We treat your personal data with care and confidentiality. We do not sell your personal information to third parties. However, we do share your data with certain categories of recipients when necessary, as outlined below:

• NASM/AFAA (Course Providers): Since the courses we sell are delivered by NASM/AFAA, we must share certain details with them to enroll you. We will provide NASM (and/or AFAA, if you enroll in an AFAA program) with your name, email address, country of residence, and the specific course purchased. This allows them to set up your user account on their online learning platform and grant you access to the materials. NASM/AFAA will process your data as independent data controllers for providing their training service. For example, NASM will likely send you a welcome email and have you agree to their own terms when you first log in. We have an authorized distributor relationship with NASM, and while we share data with them to serve you, they have committed to handling EU personal data in compliance with applicable data protection standards (see Section 4 on international transfers for more about data going to the U.S.). We may also receive limited performance data back from NASM about your progress (as mentioned earlier) ; this is a two-way data exchange purely to facilitate the service.
• Payment Processors: We use reputable third-party payment gateways (such as Stripe, Revolut, and Klarna) to handle financial transactions. When you enter payment details, you are typically interacting directly with these providers embedded in our checkout. They receive your card information or other payment data directly – it does not pass through our servers. These payment processors act as data controllers of your financial data for processing the payment, and their terms and privacy policies apply to that information. We share with them only the information necessary for the transaction: this includes the purchase amount, currency, and possibly your name and email to link the payment to your account/order. The payment provider will then inform us (via secure notification) of the payment status (success or failure) and some transaction identifiers. We require that all such providers are PCI-DSS compliant and GDPR-compliant. For instance, Stripe has an affiliated entity in the EU (Stripe Payments Europe) and adheres to GDPR in processing European transactions.
• Bank(s) for Transfers: If you pay via bank deposit or transfer, your bank and our bank will process certain personal data (your name, IBAN/account number, payment reference) in the course of the transaction. This is pursuant to normal banking operations and legal obligations. We will see the info included with the transfer (e.g., name of sender, any note you add) and we may retain that for our records.
• Email Service Provider (Moosend): If you subscribe to our newsletter or opt in to marketing emails, your name and email address will be stored in our third-party email marketing platform (currently planned to be Moosend – a GDPR-compliant email marketing service). This platform helps us design and send bulk emails efficiently and track engagement (like open rates or clicks) in aggregate. We have a data processing agreement in place with such providers as needed, meaning they can only use your data to provide services to us and not for their own purposes. You can unsubscribe at any time, and we will then remove your data from the active mailing list.
• Hosting and IT Service Providers: Our website is hosted on servers provided by third-party hosting companies (or cloud services). As a result, any data you provide through the Site (account info, form submissions) will reside on their servers. We use hosting providers that are reliable and compliant with EU data protection (our main servers are EU-based datacenters). These providers may technically have access to data for storage and backup, but they are not allowed to use it. We ensure there is a contract in place (with standard data protection clauses) with any hosting or IT maintenance providers. Similarly, if we use a CRM system or other software tools internally that store customer data (for managing orders, support tickets, etc.), those providers may process data on our behalf. We choose reputable providers with appropriate safeguards.
• Analytics and Advertising Partners: If we use analytics tools like Google Analytics, those tools will collect usage data via cookies or scripts. Google Analytics, for instance, might act as a data processor for us, but in practice it collects data directly from user browsers and stores it on Google’s servers. We configure such tools to anonymize data where possible (e.g., IP anonymization) and not to collect unnecessary data. We currently do not use any targeted advertising cookies or third-party ad networks that would get your data from our Site. If that changes, we will update our cookie and privacy disclosures and obtain necessary consent.
• Business Partners and Affiliates: We do not currently share personal data with any joint venture partners or affiliates, except NASM/AFAA as described. If in the future we collaborate with fitness organizations or educational partners (for example, offering a combined program), we would inform you and only share data with consent or as necessary for service. For instance, if an in-person workshop is delivered by a local partner, we might share a roster (name, contact) of participants with the instructor solely to conduct the class.
• Legal and Compliance Recipients: We may disclose your information when required to do so by law or lawful request by public authorities. For example, if the tax authority or another regulator in Greece requests certain transaction records or if we’re responding to a lawful subpoena or court order. We will only share what is necessary and will verify any request’s legitimacy. Also, if necessary, we might share data to enforce our Terms or protect our rights, property, or safety, or that of our customers or others. This could include sharing information with law enforcement or fraud prevention agencies regarding fraudulent transactions or security threats.
• Professional Advisors: We may share relevant parts of your information with our professional advisors (lawyers, accountants, auditors) on a need-to-know basis. For instance, our accountant will see invoice records which contain personal data (your name, possibly address on the invoice) when preparing financial statements or tax filings. Similarly, if we face a legal dispute with a user, our legal counsel would need to review the contract and communications with that user, which contain personal data. These advisors are bound by confidentiality obligations.
• Corporate Transactions: If INFC is involved in a merger, acquisition, sale of assets, or reorganization, your data may be transferred to the succeeding entity or prospective buyers, but always under appropriate confidentiality and only for the purposes of continuing the service or due diligence. We would inform you of any change in data controller if such a transaction and transfer takes place. Your data will remain subject to this Privacy Policy (unless you’re notified of changes) even after any transfer.

We strive to minimize the data shared and ensure that each third-party recipient has a valid need for access. Whenever personal data is shared with a data processor (third party processing data on our behalf), we make sure there is a data processing agreement in place to safeguard your information according to GDPR standards. When sharing with another data controller (like NASM or payment companies), we ensure the transfer is lawful and ideally within frameworks that protect your rights (see Section 4 on International Transfers).

If you have questions about specific third parties that might have your data, feel free to contact us. We can provide a current list of main subprocessors or partners upon request.