Privacy Policy
Last updated: 29 July 2026
1. Data controller
In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data ("GDPR"), and Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights ("LOPDGDD"), Amber Muscle, S.L. hereby informs users of the website ambermuscle.com about this Privacy Policy.
Identifying details of the data controller:
Company name: AMBER MUSCLE, S.L.
Spanish Tax ID (NIF): B75723957
Registered office: Calle Cirauqui, 7, 28050 Madrid (Spain)
Registration data: Madrid Mercantile Registry, Section 8, Sheet M-842077, Entry 2 (13 April 2026)
Contact channel for data protection matters: contact form on the website
Amber Muscle is not required to appoint a Data Protection Officer pursuant to Article 37 GDPR and Article 34 LOPDGDD, as the legally established conditions do not apply. For any query, complaint or exercise of rights relating to personal data, the User may contact Amber Muscle through the contact form.
2. Personal data processed
Amber Muscle processes the following personal data through the website ambermuscle.com:
2.1 Browsing data (collected automatically)
When accessing the Website, the Google Analytics 4 analytics service collects technical and usage data, including: IP address (anonymised in transit), approximate country and city, device type, operating system, browser, language, pages visited, time spent, traffic source and interaction events (clicks, scroll, plays).
2.2 Technical data from third-party services
When loading typographic fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), the service records the User's IP address. Google applies its own privacy policies to this processing.
2.3 Voluntarily provided data
If the User contacts Amber Muscle through the contact form hosted on the WordPress platform linked to the Website, the data voluntarily provided will be processed: name, email address, content of the message and any other information shared in the communication.
The Website does NOT collect personal data through its own forms, account registration, subscriptions or purchases.
3. Purposes and lawful bases of processing
Personal data are processed for the following purposes and on the following lawful bases:
3.1 Statistical analysis of Website use
Purpose: to understand how Users interact with the Website in order to improve its usability, content and performance.
Lawful basis: the User's consent given through the cookie banner (Art. 6(1)(a) GDPR), or the legitimate interest of Amber Muscle in improving the Website (Art. 6(1)(f) GDPR) in the case of strictly aggregated technical data and cookies.
3.2 Typographic font service
Purpose: to display the content of the Website with appropriate typography.
Lawful basis: the legitimate interest of Amber Muscle in providing an adequate browsing experience (Art. 6(1)(f) GDPR).
3.3 Handling enquiries and communications
Purpose: to respond to enquiries, requests for information or any communication addressed to Amber Muscle by the User.
Lawful basis: the User's consent upon initiating the communication (Art. 6(1)(a) GDPR) and, where applicable, the performance of pre-contractual measures (Art. 6(1)(b) GDPR).
3.4 Compliance with legal obligations
Purpose: to comply with the legal obligations applicable to Amber Muscle, including those of a commercial, fiscal or tax nature.
Lawful basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
4. Retention periods
Google Analytics browsing data: 14 months from the last interaction, unless consent is renewed.
Google Fonts technical data: access logs are managed by Google according to its own policy.
Communications by email or form: for a maximum period of 2 years from the last communication, unless a longer legal retention obligation applies.
Data necessary to comply with legal obligations: for the periods established in the applicable regulations (commercial, fiscal, accounting).
5. Recipients and international transfers
5.1 Recipients
Personal data are not communicated to unrelated third parties unless required by law. Users are informed that the following service providers process data on behalf of Amber Muscle or receive technical data when visiting the Website:
Google LLC (Google Analytics 4 service)
Google LLC (Google Fonts service)
Automattic, Inc. (WordPress.com platform for the contact form, where used)
Cloudflare, Inc. (content delivery network and security service)
GitHub, Inc. (website hosting via GitHub Pages)
5.2 International transfers
The providers listed above are companies based in the United States of America. Amber Muscle ensures that such international transfers are subject to the appropriate safeguards provided for in the GDPR, in particular:
European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-U.S. Data Privacy Framework, to the extent that the providers are certified under it.
Standard contractual clauses approved by the European Commission, where applicable.
Users may consult the certification status of each provider on the official list published at dataprivacyframework.gov/list.
6. User rights
The User has the right to:
Access their personal data.
Request the rectification of inaccurate data.
Request the erasure of their data when no longer necessary, when consent has been withdrawn, or when any other ground provided for in the GDPR applies.
Object to the processing of their data on grounds relating to their particular situation.
Request restriction of processing.
Request the portability of the data they have provided.
Withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal.
Not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect the User.
To exercise these rights, the User may contact Amber Muscle through the contact form, providing a copy of an identification document. Amber Muscle will respond within a maximum period of one month from receipt of the request, extendable by two additional months in the cases provided for in the GDPR.
Users also have the right to lodge a complaint with the Spanish Data Protection Agency ("AEPD"), whose contact details are:
Website: aepd.es
Electronic office: sedeagpd.gob.es
Postal address: Calle Jorge Juan, 6, 28001 Madrid, Spain
7. Data security
Amber Muscle adopts appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, in accordance with Article 32 GDPR. These measures include, among others, encryption in transit via HTTPS, restricted access to data and the periodic review of security configurations.
Amber Muscle further reminds users that the MyEliteHealth application has been designed in accordance with the principle of privacy by design and by default (Art. 25 GDPR).
8. Minors
The Website is not directed at minors under fourteen (14) years of age. Amber Muscle does not knowingly collect personal data from minors of that age through the Website. Should it become aware that such data has been collected without consent of the holder of parental authority or guardianship, Amber Muscle will proceed to delete it immediately.
9. Modifications
Amber Muscle may modify this Privacy Policy to adapt it to legislative, case-law or service changes. Users are advised to review this page periodically. Any substantial change will be communicated through a visible update on the Website.