es
open

Privacy Policy

Content

1. Information on the collection of personal data and contact details of the data controller

1.1

We are pleased that you are visiting our website and thank you for your interest. Below we inform you about the handling of your personal data when using our website. Personal data is any data with which you can be personally identified.

1.2 Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Fitness Nation GmbH

Bergstr. 18, 59394 Nordkirchen, Germany

Tel.: 025969372486

Email: info@fitness-nation.com

The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3 Data Protection Officer

The data controller has appointed a data protection officer. They can be contacted as follows:

Mr. Jürgen Recha

c/o interev GmbH

Robert-Koch-Straße 55

30853 Langenhagen

1.4 SSL/TLS encryption

This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (eg, orders or inquiries to the controller). You can recognize an encrypted connection by the string "https://" and the lock symbol in your browser line.

2. Data collection when visiting our website

When using our website for purely informational purposes, ie, if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to our server (so-called "server log files").

When you call up our website, we collect in particular:

  • our visited website / accessed subpages
  • date and time at the time of access
  • amount of data sent in bytes
  • source/reference from which you reached the page
  • browser used
  • operating system used
  • IP address used (if applicable in anonymized form)

Purposes of processing:

  • technical provision of the website
  • ensuring stability and security
  • error analysis and abuse/attack investigation (eg, DoS/DDoS)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the stability and functionality as well as security of our website).

No sharing or other use of the data takes place. As a rule, we do not use the collected data for the purpose of drawing conclusions about your person. We reserve the right to do so only if there are concrete indications of unlawful use and clarification is necessary.

3. Content Delivery Network (CDN) / Cloudinary

When you upload images using our portal (see section 8), we use a Content Delivery Network (CDN) provided by the technology service provider Cloudinary . A CDN is an online service that delivers large media files (such as graphics, images, or scripts) through a network of regionally distributed servers connected via the internet. This optimizes loading speeds and stability.

Service Provider: Cloudinary Inc., 111 W Evelyn Ave, Suite 206, Sunnyvale, CA 94086, USA

Purpose: Storage, delivery, and technical optimization of uploaded images

Legal Basics:

  • Art. 6(1) b GDPR (insofar as the upload is part of the portal/contract use)
  • Art. 6(1) f GDPR (legitimate interest in secure, efficient operation)

Cloudinary processes the data exclusively in pseudonymized form under an internal ID.

Data Processing

Cloudinary acts as our data processor. A data processing agreement is in place in accordance with Article 28 of the GDPR.

Third Country Transfer / USA

It cannot be ruled out that personal data will be transferred to Cloudinary servers in the USA. The level of data protection in the USA may not be equivalent to that in the EU or the EEA. In particular, personal data may be subject to extensive access rights by authorities.

To ensure data security, we have entered into Standard Contractual Clauses (SCCs) with Cloudinary , as approved by the European Commission. In addition, we conduct Transfer Impact Assessments (TIAs) where necessary and implement appropriate technical and organizational measures to protect the data.

If, in a specific case, a third-country transfer is only permissible on the basis of explicit consent, we will obtain this consent in advance (Art. 49 para. 1 lit. a GDPR). Consent can be withdrawn at any time with effect for the future.

Cloudinary's privacy policy: https://cloudinary.com/privacy

4. Cookies

To make your visit to our website more attractive and to enable the use of certain functions, we use cookies on various pages. These are small text files that are stored on your device.

Types of cookies

  • Session cookies: are deleted after you close your browser.
  • Persistent cookies: remain on your device and allow your browser to be recognized.

Cookies may contain, in particular, the following information: browser data, location data (if technically collected), IP address values, session IDs, settings.

