Privacy Policy regarding the processing
of your personal data
on our website,
within our fitness management software solution
and in our app
Data protection is a matter of trust, and this trust is of utmost importance to us. This privacy Policy is intended to provide transparent information about how we process your personal data and for what purposes.
This notice applies to all individuals whose personal data we process, regardless of the manner in which they interact with us — whether by telephone, through our website, via our app, or through social networks. It covers both personal data already collected and personal data that may be collected in the future.
A. To whom is this Privacy Policy addressed?
Our processing activities may concern, in particular, the following categories of persons:
B. What constitutes personal data?
Personal data includes all information relating to an identified or identifiable natural person. A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, or one or more factors specific to that individual.
We may process, in particular, the following categories of personal data:
In our application, logging in via a Facebook account is not possible, even if the interface may suggest otherwise. Should this option be introduced in the future and you choose to log in through this service, we would in that case gain access to certain data stored with the respective provider, such as your username, profile picture, date of birth, gender, and other information, the scope of which you can generally control. For further details, please refer to the privacy policy of the respective provider.
C. Where do the personal data we process originate from?
The personal data we process originate primarily from you, in particular when you provide such data to us or when you interact with us (for example, when creating an account in our application or when entering into a contract for the use of our fitness centres). We also collect certain data automatically, especially when you visit our website or use our application. In addition, we may receive data from third parties, such as banks, insurance companies, commercial or contractual partners in connection with purchases or payments, as well as providers of online services, including internet analytics providers.
D. For what purposes do we process personal data?
We process personal data in order to ensure effective communication, including responding to enquiries addressed to us, contacting you where necessary, and maintaining our customer relationship.
We also process personal data as required for the performance and administration of our contractual relationship with you - for example, to open and manage customer accounts, administer payments and invoicing, and record, store, or otherwise process business-related data.
In addition, we use certain personal data for information and marketing purposes, such as presenting offers or displaying promotional messages on digital screens.
Personal data are also processed for security and prevention purposes, for instance through video surveillance in our fitness centres or when access bans need to be issued against unwelcome individuals. For these purposes, video recordings may be reviewed, including through automated analysis. In the event of a specific suspicion, it may be possible to define a combination of characteristics (such as clothing details or body height) and to search for this combination automatically within recordings made during a defined timeframe. This facilitates a more efficient review of the footage and supports the identification of potentially unlawful behaviour. It is important to note that no analysis of biometric data, such as facial recognition, nor any automated evaluation of behavioural patterns or similar analyses is carried out in this context.
Other purposes may also require the processing of personal data, in particular:
E. To whom do we disclose personal data?
We may disclose personal data to third parties when their services are required. In most cases, these service providers act as processors and process the data exclusively on the basis of our instructions. However, certain providers may process data as independent controllers. We require our processors to handle personal data strictly in accordance with our instructions and to implement appropriate technical and organisational measures to ensure data security. Some service providers nevertheless act as independent or joint controllers. This is particularly the case with our CRM partner, MagicLine GmbH, which processes certain data as an independent controller, exclusively for statistical purposes and for preparing analyses required for software development within the framework of the services and application offered.
F. Are personal data transferred abroad?
As a general rule, personal data are processed and stored in Switzerland or within the European Union (Germany, Poland and USA (google, Fonts, reCAPTCHA)). However, in certain circumstances, it may be necessary to transfer personal data to service providers located in other jurisdictions, including countries outside the EU. Some of these countries may not provide a level of data protection equivalent to that applicable in Switzerland. In such cases, we ensure that your data remain appropriately protected, in particular through the implementation of suitable safeguards. In exceptional cases, a transfer to a country that does not provide an adequate level of protection may occur, provided that strict conditions are met — for example, your explicit consent, the necessity of such a transfer in connection with legal proceedings abroad, or when the transfer is indispensable for the performance of a contract.
G. What about Sensitive Personal Data and profiling?
We do not currently process any sensitive personal data.
The term "profiling" refers to any automated processing of personal data aimed at analysing or predicting certain personal aspects or behaviours of an individual. Profiling may occur in the context of the use of the App. No automated individual decisions are made in this context that could produce legal effects concerning you or otherwise significantly affect you. Profiling may, however, enable more personalised support and advice or allow offers to be better tailored to specific customer needs.
H. For how long are personal data processed?
Personal data are stored and processed only for as long as necessary to fulfil the purpose for which they were collected, in accordance with the applicable data protection requirements. In the context of a contractual relationship, data are stored and processed for at least the duration of the contract. In addition, we comply with statutory retention periods, in particular those relating to commercial documentation as well as accounting and tax obligations.
