NXT LVL Personal Training
TA Fitness / NXT LVL Personal Training
Effective date: 7 November 2026
Version: 2.1
TA Fitness, also trading as NXT LVL Personal Training ("NXT LVL", "we", "us" or "our"), is responsible for the personal data described in this Privacy Policy. This policy explains how we collect, use, store, share and protect personal data when you visit our website, contact us, become or consider becoming a client, use our services, or use StudiU as an NXT LVL member.
This policy applies to clients, members, prospective clients ("leads"), people who apply to rent space at our studio, parents, guardians, third-party payers and website visitors. Staff, job applicants and suppliers are covered by separate privacy information.
Controller: TA Fitness (Tal Assa Fitness), trading as NXT LVL Personal Training
Legal form: Sole proprietorship registered in the Netherlands
KvK number: 62960652
Address: Eleanor Rooseveltlaan 106, 1183 CL Amstelveen, the Netherlands
Privacy contact: Tal Assa
Email: empower@nextlevelams.nl
Website: www.nextlevelams.nl
We have not appointed a formal Data Protection Officer. Privacy questions and requests can be sent to the contact above.
You may provide information to us when you:
We may also receive information from a parent, guardian or payer, from Mollie after a payment, from a referral you have authorised, from our service providers, or from a previous system during an authorised migration. Existing member data may have been migrated from Virtuagym to StudiU.
Please provide another person's information only if you are authorised to do so and they have received appropriate privacy information.
Depending on your relationship with us and the services you choose, we may process the following categories.
A. Identity, contact and account information
B. Membership and training information
C. Health, injury, fitness and measurement information
Where you voluntarily provide it and we have a valid condition to use it, this may include:
Some of this is special-category health data under the GDPR and receives additional protection. Section 7 explains how we use it.
D. Payment, bank and administration information
We do not store your payment-card PIN, card verification code or full card credentials.
E. Communications
WhatsApp messages are not copied into StudiU. Detailed health, financial and trainer information should be communicated and stored within StudiU rather than WhatsApp.
F. Website, application and security information
G. Optional AI information
For adults who enable or use the StudiU AI assistant, we may process the request, limited relevant account context, the response, suggested action, approval or rejection, and associated audit information. Section 9 explains the safeguards.
|
Purpose |
Legal basis |
|
Respond to enquiries, arrange an intake and take requested pre-contract steps |
Steps at your request before a contract; otherwise our legitimate interest in responding |
|
Create and administer a membership or account and deliver NXT LVL services |
Performance of our contract |
|
Manage bookings, attendance, credits, communications and member support |
Performance of our contract and our legitimate interest in operating the service |
|
Personalise training and support safe participation using optional health information |
Explicit consent under Articles 6 and 9 GDPR, unless another specific legal condition applies |
|
Measure and document optional fitness or body-composition progress |
Explicit consent where the data reveal health information |
|
Process payments, refunds, direct debits and payment reminders |
Performance of our contract; legal obligation for financial records; legitimate interests for recovering valid debts |
|
Keep accounting, invoice and tax records |
Legal obligation |
|
Protect accounts, systems and people; prevent misuse and investigate incidents |
Our legitimate interest and the interests of members in a secure service |
|
Maintain consent, access, approval and audit evidence |
Legal obligation and our legitimate interest in accountability and dispute handling |
|
Provide the optional adult-only AI feature |
Your consent |
|
Send optional electronic marketing |
Consent, unless a specific legal customer exception applies |
|
Produce minimised website and service statistics |
Consent where required; otherwise our legitimate interest where analytics is privacy-preserving and does not require consent |
|
Establish, exercise or defend legal claims |
Our legitimate interest and applicable legal obligations |
Where we rely on legitimate interests, we consider the necessity of the use and its impact on your rights. You may object as explained in section 17.
The information needed depends on the service or payment method selected:
If required information is not provided, we may be unable to create the relevant account, use the selected payment method or deliver a particular service. Refusing optional processing does not prevent access to the core service, although we may be unable to personalise an activity that depends on information you choose not to provide.
StudiU is developed and operated by TA Fitness and is used as NXT LVL's internal studio-management platform. StudiU is a trade name and system of the same legal entity; it is not a separate external company processing NXT LVL member data. TA Fitness remains the controller.
We use StudiU to manage accounts, intake information, memberships, bookings, attendance, credits, payments, communications, measurements, reports, consent records and member files.
Access is provided through individual accounts and role-based permissions. The owner and authorised NXT LVL staff may access information needed for administration, support, safety or service delivery. Assigned trainers may see the member's identity, booking/training information, their own trainer notes and relevant safety information, but do not receive unrestricted access to address, contact, bank or administration information. Full IBANs and other sensitive administrative data are restricted and masked where full display is unnecessary. Access and changes may be logged.
