PRIVACY POLICY

When you use our website, your personal data is processed; we are therefore obliged, in accordance with Article 13 of the GDPR, to inform you about certain aspects of this processing. We are pleased to fulfil this obligation with this privacy policy:

1. Definitions

Firstly, for the sake of greater transparency, we will explain general terms relating to the processing of personal data. The specific information requirements set out in Article 13 of the GDPR are fulfilled under section B.

1.2 Personal data

Personal data refers to any data that can be linked to you personally, e.g. name, address, email addresses, user behaviour.

1.2 Data subject

Where personal data is processed by a service provider on our behalf, Article 28 of the GDPR requires the conclusion of a DPA. This is a contract required under data protection law, which ensures that the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

1.3 Withdrawal of consent

If you have given your consent to data processing in accordance with Article 6(1)(a) of the GDPR, Section 25 (1) of the TDDDG or Article 9(2)(a) of the GDPR, you may withdraw this consent at any time by notifying the data controller, in accordance with Article 7(3) of the GDPR. Such withdrawal does not affect the lawfulness of processing carried out on the basis of your consent up to the point of withdrawal.

1.4 EU-US Data Privacy Framework

This is an agreement on data exchange between the European Union and the United States of America. It safeguards the rights of data subjects whose data is processed in the US. There is an adequacy decision by the European Commission within the meaning of Article 45 of the GDPR, according to which an adequate level of protection has been established. Providers may undergo self-certification. If certification is granted, the transfer of data to this US provider is covered by the adequacy decision.c

2. Information pursuant to Article 13 of the GDPR

2.1 Data controller and data protection officer

2.1.1 Data controller

The data controller pursuant to Article 4(7) of the GDPR is:

fitbox GmbH
Oranienburger Str. 5c
10178 Berlin

represented by the managing directors Ingo Huppenbauer, at the same address, and Dr Björn Schultheiss, at the same address

Tel.: (030) 513 049 78
Email: info@fitbox.de

(see our legal notice).

2.1.2 Data Protection Officer

You can contact our Data Protection Officer at:

SecData GmbH
Rohrteichstraße 35a
33602 Bielefeld

represented by the Managing Director Dr Christoph Franke, at the same address

Email: info@secdata.gmbh
Telephone: 0521/557519-333

or via our postal address, adding ‘the Data Protection Officer’ to the address.

2.2 Your rights

You have the following rights in relation to your personal data vis-à-vis the data controller referred to in Section I.1:

Right of access,
Right to rectification or erasure,
Right to restriction of processing,
Right to object to processing,
Right to data portability.

You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data.

The competent supervisory authority is:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59-61
10555 Berlin

Tel.: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de

You may exercise the aforementioned rights with and against each of the data controllers.

2.3 Information pursuant to Article 13(1)(c)–(f) and (2) of the GDPR

In the interests of greater transparency, we fulfil these information obligations when describing each specific processing activity.

2.3.1 Provision of the website (hosting) and log files

We host the content of our website with the following provider:

HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA, represented by the CEO Yamini Rangan, email: hubspotgermany@hubspot.com.

When you visit our website, the provider collects various log files, including your IP addresses. For further details, please refer to the provider’s privacy policy: https://legal.hubspot.com/de/privacy-policy.

The provider HubSpot also processes your data on servers in the USA. In principle, the USA is a non-adequate third country within the meaning of Article 44 of the GDPR. However, the EU-US Privacy Framework constitutes an adequacy decision by the European Commission within the meaning of Article 45 of the GDPR, pursuant to which an adequate level of protection has been established. The provider has undergone self-certification as an active member.

We have entered into a data processing agreement (DPA) with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

We use the CloudFront Content Delivery Network (CDN) provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (AWS), to enhance the security and delivery speed of our website.

The provider temporarily stores your IP address in anonymised form at so-called edge locations so that requests for specific resources on our website can be processed quickly.

The legal basis for this is our legitimate interest in not operating our own content delivery network, in accordance with Article 6(1)(f) of the GDPR.

