Privacy Policy
1. Who We Are
The Tri Project Ltd (company number 16992787), registered in England and Wales, trading as "The Tri Project" ("we", "us", "our"), of 1 Kelcey Road, Quorn, Loughborough, LE12 8UU, United Kingdom, is the data controller responsible for your personal data as described in this policy.
If you have any questions about this policy or how we handle your personal data, contact us at contact@thetriproject.com.
2. Scope of This Policy
This policy applies to (a) your use of The Tri Project community, hosted on the Circle platform, which operates on a paid subscription basis, (b) our 1:2:1 coaching services for clients who progress beyond the community, including the medical screening and training data collected as part of that service, and (c) our main website, including the waitlist sign-up form referred to in Section 3.8.
Circle also provides its own privacy notice governing the underlying platform infrastructure. This policy explains, in addition, how The Tri Project itself collects and uses your data.
3. Personal Data We Collect
3.1 Account and subscription data
Name, email address, username, and password, collected when you register and subscribe to the community.
3.2 Payment data
Your subscription is processed by Stripe, our payment processor. We do not store your full card details — Stripe processes and stores this information directly, in accordance with its own security standards (PCI DSS) and privacy policy.
3.3 Community activity data
Posts, comments, direct messages to other members, and any other content you choose to share within the community.
3.4 Training and performance data (all members)
Linking your TrainingPeaks account is a condition of joining the community: it is how we assign you a training plan from the TrainingPeaks Marketplace and give you access to a TrainingPeaks Premium account, both included as part of your subscription. This link gives us access to your training data, which may include workout metrics, heart rate, pace, power, GPS/location during activities, and similar performance data. Because this can reveal health-related information, we explain how and why we use it, and your rights over it, separately in Section 5.1.
3.5 Health information (coaching clients only)
Before starting 1:2:1 coaching, you complete a medical screening form covering information such as pre-existing injuries, medical conditions, and medications. We explain how and why we use this, and your rights over it, separately in Section 5.2.
3.6 Technical and usage data
IP address, browser and device information, and how you use the community and any Tri Project web pages, collected automatically via Google Analytics.
3.7 Marketing and social media data
If you interact with our Instagram page or any Tri Project advertising on Meta platforms (Facebook/Instagram), Meta may collect data about that interaction under its own privacy policy. We may also collect your email address if you sign up to a mailing list, via [marketing platform — not yet selected].
3.8 Waitlist data
If you join our waitlist via our website, we collect your email address through FormSubmit, a third-party form service embedded on the site. We then manually transfer this into our Google Workspace account to manage and contact people on the waitlist.
3.9 Website enquiry form
Our main website also has an enquiry form, hosted on a separate platform (Zite). This form does not currently store or forward any submissions, so no personal data is collected through it. If that changes, this policy will be updated to describe what is collected and why.
4. How and Why We Use Your Data, and Our Legal Basis
We only use your personal data where we have a lawful basis to do so under UK data protection law. The table below sets out our main purposes.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Provide and administer your community subscription | Account, subscription, payment data | Necessary to perform our contract with you |
| Deliver your TrainingPeaks Marketplace plan and Premium account (all members) | Training and performance data via TrainingPeaks | Contract, to deliver your plan and Premium account; explicit consent for health-related elements (e.g. heart rate) |
| Deliver 1:2:1 coaching services | Training, performance, and health screening data | Contract; explicit consent for health data |
| Process payments | Payment data (via Stripe) | Necessary to perform our contract with you |
| Respond to enquiries and provide support | Account and communications data | Contract / legitimate interests |
| Improve and analyse use of the community and website | Technical and usage data (Google Analytics) | Legitimate interests |
| Send marketing communications (e.g. newsletters, offers) | Contact data | Consent (withdrawable at any time) |
| Social media advertising | Interaction data via Meta/Instagram | Consent / legitimate interests, as applicable |
| Manage our waitlist | Email address (via FormSubmit, stored in Google Workspace) | Consent (withdrawable at any time) |
| Comply with legal and tax obligations | Payment and account records | Legal obligation |
| Assess your safety and suitability for training | Health information (medical screening) | Explicit consent (Article 9(2)(a) UK GDPR) |
5. Special Category (Health-Related) Data
We only process special category (health-related) data where we have both a lawful basis under Article 6 and a specific condition under Article 9 of the UK GDPR. We collect this kind of data in two distinct ways, explained separately below, each with its own purpose, legal basis, retention period, and rights.
5.1 Training and Performance Data (All Members)
Purpose: To assign you a training plan from the TrainingPeaks Marketplace and give you access to a TrainingPeaks Premium account, both included as part of your subscription, and, if you take up 1:2:1 coaching, to allow your coach to plan and review your training.
