Privacy Policy

Last updated: 3 August 2026

1. Who we are

The controller of your personal data is SME SPORE SRL (hereinafter “FITGYM”, “we”, “us”), a Romanian legal entity with its registered office at Bd. Alexandru Lăpușneanu, Nr. 113, Constanța, Constanța County, Romania, registered with the Trade Register under no. J2009000332137, tax ID (CUI) RO25081914, e-mail: office@fitgym.ro, phone: +40 767 010 701.

This policy describes how we collect, use, store and protect your personal data when:

you visit our website fitgym.ro (the “Website”);
you use the FITGYM mobile application for iOS and Android (the “App”);
you are a member of our fitness clubs or interact with us at the front desk, by phone or by e-mail.

We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable national legislation.

2. What data we process

2.1. Data processed about you as a gym member

Member accounts are created at the gym’s front desk, not through the App. Upon registration and throughout your membership we process:

first and last name;
mobile phone number;
optionally, if you provide them: e-mail address and date of birth;
the access code associated with your account (used to enter the gym, on a card or as a QR code);
membership type, validity period, membership history and payment history;
gym entry history (date, time and location of each entry).

2.2. Data processed through the App

The FITGYM App is intended exclusively for registered gym members and does not allow the creation of new accounts. Through the App we process:

your mobile phone number – used for authentication. Each time you log in, you receive a one-time verification code (OTP) by SMS, valid for 10 minutes. The App does not use passwords;
your member account data – name, phone number, e-mail, date of birth, membership type and validity, gym entry history, membership history and issued invoices, displayed in the App;
your access QR code – generated locally on your device from your account’s access code;
payment data – memberships can be paid for in the App through the payment processor Stripe. Card data is collected directly by Stripe; we never have access to your full card number and we do not store it. We only receive payment confirmation and a transaction identifier from Stripe. If you choose to scan your card with the camera instead of typing its details, the App will request camera access; the images are processed by Stripe solely to read the card details and are not stored;
company billing details – if you request an invoice issued to a legal entity, you enter the company’s tax identification code (CUI) and the company details (name, registration number, address) are retrieved automatically from the public registry of the Romanian National Agency for Fiscal Administration (ANAF) and associated with your account;
feedback – messages you voluntarily send us through the App’s feedback section;
your language preference for the App (Romanian or English);
technical data – device model and App version, associated with your login session in order to identify active sessions.

The App does not collect location data, contacts, photos or any other data from your device and does not use cookies, analytics or advertising services. The current version of the App does not send push notifications.

Should we introduce push notifications (for example, to let you know that your membership is about to expire), they will work only with the permission granted in your device settings, which you may revoke at any time. For this purpose we will process a technical notification identifier of your device (the “push token”), exclusively to deliver the notifications, on the basis of your consent (Art. 6(1)(a) GDPR); the token will be kept until you disable notifications or uninstall the App.

2.3. Data collected through the Website

When you visit the Website, we may collect:

data you voluntarily submit through the contact form (name, e-mail, phone, message content);
standard technical data: IP address, browser type, pages visited;
cookies, in accordance with the Cookie Policy available on the Website.

3. Purposes and legal bases of processing

Purpose	Data used	Legal basis
Concluding and performing the membership contract (gym access, membership management)	Identification data, membership data, entry history	Art. 6(1)(b) GDPR – performance of a contract
Authentication in the App via SMS code (OTP)	Phone number	Art. 6(1)(b) GDPR – performance of a contract
Processing payments made in the App	Identification data, transaction identifier	Art. 6(1)(b) GDPR – performance of a contract
Issuing invoices and accounting records	Identification data, billing data	Art. 6(1)(c) GDPR – legal obligation
Displaying membership, entry and invoice information in the App	Account data, entry history, invoices	Art. 6(1)(b) GDPR – performance of a contract
Sending push notifications (should they be introduced)	Notification token	Art. 6(1)(a) GDPR – consent, revocable at any time from the device settings
Improving our services based on the feedback you send	Content of the feedback message	Art. 6(1)(f) GDPR – legitimate interest
Maintaining security and diagnosing technical issues	Technical data, server logs	Art. 6(1)(f) GDPR – legitimate interest
Responding to requests submitted through the contact form	Form data	Art. 6(1)(f) GDPR – legitimate interest

We do not send you unsolicited commercial communications through the App. Should we introduce marketing communications, we will do so only with your prior consent, which you may withdraw at any time.