For security reasons and to protect the transmission of confidential content – such as orders or enquiries that you send to us as the website operator – this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of your browser changes from ‘http://’ to ‘https://’ and by the padlock symbol in your browser bar. When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

Browser type and browser version
Operating system used
Referrer URL
Hostname of the accessing computer
Time of the server request
IP address

This data is not combined with other data sources.

This data is collected on the basis of Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in ensuring the technically error-free display and optimisation of its website – to this end, the server log files must be recorded.

2.3.2 Cloudflare

We use the Cloudflare application provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to make our website faster and more secure. The provider uses cookies and processes user data. Cloudflare, Inc. is a provider based in the USA that offers a content delivery network and security services. The services are used between the user and our hosting provider and function as a so-called reverse proxy for websites.

These security measures enhance the performance of our website and reduce its vulnerability to attacks.

Cloudflare itself only collects data that the website operator has authorised. This includes data such as contact details, IP address, fingerprinting ID, DNS log data and information about websites derived from your browsing activity. Log data helps Cloudflare, in particular, to detect new threats.

Cloudflare uses cookies to identify users and to tailor security tools to individual users. This enables us to determine whether your device is trustworthy, thereby granting you access to our website. The cookie is strictly necessary for the security functions and cannot be disabled.

Cloudflare deletes such data within 24 hours. The provider does not store personal data such as your IP address.

It is possible to prevent data processing by Cloudflare by disabling the execution of script code in your browser or by installing and using a script blocker.

The legal basis for this processing is our legitimate interest in not operating our own content delivery network, in accordance with Article 6(1)(f) of the GDPR.

The data mentioned above is generally transferred to a server operated by the provider in the USA and processed there. In principle, the USA is a non-adequate third country within the meaning of Article 44 of the GDPR. However, the EU-US Privacy Framework constitutes an adequacy decision by the European Commission within the meaning of Article 45 of the GDPR, pursuant to which an adequate level of protection has been established. The provider has undergone self-certification as an active member.

Further information is provided by the provider at: https://www.cloudflare.com/de-de/privacypolicy/

2.3.3 Contact form and contacting us

When you contact us by email or via a contact form, we will store the data you provide (surname, first name, email address, telephone number and your message) in order to answer your enquiries. We will delete the data collected in this context, if the enquiry relates to a contract, in accordance with the retention periods applicable to the contract; otherwise, once storage is no longer necessary, or we will restrict processing if statutory retention obligations apply. Depending on the nature of the enquiry, the legal basis is either our legitimate interest in responding to your enquiry quickly and effectively in accordance with Article 6(1)(f) of the GDPR, or the implementation of pre-contractual measures in accordance with Article 6(1)(b) of the GDPR. If the enquiry can be linked to an existing contract, the legal basis is the performance of the contract in accordance with Article 6(1)(b) of the GDPR.

2.3.4 Processing of data from your devices

In addition to the data mentioned above, when you use our website we employ technical tools for various functions, in particular cookies, which may be stored on your device. When you visit our website, and at any time thereafter, you can choose whether to allow cookies in general or which specific additional functions you wish to select. You can make changes in your browser settings or via our Consent Manager. Below, we first describe cookies from a technical perspective before going into more detail about your individual options, explaining technically necessary cookies and those you can voluntarily enable or disable.

Cookies are text files or pieces of information stored in a database on your hard drive and associated with the browser you are using, so that the party setting the cookie can receive certain information. Cookies cannot run programmes or transmit viruses to your computer; their primary purpose is to make the website faster and more user-friendly. This website uses the following types of cookies, the functioning and legal basis of which we will explain below: Transient cookies: These, in particular session cookies, are automatically deleted when you close your browser or log out. They contain a so-called session ID. This allows various requests from your browser to be assigned to the same session, and your computer can be recognised when you return to our website.

Persistent cookies: These are automatically deleted after a specified period, which varies depending on the cookie. You can view the cookies that have been set and their expiry dates at any time in your browser settings, and delete the cookies manually.

Other technologies: These functions do not rely on cookies, but on similar technical mechanisms, such as Flash cookies, HTML5 objects or an analysis of your browser settings. The result is that we are also able to use the techniques described below. Here too, you may, of course, give your consent or object.

