Privacy policy

Only what you choose to type. The enquiry form on this site has these fields and no hidden ones:

The web host also keeps ordinary server logs (the IP address the request came from, the time, the page and the browser string) for a short period, as every web server on earth does. We do not read them for marketing and we do not join them to your enquiry.

We do not ask for, and have no use for, your date of birth, your address, your payment details, health information or anything about your training.

Almost none. There is no Google Analytics on this site, no Meta pixel, no advertising tag, no heatmap tool and no session recording. We do count page views, using Vercel Analytics: it sets no cookies, stores no IP address and cannot recognise you on another website. That is why there is still no consent banner: there is nothing here to consent to.

The one thing stored in your browser is your language choice, kept in localStorage under the key citadel-lang, so the site does not ask you again on your next visit. It never leaves your device, it is not an identifier, and clearing your browser data removes it.

We do not guess your language from your location or your device. The site opens in English for everyone; any other language is a choice you make from the globe menu, or a link that carries one.

Four parties, each doing one job:

Translation. If you write to us in a language other than English, we pass the free-text parts of your enquiry (your gym, your country, the machines and your message) through Anthropic's Claude API so that Citadel reads it in English and answers you properly. Your name and email address are never sent for translation. Anthropic does not train models on data sent through its API. If your enquiry is already in English, nothing is sent at all.

That is the complete list. No advertising network, no data broker, no CRM that resells its database.

Yes, and you should know that before you send. Citadel is an Australian manufacturer, so any enquiry ends up in Australia. The hosting and email providers above operate from the United States and from edge locations worldwide, and your regional distributor is in your own region.

Where the law of your country requires a legal basis for that transfer, the EU and the UK in particular, we rely on the transfer being necessary to answer the enquiry you chose to send us, and on our providers' standard contractual clauses. If you would rather your details stayed in your own country, contact your regional distributor directly instead of using this form.

An enquiry lives in an email inbox, so it stays there while there is a live conversation and while the commercial relationship it started is running. Where an order results, the record is kept for seven years because Australian tax and warranty law requires it. The structural warranty is twenty years, and a warranty claim we cannot verify is a warranty claim we cannot honour.

An enquiry that goes nowhere is deleted when it stops being useful, and immediately if you ask us to.

Everything is served over HTTPS. The form is rate-limited and carries a spam trap. Access is limited to the people at Citadel and at your distributor who need it to answer you. Nobody can promise perfect security, and we will not; what we can say is that we hold as little as possible, which is the only protection that never fails.

This is a business-to-business site selling commercial gym equipment. It is not directed at children and we do not knowingly collect information from anyone under 16. If you believe a child has sent us something, email us and we will delete it.

Citadel Strength is an Australian business and this is our home law. You may request access to the personal information we hold about you and ask us to correct anything inaccurate, and we must respond within a reasonable period, which in practice means days.

We do not use your information for direct marketing, so there is nothing to opt out of. We do not disclose it to anyone outside the four parties named above.

If you are not satisfied with how we have handled a privacy matter, complain to us first at orders@citadelstrength.com.au. If we do not resolve it, you can take it to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, which can investigate at no cost to you.

The thirteen Information Privacy Principles apply to your enquiry. You have a right of access to what we hold and a right to have it corrected, and we must tell you if we have refused a request and why.

Because your details are sent to Australia and to our hosting providers overseas, principle 12 applies: we may only send it to a country with comparable safeguards, or with your knowledge. This page is that knowledge: Australia is recognised as comparable, and our providers are bound by contract.

Muscle Dept in Auckland is the New Zealand distributor and will receive New Zealand enquiries. Complaints go to the Office of the Privacy Commissioner at privacy.org.nz.

Citadel Strength is the data controller. Stephan Entian handles the European territory and receives EU enquiries as a joint recipient.

Lawful basis. Article 6(1)(b), steps taken at your request before entering into a contract. You asked us for a quote; we process your enquiry to give you one. We do not rely on consent, so there is no consent to withdraw, and we do not rely on legitimate interests for marketing because we do not market to you.

Your rights. Access, rectification, erasure, restriction, portability and objection, all under Articles 15 to 21. Email us and we will action it within one month, free of charge. You do not need to give a reason.

Transfers outside the EEA. Your enquiry goes to Australia and to US-based providers. Australia does not hold an EU adequacy decision, so we rely on Article 49(1)(b), that the transfer is necessary to perform the pre-contractual steps you asked for, and our providers operate under standard contractual clauses.

Complaints. You may lodge one with the supervisory authority in your own member state; the full list is at edpb.europa.eu. In Germany, that is your state's Landesbeauftragte für Datenschutz. You may complain to them without coming to us first, though we would rather you gave us the chance.