I. How do we ensure the security of personal data?
To protect the personal data we process, we implement appropriate technical and organisational security measures. These measures are designed to prevent unauthorised or unlawful processing, as well as the risks of loss, accidental alteration, unintentional disclosure, or unauthorised access. It should be noted, however, that no system can completely eliminate the possibility of data security breaches. A residual risk inevitably remains despite state-of-the-art measures and the application of rigorous safeguards.
J. Specific provisions regarding the processing
of personal data on our website
Cookies
Our website uses cookies. These do not damage your device and do not contain viruses. They help make our services more user-friendly, efficient, and secure. Cookies are small text files that are stored on your device by your browser. Most of the cookies we use are session cookies, which are automatically deleted at the end of your visit. Other cookies may remain stored on your device until you delete them; these enable us to recognise your browser during future visits. You can configure your browser to notify you when cookies are being stored, to allow cookies only in specific cases, to exclude the acceptance of cookies in certain cases or generally, and to activate the automatic deletion of cookies when the browser is closed. Please note that disabling cookies may limit certain functionalities of this website. Cookies that are required for the electronic communication process or for providing features expressly requested by you are stored automatically. Other types of cookies — such as those used to analyse your browsing behaviour — are addressed separately in this privacy notice.
Server Log Files
Our hosting provider automatically collects and stores certain information in server log files, which your browser transmits to us automatically. In particular, the following data: the type and version of your browser, the operating system used, the referrer URL, the hostname of the device accessing the site, the time of the server request, and the IP address. No merging or comparison of this data with other data sources is carried out.
Contact Form
When you submit an enquiry via a contact form, the information entered in the form — including the contact details you provide — is stored for the purpose of processing your request and retained in case follow-up questions arise. The data transmitted through the contact form are retained until you request their deletion or until the purpose of their storage no longer applies (for example, once your request has been fully resolved). Mandatory statutory retention obligations — in particular legally prescribed retention periods — remain unaffected.
SSL / TLS Encryption
For security reasons, and in order to protect the transmission of confidential information that you send to us as the operator of this website, our website uses SSL or TLS encryption. You can recognise an encrypted connection by the change in the browser's address bar from "http://" to "https://", as well as by the appearance of a padlock symbol. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by unauthorised third parties.
ANALYTICS TOOLS AND ADVERTISING
Google Analytics
Our website uses features of the web analytics service Google Analytics, provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses cookies, which are text files stored on your device and which enable an analysis of your use of the website. The information generated by these cookies regarding your use of the website is generally transmitted to and stored on a Google server in the United States. We have activated IP anonymisation on this website. As a result, your IP address is shortened by Google within Member States of the European Union or in other states that are party to the Agreement on the European Economic Area before being transferred to the United States. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and shortened there. Acting on behalf of the operator of this website, Google uses this information to analyse your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.
Google AdSense
This website uses Google AdSense, an advertising service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google AdSense uses cookies (text files stored on your device) that enable analysis of your use of the website. The service also uses web beacons (invisible tracking elements), which allow, among other things, the evaluation of visitor traffic on pages. The information generated by cookies and web beacons regarding your use of the website — including your IP address — as well as data relating to the display of advertising formats are transmitted to and stored on a Google server in the United States. Such information may be disclosed by Google to contractual partners. However, Google undertakes not to associate your IP address with other data held about you. By accessing and using our website, you consent to the processing of your personal data by Google in the manner and for the purposes described above.
Disabling cookies
It is possible to prevent cookies from being stored by configuring your browser settings accordingly. However, please note that disabling cookies may restrict access to certain functionalities of our website or limit its proper operation. You can also prevent Google from collecting data generated by cookies and relating to your use of the website (including your IP address), as well as from processing this data, by downloading and installing the browser add-on available at the following address: https://tools.google.com/dlpage/gaoptout?hl=de.
Objecting to data collection
You can prevent Google Analytics from collecting your data by clicking the following link. An opt-out cookie will then be stored on your device, preventing the collection of your data during future visits to this website: Disable Google Analytics.
For more information on how Google Analytics processes user data, please refer to Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.
PLUGINS AND TOOLS
Google reCAPTCHA
We use "Google reCAPTCHA" (hereinafter: "reCAPTCHA") on our websites. The provider of this service is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). The purpose of reCAPTCHA is to determine whether data entered on our websites (for example, via a contact form) is submitted by a human or by an automated program. To achieve this, reCAPTCHA analyses the behaviour of website visitors using various indicators. This analysis begins automatically as soon as the visitor accesses the website. For the analysis, reCAPTCHA evaluates a range of information (such as the IP address, the duration of the visit, or mouse movements performed by the user). The data collected during this process is transmitted to Google. reCAPTCHA analyses run entirely in the background. Website visitors are not informed that such an analysis is taking place. The processing of this data is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in protecting its online services from abusive automated use, including fraudulent data extraction and spam. For further information on Google reCAPTCHA as well as Google's privacy policy, please refer to the following link: https://www.google.com/recaptcha/intro/android.html.