Essential functions technically necessary for the display of the website: The technical structure of the website requires us to use certain technologies, in particular cookies. Without these techniques, our website cannot be displayed (correctly in full) or the support functions may not be available. These are generally transient cookies, which are deleted at the end of your visit to the website, or at the latest when you close your browser. You cannot opt out of these cookies if you wish to use our website. The individual cookies are listed in the Consent Manager.

Optional cookies subject to your consent: We only set certain cookies once you have given your consent, which you can select via the so-called ‘cookie consent tool’ when you first visit our website. These functions are only activated if you give your consent and may, in particular, enable us to analyse and improve visits to our website, make it easier for you to use the site across different browsers or devices, recognise you when you return, or display advertising (including, where applicable, tailoring adverts to your interests, measuring the effectiveness of adverts, or displaying interest-based advertising). The legal basis for this processing is Article 6(1), first sentence, point (a) of the GDPR and Section 25(1) of the TDDDG.

You may withdraw your consent at any time, without this affecting the lawfulness of the processing carried out prior to the withdrawal.

The functions we use, which you can select and subsequently withdraw individually via the Consent Manager, are described below.

a) Cookie Consent Tool

To obtain consent for the processing of website users’ data and to manage this consent, we use the Cookie Consent Tool provided by HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA. To this end, the provider records the consents granted and withdrawn, the respective time and an identification number. To this end, the provider uses cookies.

The legal basis for this processing is our legal obligation to provide evidence of consent given (under Article 7(1) of the GDPR) in accordance with Article 6(1)(c) of the GDPR.

Further information is provided by the provider at https://legal.hubspot.com/privacy-policy.

b) Google Tag Manager

We use the Tag Manager provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager enables us to integrate statistics and analytics tools into our website. The Tag Manager itself does not store any cookies and has no analytics functions of its own. The Tag Manager therefore only records your IP address. Google acts as a data processor and we have entered into a corresponding contract with Google.

The information generated by the cookie and the (usually truncated) IP addresses relating to your use of this website are generally transmitted to a Google server in the USA and processed there. The provider is an active participant in the EU-US Data Privacy Framework, which sets out rules for secure data transfer to the USA. In addition, the provider uses standard contractual clauses within the meaning of Article 46(2) and (3) of the GDPR, which are intended to ensure that data processing complies with European standards. The European Commission has assessed these clauses, by means of an implementing decision, as providing adequate safeguards for the transfer of personal data to the USA. Further information from the provider can be found at: https://policies.google.com/privacy/frameworks.

The legal basis is our legitimate interest in the swift and straightforward integration of various analytics and statistics tools in accordance with Article 6(1)(f) of the GDPR. Where we seek your consent for this, the processing is based on Article 6(1)(a) of the GDPR. Your consent may be withdrawn at any time.

c) Facebook Pixel

We use the visitor action pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure conversions among visitors to our website. Conversion tracking allows us to monitor the behaviour of website visitors after they have been redirected to our website by clicking on a Facebook advert. This enables us to assess the effectiveness of advertising campaigns run via Facebook for statistical purposes and market research, which helps to optimise future advertising campaigns.

We do not have access to the data collected in this way, so we cannot draw any conclusions about the identity of individual visitors. The provider processes this data and may also link it to any user profile you may have with them. The provider therefore also uses this data for its own advertising purposes. We have no control over this.

The legal basis for the use of the Facebook Pixel is our legitimate interest in effective advertising measures via social media within the meaning of Article 6(1)(f) of the GDPR. Where we seek your consent, the legal basis is your consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG. Your consent may be withdrawn at any time. The provider also processes your data in the USA. The provider is an active participant in the EU-US Data Privacy Framework, which sets out rules for the secure transfer of data to the USA. In addition, the provider uses standard contractual clauses within the meaning of Article 46(2) and (3) of the GDPR, which are intended to ensure that data processing complies with European standards. The European Commission has assessed these clauses, by means of an implementing decision, as providing adequate safeguards for the transfer of personal data to the USA. Further information from the provider can be found at: https://de-de.facebook.com/privacy/policy/.

d) Reviews via ProvenExpert

We use the ProvenExpert review platform provided by Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin. We have incorporated the provider’s review badges onto our website.

