SIA My Fitness (hereinafter MyFitness or also we) highly values its clients’ (hereinafter You) privacy.

In this privacy notice we explain how we collect and use Your personal data as well as what we do to ensure the protection of Your personal data. The aim of the given privacy notice is to help You understand how and why we process Your personal data as well as what Your rights relative to Your personal data are.

This privacy notice is applicable to You if You are our contractual member, use our services with no contract, e.g. single-entry ticket, friend ticket or gift certificate, test training, third party contract (e.g. employer), subscribe to our newsletter or have expressed the interest to receive our offers as well as if you submit an information request in our web environment.

1. The controller of personal data

SIA My Fitness
E.Birznieka Upīša iela 21 E, LV -1011 Rīga
E-mail: datuaizsardziba@myfitness.lv

2. What type of personal data do we process?

• Personal data – first name and family name, identity code, date of birth, photo
• Contact data – phone number, e-mail address, residential address, correspondence language
• Surveillance camera recordings – surveillance camera recordings set-up in sports clubs to protect people and property
• Audio recordings of incoming and outgoing phone conversations – voice recordings which are obtained from the audio recordings of phone conversations with clients and potential clients
• Incoming and outgoing email correspondence – correspondence with clients and potential clients
• Service data – the data which reveals Your activities in using our services, e.g. your purchases of MyFitness goods and services as well as data concerning violations and Your signed agreements.
• Body analysis data – a special category of personal data which can only be processed with Your agreement. If You have given us the corresponding agreement, then we will save the data to Your client account and if you give separate permission, then the personal coach also has the right to review the data.
• Payment instrument data in incomplete, undecipherable form – we collect and store this data if you purchase a paid subscription to the NETFIT online training platform https://www.netfit.lv/ (as defined in the Terms of Use). The specific personal data will include the following information – type of credit or debit card, payment card validity period, the last four digits of the payment card number, as well as information about your payment history.

3. What are our aims and legal bases when processing Your personal data?

There are different aims for processing personal data and each processing must take place according to a legal basis. MyFitness processes Your personal data according to the following legal bases:

Data processing required for contract fulfilment

We use this legal basis for processing data if it is necessary for fulfilling the contract You signed with us or for actions which are required prior to signing the contract at Your request. The following data are used for the following aims to enable and ensure You the provision of contractual services.

Legally required obligations of MyFitness requiring data processing

Under certain circumstances legislation obligates us to process Your personal data. If the data processing is required by law, neither MyFitness nor You can influence the processing of such data. According to the given legal basis we process data with the following aims:

Data processing based on MyFitness’s legitimate interest

A legitimate interest means that we do not directly need to process Your data to fulfil contractual obligations nor legal obligations, but the processing is still necessary. The processing may be needed to develop our services and products making them better for You, protect our property, clients and employees, using surveillance cameras, make business decisions and compile statistics. Under the legitimate interest conditions we are not obligated to process Your data by law or through contractual obligations , we therefore do not request Your permission which gives You the right to ask for explanations as well as to present objections, if you consider that Your data processing for the following aims breaches Your rights.

Marketing profiling

We use different data processing technologies to process Your data for marketing purposes. The technologies enable using mathematical analysis, statistics or other methods to create marketing profiles, establish probabilities and make marketing predictions. The information received gives us an opportunity to evaluate and predict client expectations concerning our goods and services and develop our services according to the expectations. The information also allows us to make personal offers to You and personalise our services.

We may process your data with other aims than what is listed above, based on legitimate interest, but the aims will always stay in a reasonable relationship with our main activity and are necessary for its development.

Data processing based on agreement

In order to provide services based on Your concrete needs and ensure personalised service, we need Your agreement for processing data under certain circumstances. If you give us Your agreement we will send you MyFitness newsletters as well as offers from us and our good cooperation partners. Our cooperation partners include, for example: sports, health, culture, beauty, catering, transportation and accommodation service providers. The list is illustrative and our partners change from time to time, but we always maintain the joint aim of furthering a healthy and sporty lifestyle.

You always have the right to revoke agreements (each separately as well as all jointly) given to us by removing the checkmark from the appropriate box within the self-service environment. If you are not a MyFitness club member and cannot access the self-service environment, you can send us a corresponding message to the e-mail address datuaizsardziba@myfitness.lv. If you revoke Your agreement, we will not process Your data according to the agreed upon aim. In case of body analysis data, this means the data will be deleted within 7 days from Your MyFitness user account and the MyFitness system without the possibility to later restore the data.

4. Who else processes Your data in addition to MyFitness?

Your personal data is accessible only to those MyFitness employees who need the data to perform their work duties (so-called need-to-know basis). Outside MyFitness, Your data is accessible under very restricted situations which are described below and only if it is necessary for achieving personal data processing aims:

• • Other MyFitness group companies: Your personal data is shared with other group companies (all are located within the European Union), if necessary for making management decisions and group business activity development as well as using joint data systems.
  • Persons providing services to us: Your data is accessible to persons providing services to us (the list is not complete and occasionally we order services in new fields): business software provider, IT  and ecomunications maintenance and servicing provider, mail server provider, website administrator, auditor, lawyers, data analysis software developer, MyFitness mobile application provider, collection service provider. Video and audio recordings are not available to maintenance personnel.
  • To other independent controller and Payment processors: if you have subscribed to NETFIT, https://www.netfit.lv/, NETFIT has links to third parties (independent controller pages, including AS LHV Pank as an independent controller) and processors of these third parties (including AS EveryPay), who process personal data in accordance with their privacy policies, which are available on their websites

• Public authorities and state institutions (e.g. police, courts, alarm centre, data protection inspectorate): we will only forward Your data when it is a legal obligation.