Google Web Fonts
Our website uses "Google Web Fonts," a service provided by Google, to ensure a consistent and technically optimal display of fonts. When you access a page, your browser automatically downloads the required fonts into its cache to display text and typographic elements correctly. To do so, the browser you are using must establish a direct connection to Google's servers. Through this connection, Google is informed that our website has been accessed from your IP address. The use of Google Web Fonts is based on our legitimate interest in ensuring a coherent, technically optimal, and visually appealing presentation of our online services. If your browser does not support Web Fonts, a standard font installed locally on your device will be used. Additional information regarding Google Web Fonts can be found at: https://www.google.com/policies/privacy/.
Data Processing Agreement
We have entered into a data processing agreement with Google and fully comply with the strict requirements of the German data protection authorities in connection with the use of Google Analytics.
K. Additional data protection information regarding
data processing carried out under the sole responsibility
of MagicLine GmbH
To provide you with a high-quality professional service, we work with MagicLine GmbH, a globally recognised fitness management software provider widely appreciated by its users. This collaboration enables us to serve you in a more flexible and needs-oriented manner.
When data are entered - either by you or by us - into the application or into the fitness management software solution, they are recorded directly in the MagicLine GmbH system. For these processing activities, MagicLine GmbH acts primarily as a processor, operating on the basis of our instructions. The information regarding these processing activities carried out on our behalf has been outlined in the preceding sections.
Certain processing operations, however, are carried out under the independent responsibility of MagicLine GmbH. These concern, in particular, the processing of personal data for the following purposes:
- the development of statistical analyses;
- the preparation of evaluations required for the development and optimisation of the software and services offered.
The data protection principles set out in Sections A to I also apply to these specific processing activities, insofar as they relate to data entered into the MagicLine GmbH system. The lawfulness of these processing operations is based on legitimate interests pursuant to Article 6(1)(f) GDPR. MagicLine GmbH relies on this processing to adapt and continuously improve its application and the associated services. Without such processing, the ongoing technical development of the application would not be possible, which would compromise its full functionality.
L. Additional information regarding the joint controllership
of K-Fit and MySports GmbH (Hamburg) in the context of data processing
To provide the self-service functionality, the booking portal and/or activity-based sports sponsorship, K-Fit works in close cooperation with MySports GmbH. This collaboration also involves the processing of personal data within the scope of the functionalities described above. K-Fit and MySports GmbH have jointly defined how such data are processed at the various stages of the relevant processes.
The key elements of these arrangements, as well as the respective joint responsibilities applicable to the processing activities described below, are outlined in the following sections:
1. Who are the joint controllers?
K-Fit and MySports GmbH
Raboisen 62. For which stages of the process does joint responsibility apply?
2.1 Collection of user data
To use the service, the following user data are collected:
| Access data | User information |
|---|---|
| Email address |
|
For the legal basis applicable to the processing of these data, please refer to the privacy policy of MySports GmbH (https://www.mysports.com/privacy).
2.2 Registration for self-service and establishment of a "Connect" link
To use K-Fit's self-service functionality, a technical connection ("Connect") must be established between your device and the K-Fit system. This technical connection can only be created if your membership with K-Fit has been confirmed. To verify your membership, MySports GmbH transmits to K-Fit the email address you provided when registering with MySports. This email address is then compared with the membership data stored by K-Fit. Alternatively, the "Connect" link may also be established without using the email address, by entering your membership number and date of birth directly with K-Fit. If K-Fit confirms the existence of a valid membership, K-Fit will transmit the following data to MySports GmbH, resulting in the processing of the following personal data concerning you:
| Membership verification request by MySports GmbH to K-Fit | Email address (as registered with MySports GmbH), or alternatively: - Your membership number and date of birth as recorded by K-Fit |
|---|---|
| If membership is confirmed: |
Transmission by K-Fit to MySports GmbH of the following data: - Your K-Fit membership number, - Your date of birth, - The name and address of K-Fit, including associated usage rights, - Where applicable, additional information relating to K-Fit |
| If a "Connect" link is requested: | Registration of K-Fit by MySports GmbH |
For the legal basis applicable to the processing of these data, please refer to the privacy policy of MySports GmbH (https://www.mysports.com/privacy).
