Privacy policy

Who we are

The controller of your data is MADAGYM SRL, which runs the SERGYM Boutique Fitness 24/7 gym in Cluj-Napoca and the sergym.ro website.

• CUI 37536696, Trade Register no. J12/2336/2017
• Registered office: Str. Edgar Quinet nr. 8, bl. B, ap. 40, Cluj-Napoca, Cluj county, 400592, Romania
• E-mail: office@sergym.ro
• Phone and WhatsApp: 0748 583 841

This policy explains what data we collect, why, how long we keep it and what rights you have.

What data we collect

• Contact details you send us through forms, e-mail or WhatsApp: name, phone, e-mail and your message.
• Membership data: name, e-mail, phone, membership type and period, payment status and the payment history we receive from Stripe. Card details are stored by Stripe, not by us.
• Sign-in data for My account: a 6-digit code sent by e-mail, which we store only as a cryptographic hash and which is valid for 2 minutes, plus a session cookie.
• Gym entry history: the date, time and key used at each entry, recorded by the TTLock system.
• Images from the gym's video cameras.
• Health data, only if you work with a trainer and choose to tell us.
• Photos and clips you appear in, only with your consent.
• Data about a parent or legal guardian, for members between 16 and 18: name, phone and the signed consent.
• Technical logs of the app, linked to your account, with no e-mail or phone number in the text.
• Device and browsing data: browser, device and approximate location, through analytics and marketing cookies, only if you agree.

Why we use the data and on what basis

• Your membership, gym access and My account: performing our contract with you (art. 6(1)(b) GDPR).
• Payment and invoice records: our legal accounting obligations (art. 6(1)(c) GDPR).
• Answering messages, sending the materials you request and booking a free visit: your consent, given through the form (art. 6(1)(a) GDPR).
• Keeping the gym, the site and payments safe, including video cameras, entry history and technical logs: our legitimate interest (art. 6(1)(f) GDPR).
• Health data for training: your explicit consent (art. 9(2)(a) GDPR).
• Photos and clips for the site and social media: your consent (art. 6(1)(a) GDPR).
• Analytics and marketing cookies: only your consent.

We make no automated decisions about you and build no profiles with legal effects.

Video surveillance

We use video cameras in the gym for the safety of members, staff and property, to prevent and investigate incidents, and to make sure the gym rules, including the self-service system, are followed.

The cameras cover the entrance and the training areas. We have no cameras in changing rooms, showers or toilets, and we don't record sound. Signs in the gym show that cameras are present.

The legal basis is our legitimate interest in keeping people and property safe (art. 6(1)(f) GDPR).

Recordings are stored on the recording equipment in the gym and kept for 30 days, then deleted automatically. If an incident happens, we keep the relevant recording for as long as it takes to resolve it.

Only the administrators of MADAGYM SRL can view the images. We hand them to the authorities only when the law requires it. We never use camera recordings for advertising.

Gym entry history

When you enter the gym, the TTLock system records the date, the time and the key used. We use this data to check that access is used personally, for the safety of the gym, to investigate incidents and to answer questions about your access. The legal basis is the performance of the contract and our legitimate interest in keeping the gym safe (art. 6(1)(b) and (f) GDPR).

We may also use how often you visit to get in touch if you haven't been for a while, to see whether we can help. You can object to this use at any time by writing to office@sergym.ro. We keep the entry history for at most 12 months.

Health data (personal training and training programmes)

When you buy a personal training package or a training programme, we ask for your consent for the trainer to use the health information you choose to share: injuries, conditions, limitations, treatments or your doctor's recommendations.

Consent is given through a separate box at purchase or on the sign-up form at the gym.

We use this information only so that your training is adapted and safe for you. Because it is sensitive data, we process it only with your explicit consent (art. 9(2)(a) GDPR).

Only your trainer and the administrators of MADAGYM SRL have access to it. We don't use it for advertising and we don't pass it on to anyone else.

We keep it for as long as you work with the trainer and for at most 12 months after the last session, then we delete it.