Purpose

  • technically necessary functions (e.g. shopping cart, login)
  • Convenience features (e.g., saving settings)
  • Statistical evaluations / reach measurement (if used and consent has been given)
  • Marketing/Personalization (if used and consent has been given)

Legal Basics

  • Art. 6(1) b GDPR (contract/portal use, insofar as cookies are required for this purpose)
  • Article 6(1) a GDPR (Consent for cookies/technologies requiring consent)
  • Art. 6(1) f GDPR (legitimate interest in a technically stable, user-friendly website)

You can configure your browser to notify you when cookies are being set, allowing you to decide whether to accept them individually, or to block cookies in certain cases or entirely. Please note that disabling technically necessary cookies may limit the functionality of our website.

Browser help pages:

5. Consentmanager (cookie consent tool)

This website uses the cookie consent tool from [company name] to obtain effective user consent for cookies and cookie-based applications that require consent:

consentmanager (Jaohawi AB, Håltegelvägen 1b, 72348 Västerås, Sweden)

By integrating JavaScript code, a banner is displayed to users when they visit the page, allowing them to grant or deny consent. The tool blocks the setting of cookies requiring consent until consent has been given.

The following data, among others, is processed to manage your selection:

  • IP address
  • Consent status / preferences
  • Timestamp
  • Browser/device information

Legal Basics:

  • Article 6(1) c GDPR (legal obligation to obtain/manage consent)
  • Article 6(1)(f) GDPR (legitimate interest in legally compliant consent management)

Further information: https://www.consentmanager.de/privacy.php

6. Making contact

When you contact us (e.g., via contact form or email), personal data is collected. The specific data collected is indicated on the respective contact form.

Purpose: To answer your request, contact you, and provide technical administration.

Legal basis: Art. 6(1) f GDPR (legitimate interest in communication)

If your contact is aimed at concluding a contract or relates to an existing contractual relationship, the additional legal basis is Art. 6(1) b GDPR.

Your data will be deleted after your request has been processed, unless there are legal retention obligations to the contrary.

Direct contact with fitness studios

Through our portal, we offer various ways to directly contact a fitness studio (e.g., call-back, landing pages, trial workouts, bring a friend). The personal data you provide in connection with these contact requests will be analyzed by us and made available to the relevant fitness studio for the purpose of responding to your inquiry or contacting you within our system.

Once your data has been forwarded, we generally do not process it further. The contacted gym processes the data under its own data protection responsibility. Please refer to the respective gym's privacy policy for more information.

7. Online appointment booking

Dedicated function for online appointment booking

We process personal data as part of the online appointment booking process. The specific data collected is determined by the respective input form. Required data fields are marked accordingly.

Purpose: Scheduling an appointment, processing your request

Legal Basics:

  • Article 6(1)(b) GDPR (contract/initiation)
  • Article 6(1)(f) GDPR (legitimate interest in efficient communication)

Direct appointment booking with fitness studios

Through our portal, we also offer the option of booking an appointment directly with a fitness studio. Your personal data will be forwarded to the respective fitness studio. The fitness studio processes this data under its own responsibility. Please refer to the privacy policy of the individual studio.

8. Data processing when opening a customer account and for contract processing, portal registration

In accordance with Article 6(1)(b) GDPR, personal data will continue to be collected and processed if you provide it to us for the performance of a contract or when opening a customer account. The specific data collected is evident from the respective input forms. You can delete your customer account at any time by sending a message to the data controller's address above. We store and use the data you provide for contract processing. After complete contract fulfillment or deletion of your customer account, the processing of your data will be restricted in accordance with tax and commercial law retention periods and deleted after these periods have expired, unless you have expressly consented to further use of your data or we have reserved the right to further use your data as permitted by law.

Registration on the portal

You can register on our website by providing personal data. The specific personal data processed for registration is determined by the input form used. We use the so-called double opt-in procedure for registration, meaning your registration is only complete once you have confirmed it by clicking the link in the confirmation email sent to you for this purpose. If you do not confirm your registration within 24 hours, it will be automatically deleted from our database. Providing the aforementioned data is mandatory. You may voluntarily provide any further information through our portal.

