Privacy Policy
Why a Privacy Policy?
Dear User,
The security of your personal data is very important to us! For this reason, we continuously improve the level of protection and ensure that our practices comply with the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC).
This document explains what personal data we process and how we use it. Some of the information provided herein complements the Terms of Use, and therefore both documents should be read together. However, if you still have questions or need further clarification, you can always contact us!
Who is the Data Controller?
The controller of your personal data is us:
eFitness Spółka Akcyjna, with its registered office in Poznań, address: ul. Grunwaldzka 186, 60-166 Poznań, Poland. The company’s records are maintained by the District Court of Poznań – Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register, entered in the Register of Entrepreneurs under KRS no. 0000908260, NIP (Tax Identification Number) 7822482230, REGON (Statistical Number) 301209678 (hereinafter referred to as „the Controller” or „we”).
How to contact the Controller?
You can contact us via:
• post – to the address of our registered office: ul. Grunwaldzka 186, 60-166 Poznań, Poland;
• email – by contacting our Data Protection Officer, Mr. Jacek Zontek, at: [email protected].
What personal data do we collect and how do we obtain it?
In most cases, we collect your personal data directly from you during account registration or later when you provide data via the application interface. Sometimes, your data may be provided by the affiliated club you are a member of. Additionally, if you register using external authentication (e.g. iCloud or Google account), we obtain the relevant data from such third-party provider.
The scope of data processed varies depending on:
- which services you use,
- which club you are affiliated with,
- what information you provided when registering your account,
- your communication preferences, and
- consents you have given.
Each club may independently determine which of your personal data is collected and provided to us for processing and in what circumstances. For example, a club may require certain personal data to create a membership or to register you for classes or additional services.
We may process the following categories of personal data:
• identification data such as your first and last name, date of birth, gender;
• contact details such as email address and telephone number;
• address details such as your home or mailing address;
• financial data such as your bank account number;
• data related to your club activity;
• device data related to the device you use to access our application;
• other data provided voluntarily, subject to your consent.
What is the purpose and legal basis of processing your personal data?
Your personal data will be processed for the following purposes:
• to provide you with our services, especially access to our application — this processing is based on Article 6(1)(b) of the GDPR (performance of a contract);
• to process any complaints, inquiries, or claims you may submit — based on our legitimate interest under Article 6(1)(f) GDPR;
• to establish, pursue, or defend legal claims — based on our legitimate interest under Article 6(1)(f) GDPR;
• to prevent abuse and fraud, and to ensure the security of services — based on our legitimate interest under Article 6(1)(f) GDPR;
• for marketing of our products or services — based on our legitimate interest under Article 6(1)(f) GDPR;
• for direct marketing of our own or our business partners’ products or services, including sending marketing communications via electronic means or telecommunications equipment — based on your consent under Article 6(1)(a) GDPR;
• for statistical and analytical purposes, to better tailor services to users’ needs, optimize service processes, ensure IT security, and detect misuse — based on our legitimate interest under Article 6(1)(f) GDPR;
• to comply with legal obligations imposed on us, such as documenting your rights and fulfilling record-keeping obligations — based on Article 6(1)(c) GDPR.
We do not intend to process your personal data for purposes other than those stated above. Should this change, we will inform you accordingly and seek your consent if required.
Who may we share your personal data with?
We may share your personal data with:
• our business partners supporting the operation of the application, including content providers, IT infrastructure and software providers, and IT service providers;
• our business partners providing necessary services to us, such as legal, tax, accounting, and consultancy services, as well as postal and courier services when physical correspondence is required;
• other contractors of the Controller, in accordance with applicable data processing agreements;
• public authorities or entities entitled under the law to request access to your data, or third parties where necessary to protect the rights of the Controller or others, including in connection with legal claims.
Where do we process your personal data?
In most cases, we process your personal data within Poland. However, due to cooperation with our partners and the use of certain IT systems, your data may occasionally be transferred outside Poland and outside the European Economic Area (EEA). In such cases, we implement appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, to ensure the security and integrity of your data.
How long do we retain your personal data?
The retention period for your data depends on the purpose of processing:
• for the period covered by your consent — until withdrawal if no time limit was specified;
• for the duration of service provision — until the service contract is terminated;
• for complaint handling — for one year after the resolution of the complaint;
• for the duration required by law for specific types of records or legal obligations;
• for the time necessary to protect our rights or the rights of third parties, including the pursuit or defense of legal claims, taking into account applicable limitation periods;
• for marketing purposes — until the termination of the service contract or until you object to processing, or in the case of consent-based processing — until consent is withdrawn;
• for accountability purposes (demonstrating compliance with data protection laws) — for the time required by applicable legal regulations.
After the longest applicable retention period expires, your personal data will be permanently deleted.
Can I refuse to provide personal data?
Providing personal data is voluntary. However, please be aware that failure to provide certain data may result in the inability to use the application or certain of its functionalities. Refusal to provide data may also prevent us from achieving other purposes outlined in this document.
Can I withdraw my consent?
You may withdraw your consent to the processing of your personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. However, once consent is withdrawn, we will no longer process your data for the purposes that required your consent. You may withdraw consent by contacting us via email or in writing.
What rights do you have regarding your personal data?
In connection with the processing of your personal data, you have the following rights:
• Right of access — to obtain confirmation of whether your personal data is processed, information about such processing, and a copy of your data;
• Right to rectification — to correct or complete inaccurate or incomplete data;
• Right to erasure — to request the deletion of your personal data where justified (e.g. data no longer required, consent withdrawn, unlawful processing);
• Right to restriction of processing — to request restriction of processing where appropriate (e.g. if processing is no longer necessary or is disputed);
• Right to object — to object, on grounds relating to your particular situation, to processing based on our legitimate interests (including profiling);
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.
If you have concerns regarding the lawfulness of our processing of your personal data, you have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Poland).
Do we use automated decision-making or profiling?
Your personal data may be subject to automated processing, including profiling. This allows us to tailor our activities to your preferences. Such processing may involve automated decisions or actions based on your data.