The primary StudiU database, authentication and file storage are hosted through Supabase in Frankfurt, Germany. Vercel provides application hosting and delivery.
Health, injury and some fitness or body-measurement information may be special- category data under the GDPR. We normally ask for separate, explicit consent before using this information for safe and personalised training, progress tracking or Visbody measurements.
Providing this information is optional. We collect only information relevant to the service and limit access to people who require it for training, safety, administration or authorised support. It is not used for marketing or sent to the StudiU AI provider.
You may withdraw consent through StudiU's privacy settings or by contacting us. Withdrawal does not affect earlier lawful processing. We will stop the consent-based use and delete or restrict the information unless another legal ground requires limited retention. Withdrawal may mean that we can no longer personalise a service that depends on the information.
NXT LVL provides fitness and training services and is not a medical-care provider. Tell the trainer when you require medical clearance and seek qualified medical advice where appropriate.
People under 18 may use certain NXT LVL services only with approval from a parent or legal guardian. We verify and record guardian authority before the minor purchases or joins the relevant programme and provide age-appropriate information to the minor.
Where consent is the legal basis and the member is under 16 in the Netherlands, consent or authorisation from the legal representative is generally required. Guardian approval, membership terms, optional health-data consent, marketing choice and payer/SEPA approval are requested and recorded separately.
A minor may have their own StudiU account. We communicate through the parent or guardian, or in a managed group that includes the parent or guardian. We do not communicate privately with the minor through WhatsApp.
If a parent or another person pays for the member, we process that payer's own identity, contact, bank and mandate information. The payer must personally authorise the SEPA mandate. The optional AI feature is unavailable to everyone under 18, and data from under-18 accounts must not be sent to Anthropic.
Independent trainers and other professionals can apply to rent space at our studio through the rental form on our website. This section explains what happens to the information in that application. The rest of this policy applies as well.
What we collect. Your name, email address and telephone number; your business name, KvK number and profession; the space you want to rent; how many participants you expect (1 to 5); your preferred days and times of day; your preferred start date and a message (both optional); and your two confirmations: that you hold, or will arrange, suitable business liability insurance before your first booking, and that we may contact you about your request. We record the date and time of those confirmations, the language you used and a reference to the version of this policy shown to you. The other fields are required: without them we cannot assess your application.
Why, and on what basis. We use the application only to assess your request, contact you about it and, if we go ahead, prepare a rental agreement. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). The form is not meant for health information, so please do not include any in your message.
Emails. After you send the form, you receive one short confirmation email in the language you used. It contains nothing you typed in. The studio receives one notification email with the type of request, the space and your name. Both emails are sent through Resend.
Protection against misuse. The form is protected by Cloudflare Turnstile, which receives your IP address and technical device information to check that a person is sending the form. We also store a one-way hash of your IP address with the application, made with a secret key, so that we can recognise misuse of the form. We do not store your IP address itself.
Who sees it. Only the owner and authorised NXT LVL staff who handle rental applications, in StudiU. The data is stored as described in section 6; our providers are listed in section 12.
How long we keep it. 12 months after we close your application. An application that is never closed is deleted no later than 24 months after you sent it. The follow-up task in our work list is deleted with it.
Your rights. You can ask for a copy of your application, or ask us to correct or delete it, by emailing empower@nextlevelams.nl. We can export a single application in full and delete it, together with its follow-up task, without affecting anything else. The rights in section 17 apply, including the right to complain to the Autoriteit Persoonsgegevens.
Adult members may choose to use an optional StudiU AI assistant powered through Anthropic's commercial API using Claude Haiku. The assistant may answer limited questions about a schedule or subscription. It may also suggest or prepare an action for an authorised NXT LVL administrator or user.
The following safeguards apply:
Raw AI prompts and responses are normally kept for no more than 30 days. Approval and action-audit records may be kept for up to 24 months. Financial records created after an approved action follow the financial retention period.
Mollie processes online payments, direct-debit instructions, fraud-prevention information and applicable regulatory information. Mollie also supplies its own privacy information for processing it performs for its purposes.
For membership administration and SEPA direct debit, StudiU may store the account-holder name, full IBAN, BIC, Mollie references, unique mandate reference, mandate date/type/status, transaction information and evidence of approval. These details are used only for payment, refunds, administration, payment reminders, dispute handling and legal compliance—not for marketing, analytics or AI.