The same rights as the EU section above (access, rectification, erasure, restriction, portability, objection), exercised the same way and answered within one month.

The UK has granted Australia no adequacy decision, so as with the EU we rely on the transfer being necessary for the pre-contractual steps you requested.

Because we send no marketing email and set no non-essential cookies, PECR adds nothing here. Complaints go to the Information Commissioner's Office at ico.org.uk, which takes them directly.

Brandon Beckrich covers North America and receives US enquiries.

We do not sell or share your personal information as the CCPA and CPRA define those terms, and we have not in the preceding twelve months. There is therefore no "Do Not Sell or Share My Personal Information" link to click, because there is nothing behind it.

Californian residents may request to know what we have collected, request deletion, request correction, and may not be discriminated against for asking. Email us; we verify by replying to the address the enquiry came from. The only category we collect is identifiers and commercial-interest information you typed yourself. We collect no sensitive personal information as defined by the CPRA.

Residents of Virginia, Colorado, Connecticut, Utah, Texas and the other states with comprehensive privacy statutes have materially the same rights, and we honour them without asking which state you are in. Californian complaints go to the California Privacy Protection Agency at cppa.ca.gov or the state Attorney General; elsewhere, your own Attorney General.

Sending an enquiry is your implied consent to us using it to answer you; you may withdraw that at any time and we will delete the enquiry, though we will then no longer be able to quote you.

You have a right of access to what we hold and a right to challenge its accuracy. Canada's anti-spam legislation (CASL) is satisfied because we send you a reply to your own enquiry and no commercial electronic messages beyond that.

Complaints go to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial commissioner in Quebec, British Columbia or Alberta.

Korea is Citadel's largest market outside Australia and PIPA is a demanding statute, so this section is specific.

You may refuse this collection. Because the only thing we do with it is answer you, refusing means we cannot reply, so please contact the Korean distributor directly instead, which involves no overseas transfer by us.

You have the right to access, correct, delete and suspend the processing of your information, and to be told promptly of any breach. Requests to orders@citadelstrength.com.au. Disputes may be taken to the Personal Information Protection Commission at pipc.go.kr, or through the Personal Information Dispute Mediation Committee (privacy.go.kr, 국번없이 182).

The purpose of use is stated above and we will not use your information for any other purpose without telling you first.

Under the amended APPI we must identify the countries your information goes to before it goes there, and the measures protecting it. Those are Australia (Citadel) and the United States (Vercel, Resend, and Anthropic for translation of the free-text fields only); both are protected by contract with our providers and by Australia's own Privacy Act.

You may request disclosure, correction, suspension of use or deletion. Complaints may be made to the Personal Information Protection Commission at ppc.go.jp.

By sending the enquiry form you give separate consent to your information being transferred outside mainland China, to Australia and to the United States for hosting, email delivery and translation. That consent is the legal basis, and you may withdraw it at any time by emailing us, at which point we delete the enquiry.

You have rights of access, copy, correction, deletion and portability, and a right to an explanation of how your information is handled. This page is that explanation, and we will answer anything it does not cover.

If you would prefer nothing left mainland China, do not use the form: contact us through our WeChat or Instagram channels, or ask a Chinese reseller to enquire on your behalf.

Savafit CRD is the exclusive Hong Kong distributor and receives Hong Kong enquiries.

Supplying your details is voluntary; if you do not supply an email address we cannot reply. Under sections 18 and 22 of the Ordinance you may request access to and correction of your data, and we may charge no more than the direct cost of complying, and in practice we charge nothing.

Your data will not be used for direct marketing, which under Part VIA would require your separate written consent. Complaints go to the Office of the Privacy Commissioner for Personal Data at pcpd.org.hk.

Sending an enquiry is deemed consent to us using your details to respond to it. You may withdraw consent by email, and we will confirm and then stop.

You have a right of access and a right of correction. Because we transfer your information overseas, we are required to ensure a comparable standard of protection abroad, which we do by contract with our providers.

Complaints go to the Personal Data Protection Commission at pdpc.gov.sg.

Your rights under the UAE Personal Data Protection Law include access, correction, erasure, restriction of processing, portability and objection: the same set we honour everywhere, exercised the same way.

Cross-border transfer to Australia and the United States is on the basis that it is necessary to perform the pre-contractual steps you requested, and is covered by contract with our providers.

Complaints may be made to the UAE Data Office. If you are in the DIFC or ADGM free zones, those zones have their own data protection regimes and their own commissioners, and we will deal with you under whichever applies.

If your country is not listed, you still get everything in section 01 (access, correction, deletion, no marketing, no selling) because we apply that as our own standard rather than as the minimum some particular statute forces on us.

If your country's law gives you more than that, tell us which law and what it requires, and we will meet it. Citadel ships worldwide and we would rather be told than guess.