Privacy Policy
Effective date: 17 October 2026
Endurix is a training planning, coaching and analysis platform for athletes and coaches. This policy explains which personal data we process, why we use it, who receives it and your rights. We process personal data in accordance with the General Data Protection Regulation (GDPR).
1. Who is responsible?
L3-Sports, trading as Endurix.cc, is responsible for processing personal data for the purposes described in this policy.
L3-Sports / Endurix.cc
Spinnewiel 3
7641 LX Wierden, The Netherlands
Chamber of Commerce: 69613494
Email: info@endurix.cc
Where an independent coach uses your data for their own coaching purposes, that coach may also have their own responsibility for that processing. Ask your coach for their privacy policy where appropriate.
2. What data do we process?
Depending on the features you use and the data you provide or share, we process:
- Account and contact details, such as your name, email address, contact information and account settings.
- Training and coaching profile data, such as sport preferences, goals, body measurements, thresholds and training zones.
- Training data, such as planned and completed workouts, duration, distance, pace, power, heart rate and training load.
- Health and recovery data that you enter or share through an integration, such as sleep, HRV, stress and perceived fatigue.
- Communications and feedback, such as messages, workout responses and shared coaching notes.
- Payment and invoicing data needed for subscriptions and purchases. Payment providers may process payment details directly; Endurix does not store full credit card details.
- Technical data, such as IP addresses, browser and device information, security events and logs.
- Integration data needed to manage connected services, such as external user identifiers, permissions and authorization credentials.
3. Why do we use the data?
- To manage your account and provide access to the platform.
- To plan training, import activities and exchange workouts with connected services.
- To analyse training load, recovery, progress and workout execution.
- To support coaching, communication, feedback and training recommendations.
- To process subscriptions, purchases, payments and invoices.
- To provide support, resolve faults and secure the platform.
- To send service notifications and, with your consent, newsletters.
- To meet legal obligations.
4. What are our legal bases?
We process data where necessary to perform our agreement with you, meet a legal obligation, with your consent, or for a legitimate interest such as security and fraud prevention. When relying on legitimate interests, we balance these against your rights and interests.
For health data that qualifies as special category personal data, we obtain explicit consent where required, unless another applicable legal exception applies. You may withdraw consent. Withdrawal does not affect the lawfulness of earlier processing, but features that require this data may become unavailable.
5. Who receives your data?
Endurix does not sell or rent personal data or training data. Endurix does not provide this data to third parties for their own advertising, marketing, profiling, sale or other independent commercial purposes.
Service providers processing data on Endurix’s behalf may use it only to provide the agreed services to Endurix. They must follow the applicable processing arrangements and instructions.
We share data only for the purposes described in this policy and where an appropriate legal basis exists. Recipients may include:
- A coach you have granted access to, within that access.
- MonsterASP for hosting, database storage and backups.
- OpenAI for the AI processing described in section 9.
- Payment, invoicing, email, support and technical service providers, to the extent they need data to deliver their services to Endurix.
- Services you connect, such as Garmin Connect and Strava, for features you authorize.
- Competent authorities where disclosure is legally required.
We put appropriate data protection arrangements in place with providers acting as processors on our behalf. Some recipients, including connected platforms and payment providers, may act as independent controllers for data they process for their own purposes. Our arrangements with processors do not automatically govern an independent party’s own processing; that party’s privacy policy applies to it.
6. Where is data stored and how is it protected?
MonsterASP stores our database and backups in a data centre in Germany. We use secure connections to transmit data and restrict access to authorized users and service providers who need it.
Our database location is not automatically the location of all external processing. External services, including AI services, may process data outside the European Economic Area. Where this occurs, we ensure a permitted transfer basis and appropriate safeguards, such as an applicable adequacy decision or Standard Contractual Clauses with supplementary measures where necessary. Contact info@endurix.cc for information about the relevant recipients and safeguards.
7. How long do we retain data?
We retain data no longer than necessary for the purpose for which it was collected. Endurix applies the following retention periods:
| Data | Retention period |
|---|---|
| Account, profile and training history, including imported Garmin activities | While the account is used and the data is needed for the service, training history and coaching. Earlier deletion requests and withdrawals of consent are handled separately. |
| Daily health and recovery data | Up to 24 months. |
| Personal analyses and AI insights | No longer than the associated source data. When source data is deleted, we also assess deletion of personal analyses derived from it. |
| Raw webhook messages | Up to 7 days after successful processing. |
| Technical logs | Up to 30 days. We limit their content and avoid full health data and access tokens. |
| Data following account deletion or a valid erasure request | Removed from active systems without undue delay, normally within 30 days, subject to an applicable legal exception. |
| Backups | A rolling period of up to 30 days. |
| Invoicing and accounting records | For the period required by applicable accounting and tax retention obligations. These obligations do not justify retaining Garmin health data alongside those records. |
Deleted data may remain in existing backups for up to 30 days after removal from active systems. These copies are used only for disaster recovery. Following a restoration, we reapply previous deletions before making data available again. Ending a paid subscription is not automatically the same as deleting your account.