You can withdraw your consent at any time by writing to office@sergym.ro or by telling your trainer. Without this information, the trainer may not be able to adapt some exercises safely.

Photos and video

Sometimes we take photos and clips in the gym for the site and for our social media accounts (Instagram, Facebook, TikTok, YouTube).

We ask for your consent through a separate, optional box when you buy a membership or on the sign-up form at the gym. Your membership does not depend on this consent.

We don't publish material in which you can be identified without your consent. If you haven't given it, we try to keep you out of the frame, and if you still appear, we make you unidentifiable or don't use the material.

The legal basis is your consent (art. 6(1)(a) GDPR). You can withdraw it at any time from My account or by writing to office@sergym.ro. We remove the material from our accounts within 7 days. We can't control copies already shared by other people.

Members between 16 and 18

Memberships can be bought online only by people who are 18 or older. People between 16 and 18 can sign up only at the gym, with the written consent of a parent or legal guardian.

In that case we keep, next to the member's data, the parent's name and phone and the signed consent, for as long as the membership data. For a member under 18, the consent for photos and clips is given by the parent.

Who we share the data with

We don't sell your data. We share it only with the providers we need in order to offer you our services, and only as far as necessary:

• Stripe (Ireland): card payments and recurring payments.
• Netlify and Neon: hosting the site and the database.
• Resend: sending e-mails.
• TTLock: gym access. It receives your name, phone and membership period.
• Meta (WhatsApp): if you write to us on WhatsApp.
• The training app used by SERGYM: if you work with a trainer or have a programme in the app.
• Google (Analytics and Maps) and Meta (Pixel): only if you accept the respective cookies.
• Public authorities: only when the law requires it.

Transfers outside the European Union

Some providers may process data in the United States. For the certified ones, the transfer relies on the EU-US Data Privacy Framework. For the others, we use the standard contractual clauses approved by the European Commission.

TTLock is operated by a company in China. We use TTLock's European server, so the data is stored in the European Union, but the provider may access it from outside the EU, for example for technical support. We send TTLock only the minimum needed for access: name, phone and membership period. Insofar as a transfer takes place, it is necessary to perform our contract with you, that is, to give you access to the gym (art. 49(1)(b) GDPR).

How long we keep the data

• Membership data: for as long as you have an active membership and for 3 more years after your last membership ends.
• Payment and invoice data: 5 years, as accounting law requires.
• Messages and requests for materials: as long as needed to answer you, at most 12 months.
• Video camera recordings: 30 days, except those linked to an incident.
• Gym entry history: at most 12 months.
• Health data: for as long as you work with the trainer and at most 12 months after the last session.
• Photos and clips: until you withdraw your consent or until we remove the material. We keep the proof of consent for as long as we use the material and for 3 more years.
• The sign-in code: 2 minutes. The My account session: 7 days from last use.
• Technical logs: 90 days.
• Cookies: as stated on the cookie settings page.

Cookies

We use essential cookies, without which the site and My account don't work. Analytics cookies (Google Analytics) and marketing cookies (Meta Pixel) are used only if you agree. The details and your options are on the cookie settings page. You can change your choice at any time.

How we protect the data

We use reasonable technical and organisational measures: encrypted connections, sign-in codes stored only as cryptographic hashes, access to data limited to the people who need it, and providers that comply with the GDPR.

Your rights

You have the right:

• to find out what data we hold about you and to receive a copy;
• to ask us to correct wrong data;
• to ask us to delete your data, within the limits of the law;
• to ask us to restrict processing;
• to object to processing based on our legitimate interest;
• to ask for data portability;
• to withdraw your consent at any time, without affecting the processing done before the withdrawal.

For any of these rights, write to us at office@sergym.ro. We answer within one month at most.

Complaints

If you are unhappy about something, please write to us first. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro.

Changes

We may update this policy when our services or the law change. The current version is always on this page, with the date of the last update. If the changes are important, we also let you know by e-mail.

Contact

For any question about your data: office@sergym.ro or WhatsApp 0748 583 841.