4. Who we share your data with

We do not sell or rent your data. We share it only with the following categories of recipients, strictly to the extent necessary:

SMSO.ro – a Romanian SMS service provider, which delivers the authentication codes to your phone number;
Stripe Payments Europe, Ltd. (Ireland) – the processor of payments made in the App; card data is collected and processed directly by Stripe under its own privacy policy;
SmartBill – the platform through which we issue invoices and fiscal documents;
Hetzner Online GmbH (Germany) – the hosting provider for the servers running the Website and the App’s infrastructure, located in the European Union;
Apple Inc. and Google LLC – as operators of the app stores through which the App is distributed and, should push notifications be introduced, of the notification infrastructure (Apple Push Notification service and Firebase Cloud Messaging, respectively);
our accounting services provider, for the fulfilment of fiscal obligations;
public authorities, where we are required to do so by law.

We have data processing agreements compliant with Art. 28 GDPR in place with all providers that process data on our behalf.

5. International transfers

Your data is stored on servers located in the European Union. Certain services (payment processing through Stripe, App distribution through Apple and Google) may involve the transfer of some data to the United States of America. Such transfers take place on the basis of the EU-US adequacy decision (EU-US Data Privacy Framework) or, where applicable, the Standard Contractual Clauses approved by the European Commission.

6. How long we keep your data

member account data: for the duration of your membership and for 3 years after it ends, corresponding to the general statute of limitations;
financial and accounting documents (including invoices): 5 years, in accordance with fiscal legislation, or the longer period required by law for certain categories of documents;
gym entry history: for as long as the member account exists; it is deleted together with the account;
authentication codes (OTP): 10 minutes from generation;
App login sessions: until you log out or until the account is deleted;
the push notification token (should notifications be introduced): until you disable notifications or uninstall the App;
feedback messages: no longer than 2 years from submission;
contact form data: no longer than 1 year after the request is resolved;
technical server logs: no longer than 90 days.

Upon expiry of these periods, the data is deleted or irreversibly anonymised.

7. Account deletion

You may request the deletion of your member account at any time at the front desk of any FITGYM club or by e-mail at office@fitgym.ro. Deleting the account removes your profile data, including your entry history. Data we are legally required to keep (for example, invoicing documents) will be retained until the expiry of the statutory periods, without being used for any other purpose.

8. Your rights

Under the GDPR, you have the following rights:

right of access – to obtain confirmation that we process data about you and a copy of that data;
right to rectification – to correct inaccurate or incomplete data;
right to erasure (“right to be forgotten”) – under the conditions of Art. 17 GDPR;
right to restriction of processing – under the conditions of Art. 18 GDPR;
right to data portability – to receive your data in a structured, commonly used format;
right to object – to processing based on legitimate interest;
right to withdraw consent – at any time, without affecting the lawfulness of processing carried out before the withdrawal;
right not to be subject to a decision based solely on automated processing – we note that we do not use automated decision-making and do not carry out profiling that produces legal effects concerning you.

To exercise these rights, send a request to office@fitgym.ro or to the registered office address indicated in section 1. We will reply within one month of receiving your request; this period may be extended by two months in complex cases, in which case we will inform you in advance.

If you consider that your rights have been infringed, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, www.dataprotection.ro, or you may bring the matter before the courts.

9. Data security

We apply appropriate technical and organisational measures to protect your data, including:

encrypted communications (HTTPS/TLS) between the App, the Website and our servers;
authentication via one-time verification codes (OTP), with no passwords stored;
session tokens stored exclusively in the device’s secure storage (Keychain on iOS, Keystore on Android);
role-based access to data, limited to staff who need it;
hosting on infrastructure located in the European Union, with security updates applied regularly;
regular backups.

10. Children's data

Our services are intended for persons aged 16 or over. Minors may become members only with the consent of a parent or legal guardian, given when the membership contract is concluded at the front desk. We do not create accounts for, and do not knowingly collect data of, children under 16 through the Website or the App.

11. Changes to this policy

We may update this policy from time to time. The current version, together with the date of its last update, is permanently published on this page and accessible from the App. In the event of significant changes, we will inform you through the App, by SMS or by notice at the gym’s front desk.

12. Contact

For any questions regarding the processing of your personal data:

SME SPORE SRL
Bd. Alexandru Lăpușneanu, Nr. 113, Constanța, Constanța County, Romania
E-mail: office@fitgym.ro
Phone: +40 767 010 701