The provider’s review system enables customers to rate our services online. The review badge enables us to display customer reviews submitted about us on the provider’s platform as a badge on our website. When you visit our website, a connection is established with the provider for display purposes, so that the provider can determine that you have visited our website. In doing so, the provider collects your IP address and your language settings as personal data, so that the badge can be displayed in the selected language.

The legal basis for the processing of the aforementioned personal data is your consent in accordance with Article 6(1)(a) of the GDPR, which you can give and withdraw via the cookie consent tool. Your consent may be withdrawn at any time.

Further information on the provider’s data protection policy can be found at: https://www.provenexpert.com/de-de/datenschutzbestimmungen/.

The provider acts as a data processor and we have entered into a corresponding data processing agreement with the provider.

e) Google Fonts

We use the ‘Google Fonts’ provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. When you visit our website, the provider’s fonts are loaded from the provider’s server into your browser cache. In doing so, the provider stores your IP address. The purpose is to improve the visual presentation of our text elements. The legal basis is our legitimate interest in the visually appealing presentation of our website in accordance with Article 6(1)(f) of the GDPR. The provider stores your IP address for a period of one year from the date of access.

In principle, the USA is a non-adequate third country within the meaning of Article 44 of the GDPR. However, the EU-US Privacy Framework constitutes an adequacy decision by the European Commission within the meaning of Article 45 of the GDPR, pursuant to which an adequate level of protection has been established. The provider has undergone self-certification as an active member.

Further information from the provider can be found at: https://policies.google.com/privacy/frameworks.

f) Google Maps

On this website, we use the Google Maps service. This enables us to display interactive maps directly on the website and allows you to use the map function conveniently. In addition, you can allow your location to be determined at https://fitomat.com/en/all-studios The legal basis for the use of the maps is Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG; in other words, the integration takes place only with your consent.

When you visit the website, Google receives information that you have accessed the relevant subpage of our website. In addition, the basic data mentioned above, such as your IP address and timestamp, are transmitted. This occurs regardless of whether Google provides a user account through which you are logged in, or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish for your data to be associated with your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such analysis takes place in particular (even for users who are not logged in) to deliver targeted advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact Google.

When determining your location at https://https://fitomat.com/de/alle-studios, geolocation data from your device is also transmitted to the provider.

The information collected is stored on Google’s servers, including those in the USA. The provider is an active participant in the EU-US Data Privacy Framework, which sets out rules for the secure transfer of data to the USA. In addition, the provider uses standard contractual clauses within the meaning of Article 46(2) and (3) of the GDPR, which are intended to ensure that data processing complies with European standards. The European Commission has assessed these clauses, by means of an implementing decision, as providing adequate safeguards for the transfer of personal data to the USA. Further information from the provider can be found at: https://policies.google.com/privacy/frameworks.

Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the provider’s privacy policy. There you will also find further information on your rights in this regard and settings options to protect your privacy: www.google.de/intl/de/policies/privacy.

g) HubSpot

We use the customer relationship management tool and analytics service HubSpot, provided by HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA. The purpose of this is to visualise online sales, generate leads, improve the customer experience and manage customer relationships. To this end, the service sets a cookie which records the IP address, device identifier, duration of the visit, clickstream data and communication history of website visitors. Furthermore, in the event of an online contract being concluded, your name, address and email address will be processed by the provider for the purpose of analysing customer data in accordance with the processing purposes. HubSpot cookies are valid for a maximum of 24 months. If the data collected via the cookie can be linked to a contract, it will be stored in accordance with the retention periods applicable to the contract, i.e. for a period of three years from the end of the contract. If the data is not linked to a contract, the retention period is three years from the date the data was collected. The legal basis is your freely revocable consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG. The data mentioned above is generally transferred to a server operated by the provider in the USA and processed there. In principle, the USA is a non-adequate third country within the meaning of Article 44 of the GDPR. However, the EU-US Privacy Framework is covered by an adequacy decision issued by the European Commission within the meaning of Article 45 of the GDPR, under which an adequate level of protection has been established. The provider has undergone self-certification as an active member. The provider provides further information on data protection at https://legal.hubspot.com/de/privacy-policy.

h) Google Reviews / Elfsight

We use a service provided by Elfsight, LLC, 19/3 Paronyana St, 201 Yerevan, 0015, Armenia, to display user reviews of our company from the Google platform on our website. When you visit our website, your IP address, operating system and browser are transmitted to a server operated by the provider, and a cookie is loaded so that the user reviews can be retrieved and displayed. In addition, a connection is established to a server operated by Google, from which the reviews are loaded and updated. Google also receives your IP address as a result of this. The legal basis is our legitimate interest in advertising using positive user reviews and in not having to maintain our own tool for displaying them, in accordance with Article 6(1)(f) of the GDPR. If you have given your consent, the legal basis is your freely revocable consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG.

