1. Controller and contact
The controller is Zdravie vo svojich rukách s. r. o., Osuského 3784/3B, 851 03 Bratislava – mestská časť Petržalka, Slovak Republic, company ID 53535871, registered in the Commercial Register of Mestský súd Bratislava III, section Sro, entry 150424/B. We operate APEX Fitness Club, OC MAX, Galantská cesta 5692/20, 929 01 Dunajská Streda, first floor above ground level.
Contact us about personal data and your rights at club.apex.fitness@gmail.com, +421 949 251 571 or by writing to our registered office. This notice covers our website, customer services, GYMIFY access, security cameras and the optional advertising described below.
2. Data and sources
GYMIFY registration provides us particularly with first and last names; we do not require a photograph. For accounts, purchases or communications we may also process an email you provide and other data necessary for the particular service, account identifier, product, validity, admissions used, QR entitlement, entry time, price, payment status and necessary billing information. We do not require every listed item from every person. Do not send us complete payment-card details; the payment service identified during purchase handles payment.
Website delivery and security involve technical data such as IP address, request time, device and requested page. With the appropriate consent, cookie identifiers, traffic sources and website or advertising interactions may also be processed. Communications involve your message and contact details. Cameras record images of people in marked areas.
Data comes from you, service use and your device, GYMIFY in connection with your membership and, for authorised advertising, platform measurements and reports. We do not build advertising email lists from purchased or publicly harvested contacts.
Discount eligibility should be checked only as necessary and proportionately. Do not send medical reports or diagnoses. Any verification requiring health data needs prior specific information and a condition under GDPR Article 9; without this, we do not request or retain such data. Health information, ZŤP disability status and camera footage are not used for advertising audiences.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention period or criterion |
|---|---|---|
| Purchases, pass administration, QR entitlement and admissions | Contract and pre-contractual steps, GDPR Article 6(1)(b) | During the relevant service and settlement of the purchase; afterwards only what is necessary for legal duties or specific legal claims |
| Accounting and mandatory records | Legal obligation, Article 6(1)(c) | Accounting documents generally for the 10 years following the year concerned under Slovak accounting law; specific legal reasons may require longer retention of the relevant document |
| Enquiries, assistance and complaints | Article 6(1)(b) for contracts and pre-purchase requests, (c) for legal duties; otherwise (f), our legitimate interest in handling communications and protecting rights | Until resolved; afterwards only relevant parts for the applicable limitation period or until final resolution of a specific dispute |
| Website security and misuse investigations | Legitimate interest in a functioning, secure website, Article 6(1)(f) | As needed to deliver the page or investigate a technical fault or security event; evidence concerning a specific incident is separated and assessed individually |
| Security cameras | Legitimate interest in protecting people and property and investigating incidents, Article 6(1)(f) | Ordinary footage for no more than 72 hours under section 4; exceptions only for necessary extracts of specific incidents |
| GA4 visitor statistics | Voluntary consent, Article 6(1)(a), and section 109(8) of Slovak Act No. 452/2021 Coll. for relevant technologies | User- and event-level retention setting of 2 months, subject to Google's deletion cycle; this is not a limit on every aggregated report or all data Google holds for its own purposes |
| Google / Meta personalised advertising, audiences and evaluation of that advertising | Voluntary consent, Article 6(1)(a), and applicable device-storage/access consent under Act No. 452/2021 Coll. | Website remarketing audiences for up to 30 days from the last authorised interaction, ending earlier on withdrawal; contact audiences for up to 6 months from advertising consent or its active renewal, ending earlier on withdrawal |
| Remembering and demonstrating choices | Respecting your choice, relevant legal obligations and our legitimate interest in demonstrating compliance; Article 6(1)(c) and (f), depending on purpose | Browser choice for 6 months; minimal consent/withdrawal evidence only as necessary to demonstrate lawfulness and defend relevant claims, without further advertising use |
The accounting period does not automatically apply to entire accounts or all correspondence. When the purpose ends, we erase or genuinely anonymise data; necessary legal records are kept separately with restricted access. Repeat imports, synchronisation or a new purchase do not by themselves extend an advertising audience's permitted period without the relevant consent renewal.
4. Security cameras
Cameras protect people and property and help investigate specific security incidents in this self-service gym. Areas are marked before entry. Changing rooms, showers and other private areas are not monitored. This arrangement does not include audio recording or biometric identification.
