A note from me
Palmares is a one-person business — it's just me, Jon. I take your privacy seriously, but I'm not a giant corporation with a legal department, and this policy is written in plain English rather than dense legalese. My rule is simple: I handle your data the way I'd want mine handled. If anything here raises a question or a concern, please just email me at hello@palmares.co.uk and we'll sort it out together.
Who we are
Palmares Limited is a cycling coaching and training plan business registered in England and Wales (company number 08931710). Our registered address is 66 Paul Street, London, EC2A 4NE.
If you have any questions about this policy, you can contact us at hello@palmares.co.uk.
What data we collect and why
We only collect data that helps us provide a relevant, useful experience. Here's what we collect and why:
- Name and email address — when you complete our quiz or sign up, we collect your name and email so we can send you training plan recommendations and educational content. This is the basis of our email service.
- Quiz answers — your age group, ability level, weekly training hours, goals, and biggest training challenge. We use this to recommend the right training plan for you and to personalise the emails we send and what you see on our website.
- Email engagement — whether you open emails or click links. We use this to understand what content is most useful and to avoid sending irrelevant emails.
- Purchase information — if you buy a training plan via TrainingPeaks, we record the plan purchased, the date, and the value. This helps us track what's working and serve you better after purchase.
We don't sell your data to third parties. We don't use it for any purpose other than running Palmares.
Legal basis for processing
Under UK GDPR, we need a legal basis for processing your personal data. We rely on:
- Consent — when you submit the quiz or sign up, you're consenting to receive emails from Palmares. You can withdraw consent at any time by unsubscribing (every email has an unsubscribe link). Marketing and analytics cookies are also set only with your consent.
- Legitimate interests — for basic analytics that help us understand how the site is used, such as page view counts and traffic sources, for keeping the site secure against automated abuse, and for keeping our ads away from people they aren't meant for (see Advertising and measurement).
Advertising and measurement
We advertise Palmares on platforms such as Meta (Facebook and Instagram), Google, and X. To understand which ads lead to sign-ups and purchases — and to avoid wasting money showing ads to the wrong people — we share a limited amount of measurement data with these platforms. This only happens where you've accepted marketing cookies, and we never share more than is needed to measure our advertising:
- Hashed email for ad measurement — when you sign up or buy, we may share a securely hashed (irreversible) version of your email address with Google and Meta. Hashing means the platform can match it to an existing account for measurement without us handing over your email in readable form. This powers Google's enhanced conversions and Meta's conversion measurement.
- Server-side purchase events — when you complete a purchase, we send a purchase event to Meta directly from our systems (server-side), rather than only through your browser. This is more reliable than a browser pixel and uses the same hashed details described above. It lets us measure which ads led to a sale.
- Building advertising audiences from quiz answers — we use your quiz answers (such as your goal or ability level) to build advertising audiences on Meta, so we can show more relevant ads to people with similar training needs. Where this involves your quiz data, it only happens with your marketing-cookie consent, and you can opt out at any time by adjusting your cookie preferences or unsubscribing.
- Advertising pixels — Google, Meta, and X pixels in your browser help measure campaign performance and show you relevant ads. These are only set with your consent.
Separately, we keep a short list of people we'd rather not show ads to, such as existing coaching clients and other coaches. We upload a hashed (irreversible) version of their email addresses to Meta purely to keep our ads away from them, never to target them, and the list is used for nothing else. If you think you're on it and would like to come off, email hello@palmares.co.uk.
Who we share data with
We use a small number of trusted services to run the business. Each acts as a data processor on our behalf:
- ActiveCampaign — our email marketing platform. Stores your contact information, quiz answers, and email engagement data. ActiveCampaign Privacy Policy
- TrainingPeaks — where training plans are sold and delivered. Handles payment processing and plan fulfilment. TrainingPeaks Privacy Policy
- Google — website analytics and advertising measurement, including Google Ads conversion tracking. Google Privacy Policy
- Meta — advertising measurement for our Facebook and Instagram campaigns, including server-side conversion events. Meta Privacy Policy
- RightMessage — personalisation software that remembers your quiz answers and customises what you see on our website. It syncs your preferences with ActiveCampaign so your experience stays consistent across visits and emails. It stores nothing on your device and sends no browsing data until you accept analytics and functional cookies. RightMessage Privacy Policy
- Webflow — the platform that hosts this website. Webflow processes basic visitor data such as IP addresses and page requests in order to serve the site. Webflow Privacy Policy
- Cloudflare — provides security and bot protection for our forms (Cloudflare Turnstile), which helps stop automated abuse and spam sign-ups. This sets a temporary, functional token and does not track you across sites. Cloudflare Privacy Policy
- Google Apps Script — we use Google's automation tools to connect our systems — for example, to record a purchase in ActiveCampaign and pass a measurement event to our advertising platforms when you buy a plan, and to keep our advertising exclusion list up to date. Google Privacy Policy
- Microsoft Clarity — heatmap and session-replay software that shows how visitors interact with our website (mouse movements, clicks, scroll depth). It masks the text you type, but it does record how you move around a page. Only used with your consent. Microsoft Privacy Statement
- QuickEmailVerification — checks that your email address is valid when you sign up, so we don't send to addresses that don't exist. It receives your email address only, and we use it for nothing else. QuickEmailVerification Privacy Policy
How long we keep your data, and deleting it
We keep your contact information and quiz data for as long as you remain subscribed to our emails. If you unsubscribe, we stop emailing you and we won't keep your data longer than we need to.
You can ask us to delete the data we hold about you at any time — just email hello@palmares.co.uk and we'll action it across the services we control, normally within 30 days. A few things to know:
- Some of the services listed above keep data under their own retention schedules, which we don't control directly. Where we can ask them to delete your data, we will.
- If you've bought a plan, we're legally required to keep basic purchase records (what was bought, when, and for how much) for seven years to meet UK accounting rules, even if you ask us to delete everything else.
Your rights
Under UK GDPR, you have the right to:
- Access — request a copy of the data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data
- Restriction — ask us to limit how we use your data
- Portability — request your data in a machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — at any time, by unsubscribing or emailing us
To exercise any of these rights, email us at hello@palmares.co.uk. We'll respond within 30 days. If you're unhappy with how we've handled your data, you can also complain to the Information Commissioner's Office (ICO).
Cookies
Cookies are small files stored on your device when you visit a website. We use the following categories:
- Strictly necessary — essential for the site to function, including security and bot protection. These can't be disabled.
- Functional — remember your choices and personalise what you see, such as the training plan your quiz answers point to (RightMessage). Only set with your consent.
- Analytics — Google Analytics and Microsoft Clarity, to understand how people use the site. This may include recognising your device across visits so we can understand how people move through the site over time. Only set with your consent.
- Marketing (shown as "Advertisement" in the cookie banner) — advertising pixels from Google, Meta, and X, used to measure campaign performance and show relevant ads. Only set with your consent.
When you first visit the site, a cookie banner will ask for your consent. You can change your preferences at any time with the cookie button in the bottom-left corner of every page.
Personalisation and on-site behaviour
To make the site more useful, we personalise it based on how you use it over time — such as the pages and guides you view across visits — to tailor what we show you and, occasionally, to suggest something relevant. This builds a simple profile of your interests on our own site only; it isn't shared with advertisers, and it only runs if you accept both analytics and functional cookies. Without them you can still take the quiz, but the site won't remember your answers between visits. You can turn it off at any time by adjusting your cookie preferences.
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page will always reflect the most recent version. For significant changes, we'll notify subscribers by email.