2.4 Our presence on social media

We have various accounts on so-called social media platforms. We operate these accounts via the following providers:

Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, represented by Richard Kelly;https://www.facebook.com/privacy/policy); Our page: https://www.instagram.com/fitomatgym/
Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, represented by Richard Kelly; https://www.facebook.com/privacy/policy/); Our page: https://www.facebook.com/fitomat.gym;
TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, represented by Cormac Keenan, Richard Martin Baillie Waterworth; https://www.tiktok.com/legal/page/eea/privacy-policy/de); Our page: https://www.tiktok.com/@fitomat
YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: https://policies.google.com/privacy); Our page: https://www.youtube.com/@FITOMAT247
LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, represented by Keith Ranger Dolliver, Benjamin Orndorff, James O’Connor, Henry Chi-Ning Fong, Mark Legasp; https://www.linkedin.com/legal/privacy-policy; Our page: https://de.linkedin.com/company/fitomat.

We rely on the technical platform and services provided by these providers for these information services. Please note that you use our social media profiles and their features at your own risk. This applies in particular to the use of interactive features (e.g. commenting, sharing, rating). When you visit our social media pages, the providers of the social media platforms collect, amongst other things, your IP address and other information stored on your device in the form of cookies. This information is used to provide us, as the account operators, with statistical information about interaction with us.

The data collected about you in this context is processed by the platforms and may be transferred to countries outside the European Union, in particular the USA. The providers Meta, Google and LinkedIn are active participants in the EU-US Data Privacy Framework, which the European Commission has determined to provide an adequate level of protection within the meaning of Article 45 of the GDPR.

We would like to point out that the provider, TikTok, processes data in non-secure third countries such as the USA and China. We have no influence over TikTok’s processing of data. Furthermore, we are unable to ascertain the extent to which, the location where and the duration for which the data is stored; the extent to which TikTok complies with existing obligations to delete data; what analyses and linkages are carried out with the data; and to whom the data is disclosed.

We are not aware of how the social media platforms use the data generated by your visit to our account and your interaction with our posts for their own purposes, how long this data is stored, or whether data is passed on to third parties. Data processing may vary depending on whether you are registered and logged in to the social network or are visiting the site as an unregistered and/or logged-out user. When you access a post or the account, the IP address assigned to your device is transmitted to the social media platform provider. If you are currently logged in as a user, a cookie on your device can be used to track your browsing activity online. Buttons embedded in web pages enable the platforms to record your visits to these web pages and link them to your respective profile. This data can be used to offer you content or advertising tailored to your interests. If you wish to avoid this, you should log out or deactivate the ‘stay logged in’ function, delete the cookies stored on your device and restart your browser.

As the provider of this information service, we also process only those data relating to your use of our service which you provide to us and which require interaction. If, for example, you ask a question that we can only answer by email, we will store your information in accordance with the general principles of our data processing, as described in this privacy policy. The legal basis for this is our legitimate interest in the promotional presentation of our company in accordance with Article 6(1)(f) of the GDPR.

To exercise your data subject rights, you may contact either us or the provider of the social media platform. If one party is not responsible for responding or needs to obtain the information from the other party, we or the provider will then forward your enquiry to the relevant partner. Please contact the operator of the social media platform directly with any questions regarding profiling or the processing of your data when using the website. If you have any questions regarding the processing of your interactions with us on.

The information that the social media platform receives and how it is used is described by the providers in their privacy policies (see the link in the table above). There you will also find details of how to contact them and information on how to manage your advertising settings. Further information on social networks and how you can protect your data can also be found at www.youngdata.de.

