This document is a policy for the protection of personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (General Data Protection Regulation) (OJ C 133, 11.12.1998, p. 1). EU L 119, p. 1), hereinafter referred to as the GDPR.

2.1 Definition

This Privacy Policy (hereinafter referred to as the Policy) is intended to map the requirements, principles and regulations of the protection of personal data at Gymme Sp. z o.o. with its registered office in Wroclaw, hereinafter referred to as the Administrator.

The policy consists of:

• description of the rules for the protection of personal data, in force at the Administrator;
• details and complementary to this Policy.

2.2 Objectives

The purpose of the Information Security Policy is to indicate the actions to be followed and to establish the rules and rules of conduct to be followed in order to properly perform the Administrator’s duties regarding the security of personal data.

In particular, for the purposes of the Policy, it is:

• safeguarding the resources of systems, technical infrastructure, equipment and fittings against theft, destruction or damage,
• prevent the installation and use of illegal or dangerous software,
• prevent access to information contained in information systems for persons not authorized to do so,
• prevent the destruction or unauthorized alteration of personal data,
• paper documentation containing personal data against theft or copying.

2.3 Assumptions

The protection of personal data with the Administrator is based on the following pillars:

• Legality – The Administrator takes care of privacy and processes the data lawfully.
• Security – The Administrator makes every effort to ensure an adequate level of data security.
• The rights of data subjects – the Controller allows data subjects, exercise of their rights and rights.
• Accountability – The Controller documents how it fulfils its obligations to protect personal data in order to be able to demonstrate the compatibility of the processing of personal data with the GDPR at any time.

2.4 Rules

The Controller processes personal data in compliance with the following principles:

• Legality – personal data are processed on the basis of a specific legal basis and in accordance with the law;
• Reliability – personal data are processed fairly and fairly;
• Transparency – personal data are processed in a transparent manner for the data subject;
• Minimization – personal data are processed only to the extent necessary for the purposes;
• Adequacy – the processing of personal data is proportional to the needs of the Administrator;
• Limited storage – data is stored by the Administrator for a period of not more than necessary for the purposes in which this data are processed;
• Regularity – the processing of personal data is carried out with care for the correctness of personal data;
• Timeliness – the processing of personal data takes place at the necessary time;
• Integrity and confidentiality – The Controller ensures adequate security of the processing of personal data.

2.5 Scope of the Policy

The rules set out by the Policy apply to all personal data sets administered by the Administrator, in particular:

• all existing, currently or future IT systems and paper systems in which personal data to be processed or will be protected are processed;
• personal data processed by the Controller both when he is the controller of the data and when he processes the data entrusted to him on the basis of contracts entrusting the processing of personal data, within the meaning of Art. 28 GDPR;
• all media, e.g. paper, magnetic, optical, etc., on which personal data protected is or will be located;
• all locations – buildings and premises in which personal data subject to protection are or will be processed;
• all employees within the meaning of the Labour Code, consultants, trainees and other persons having access to personal data subject to protection.
• All employees within the meaning of the Labour Code, consultants, trainees and other persons having access to protected information shall apply to the principles laid down by the Policy.

Controller of Personal Data (Administrator) – GymMe Sp. z o.o. (hereinafter referred to as the “Company”) with its registered office in Wroclaw (ul. Mieczysław Wolfkego 38, 54-701 Wrocław), entered in the National Court Register under krs number: 0000808599, with nip 8943146997; Contact: info@gymme.today,share capital of PLN 5000.00;

Personal data – means information about an identified or identifiable natural person; an identifiable natural person is a person who can be identified directly or indirectly, in particular on the basis of an identifier such as name, identification number, location data, internet identifier or one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person;

Personal data set – means an orderly set of personal data available according to specific criteria, regardless of whether the set is centralised, decentralised or distributed functionally or geographically;

Processing of personal data – means an operation or set of operations performed on personal data or sets of personal data in an automated or non-automated manner, such as the collection, recording, organisation, organisation, storage, adaptation or modification, retrieval, viewing, use, disclosure by transmission, dissemination or other sharing, matching or combining, restricting, erasure or destruction;

User – a person with access to the resources of the IT system authorized to process personal data in this system;

IT system – a team of devices, computer hardware, software and databases processing personal data;

Data carriers – any media on which the information is stored in electronic form, in particular discs, CD-ROMs, magnetic cards or portable memory;

IT network – a physical layer of the IT system that includes wiring, nodes and active devices that organize network traffic;

Processor – means a natural or legal person who processes personal data on behalf of the controller under a contract entrusting the processing of personal data, in accordance with Art. 28 of GDPR.

