GymBro Privacy Policy

This Privacy Policy sets out the rules for processing and protecting personal data provided by Users in connection with their use of services available through the GymBro mobile application.

1. Definitions

• Administrator – GymSolutions based in Poland, responsible for processing Users' personal data
• User – a natural person using the GymBro application
• Personal data – information about an identified or identifiable natural person
• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data

2. Data Controller

The controller of personal data collected through the GymBro application is GymSolutions.

Contact with the Administrator is possible via email: [email protected]

3. Purposes and Legal Bases for Data Processing

Users' personal data is processed for the following purposes:

3.1. Service Provision

Data is processed for the performance of the contract for the provision of electronic services (Art. 6(1)(b) GDPR), including:

• Creating and managing user accounts
• Access to application features
• Personalizing user experiences
• Enabling use of training and nutrition plans

3.2. Direct Marketing

Data may be processed for direct marketing of products and services based on the legitimate interest of the Administrator (Art. 6(1)(f) GDPR).

3.3. User Contact

Contact data is used for communication with users, including responding to inquiries and providing technical support.

3.4. Analysis and Service Improvement

Data may be processed for statistical analysis and improvement of application functionality based on the legitimate interest of the Administrator.

4. Types of Processed Data

In providing services, the Administrator may process the following categories of personal data:

• Identification data (first name, last name)
• Contact data (email address, phone number)
• Application usage data (system logs, activity history)
• Health and fitness data (body weight, height, training goals) - if the user chooses to provide them
• Payment data (for premium services)

5. Sharing of Personal Data

Users' personal data may be transferred to the following categories of recipients:

• IT service providers supporting the application (hosting, servers, technical support)
• Payment service providers (for financial transactions)
• Analytical and marketing tool providers
• Entities authorized by law (e.g., law enforcement, courts)

The Administrator does not transfer personal data to third countries or international organizations unless necessary for service provision (e.g., use of cloud services), with transfers made with appropriate safeguards required by GDPR.

6. Data Retention Period

Personal data will be processed for the period of:

• Use of the application services by the User
• Until consent withdrawal (for consent-based processing)
• Until effective objection to data processing
• Until the expiration of the limitation period for claims under the contract
• Until fulfillment of legal obligations requiring data processing

After the processing period expires, data is irreversibly deleted or anonymized.

7. User Rights

Users have the right to:

• Access data – obtain information about processed personal data and copies thereof
• Rectify data – correct inaccurate or complete incomplete data
• Delete data (right to be forgotten) – in certain cases provided by law
• Restrict processing – in situations specified in GDPR
• Data portability – receive data in a structured format and transfer it to another controller
• Object to processing – when processing is based on legitimate interest
• Withdraw consent – at any time, without affecting the lawfulness of processing based on consent before its withdrawal
• Lodge a complaint – with the supervisory authority (President of the Personal Data Protection Office in Poland)

To exercise the above rights, contact the Administrator at: [email protected]

8. Data Security

The Administrator applies appropriate technical and organizational measures to ensure the security of processed data, including:

• Data encryption during transmission (SSL/TLS)
• Encryption of sensitive data in the database
• Access control to personal data
• Regular data backups
• Security incident response procedures
• Employee training on personal data protection

9. Cookies and Tracking Technologies

The application may use cookies and similar technologies for:

• Ensuring proper application operation
• Remembering user preferences
• Statistical analysis of application usage
• Customizing content to user needs

Users can change cookie settings at any time in the application or mobile device settings.

10. Children's Data

The application is not intended for persons under 16 years of age. The Administrator does not knowingly process personal data of children under this age. If it is found that a child's data has been collected, the Administrator will take steps to delete it immediately.

11. Changes to Privacy Policy

The Administrator reserves the right to make changes to this Privacy Policy. Users will be informed of any changes through the application or by email.

The current version of the Privacy Policy is always available in the application.

12. Contact

For questions regarding personal data processing or exercising your rights, please contact:

Last updated: January 2025