What this involves: Delivering your plan and Premium account requires linking you to our TrainingPeaks coach account, which is a condition of joining the community. This link gives us access to your training data, which may include heart rate and other physiological data that can reveal information about your health — so we treat that specific element as special category data for every member, not only coaching clients.
Legal basis: Delivering your training plan and Premium account is necessary to perform our contract with you (Article 6(1)(b) UK GDPR). The health-related elements this link exposes (such as heart rate) are separately processed only with your explicit consent (Article 9(2)(a) UK GDPR), given as a distinct step, separate from your general acceptance of these terms, when you join.
Retention: For as long as your subscription is active, and for [90 days] after you disconnect TrainingPeaks or close your account.
Your rights: You can withdraw your consent to the health-related elements at any time by contacting us. Because your training plan and Premium account are delivered through the same TrainingPeaks link, withdrawing may also mean losing access to those specific benefits.
5.2 Medical Screening Data (1:2:1 Coaching Clients)
Purpose: To assess your safety and suitability for individualised training, and to allow your coach to plan your programme around any relevant injury, condition, or medication.
What this involves: Before starting 1:2:1 coaching, you complete a medical screening form covering information such as pre-existing injuries, medical conditions, and medications.
Legal basis: Explicit consent (Article 9(2)(a) UK GDPR), given at the point you sign up for coaching, separate from your general community membership consent.
Retention: For the duration of the coaching relationship and for [7 years] afterwards — reflecting standard UK personal injury limitation periods and typical insurance record-keeping requirements.
Access: Restricted to your coach and, where necessary, anyone else directly involved in delivering your coaching. Not shared with the wider community.
Your rights: You can withdraw this consent at any time by contacting us, though this may mean we can no longer safely provide coaching services to you.
6. Who We Share Your Data With
We share your personal data with the following categories of third party, only as needed to provide our services:
- Circle, our community hosting platform
- Stripe, our payment processor
- TrainingPeaks, for training data (all members)
- Google, for website and community analytics (Google Analytics)
- Meta Platforms, Inc., for our Instagram presence and any social media advertising
- FormSubmit, to receive waitlist sign-ups from our website
- Google Workspace, where we store waitlist sign-ups and other administrative records
- [Marketing platform, once selected], for email communications, if you opt in
- Professional advisers, such as accountants, solicitors, and insurers, where necessary
- Law enforcement or regulators, where we are legally required to do so
- A buyer or successor, in the event we sell or transfer part of our business
We do not sell your personal data to third parties.
7. International Data Transfers
Several of the providers listed above — including Circle, Stripe, TrainingPeaks, Google, and Meta — are based in, or transfer data to, the United States or other countries outside the UK. Where this happens, we rely on the safeguards those providers have in place, such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses, to ensure your data continues to receive an appropriate level of protection.
8. How Long We Keep Your Data
- Account and community data: for as long as your subscription is active, and for [90 days] after you close your account, in case of disputes or to allow you to reactivate.
- Payment and financial records: for 6 years, as required by HMRC.
- Training, performance, and medical screening data: see Sections 5.1 and 5.2 above, which set out the specific retention period for each.
- Waitlist data: until you are offered a place, ask us to delete it, or the waitlist closes, at which point it is deleted from both FormSubmit and our Google Workspace records.
- Marketing data: until you unsubscribe or withdraw consent.
9. Cookies and Similar Technologies
Our community and any Tri Project web pages may use cookies or similar technologies, including Google Analytics and the Meta/Instagram pixel, to understand site usage and measure advertising performance. Where these are not strictly necessary for the site to function, we will ask for your consent before they are set, and you can change your preferences at any time via [cookie settings tool/link].
10. Children
Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have done so, we will delete that information promptly.
11. Your Rights
Under UK data protection law, you have the right to: access the personal data we hold about you; have inaccurate data corrected; ask us to delete your data; restrict or object to our processing of your data; receive your data in a portable format; and withdraw consent at any time, where we rely on consent.
To exercise any of these rights, contact us at contact@thetriproject.com. If you are unhappy with how we have handled your data, you also have the right to complain to the Information Commissioner's Office (ico.org.uk, telephone 0303 123 1113).
12. Automated Decision-Making
We do not currently make any decisions about you based solely on automated processing that would have a legal or similarly significant effect on you. If this changes in future, we will update this policy and, where required, seek your consent.
13. Keeping Your Data Secure
We use appropriate technical and organisational measures to protect your personal data, including restricting access to health information to your coach only, and expecting reasonable security practices from the third parties listed in Section 6. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.
14. Changes to This Policy
We may update this policy from time to time. We will let you know of any material changes via the community or by email.
15. Contact Us
The Tri Project Ltd
1 Kelcey Road, Quorn, Loughborough, LE12 8UU, United Kingdom
contact@thetriproject.com