ROUNDSET
Privacy Policy
Last updated: 30 October 2026 · Translation of the Portuguese version.
This policy explains how ROUNDSET handles the personal data sent through the roundset.eu website and what your rights are under the General Data Protection Regulation (GDPR).
1. Who we are
ROUNDSET is a management platform for gyms and fitness businesses, in development in Portugal.
Contact for privacy questions and to exercise your rights: contacto@roundset.eu.
2. Scope
This policy applies to the roundset.eu website, in its Portuguese, Spanish and English versions, and to the contact form.
3. The data we process
- The details you enter in the form: your name and email and, optionally, your company or gym, country and message.
- Technical details of your enquiry: the date it was received, the status of the internal email notice and a random technical identifier for the submission.
- Your IP address and technical browser signals are used by Cloudflare at the time of submission for the anti-spam check and to limit abusive requests. We do not store your IP address or the result of the anti-spam check in our database.
- The providers listed in section 5 may record technical access data, such as IP addresses, in their own systems, in line with their own policies.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) or our legitimate interest in replying to people who contact us (Art. 6(1)(f)) |
| Protecting the form against spam and abuse | Legitimate interest in the security of the service (Art. 6(1)(f) GDPR) |
We do not use your data to send marketing communications.
5. Service providers
We use the following providers to run the website and handle enquiries:
- Cloudflare: running the service that receives the form, the database where enquiries are stored, the anti-spam check (Turnstile) and request limiting.
- Resend: sending an internal notice of each new enquiry to our mailbox.
- Google: website hosting (Firebase Hosting) and the mailbox where we receive notices of new enquiries (Gmail).
6. Data location and international transfers
The database where we store enquiries (Cloudflare D1) is configured with the European Union jurisdiction.
Cloudflare, Resend and Google are headquartered in the United States, and some processing may take place outside the European Economic Area.
For information about the safeguards that apply to these transfers, write to contacto@roundset.eu.
7. How long we keep data
In our database and mailbox:
- Enquiries: deleted 12 months after the last interaction with you about the enquiry (submitting the form or the last exchange of messages or conversation). They are kept while still being handled (for example, during follow-up or a pilot project) or where there is a legal obligation to keep them, and only for as long as that reason applies.
- Technical copy of the internal notice: deleted automatically as soon as the notice has been sent.
- Notices of new enquiries in our mailbox: deleted 12 months after they are received, except for enquiries still being handled or subject to a legal obligation to keep them.
Once these periods end, the data is deleted from our database and the notices are deleted from the mailbox following an internal procedure.
Backups: database copies that we export are deleted 30 days after they are made, and the restore history kept by Cloudflare covers at most 30 days. They are only used to recover the service after a failure. A record deleted from the database may therefore remain in these copies for up to 30 days, without being used for any other purpose.
Technical logs kept by the providers follow the periods each of them defines.
8. Your rights
Under Articles 15 to 21 of the GDPR, you can ask for:
- access to your data;
- correction of inaccurate or incomplete data;
- deletion of your data;
- restriction of processing;
- portability of the data you provided to us;
- objection to processing based on legitimate interest.
To exercise any of these rights, write to contacto@roundset.eu. We reply within one month, which may be extended in the cases set out in Art. 12 GDPR. We may ask you for additional information strictly needed to confirm your identity.
9. Complaints
You have the right to lodge a complaint with a supervisory authority, in particular the Portuguese authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or the authority in your country of residence.
10. Cookies and browser storage
What we checked (technical check of 29 October 2026, in a browser session with no previous data):
- The website does not set cookies and does not use analytics or advertising tools. During that check, with the anti-spam check loaded, no cookie was created by any domain.
- When you send the form, the website stores in the tab's session storage (sessionStorage) only a random technical identifier and a fingerprint (hash) of the content, to avoid duplicate enquiries if the connection fails. Your name, email and message are not stored. This information is deleted after a successful submission or when you close the tab.
- The anti-spam check (Cloudflare Turnstile) is loaded from challenges.cloudflare.com and is run by Cloudflare under Cloudflare's privacy policy.
11. Security
- The website and the form service run over HTTPS; requests made over HTTP are redirected to HTTPS.
- Form data is validated on the server, with an anti-spam check and request limiting.
- We collect only the data we need and do not store IP addresses.
- Our service's technical logs do not include names, emails, messages or IP addresses, and the platform's automatic logging of each request is turned off.
No system is completely immune to failure. If a personal data breach occurs, we will act in line with our obligations under the GDPR.
12. Changes to this policy
This policy may be updated. The date of the current version is shown at the top of the page.
Privacy contact: contacto@roundset.eu