Privacy Policy

1. The data controller for the private gym soloSpace GYM and the website www.solospacegym.sk is:
   1. Business name: Ing. Barbora Kováčová
   2. Registered address: Obrancov mieru 363/14, 015 01 Rajec, Slovakia
   3. Company ID (IČO): 56712553
   4. Tax ID (DIČ): 1125804581 (not VAT-registered)
   5. Registration: Registered in the Trade Licensing Register of the Žilina District Office, trade register no. 580-82087

   (we'll call ourselves "the Operator").

2. Contact for privacy questions:
   1. Email: solospacegym@gmail.com
   2. Phone: +421 948 462 676

1. We use the GYMIFY booking software and customer app to register customers, manage bookings, sell access and assign entry permissions. It's run by:

   GYMIFY & Co, s. r. o., based at Oščadnica 930, 023 01 Oščadnica, Slovakia, IČO: 53 386 850, registered with the Žilina District Court's Commercial Register, Section: Sro, File No.: 75814/L (referred to as "GYMIFY").

2. How your data is handled, technically:
   1. GYMIFY acts as our data processor under Art. 28 GDPR for data related to running the gym.
   2. Everything you enter when registering, booking, paying or getting an access code is processed and stored exclusively on GYMIFY's cloud servers and infrastructure.
   3. We don't store this data on our own local servers or storage. We access it through a secure admin panel, only to verify access rights, manage bookings, oversee operations, and handle customer requests.

We process personal data for the following specific purposes:

1. Booking a slot, forming the contract, and letting you in
   1. Purpose: Registering you, managing and logging bookings, generating access codes (PIN/QR), managing your account, and booking-related communication.
   2. Legal basis: Art. 6(1)(b) GDPR – performing a contract you're party to, or taking steps before entering one.
   3. Data: Name, surname, email, phone number, booking details (date, time), access identifiers, visit history.
   4. How long: For as long as your account/contract is active, then until the general limitation period expires (usually 3 years after the contract ends), to protect our legal claims.
2. Accounting & tax records
   1. Purpose: Bookkeeping, issuing and filing tax documents and invoices for services provided.
   2. Legal basis: Art. 6(1)(c) GDPR – our legal obligation (mainly Act No. 431/2002 Coll. on Accounting, and tax law).
   3. Data: Billing and payment details (name, surname, permanent address, account number, amount, payment date).
   4. How long: 10 years following the year the records relate to, as required by accounting law.
3. CCTV monitoring
   1. Purpose: Protecting our property, protecting people's life, health and safety on-site, and enforcing the House Rules in this unstaffed, private gym. The space is clearly marked with warning signs. Toilets and changing rooms are never filmed.
   2. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in protecting property and ensuring safety.
   3. Data: Video footage of you in the monitored area, with no audio.
   4. How long: Footage loops automatically and is kept for a maximum of 15 days. If there's a security incident or damage, we keep the relevant footage as long as needed for police, court or insurance purposes.
4. Direct marketing & newsletter
   1. Purpose: Letting you know about news, schedule changes and promotions.
   2. Legal basis:
      1. Existing customers: Art. 6(1)(f) GDPR – our legitimate interest in marketing our own similar services, under § 116(3) of Act No. 452/2021 Coll. on electronic communications. You can object and unsubscribe for free, anytime, with one click in the email.
      2. Website visitors (not yet customers): Art. 6(1)(a) GDPR – your freely given consent.
   3. Data: Email address, first name.
   4. How long: Until you object, or until you withdraw consent (max. 3 years).
5. Website analytics (Google Analytics)
   1. Purpose: Measuring site traffic, understanding how visitors use the site, and improving how it works.
   2. Legal basis: Art. 6(1)(a) GDPR – your consent, given via the cookie banner on the site, under § 109(8) of Act No. 452/2021 Coll. on electronic communications.
   3. Data: Online identifiers (anonymised IP address, cookies, device/browser info, on-site activity).
   4. How long: Per the tool's settings (usually max. 14 months), or until you clear your cookies or withdraw consent.
6. Taking and publishing photos & videos
   1. Purpose: Promoting our services on our website and social media profiles.
   2. Legal basis: Art. 6(1)(a) GDPR – your freely given consent.
   3. Data: Photos, video footage showing your likeness.
   4. How long: Until you withdraw consent.

1. Your data is only shared with our authorised staff and contractual partners who guarantee adequate security and process data under a data processing agreement:
   1. GYMIFY & Co, s. r. o. – our tech platform, cloud infrastructure and booking software provider,
   2. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – our analytics provider (Google Analytics),
   3. our payment gateway provider (Comgate, a.s.) – for processing card payments (acting as an independent controller for financial services),
   4. our external accounting firm – handling our bookkeeping,
   5. our CCTV & access-system contractor – installing and servicing our security systems,
   6. our web hosting & IT support provider.
2. Your data may be shared with public authorities (Police, courts, tax office) only where the law specifically requires it.

1. We don't transfer personal data outside the EU/EEA, except through Google Analytics. Google LLC is certified under the EU-U.S. Data Privacy Framework, under which the European Commission has confirmed an adequate level of data protection for transfers to the US.
2. We don't use automated decision-making, including profiling, under Art. 22 GDPR.

Under GDPR, you have the following rights:

1. Access your data (Art. 15 GDPR): Confirm whether we're processing your data, and get access to it.
2. Correct it (Art. 16 GDPR): Ask us to promptly fix inaccurate data or complete incomplete data.
3. Delete it (Art. 17 GDPR): Ask us to erase your data ("the right to be forgotten") once it's no longer needed, or if there's no legal basis to keep processing it.
4. Restrict processing (Art. 18 GDPR): Ask us to temporarily limit processing in the cases set out in GDPR.
5. Data portability (Art. 20 GDPR): Get data you gave us under a contract or consent, in a structured, machine-readable format.
6. Object (Art. 21 GDPR): Object anytime to processing based on legitimate interest (especially CCTV and direct marketing).
7. Withdraw consent: If processing is based on consent (e.g. analytics cookies, the newsletter for non-customers, photos), you can withdraw it anytime.

How to exercise your rights:

You can reach us:

• by post, to our registered address: Obrancov mieru 363/14, 015 01 Rajec, Slovakia
• by email: solospacegym@gmail.com

Filing a complaint:

If you think your personal data is being processed in breach of the law, you have the right to file a complaint with the supervisory authority: the Slovak Data Protection Authority (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava 27, web: www.dataprotection.gov.sk.

1. This privacy policy is published and permanently available on our website, www.solospacegym.sk.
2. We can update this document if the law changes, or if how we run the gym changes technologically.
3. This document takes effect on 17 September 2026.