Ordinary footage is subject to a maximum retention of 72 hours from recording, with automatic deletion; a shorter period is used where sufficient. This is not a universal statutory camera-retention limit. When an incident is identified, only its necessary relevant extract may be separated and retained as needed for investigation, legal claims or proceedings. The need is regularly reviewed and the extract deleted when it ends. Blanket six-month retention of ordinary footage does not form part of this policy.
Access is restricted to our authorised person responsible for operational security. Relevant footage may be supplied to police, courts, insurers or legal representatives where legally justified. It is not published or used for marketing. Consent to entry or contractual terms is not the legal basis.
For footage-related requests, promptly provide the approximate time and place of your visit so footage can be located before routine deletion. Other people's rights are protected when access is provided. You may object on grounds relating to your particular situation.
5. GYMIFY and other recipients
We disclose data only as necessary to authorised persons and suppliers according to their roles:
- GYMIFY & Co, s. r. o., Oščadnica 930, 023 01 Oščadnica, company ID 53386850: registration, purchases, passes and access platform. It may act as our processor when handling gym data for us, and independently for its own user relationship and purposes. GYMIFY information.
- Netlify, Inc., USA, and relevant hosting suppliers: website delivery and technical security. Their involvement does not automatically amount to marketing consent. Netlify information.
- Google Ireland Limited, Ireland, and relevant Google companies: GA4, authorised Google Ads features, Customer Match and Gmail communications. Roles vary: Google may process for us under the relevant terms for Analytics and Customer Match and may be an independent controller for other advertising operations. Partner-site data, Google privacy.
- Meta Platforms Ireland Limited, Ireland, and relevant Meta companies: authorised Facebook and Instagram advertising, Meta Pixel and customer-list audiences. We may be joint controllers for collection, transmission and specified targeting stages to the extent we jointly determine purposes and means; Meta's subsequent own processing follows its own rules. Our contact above is available for related rights, which can also be exercised against Meta. Meta privacy.
- The payment provider identified at purchase, banks, accounting, IT and legal services as necessary, and competent authorities for legal obligations or specific proceedings. We can provide information about the recipient of a particular transaction on request.
A technical supplier is not automatically an independent controller for everything, and an advertising platform is not always merely a processor. This notice explains our processing; recipients' own activities are also governed by their policies.
6. Analytics, advertising and email matching
Our advertising primarily targets Slovakia, Dunajská Streda and its surroundings. General advertising selected by region or search term does not necessarily use our customer database. Personalised targeting based on website visits or our own email contacts requires the relevant consent.
Depending on your choices, we may use GA4 for visitor statistics, Google Ads for advertising and evaluation, and Meta Pixel for Facebook and Instagram advertising. Remarketing allows APEX adverts to be displayed on supported services based on an earlier interaction. GA4 data can enter advertising audiences only with a valid advertising choice; analytics consent alone is insufficient.
For Google Customer Match and Meta Customer List Custom Audiences, an email collected directly by us with documented advertising consent may be securely supplied to Google or Meta to match their user accounts, create an advertising audience and show personalised APEX adverts. The email is normally hashed before transfer according to the service's requirements. Hashing is not anonymisation: it remains personal data that can be matched. This does not give us a list of private profiles corresponding to individual email addresses.
Matching forms part of the same specific personalised-advertising consent where the wording shown when consent was given clearly covered this operation and its recipients. There is no additional matching-approval button. We must nevertheless be able to demonstrate the appropriate consent for every email used. Anonymous cookie acceptance does not authorise uploading all GYMIFY contacts. Without that consent and its demonstrable link to the contact, the address is not uploaded.
Advertising lists are not a membership requirement. They exclude minors, health data, diagnoses, ZŤP disability status and conclusions from camera footage. Emails and their hashes are not sent as ordinary GA4 events or in URLs. Advertising consent does not permit a different new purpose such as newsletters. This description does not automatically introduce enhanced conversions, server-side transfers or additional contact-data uses.
This is advertising profiling: estimating fitness interest and assigning an audience based on permitted interactions or a contact match. We do not use it for solely automated decisions granting or refusing membership or producing similarly significant effects under GDPR Article 22. Availability of individual advertising features also depends on platform rules and account eligibility.