Full IBANs are restricted and masked wherever full display is unnecessary. A general acceptance of membership terms does not replace the payer's SEPA mandate. The mandate and payer approval are recorded separately. If the payer is not the member, the payer is treated as a separate person whose data is covered by this policy.
WhatsApp is optional. If you choose it, NXT LVL uses its managed WhatsApp Business account for scheduling and general progress communication. Messages are not backed up to trainers' personal accounts and are not copied into StudiU. We avoid sending detailed health, financial or trainer-note information through WhatsApp; such information should remain in StudiU.
Operational WhatsApp communication may take place in a group managed by NXT LVL that includes NXT LVL, the assigned trainer and the relevant member or members.
You can choose an available email or in-app alternative and can change your WhatsApp preference in StudiU or by contacting us. For minors, communication is with the parent/guardian or in a group that includes them, as described in section 8.
We do not sell personal data. Authorised NXT LVL staff receive information only according to their roles. Depending on the services and features used, the following providers may process limited information for us:
We require providers to protect personal data and enter into appropriate data- processing and transfer arrangements where required. Some providers may also process limited data as an independent controller when required for their own legal, security or regulatory obligations.
We may disclose limited information to professional advisers, accountants, insurers, debt-recovery providers, competent authorities or courts where reasonably necessary or legally required.
We aim to keep core member information within the European Economic Area (EEA), and the primary StudiU database and file storage are in an EU region. Some providers or their subprocessors may process information outside the EEA, including in the United States.
Where an applicable adequacy decision does not cover the transfer, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where appropriate, supplementary technical and organisational measures. You may request information about relevant safeguards, subject to necessary redactions for confidential or security-sensitive information.
Our website and StudiU use storage necessary for authentication, security, language, consent and service preferences. Cloudflare Turnstile processes technical device and network information to protect forms and may use a necessary security cookie depending on its configuration.
Vercel Web Analytics is configured as a cookieless, privacy-focused analytics service. It provides aggregated information such as page, referrer, general location, browser, device and operating-system categories. We do not intentionally include form answers, member identifiers, health or payment data in analytics events.
Where Google Analytics or another non-essential technology requires consent, it remains disabled until you make an affirmative choice. You can refuse or withdraw non-essential cookie consent without losing access to the core website or service. The cookie banner and Cookie Policy provide current details and settings.
We do not use advertising or retargeting trackers unless they are separately disclosed and activated only after valid consent where required.
We keep personal data only for as long as needed for the stated purpose, legal obligations or a documented legal claim. Our usual periods are:
We may keep specific information longer when required by law, necessary for an active dispute or legal claim, or requested by a competent authority. Access is then limited to that purpose.
We use technical and organisational measures appropriate to the sensitivity and risk of the processing. These include role-based access, individual accounts, multi-factor authentication for privileged access, encrypted connections and storage, tenant and permission controls, masking of sensitive fields, access and approval logs, session controls, backups, vulnerability management and incident procedures.
No service can guarantee absolute security. If a personal-data breach occurs, we document, contain and assess it and notify the Autoriteit Persoonsgegevens and affected people where the GDPR requires this.
Subject to the GDPR's conditions and exceptions, you may have the right to:
You can correct certain account details, download available measurements and manage optional health, marketing, WhatsApp and AI choices in StudiU. For a complete request, email empower@nextlevelams.nl. We may verify your identity, for example with a one-time code sent to the registered email address. We normally respond within one month.
Deletion is not absolute. We may retain limited information for tax, payment, SEPA, security, dispute or other legal obligations, with access restricted to that purpose.
You may lodge a complaint with the Dutch Data Protection Authority: Autoriteit Persoonsgegevens. We would appreciate the opportunity to address your concern first, but contacting us is not a condition for making a complaint.
We send electronic marketing only when you have opted in or a specific legal exception applies. Marketing consent is optional, separate from membership and not preselected. The consent identifies NXT LVL as the sender and the selected communication channel. Every marketing message identifies us and offers an easy, free way to unsubscribe.
You can withdraw marketing consent in StudiU, use the unsubscribe option in a message, or contact us. We do not use member lists belonging to external StudiU customer studios for NXT LVL marketing.
We may update this policy when our services, technology, providers or legal obligations change. The current version and effective date will be published on our website. We will notify affected members by email before material changes take effect. If a new purpose requires consent, we will ask for new consent before starting that processing.
Questions, objections and privacy requests can be sent to:
Tal Assa — privacy contact for TA Fitness / NXT LVL Personal Training
Email: empower@nextlevelams.nl
Address: Eleanor Rooseveltlaan 106, 1183 CL Amstelveen, the Netherlands
Website: www.nextlevelams.nl