When you use our portal, we store the data necessary for fulfilling the contract, including any payment information, until you permanently delete your account. We also store any voluntary data you provide for the duration of your portal use, unless you delete it beforehand. You can manage and change all this information in the secure customer area. The legal basis for this is Article 6(1)(f) GDPR.

Furthermore, we store all content you publish (such as public posts, wall entries, guestbook entries, etc.) in order to operate the website. We have a legitimate interest in providing the website with all user-generated content. The legal basis for this is Article 6(1)(f) GDPR. If you delete your account, your public statements, especially in the forum, will remain visible to all readers, but your account will no longer be accessible. All other data will be deleted in this case.

Registration via resellers and studios (third-party access)

The platform of the aforementioned controller is also open to other providers. In particular, we allow resellers and operators of fitness studios ("third-party providers") to access the platform via their own websites or apps ("third-party access"). These third-party providers offer their access under their own name and with their own look and feel. Third-party access, however, grants you access to all the functionalities of our platform, and your data is processed by the aforementioned controller as if you had registered directly on the portal.

Regarding the setup of your account via the relevant third-party access point, we and your chosen third-party provider are jointly responsible (Art. 26 GDPR). Under this agreement, all content you upload to the platform will be simultaneously shared across the Fitness Nation network and displayed to the entire Fitness Nation community unless you object. For this purpose, based on our legitimate interest in reaching the broadest possible international community (Art. 6(1)(f) GDPR), data will be transferred from your chosen third-party provider to the controller named above. We will inform you about this processing and the essential points of our agreement here. By the way: The controller named above is your first point of contact if you wish to exercise your rights as a data subject (Art. 15-22 GDPR). However, you can also contact your chosen third-party provider at any time, and they will then forward your request to Fitness Nation GmbH.

9. Use of single sign-on methods

Facebook Connect

On our website, you can create a customer account or register using the "Facebook Connect" single sign-on method of the social network Facebook, operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook"), provided you have a Facebook profile. You can recognize "Facebook Connect" on our website by the blue button with the Facebook logo and the text "Log in with Facebook" or "Sign in with Facebook".

By using the "Facebook Connect" button on our website, you have the option to log in or register using your Facebook user data. Only if you give your explicit consent in accordance with Art. 6(1) a GDPR during the registration process, based on a corresponding notice regarding the exchange of data with Facebook, will we receive from Facebook, depending on your personal privacy settings on Facebook, the general and publicly accessible information stored in your profile, namely your name, email address, and, if applicable, your profile picture. We process the data transmitted to us by Facebook for the purpose of registration on the portal (Art. 6(1) b GDPR).

Please note that following changes to Facebook's privacy policy and terms of service, granting your consent may also result in the transfer of your profile pictures, your friends' user IDs, and your friend list if these are marked as "public" in your Facebook privacy settings. The data transmitted by Facebook will be stored and processed by us to create a user account with the necessary information (title, first name, last name, email address), provided you have authorized this on Facebook.

For information on the purpose and scope of data collection and the further processing and use of data by Facebook, as well as your related rights and privacy settings, please refer to Facebook's privacy policy: https://www.facebook.com/policy.php

Single sign-on with your Apple ID

When you log in to our site with your Apple device, you can also use your Apple ID for login. As part of this single sign-on process, if you grant the corresponding permission during the login process, Apple will provide us with the email address associated with your Apple ID. Alternatively, you can choose to hide the email address associated with your Apple ID from us. Apple will then create a one-time email address that is only valid for our portal. Apple will forward messages sent to this address to the mailbox linked to your Apple ID.

All accounts are protected with two-factor authentication to ensure greater security, and Apple promises not to track your activity on our portal.

When using Single Sign-On with your Apple ID, you will also need to enter additional information required for registration on our portal, as described in section 7 of this privacy policy.