8. What are your rights?
Subject to GDPR conditions, you may request access, correction, erasure, restriction of processing and portability of your data. You may object to processing based on legitimate interests and withdraw consent. You may also complain to the Dutch Data Protection Authority.
Send requests to info@endurix.cc. We may request information needed to verify your identity. We normally respond within one month. For complex or multiple requests, the GDPR permits an extension; we will notify you within the first month.
9. Garmin Connect: collection, use, processing and storage
Direct link to this Garmin section
9.1 Collection and exchange
If you connect Garmin Connect to Endurix and authorize access, Endurix receives data through the Garmin Connect Developer Program. Available data depends on your permissions, your Garmin device and the enabled features.
- Through the Activity API, we receive completed activities, activity details and activity files, including sport type, duration, distance, pace, power, heart rate and elevation data where available.
- Through the Health API, we receive enabled daily health and recovery data, such as daily summaries, sleep, HRV, stress, Body Battery and body measurements where available.
- Through the Training API, we send structured workouts and training targets that you transfer from Endurix to Garmin Connect.
- We process technical integration data, including Garmin user identifiers, authorization credentials and notifications of permission changes or deregistration.
9.2 Use and processing within Endurix
We use Garmin data to display activities and recovery, compare planned and completed workouts, and analyse progress and training load. We may combine it with your training plan, other training sources and your feedback to support coaching and training recommendations. A coach you grant access to may view this data and its analyses within that access. We do not sell Garmin data or use it for advertising.
9.3 Third-party processing and AI
Garmin data is processed by service providers where needed for the described Endurix features. MonsterASP provides hosting, database storage and backups. Endurix may use OpenAI for AI-assisted feedback, training insights and recommendations when you use these features. Selected training values and derived summaries may be transmitted, such as duration, distance, power, training load and summaries of sleep, HRV and Body Battery.
This processing takes place on Endurix’s behalf, under the applicable processing arrangements and instructions. It is not a sale or provision of Garmin data for OpenAI’s own advertising or commercial profiling.
We limit AI inputs to the data needed for the relevant analysis. The reviewed workout analysis uses a restricted selection of values and does not include names, email addresses, Garmin authorization tokens, exact dates, workout titles or free-text notes in that analysis prompt. This does not guarantee that all data is fully anonymous: training and recovery values may still be personal data. We therefore treat this transmission as external data processing.
Data is processed to provide the described analysis features. Storage and processing by external AI services are governed by the applicable contractual arrangements; the Endurix backup period below is not an OpenAI retention period. You may contact us for information about external processing locations and applicable safeguards. Endurix produces the analyses and recommendations; Garmin is a data source and is not represented as the provider of Endurix or AI recommendations.
9.4 Storage and retention
MonsterASP stores the Endurix database and backups in a data centre in Germany. We retain Garmin activities while the account is used and they are needed for training history and coaching. We retain daily health and recovery data for up to 24 months. Personal analyses are retained no longer than their associated source data. We retain raw webhook messages for up to 7 days after successful processing and technical logs for up to 30 days.
Following account deletion or a valid erasure request, we remove the relevant data, including personal analyses and relevant caches, from active systems without undue delay, normally within 30 days. Backups expire within a maximum of 30 days; previous deletions are reapplied following a restoration.
9.5 Withdrawing permission and deleting data
You may disconnect through the available account settings or revoke permission in Garmin Connect. Once the revocation has been processed, we stop importing new data and transferring workouts through that connection. Permission change notifications are processed so that we use data only within the current permissions.
Disconnecting is not the same as deleting your account. Upon revocation, we assess which previously received data may lawfully be retained, taking your request and the applicable Garmin terms into account. You may explicitly request deletion of imported Garmin data and personal analyses derived from it at info@endurix.cc. Where consent is the basis for processing, we stop that processing following withdrawal.
Garmin is an independent party. Data retained by Garmin is governed by Garmin’s privacy policy; deletion at Endurix does not automatically delete data held by Garmin.
10. Other connected services
If you connect Strava, the authorized exchange may include workout names and descriptions. Endurix exchanges these only for the connected features you have authorized, not for third parties’ own advertising or commercial profiling.
If you connect another service, such as Strava, we process the data needed for the connected features that you authorize. You may disconnect the service. Each connected service has its own privacy policy for data it processes independently. A deletion request to Endurix does not automatically delete data held by that service.
11. Cookies and newsletters
We use cookies and similar technologies for necessary features, such as account access and preferences. Where required, we obtain prior consent for non-essential cookies. You may change your preferences through the available cookie settings. More information is available in our cookie policy.
We send newsletters with your consent. You may unsubscribe using the unsubscribe link or by contacting info@endurix.cc. We may continue to send necessary service notifications, such as account and security messages, separately.
12. Changes and contact
We may update this policy when our services or legal obligations change. We display the updated date and notify you of material changes where appropriate. Changes concerning the processing of Garmin data are submitted to the Garmin Connect Developer Program team for prior written approval before implementation. If new processing requires additional consent, we obtain it before that processing starts.
For questions about this policy or your data, contact info@endurix.cc.