Privacy Notice

1. Who We Are

The MAD Academy is operated by Metabolix Ltd, a company registered in England and Wales under company number 15070218. Metabolix Ltd is the data controller responsible for the personal information described in this Privacy Notice.

Metabolix LTD TA The MAD Academy. Registered office: 2 Snydale Hall, New Road, Old Snydale, Pontefract, West Yorkshire, WF7 6HD, United Kingdom. Email: support@themadacademy.com.

2. Who This Notice Applies To

This Privacy Notice applies to riders aged 18 or over who hold their own The MAD Academy membership.

Where a membership is for a rider aged 12 to 17 and is managed by their parent or legal guardian, the separate Parent and Rider Privacy Notice applies instead.

3. Information We Collect

We collect information needed to create, manage and personalise your membership and programme. This may include:

• your name, email address, date of birth and sex;
• your height, bodyweight and goal bodyweight;
• your riding level, championship and race calendar;
• your training experience, weekly training availability and strength training information;
• your test days and other programme scheduling information;
• your sleep information;
• your food preferences, dislikes and desired meal variety;
• your programme, training and performance history;
• your test results;
• your session feedback;
• changes made to your programme in response to your feedback; and
• information generated through your use of the service.

We also process information needed to administer your account and membership, including payment status, transaction records and communications with us.

When you use the service, certain technical information may also be processed automatically, such as your IP address, device or browser information, sign-in information and security logs where this is necessary to operate and protect the service.

4. Health and Fitness Information

Some of the information used by The MAD Academy may be health information and is therefore treated as special category personal data under UK data protection law.

This may include information about injuries, pain, medical conditions, food allergies and other fitness, bodyweight, sleep, test or training information where it reveals information about your health.

We use this information to personalise and adjust your training and nutrition programme and, where relevant, to take account of an injury, pain or other health-related limitation.

Where we process health information for these purposes, our lawful basis under Article 6 of the UK GDPR is that the processing is necessary to provide the service you have asked us to provide. Our additional condition for processing health information under Article 9 of the UK GDPR is your explicit consent. We ask for that consent separately before you create your rider profile.

You may withdraw your consent at any time by contacting support@themadacademy.com. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it. We will stop processing your health information on the basis of that consent and will delete it unless we have another legal reason to retain it.

If you choose not to provide health information, or withdraw your consent to its use, we may be unable to provide features of the programme that depend on that information.

Please do not provide medical records, medical images, identity documents or other information that we have not asked you to provide.

5. How and Why We Use Your Information

We use your personal information only where we have a lawful reason to do so.

We use information necessary to create and manage your account, provide your membership, build and adjust your programme and provide support because it is necessary to perform our contract with you.

We process health information as described in section 4.

We keep payment, transaction and accounting information where necessary to perform our contract with you and to comply with our legal and financial record-keeping obligations.

We may process limited account, technical and security information where necessary for our legitimate interests in operating, securing and protecting The MAD Academy, provided those interests are not overridden by your rights.

We may also use or retain information where necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

We do not sell your personal information. We do not use your personal information for advertising.

6. Who We Share Information With

We share personal information only where necessary to operate The MAD Academy or where we are legally required to do so. Our service providers include:

• Supabase, which provides authentication, database and storage infrastructure;
• our website, application and hosting infrastructure providers;
• Resend, which sends account and membership emails; and
• Stripe, which processes membership payments.

Stripe receives the information needed to process and administer payments. We do not provide your health information to Stripe or Resend.

Authorised members of The MAD Academy team may access personal information where this is necessary to provide or support the service.

We may also disclose information to professional advisers, regulators, courts, law enforcement authorities or other organisations where this is reasonably necessary or required by law.

We require organisations processing personal information on our behalf to protect it and to use it only for the purposes for which it has been provided.

7. Where Your Information Is Processed

The primary database used by The MAD Academy is hosted through our Supabase project in London, United Kingdom.

Some of our service providers may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we ensure that the transfer is permitted under UK data protection law. Depending on the destination and provider, this may include relying on UK adequacy regulations or approved contractual safeguards.

You may contact us if you would like further information about the safeguards applying to an international transfer of your personal information.

8. How Long We Keep Your Information

We keep your personal information only for as long as it is needed for the purposes described in this Privacy Notice or to meet our legal obligations.

Your profile, programme history, results and logs are retained while your account remains open so that your programme history can be maintained and used if you continue or resume your membership.

Cancelling your membership does not automatically delete your account or programme history.

You may ask us to delete your account and personal information at any time. We will delete or anonymise information that we no longer have a lawful reason to retain.

We may retain specific information after an account is deleted where this is necessary to comply with legal, tax or accounting obligations, resolve disputes, prevent fraud or establish, exercise or defend legal claims.

Payment and accounting records are retained for the period required by applicable law.

9. Your Rights

Depending on the circumstances, you have the right to:

• ask for access to the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete your personal information;
• ask us to restrict how we use your information;
• object to certain uses of your information;
• receive certain information in a portable format; and
• withdraw consent where we rely on your consent.

These rights are subject to the conditions and exceptions provided by data protection law.

You can exercise your rights by emailing support@themadacademy.com. We may need to confirm your identity before acting on a request.

10. Complaints

If you have a concern or complaint about how we use your personal information, email support@themadacademy.com.

We will acknowledge a data protection complaint within 30 days, investigate it appropriately and provide an outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection. Information about making a complaint is available at ico.org.uk.

11. Sign-In and Device Storage

The MAD Academy uses cookies or similar storage on your device where necessary to sign you in, keep your account secure and provide the service you request.

These technologies are not used to track you across other websites or for advertising. We do not use advertising trackers.

12. Automated Personalisation

The MAD Academy uses automated rules to help create and adjust your training and nutrition programme using the information you provide and your ongoing programme data.

These automated adjustments are part of the service you have requested. They are not used to make decisions about you that produce legal or similarly significant effects.

13. Changes to This Privacy Notice

We may update this Privacy Notice where our use of personal information, our service or applicable law changes.

If a change materially affects how we use your personal information or your rights, we will tell you before the change takes effect where required.

The current version of this Privacy Notice will always be available through The MAD Academy.