For information on the purpose and scope of data collection and the further processing and use of data by Apple, as well as your related rights and privacy settings, please refer to Apple's Privacy Policy: https://www.apple.com/de/legal/privacy/de-ww/

10. Comment function

When you use the comment function on this website, your comment, the time it was posted, and your chosen username will be stored and published on this website. Your IP address will also be logged and stored. This IP address is stored for security reasons and in case your comment infringes the rights of third parties or contains illegal content. We require your email address to contact you if a third party objects to your published content as being unlawful. The legal basis for storing your data is Art. 6(1) b and f GDPR. We reserve the right to delete comments if they are objected to as unlawful by third parties.

You can subscribe to follow-up comments. You will receive a confirmation email to ensure that you are the owner of the email address provided (double opt-in procedure). The legal basis for data processing when subscribing to comments is Article 6(1)(a) GDPR. You can unsubscribe from ongoing comment subscriptions at any time with effect for the future; please refer to the confirmation email for further information on how to unsubscribe.

11. Use of customer data for direct marketing

11.1 Registration for our email newsletter

When you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to send you the newsletter is your email address. Providing any further information is voluntary and is used to personalize our communications with you. We use the double opt-in procedure for sending our newsletter. This means that we will only send you an email newsletter after you have explicitly confirmed that you consent to receiving it. We will then send you a confirmation email asking you to click on a link to confirm that you wish to receive the newsletter in the future.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Article 6(1)(a) GDPR. When you subscribe to the newsletter, we store your IP address, which is registered by your internet service provider (ISP), as well as the date and time of registration, in order to be able to trace any potential misuse of your email address at a later date. The data we collect when you subscribe to the newsletter is used exclusively for the purpose of sending you promotional material via the newsletter. You can unsubscribe from the newsletter at any time via the unsubscribe link provided in the newsletter or by sending a corresponding message to the data controller named above. After you unsubscribe, your email address will be immediately deleted from our newsletter mailing list, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes permitted by law, about which we inform you in this privacy policy.

11.2 Sending the email newsletter to existing customers

If you provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services from our product range via email. According to Section 7 Paragraph 3 of the German Unfair Competition Act (UWG), we do not need to obtain your separate consent for this. The data processing is based solely on our legitimate interest in personalized direct marketing pursuant to Article 6(1)(f) of the GDPR. If you initially objected to the use of your email address for this purpose, we will not send you any emails. You have the right to object to the use of your email address for the aforementioned advertising purpose at any time with effect for the future by sending a message to the data controller named at the beginning of this document. You will only incur transmission costs at the basic rates for this. Upon receipt of your objection, the use of your email address for advertising purposes will be discontinued immediately.

11.3 Sending newsletters via Sendinblue

We send our newsletters (sections 10.1 and 10.2) using our service provider Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin. Sendinblue acts solely as a data processor for us and does not process your personal data for its own business purposes.

11.4 Advertising by postal mail

Based on our legitimate interest in personalized direct marketing, we reserve the right to store your first and last name, your postal address and – insofar as we have received this additional information from you within the framework of the contractual relationship – your title, academic degree, year of birth and your professional, industry or business designation in accordance with Art. 6(1) f GDPR and to use it for sending you interesting offers and information about our products by post.

You can object to the storage and use of your data for this purpose at any time by sending a corresponding message to the responsible party.

12. Data processing for order processing

12.1 To process your order, we work with the following service providers, who support us in whole or in part in fulfilling concluded contracts. Certain personal data will be transmitted to these service providers in accordance with the following information.

The personal data we collect will be shared with the transport company commissioned with delivery as part of the contract processing, insofar as this is necessary for the delivery of the goods. We will share your payment data with the commissioned bank as part of the payment processing, insofar as this is necessary for the payment processing. If payment service providers are used, we will inform you explicitly about this below. The legal basis for the transfer of data is Art. 6(1) b GDPR.