4.1 System for the protection of personal data with the Administrator

Inventory of personal data

• The Controller shall identify the resources of personal data, data classes, the relationship between data resources, the identification of the means of use of data, in particular: sensitive data processing cases, cases of processing of unidentified data, cases of processing of children’s data; Profiling.
• The administrator verifies that there are cases of personal data sharing.

4.2 Register of Personal Data Processing Activities

The Controller maintains the Register of Personal Data Processing Activities, hereinafter referred to as the Registry.

In the Register, for each data processing activity which the Administrator has considered distinct for the purposes of the Registry, it shall record at least: (i) the name of the action, (ii) the purpose of the processing, (iii) a description of the categories of persons, (iv) a description of the categories of data, (v) the legal basis for processing, together with a description of the category of legitimate interest of the Administrator, if the basis is a legitimate interest, (vi) the way in which data is collected, (vii) a description of the categories of data recipients (including processors), (viii) information on the transfer outside the EU/EEA; (ix) a general description of technical and organisational data protection measures.

4.3 Legal bases for the processing of personal data

The Controller identifies and verifies the legal basis for the processing of personal data, in particular:

• maintain a system for managing consents for the processing of personal data;
• inventory and prepares the justifications for cases where the processing of personal data occurs on the basis of the legitimate interests of the Controller.

The Controller records the legal basis for the processing of personal data in the Registry.

4.4 Rights of the data subject

The controller shall comply with the information obligations vis-à-vis the data subjects. In particular, the Administrator:

• provide data subjects with all legally required information during the collection of personal data, as well as in other situations where the law requires additional information to be provided to data subjects;
• provide documentation of the performance of the obligations referred to in this policy.

The Administrator provides persons who are concerned with the exercise of their rights under the GDPR. In particular, the Administrator shall endeavour to ensure that the requests of data subjects are carried out within the deadlines set by the GDPR and reliably documented.

The Controller shall apply procedures for acting in the event of a personal data breach, allowing the identification and verification of the breach and, if necessary, its immediate notification to the Office for Personal Data Protection and the notification of the data subject.

4.5 Minimization

The controller uses by default a privacymethodology that sets principles: data adequacy management, regulation, and data access management, data retention management and verification of continued suitability.

4.6 Security of personal data

The administrator shall establish the possible organisational and technical security measures and assess the cost of their implementation.

The administrator shall determine the usefulness and apply measures and approaches such as:

• pseudonymization,
• encryption of personal data,
• other cybersecurity measures consisting of the ability to continuously ensure the confidentiality, integrity, availability and resilience of processing systems and services,
• measures to ensure continuity and disaster prevention, i.e. the ability to quickly restore the availability and access of personal data in the event of a physical or technical incident.

The controller shall ensure an adequate level of data security, including:

• carry out risk analyses for data processing activities or categories thereof;
• carry out data protection impact assessments where the risk of violations of the rights and freedoms of persons is high;
• adapts data protection measures to the identified risk;
• implement an information security management system;
• manages personal data breach incidents.

4.7 Rules for entrusting personal data to entities

Processing

The processing of personal data is entrusted to processors by means of a written contract.

4.8 Transfer of personal data

The controller shall verify on an ongoing basis whether personal data is not transferred to third countries (i.e. outside the European Economic Area) or to international organisations.

In the case of transfer of personal data to third countries or to international organizations, the Administrator shall ensure compliance with the transfer of data with the GDPR.

The Controller verifies on an ongoing basis whether there are cases of cross-border processing of personal data.

4.9 Privacy by design

The controller takes into account the protection of personal data during the design phase.

4.10 List of buildings and premises in which personal data are processed

The data is stored at the Administrator’s premises or within the IT network (in particular servers that support the Site or Application, Apple and Google online stores – with respect to subscription support)

The procedures for granting permissions, authentication methods and means and backup procedures are governed by the It System Management Manual for the processing of personal data. 17.12.2019

This Policy shall be updated by the Administrator, who submits any proposals for changes to the entity responsible for its implementation.