2.3 Use of the self-service
The self-service function allows you to access the data concerning you that are stored by K-Fit and, where necessary, to modify them. To enable this access, K-Fit discloses these data to MySports GmbH solely for the purpose of allowing MySports to display them to you and to provide you with the option of updating them. Any changes you make via the self-service are subsequently transmitted by MySports to K-Fit. MySports GmbH does not retain these data permanently within its own systems.
Where available, the self-service also allows you to settle the balance of your K-Fit membership account. In such cases, MySports GmbH forwards your payment information to the relevant payment service provider. The transaction data are then returned by the payment service provider to both K-Fit and MySports GmbH, where they are stored for documentation purposes.
In connection with the provision of the self-service, the following data are processed. These data were collected by K-Fit when your membership contract was concluded and during its administration:
| Personal data | First name, last name, date of birth, gender, title, address details, contact details, payment information, digital signature, as well as, where applicable, other membership-related data stored by K-Fit |
| Contract data | Information relating to the ongoing contract, such as: tariff name, contract start date, contract duration, notice period, membership fee, contractual document in PDF format |
| Suspension periods | Reason for the suspension, membership fee during the suspension period, status, as well as, where applicable, other information stored by K-Fit relating to you |
| Member account data | Due date, collection and recovery information, outstanding amount, open balance, as well as, where applicable, other data stored by K-Fit concerning you |
| Payment data (for payments made to the member account) | Transaction data (provided by the payment service provider) |
For the legal basis applicable to the processing of these data, please refer to the privacy policy of MySports GmbH (https://www.mysports.com/privacy).
2.4 Use of the booking function
If you wish to book a service and this option is available on the website you are using, MySports collects and stores certain personal data. This is only possible if a "Connect" link has already been established. MySports then transmits these data to K-Fit so that K-Fit can be informed of the booking you intend to make:
| Booking data | Information relating to the booked service, such as: date, time, location, or type of service |
| Payment data | Transaction data (provided by the payment service provider) |
It is also possible to make a booking with K-Fit without having an existing membership. In this case, MySports GmbH collects and stores the following personal data and transmits them to K-Fit in order to inform K-Fit of the booking you intend to make:
| Personal data |
First name, last name, date of birth, gender, address, contact details, payment information Consent to the General Terms and Conditions and the Privacy Policy, marketing consent (opt-in), verification status |
| Booking data | Information relating to the booked service, such as: date, time, location, or type of service |
| Payment data | Transaction data (provided by the payment service provider) |
For the legal basis applicable to the processing of these data, please refer to the privacy policy of MySports GmbH (https://www.mysports.com/privacy).
2.5 Use of activity-based sports sponsorship
If you benefit from an activity-based sports sponsorship programme (e.g., provided by your employer), certain data are required to calculate your entitlement. K-Fit collects your activity data, uses them to determine the amount of your sponsorship benefit, and then transmits them to MySports GmbH, where they are stored.
| Personal data | Employee number (assigned by the sponsoring company), first name, last name, date of birth, email address |
| Activity data | Data required to determine your sponsorship entitlement, including the number and duration of your visits to K-Fit |
| Sponsorship conditions and entitlement | Applicable sponsorship conditions and the calculated monthly amount of your sponsorship benefit |
For the legal basis applicable to the processing of these data, please refer to the privacy policy of MySports GmbH (https://www.mysports.com/privacy).
2.6 Collection of tracking data
Tracking may also be carried out. Depending on the scope of the consent you have provided, the following tracking tools may be used:
Google Analytics
For the legal basis applicable to the processing of these data, please refer to the privacy policy of MySports GmbH.
3.1 User data and data collected during registration for the self-service
MySports GmbH processes and retains the data collected in connection with the establishment of the "Connect" link for the duration of the existing contractual relationship. When the MySports GmbH account is deleted, the data collected in this context are deleted without delay, insofar as they are still stored in the systems of MySports GmbH.
3.2 Data collected in the context of the use of the self-service
K-Fit and MySports GmbH process and retain the data collected in connection with the provision of the self-service for the entire duration of the corresponding contract.
If the contractual relationship with MySports GmbH ends, the data collected in the context of the self-service are deleted without delay by MySports GmbH, insofar as they have been stored, and subject to statutory documentation and retention obligations.
The termination of the contractual relationship with MySports GmbH has no effect on the processing of self-service data by K-Fit. K-Fit continues to process the retained data regardless of the end of the contractual relationship with MySports GmbH. These data are deleted or blocked only upon termination of the membership with K-Fit.
For the statutory retention periods applicable in each case, reference is made to the respective privacy policies.