7. Choices and withdrawal
Analytics and personalised advertising are optional and off by default. Change your choice through Cookie settings in the footer. Analytics and advertising providers can be selected separately; email matching is explained within the relevant advertising choice without another matching consent.
Where an advertising choice is demonstrably linked to a specific email, withdrawing it also covers the corresponding email matching and audience removal; matching does not need a separate withdrawal. You may also withdraw through the relevant customer setting, where available, or email us from that address. You can reject one provider or all personalised advertising. A different anonymous browser or simply deleting cookies may not identify an earlier contact; in that case, use the customer setting or our email route. Withdrawal should be as easy as giving consent.
After withdrawal, we stop new transfers for that purpose, arrange removal from relevant advertising lists we manage and prevent reimport without new valid consent. Blocking a website pixel does not replace removing an already uploaded contact. Platform deletion can involve technical processing time; this does not authorise continued advertising use. Withdrawal does not affect the lawfulness of earlier processing.
We do not operate newsletters or regular email marketing at launch. Transactional messages and replies to enquiries are not newsletters. Any future mailing will have its own information, legal basis and unsubscribe mechanism.
8. Transfers outside the EEA
Global Google, Meta and Netlify services may involve transfers or access from outside the European Economic Area, including the USA. Local advertising does not mean all data stays in Slovakia or the EU.
Transfers for which we are responsible require a valid GDPR Chapter V mechanism: an adequacy decision actually covering the recipient and transfer, or standard contractual clauses and supplementary safeguards where needed. The EU–US framework can be relied upon only while valid and where the recipient has the applicable certification. Contact us for information about safeguards and how to obtain a copy; trade secrets and other people's data may be proportionately protected.
9. Your rights
Subject to GDPR conditions, you may request access and a copy, rectification, erasure, restriction and portability of data processed automatically on consent or contract grounds. You may object to legitimate-interest processing based on your particular situation and object to direct marketing, including related profiling, at any time. Consent can be withdrawn without affecting membership.
We generally respond free of charge within one month. Where legally justified, this may be extended by up to two further months, with reasons and notice given in the first month. Identity checks are proportionate and used only where necessary. Legal archiving or necessary defence of claims may prevent immediate erasure of some data.
You may complain to the Úrad na ochranu osobných údajov Slovenskej republiky (Slovak Data Protection Office), Galvaniho 7/B, 821 04 Bratislava, dataprotection.gov.sk, or a competent supervisory authority, particularly where you habitually reside, work or where the alleged infringement occurred. In Hungary, this is NAIH. You need not first exhaust correspondence with us.
10. Security and updates
We limit access according to work needs and use appropriate technical and organisational safeguards. Only data needed for the particular contract or legal duty is mandatory; withholding it may prevent the relevant service. Refusing optional data or advertising does not have that effect.
We update this notice when actual processing changes. Publishing new wording does not itself grant consent to a new purpose. Our Cookie Notice explains website technologies in more detail.
Annex A — integrated voluntary advertising choice
Personalised APEX advertising — Google and Meta
“I consent to Zdravie vo svojich rukách s. r. o. using my permitted website and advertising interactions and my email, where linked to this consent, for personalised APEX advertising and its evaluation on Google and Meta services (Facebook, Instagram). This includes supplying and matching my email, normally in hashed form, with Google and Meta accounts through Customer Match and customer-list Custom Audiences, creating an advertising audience and showing relevant adverts. I can select the provider in settings. Consent is optional, is not required for membership and is not newsletter consent. I can withdraw at any time through the relevant settings or club.apex.fitness@gmail.com. Details are in the Privacy Notice.”
Annex B — short camera notice before entry
CCTV IN OPERATION
Controller: Zdravie vo svojich rukách s. r. o., company ID 53535871, Osuského 3784/3B, 851 03 Bratislava – mestská časť Petržalka. Purpose: protecting people and property and investigating security incidents. Legal basis: legitimate interests, GDPR Article 6(1)(f). Ordinary retention: up to 72 hours; necessary incident extracts may be retained longer for investigation and protection of rights. Changing rooms, showers and private areas are not monitored. GDPR rights include access and, where applicable, erasure, restriction and objection. Details and rights requests: club.apex.fitness@gmail.com, +421 949 251 571. The full notice is available on the APEX Fitness Club website, www.apexfitness.sk, and from the controller on request.