2.5 Online applications

You have the option of applying to us by email using one of the email addresses listed above. In doing so, we collect your email address and any other personal data you provide, such as your first name, surname, email address, telephone number, date of birth, postal address, weekly working hours, photograph, CV, cover letter or references. The purpose of processing this data is to process your application and subsequently contact you.

The legal basis for the processing is pre-contractual measures relating to your application in accordance with Section 26(1) of the Federal Data Protection Act (BDSG) in conjunction with Article 6(1)(b) and Article 88 of the General Data Protection Regulation (GDPR).

If an employment contract is not concluded, we process the applicant’s data to safeguard our legitimate interest in defending ourselves against legal claims and to retain it as evidence within the meaning of Article 6(1)(f) of the GDPR.

We will delete your applicant data no later than the end of the third year following the conclusion of the application process, subject to statutory retention obligations or any further processing rights.

2.6 Newsletter

You can subscribe to our newsletter, through which we inform you about our current offers of interest, by giving your consent. The goods and services advertised are specified in the declaration of consent. Registration is available to persons aged 16 and over. The newsletter is sent either by fitbox GmbH or by the operator of the selected studio.

We use the so-called double opt-in procedure for subscribing to our newsletter.

This means that, following your registration, we will send an email to the email address you have provided, asking you to confirm that you are the owner of the email address provided and that you wish to receive the notifications. If you do not confirm your subscription within 24 hours, your details will be blocked and automatically deleted after one month. In addition, we store your IP addresses and the times of your registration and confirmation. The purpose of this procedure is to verify your subscription and, if necessary, to investigate any potential misuse of your personal data.

The only mandatory information required to receive the newsletter is your email address. The provision of any further, separately marked data is voluntary and is used to address you personally. Following your confirmation, we will store your email address for the purpose of sending you the newsletter. The legal basis for this is Article 6(1)(a) of the GDPR.

You may withdraw your consent to receive the newsletter at any time and unsubscribe from it. You can do so by clicking on the link provided in every newsletter email, by emailing info(at)fitbox.de, or by sending a message using the contact details provided in the legal notice.

We use the HubSpot service provided by HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA, to send out our newsletter. This enables us to contact newsletter subscribers and analyse your user behaviour to improve our service.

For this purpose, we provide the service provider with the following personal data: email address and, if provided, your name and telephone number.

HubSpot acts as a data processor for the distribution of the newsletter. We have entered into a corresponding data processing agreement with the provider.

The provider also collects information about your device, the browser used, the date and time, and your browsing activity. This processing is carried out on the basis of the provider’s legitimate interest in the security and reliability of the systems, as well as compliance with the terms of use, in accordance with Article 6(1)(f) of the GDPR.

2.7 Taking out a membership

You can take out a membership at our gym via our website using the contact form. To complete the contract, you must provide your personal data (gender, surname, first name, address, account holder, IBAN, email address, date of birth, telephone number, address, start date of training) via a contact form; we require this information for the purpose of fulfilling the contractual relationship. The legal basis for this is the performance of the contract in accordance with Article 6(1)(b) of the GDPR.

For payment, you may issue us with a SEPA direct debit mandate. We will pass on your payment details to our bank for payment processing. The legal basis for this is the performance of the contract in accordance with Article 6(1), first sentence, (b) of the GDPR.

We are obliged under commercial and tax law to store your address, payment and order details for a period of ten years. This follows, amongst other things, from Section 147(3) of the German Fiscal Code and Section 257(4) of the German Commercial Code.

Your data will be passed on to the provider of our management software, MagicLine GmbH, Raboisen 6, 20095 Hamburg, for customer management purposes when you take out a membership.

a) Payment service providers

Instead of issuing a direct debit authorisation, you have the option of completing the payment transaction via various payment service providers:

The ‘PayPal’ service provided by PayPal Europe S.à.r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg;
the “Apple Pay” service provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland;
the “Adyen” online payment system provided by Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands.

The relevant provider will receive the following personal data for this purpose: name, address, email address, telephone number, device used, geolocation data, bank details. The provider stores your data until the payment process has been completed, including the processing of refunds, debt management and fraud prevention.