3.3 Data collected in the context of the use of the booking function
The provisions set out in Section 3.2 apply accordingly.
3.4 Data collected in the context of the use of activity-based sports sponsorship
The provisions set out in Section 3.2 also apply.
3.5 Tracking data
Where tracking data are collected by MySports GmbH, the retention period corresponds to the duration of the consent granted.
For further information, please refer to the privacy policy of MySports GmbH (https://www.mysports.com/privacy).
4. Provisions agreed between the joint controllers regarding data subject rights
Within the framework of their joint responsibility under data protection law, K-Fit and MySports GmbH have determined which of the two entities fulfils which obligations pursuant to the GDPR and the applicable national legislation (contact point within the meaning of Art. 26(1), sentence 3 GDPR).
These provisions relate in particular to the exercise of data subject rights, including:
- the right of access (Art. 15 GDPR),
- the right to rectification (Art. 16 GDPR),
- the right to erasure (Art. 17 GDPR),
- the right to restriction of processing (Art. 18 GDPR),
- the right to data portability (Art. 20 GDPR),
- as well as the right to object to processing (Art. 21 GDPR).
| Rights relating to personal data | Competent contact point |
|---|---|
| Establishment of the "Connect" | K-Fit |
| Provision of the self-service | K-Fit |
| Use of the booking function | MySports GmbH |
| Use of the activity-based sports promotion | MySports GmbH |
| Tracking | MySports GmbH |
Notes:
Regardless of the competencies described above, the rights granted under applicable data protection law may be exercised at any time with either K-Fit or MySports GmbH.
K-Fit and MySports GmbH shall inform each other without delay of any requests submitted by data subjects. They shall mutually provide all information necessary to process such requests.
As a general rule, the response will be provided by the entity with which the data subject has exercised their rights.
Furthermore, K-Fit and MySports GmbH each carry out additional data processing operations for which no joint controllership exists; each entity is solely responsible for those processes. Such processing operations therefore do not fall within the scope of the joint controllership arrangements described above.
M. Amendments to this Privacy Notice
This privacy notice may be amended over time, in particular if our data processing activities change or if new legal requirements become applicable. Individuals whose contact details are registered with us will be actively informed of any material changes, provided that such notification can be made without disproportionate effort. As a general rule, the version of the privacy notice that is in force at the time a data processing activity begins shall apply to that specific processing activity.
N. Rights relating to the processing of personal data
Right of access
Every individual has the right to obtain information regarding the processing of their personal data. A request for access must be submitted in writing. A copy of an identity document (identity card or passport) must be enclosed. The relevant contact address is provided at the end of this privacy notice.
Right to rectification
Personal data are kept as accurate and up to date as possible. Should inaccurate data nevertheless be stored, they will be corrected upon request.
Right to erasure and right to restriction of processing
Individuals have the right to request the erasure of their personal data, as well as the right to request the restriction of processing, insofar as such processing is not strictly necessary for the performance of a contract or required by a legal obligation, in particular statutory retention requirements.
Right to data portability
Under certain conditions, individuals have the right to obtain their personal data in a commonly used electronic format, or to request that such data be transmitted or made available to another controller.
Right to object
Individuals may object at any time, with effect for the future, to the processing of their personal data where such processing is neither necessary for the performance of a contract, nor required by a legal basis, nor justified by an overriding or legitimate interest of K-Fit or MagicLine GmbH.
Other rights
In the event of a violation of data protection rights, individuals may lodge a complaint with the competent supervisory authority.
The competent supervisory authority for data processing carried out by K-FIT AG in Switzerland is: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3005 Bern, Switzerland.
The competent supervisory authority for data processing carried out by MagicLine GmbH in Poland is:
Personal Data Protection Office
Representative: Marc Althaus
DS Extern GmbH
Bredkamp 53a, 22589 Hamburg, Germany
Tel.: +49 40 6963 5393-0
Email: [email protected]
Website: https://www.dsextern.de/team
O. Who is responsible for the processing of personal data and how can we be contacted?
For the data processing activities covered by this privacy notice (with the exception of Section L), the sole responsible entity is:
K-FIT AG,
Attn: "Data Protection",
Aemmenmattstr. 43, CH-3123 Belp, BE – Switzerland
For the data processing activities described in Section L, exclusive responsibility lies with:
MagicLine GmbH,
Raboisen 6, 20095 Hamburg, Germany.
MagicLine GmbH is subject to the European GDPR for these processing activities.
For any questions regarding this privacy notice or the processing of personal data, K-FIT AG may be contacted at the postal address above or via e-mail at: [email protected]
