Privacy Policy

1. Data Controller

The data controller is:

GM Fitness Center
Address: 35 Acad. Boris Stefanov St., Studentski Grad, 1700 Sofia, Bulgaria
Phone: +359 87 934 4090
Email: gmfit.ood@gmail.com

2. Data We Collect

When you register and use our services, we may collect the following categories of personal data:

• Full name
• Phone number
• Email address (if provided)
• Date of birth (where required for age verification)
• Payment data (processed by certified payment service providers)
• Visit history (date, entry/exit times)
• Video recordings from the CCTV system on the premises

3. Purposes and Legal Basis

We process your personal data on the following legal bases and for the following purposes:

• Performance of a contract — managing membership, granting access to the facility, processing payments
• Legitimate interest — ensuring the security of the premises through video surveillance
• Legal obligation — retaining data in compliance with statutory requirements
• Consent — sending promotional communications (only where you have given explicit consent)

4. Video Surveillance

5. Sharing Data with Third Parties

We do not sell or share your personal data with third parties for advertising or marketing purposes. Data may be disclosed only to:

• Payment service providers — for processing transactions (under strict confidentiality obligations)
• IT providers — for maintaining the smart access system
• Competent authorities — where required by law or by court order

6. Retention Periods

• Membership data — for the duration of the subscription + 5 years (accounting purposes)
• Visit history — 12 months
• Video recordings — 30 days
• Data after membership termination — 5 years from the date of termination

7. Your Rights

Under the GDPR you have the following rights:

• Right of access — to obtain a copy of the data we process about you
• Right to rectification — to request correction of inaccurate data
• Right to erasure — the "right to be forgotten", under certain conditions
• Right to restriction — to restrict the processing of your data
• Right to data portability — to receive your data in a machine-readable format
• Right to object — to processing based on legitimate interest
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise your rights, please contact us at: +359 87 934 4090 or gmfit.ood@gmail.com

8. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction. Access to data is restricted to individuals who require it in order to fulfil their responsibilities.

9. Mobile Applications and Digital Access

The smart access system may process technical device identifiers (Device ID, UUID) solely for the purpose of granting physical access to the facility. These data are not used for tracking or profiling.

We do not collect data from third parties, social networks or advertising platforms without your explicit consent.

10. Complaints

If you believe your rights have been infringed, you have the right to lodge a complaint with:

Commission for Personal Data Protection (CPDP)
Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
Website: www.cpdp.bg

11. Changes to This Policy

We reserve the right to update this policy. In the event of material changes, we will notify you via a notice on the website or by other appropriate means. The date of the last update is indicated at the top of this document.