For certain services, such as payment by direct debit, providers carry out a credit check to ensure solvency. For this purpose, the provider passes on your data, as listed above, to credit reference agencies.

If you use the online payment system Adyen (No. 3), you have the option of paying via the provider’s payment system using your credit card. Stripe then passes your data on to the relevant credit card provider. These are the following providers:

The relevant provider receives the following personal data for this purpose: name, address, email address, telephone number, device used, geolocation data, bank details. The provider stores your data until the payment process has been completed, including the processing of refunds, debt management and fraud prevention.

If you use the online payment system Adyen (No. 3), you have the option to pay using your credit card via the provider’s payment system. Stripe will then pass your data on to the relevant credit card provider. These are the following providers:

Credit cards issued by Mastercard Europe SA, Chaussee de Tervuren 198A, B-1410 Waterloo, Belgium;
Credit cards issued by Visa Europe Management Services Limited, 1 Sheldon Square, London W2 6TT;
Credit cards issued by American Express Europe S.A. (Germany branch), Theodor-Heuss-Allee 112, 60486 Frankfurt am Main;
Credit cards issued by card complete Service Bank AG, Lassallestraße 3, 1020 Vienna (Diners Club);
Credit cards issued by Discover Financial Services, Inc., 2500 Lake Cook Road, Riverwoods, IL 60015, USA (Discover).

The legal basis for the processing is the performance of a contract in accordance with Article 6(1)(b) of the GDPR.

The payment service providers act as both data controllers and data processors. As data controllers, they use the data you provide to fulfil financial regulatory obligations. As data processors, the payment service providers carry out the transaction on our behalf within their payment networks. In this respect, the payment service providers act as data processors, and we have entered into a Data Processing Agreement with them.

We will store your data until the transaction has been completed. This also includes the period required for processing refunds, debt management and fraud prevention. Thereafter, your data will be deleted, subject to any statutory retention obligations or retention rights.

2.8 Cancellation button

When you contact us via the contact form, which can be accessed via the ‘Cancel contracts here’ button, we will store the data you provide (first name, surname, address, membership number, date of cancellation, reason for cancellation and, where applicable, any additional details) in order to process your cancellation. We will delete the data collected in this context – if the enquiry relates to a contract – three years after the end of the relevant membership contract; otherwise, we will delete it once storage is no longer necessary, or restrict its processing if statutory retention obligations apply. In accordance with Section 312k(1) and (2) of the German Civil Code (BGB), we are legally obliged to provide such a cancellation button. The legal basis for data processing is therefore Article 6(1)(c) of the General Data Protection Regulation (GDPR).

2.9 Application to become a franchisee

If you are interested in a franchise partnership, you can use the contact form at https://fitomat.com/de/fitness-franchise to request information and advice. For this purpose, we collect the following personal data: first name, surname, telephone number, email address, preferred location, planned equity capital. We will then contact you by email or telephone to send you further information about our offer and to arrange an appointment.

We will delete the data collected in this context – if the enquiry is linked to a contract – in accordance with the retention periods applicable to the contract; otherwise, once storage is no longer necessary, or we will restrict processing where statutory retention obligations apply. The legal basis is the implementation of pre-contractual measures in accordance with Article 6(1)(b) of the GDPR.

2.10 Submitting a property tip

You have the option of using the contact form at https://pages.fitomat.club/tipp-immobilie to provide us with information about properties that are for sale. To this end, we collect the following personal data: first name, surname, telephone number, email address, status as owner or estate agent, and details of the property. We will then contact you by email or telephone to provide further information and, where applicable, to arrange an appointment.

2.11 Enquiring about corporate fitness

If you are interested in a corporate fitness membership, you can use the contact form at https://fitomat.com/de/firmenfitness#form to request information and advice. To this end, we collect the following personal data: first name, surname, telephone number, email address and your message. We will then contact you by email or telephone to send you further information about our offer and to arrange an appointment.

We will delete the data collected in this context, if the enquiry leads to a contract, at the end of the contract term; otherwise, once storage is no longer necessary, or we will restrict processing if statutory retention obligations apply. The legal basis is the implementation of pre-contractual measures in accordance with Article 6(1)(b) of the GDPR.