We scrutinize all service providers who process your personal data on our behalf. We assess whether our partners (processors of personal data) apply appropriate security measures to ensure that the processing of your personal data takes place in accordance with our tasks, instructions and regulatory requirements. These companies are not entitled to use your personal data for any other purpose.

5. How long do we retain Your personal data?

Your personal data is retained according to legally obligated requirements or for as long as required to fulfil the aims in this privacy notice. Below are some examples of data retention periods:

You can obtain more exact info on personal data retention by making a corresponding query to the data protection contact person specified in section 1 of the given privacy notice.

6. Your personal data security

My Fitness has established necessary legal, organisational, physical and technical security measures to protect Your personal data. Some examples of the measures we use:

Physical measures – paper-based documents containing personal data are stored in locked rooms and cabinets to which only certain employees have access for fulfilling their job duties; data processing rooms and IT-systems are sufficiently protected against fire, overheating, water, current instability and power outages.

Technical measures – video surveillance; all employee work computers are protected with password protected screensavers when the employee leaves; it is ensured that the IT-system does not accept new login attempts and locks the username when a certain number of access attempts has been exceeded; it is ensured that especially vulnerable systems (e.g. laptop computers, smartphones) are sufficiently protected (using encryption or other means).

Organisational means – all IT system users are assigned roles and profiles; it is ensured that access rights are deleted when the employee leaves MyFitness; it is ensured that there is no access from publicly used rooms to rooms where personal data is processed.

In case we use external companies for providing services, we sign an agreement with such service providers who process Your personal data, concerning Your data processing and protection which obligates the service provider to: a) take appropriate measures to ensure the personal data’s confidentiality and protect their security and ii) process personal data according to the applicable legal requirements.

7. Your rights concerning personal data

 Right to data access – You have the right to know which data we hold concerning You, for what aims they are processed; to whom the data is publicised (above all recipients in third countries), how long the data is retained; what are Your rights concerning restricting correcting, deleting and processing data. In order to respond to You, we must first authenticate you to avoid giving information to unauthorised persons. We have the right to respond to Your query within 30 days.

Right to data rectification – You have the right to demand corrections to Your personal data in case they are inaccurate or incomplete.

Right to data deletion – You have the right under certain conditions to request the deletion of Your personal data, foremost if the basis for processing Your data originates from our legitimate interest or Your agreement (e.g. if we no longer need the data, You revoke the agreement given to us to process the data).

Right to restrict processing – You have the right under certain circumstances to forbid or restrict the processing of Your personal data for a certain period (e.g. You have submitted an objection concerning data processing).

Right to present objections – You have the right to present objections concerning such data processing which is based on MyFitness’s legitimate interest incl. legally based profile analysis. MyFitness must stop processing Your personal data when You present an objection, except if MyFitness is able to prove that Your personal data is processed for effective legal reasons (decided upon case by case).

Right to data portability – In case the personal data processing is based on Your agreement or a contract signed with us and data is processed automatically, You have the right to access data concerning You which You have given to us in a structured, generally usable format as well as in machine readable form. You also have the right to demand that MyFitness forwards data directly to another service provider if that is technically possible (that means the other service provider is capable of receiving the data in the forwarded format).

If You want to exercise any of the abovementioned rights, please contact us using the e-mail address datuaizsardziba@myfitness.lv.

8. Use of surveillance cameras in sports clubs

 All MyFitness sports clubs use surveillance cameras to protect people (that is clients and employees) as well as property (that is MyFitness, employees’ and clients’ property).

The surveillance cameras are located in sports clubs so that the surveillance area includes the service counter, changing room entrances, gym, entrance to the studio. The MyFitness clients who are active in the given areas will also be video recorded. The following are the main video surveillance conditions:

Legal basis for camera use – legitimate interest

Surveillance system short description – stationary, digital, zooming- in tool

Who has access to the surveillance system and recordings – club manager and Head of Service

Recording’s retention period – recordings are kept for 1 month after which the video system deletes previous recordings and starts automatically rerecording again

Surveillance time – continuously

Surveillance type – recording and on-demand viewing

What is done to protect data collected with the surveillance system – the recordings are located on the hard disk in the location’s server room. Access to the room is only possible by the previously mentioned persons.

How can a person view one’s own data – to view data collected concerning Your person please contact us by using the e-mail address datuaizsardziba@myfitness.lv. When requesting access to data, it must be taken into consideration that the data is retained for 1 month only and in the interests and rights of other person’s in the recordings they must be made unidentifiable, therefore we cannot grant immediate access to data.

9. The right to submit a complaint to the Data Protection Inspectorate and the court

Should you desire further information concerning Your personal data or exercising Your rights, You have the possibility to contact us by using the e-mail address datuaizsardziba@myfitness.lv.

If You believe that the processing of Your personal data breaches the General Data Protection Regulation requirements, You have the tight to turn to the Data Protection Inspectorate and the courts to protect your rights and interests.