specified in the Cookie Policy
Records demonstrating compliance with GDPR (consents, requests)	3 years after the end of the relationship

After the applicable period, data is securely deleted or anonymised.

8. Your Rights

Under the GDPR and the LOPDGDD, you have the following rights in relation to your personal data:

Right of access (Art. 15 GDPR): to obtain confirmation of whether we process your data, and to receive a copy of it.
Right to rectification (Art. 16): to correct inaccurate or incomplete data.
Right to erasure / right to be forgotten (Art. 17): to request deletion of your data, where applicable.
Right to restriction of processing (Art. 18): to ask us to limit the processing of your data in certain cases.
Right to data portability (Art. 20): to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to object (Art. 21): to object to processing based on legitimate interest, including direct marketing — in which case we will stop processing immediately for marketing purposes.
Right to withdraw consent at any time (Art. 7), without affecting the lawfulness of processing carried out before the withdrawal.
Right not to be subject to automated decision-making (Art. 22): we do not carry out automated decisions or profiling that produces legal or similarly significant effects on you.

How to exercise your rights

You can exercise your rights free of charge by writing to us at:

Email: dr.irinazelenkova@gmail.com
Postal address: Avinguda Diagonal, 336, 1º 2ª, 08013 Barcelona, Spain

Please include sufficient information for us to identify you and the right you wish to exercise. We may request proof of identity. We will respond within one month of receiving your request, extendable by a further two months in complex cases (Art. 12(3) GDPR).

Right to lodge a complaint

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD):

Website: https://www.aepd.es
Postal address: C/ Jorge Juan, 6, 28001 Madrid, Spain
Telephone: +34 901 100 099 / +34 912 663 517

9. Security Measures

We have implemented technical and organisational measures appropriate to the risk of the processing, in accordance with Article 32 GDPR, including:

Access controls and password protection on devices and accounts that store personal data;
Encryption of devices storing client and health records;
Regular software updates and antivirus protection;
Confidentiality undertakings;
Periodic review of processors and their compliance documentation;
Secure deletion of data at the end of the retention period.

10. Minors

Our services and website are directed at adults. We do not knowingly collect personal data from persons under the age of 14 without the consent of a parent or legal guardian, in accordance with Article 7 of the LOPDGDD. If you become aware that a minor has provided us with personal data without such consent, please contact us so we can delete it.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The updated version will be posted on this page, with a revised "Last updated" date. Where the changes are material, we will provide additional notice (for example, by email).

12. Contact

For any question regarding this Privacy Policy or the processing of your personal data, please contact:

Email: dr.irinazelenkova@gmail.com
Telephone: +34 609 452 819
Postal address: Avinguda Diagonal, 336, 1º 2ª, 08013 Barcelona, Spain