This Policy shall enter into force on 05.04.2020.

Like most service providers, we use cookies and other data analytics technologies. Cookies are small data files stored in a web browser or device. Cookies allow you to ensure the proper functioning of our services, improve them, and post and measure advertisements. The purposes for which we and our partners use cookies and similar technologies can generally be divided into the following categories:

• necessary: these are cookies that are required to operate our services. For example, these are files that allow you to log in to the site or use the store.
• performance: For example, these are files that collect information about how you communicate with our services and personalize content.
• functional: files, which help to ensure the proper functioning of our services, remember your settings and preferences. They help us identify security threats and prevent them or help us understand and improve the quality of our services.
• advertising and social: These are files that make ads more relevant and meaningful to users of our services or to share with others on social networks such as Facebook or Instagram.

Google Analytics
(category: functional)

Google Analytics cookies are files used by Google to analyze your use of the site, to create statistics and reports about the functioning of the website. Google does not use the collected data to identify you or combine this information to enable identification. You can read more here.

Google AdWords
(category: advertising/social/business)

Google AdWords is a tool that allows you to measure the effectiveness of advertising campaigns implemented by the Administrator. It allows you to analyze such data. Google Adwords also allows people who have visited the site to show ads in the past. You can read more here.

Facebook Pixel
(category: advertising/social/business)

Facebook pixels are a tool that allows you to measure the effectiveness of advertising campaigns conducted by the Administrator on Facebook. This service allows you to track your behavior after you saw or clicked on an ad from Facebook. The tool allows advanced data analytics to optimize activities also using other tools offered by Facebook. More can be found here.

Most browsers and devices accept cookies by default, their settings usually allow you to delete or reject them. You can disable cookies at any time, but then some of the features of our website may not work properly.

You can also prevent Google Analytics from using your data. To do this, install the browser add-on that blocks Google Analytics.

You can access your settings at any time in Google Adds. There, you can decide what data Google uses to display ads dedicated to you.

You can also control how data is used on cells. On iOS devices, you can turn on the “Limit Ad Tracking” setting, and you can turn on the “Opt Out of Ads Personalization” or “Opt Out of Interest-Based Ads” setting on your Android device.

The service contract and the License Agreement are concluded between GymMe Sp. z o.o. when you place an order to subscribe to the App on the Google Play Store or the App Store.

The subscription (subscription fee for the App) is charged by the Google Play or App Store operator, using a User account registered in those stores.

Google Play Store Terms and Conditions, Technical Terms, Billing Policy, Payment Method, Refund and Cancellation Policy, as well as processing personal data provided in connection with purchase of access to the App, are specified by the operators of those stores

A free 14-day trial is available in each type of package. The subscription is activated with the trial period, while payment occurs after 14 days. From that point on, one billing period (1 month) counts.

The trial period can only be used once per phone number.

After 14 days, the application’s funnels are limited. If the user deletes the account, all data entered during the testing period will be lost.

GymMe Sp. z o.o. reserves the right to launch periodic promotions under the rules set out in these promotions. Promotions will be available after entering the code used to make a payment.

At the end of the Billing Period of your choice, the Service Agreement and the License Agreement (Subscription to the Application) are automatically extended for the next Billing Period under the selected Package (unless you change your subscription by changing the type of Package as provided for in the Google Play Store or the App Store), which will be tantamount to collecting a fee from you for the next Billing Period.

You will not be charged if you cancel your subscription under the Google Play or App Store policies, i.e. google play store or app store. no later than 24 hours before the start of the next Billing Period.

Detailed information on this topical basis as of the date of entry into force of the Terms and Conditions is available at: Google Play andAppleStore . Cancellation slated for this period will have effect starting from the next Billing Period.

Canceling your subscription in the above mode is tantamount to termination of the Service Agreement and the License Agreement.

Cancellation of the subscription results in the termination of the Service Agreement and the License Agreement on the last date of the subscription and thus the loss of your access to the functionality of the Application. Canceling a subscription does not delete data stored during application use. Repurchasing access to the Application allows you to continue working without losing data.

To delete data from our servers, you need to delete the user (from profile)

Uninstalling apps from your device doesn’t require you to unsubscribe from your subscription until you cancel on GooglePlay or Apple Store