12.2 Use of special service providers for order processing and fulfillment

– Olimp Nutrition

Order processing is handled by the service provider "Olimp" (Olimp Laboratories, a branch of Olimp Laboratories SP.zoo, Am Weiher 8, 63505 Langenselbod, Germany). Your name, address, and any other personal data will be transferred to Olimp in accordance with Article 6(1)(b) GDPR solely for the purpose of processing your online order. Your data will only be shared to the extent that it is actually necessary for processing the order. Details regarding Olimp's data protection practices and its privacy policy can be found on Olimp's website at "Olimpsport.com".

– DHL Fulfillment

Order processing is handled by the service provider DHL Home Delivery GmbH, Sträßchensweg 10, 53113 Bonn, as part of the "Shipping by DHL Fulfillment" service. Your personal data will be transferred to DHL Fulfillment solely for the purpose of processing your online order, in accordance with Article 6(1)(b) GDPR.

– Fulfillment with büromatic

Another service provider that performs fulfillment services for us is büromatic Direktwerbung GmbH & Co. KG, Gruitener Str. 202, 42327 Wuppertal. Your personal data will be transferred to büromatic solely for the purpose of processing your online order in accordance with Art. 6(1) b GDPR.

12.3 Transfer of personal data to shipping service providers

– DHL

If the goods are delivered by the transport service provider DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn), we will forward your email address to DHL before delivery, in accordance with Article 6(1)(a) GDPR, for the purpose of coordinating a delivery date or providing delivery notification, provided you have given your explicit consent during the ordering process. Otherwise, in accordance with Article 6(1)(b) GDPR, we will only forward the recipient's name and delivery address to DHL for the purpose of delivery. This data is only shared to the extent necessary for the delivery of the goods. In this case, prior coordination of the delivery date with DHL or delivery notification is not possible.

Consent can be withdrawn at any time with effect for the future by contacting the controller named above or the transport service provider DHL.

– UPS

If the goods are delivered by the transport service provider UPS (United Parcel Service Germany Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss), we will forward your email address to UPS before delivery in accordance with Art. 6(1)(a) GDPR for the purpose of coordinating a delivery date or providing delivery notification, provided you have given your explicit consent during the ordering process. Otherwise, for the purpose of delivery in accordance with Art. 6(1)(b) GDPR, we will only forward the recipient's name and delivery address to UPS. This data transfer only occurs to the extent necessary for the delivery of the goods. In this case, prior coordination of the delivery date with UPS or the transmission of shipment status information is not possible.

Consent can be withdrawn at any time with effect for the future by contacting the data controller named above or the transport service provider UPS.

12.4 Use of payment service providers (payment services)

– Apple Pay

If you choose the "Apple Pay" payment method from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment processing is handled via the "Apple Pay" function on your iOS, watchOS, or macOS device by charging a payment card stored with "Apple Pay." Apple Pay uses security features integrated into your device's hardware and software to protect your transactions. Authorizing a payment requires entering a code you previously set and verifying your identity using your device's "Face ID" or "Touch ID" function.

For payment processing purposes, the information you provide during the ordering process, along with your order details, is transmitted to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before transmitting it to the payment provider of the payment card stored in Apple Pay. This encryption ensures that only the website where the purchase was made can access the payment information. After the payment has been processed, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm the successful payment.

If personal data is processed during the described transfers, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6(1) b GDPR.

Apple retains anonymized transaction data, including the approximate purchase amount, date, and time, as well as whether the transaction was successful. Anonymization completely eliminates any possibility of identifying individuals. Apple uses this anonymized data to improve Apple Pay and other Apple products and services.

When you use Apple Pay on your iPhone or Apple Watch to complete a purchase you made through Safari on your Mac, your Mac and the authorizing device communicate over an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format that can identify you personally. You can disable the ability to use Apple Pay on your Mac in your iPhone's settings. Go to "Wallet & Apple Pay" and turn off "Allow Payments on Mac."

Further information on data protection with Apple Pay can be found at the following web address: https://support.apple.com/de-de/HT203027

– BS PAYONE

If you choose a payment method offered by the payment service provider BS PAYONE, payment processing will be handled by BS PAYONE GmbH, Lyoner Straße 9, 60528 Frankfurt/Main, to whom we will transfer the information you provided during the ordering process, along with information about your order, in accordance with Article 6(1)(b) GDPR. Your data will be transferred solely for the purpose of payment processing with the payment service provider PAYONE and only to the extent necessary for this purpose.

– Google Pay

If you choose the payment method "Google Pay" from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), payment processing is handled via the "Google Pay" application on your mobile device, which must be running at least Android 4.4 ("KitKat") and have NFC capability. The payment will be processed by charging a payment card stored in Google Pay or a payment system verified there (e.g., PayPal). To authorize a payment via Google Pay exceeding €25, you must first unlock your mobile device using the configured verification method (such as facial recognition, password, fingerprint, or pattern).

For the purpose of payment processing, the information you provide during the ordering process, along with information about your order, will be shared with Google. Google will then transmit your payment information stored in Google Pay to the originating website in the form of a unique transaction number, which is used to verify the payment. This transaction number contains no information about the actual payment details of your payment method stored in Google Pay, but is created and transmitted as a unique numerical token. In all transactions via Google Pay, Google acts solely as an intermediary for processing the payment. The transaction is executed exclusively between the user and the originating website by debiting the payment method stored in Google Pay.

If personal data is processed during the described transfers, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6(1) b GDPR.

Google reserves the right to collect, store, and analyze certain transaction-specific information for each transaction made through Google Pay. This includes the date, time, and amount of the transaction; the merchant's location and description; a description of the purchased goods or services provided by the merchant; photos you attached to the transaction; the name and email address of the seller and buyer or sender and recipient; the payment method used; your description of the reason for the transaction; and, if applicable, the offer associated with the transaction.

According to Google, this processing is carried out exclusively in accordance with Art. 6 para. 1 lit. f GDPR on the basis of the legitimate interest in proper accounting, verification of transaction data and the optimization and maintenance of the Google Pay service.

Google also reserves the right to combine the processed transaction data with other information collected and stored by Google when you use other Google services.

The Google Pay terms of service can be found here: https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de

Further information on data protection at Google Pay can be found at the following web address: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de

– giropay

When paying via "giropay," payment processing is handled by giropay GmbH, An der Welle 4, 60322 Frankfurt/Main, to whom we forward the information you provided during the ordering process, along with information about your order. Your data is transferred in accordance with Art. 6(1) b GDPR solely for the purpose of payment processing and only to the extent necessary for this purpose. Further information about giropay GmbH's data protection policy can be found at the following web address: https://www.giropay.de/rechtliches/datenschutzerklaerung .

– Paydirekt

If you choose the paydirekt payment method, the payment will be processed by the payment service provider paydirekt GmbH, Hamburger Allee 26-28, 60486 Frankfurt am Main, Germany. Your payment data (e.g., payment amount, payee details) and your confirmation that the payment data is correct will be collected, processed, and transmitted to your bank by paydirekt GmbH for the purpose of processing the paydirekt payment in accordance with Article 6(1)(b) GDPR. This processing only occurs to the extent that it is actually necessary for processing the payment. Paydirekt GmbH then authenticates the payment using the authentication method registered with your bank. Further information about the transfer and processing of your data can be found in the paydirekt privacy policy, which you can view at the following link: https://www.paydirekt.de/agb/index.html .

– Paypal

When paying via PayPal, credit card via PayPal, direct debit via PayPal, or – if offered – "purchase on account" or "installment payment" via PayPal, we forward your payment data to PayPal (Europe) Sarl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") for payment processing. This transfer is carried out in accordance with Art. 6(1) b GDPR and only to the extent necessary for payment processing.

For the payment methods credit card via PayPal, direct debit via PayPal, or – if offered – "purchase on account" or "installment payment" via PayPal, PayPal reserves the right to conduct a credit check. For this purpose, your payment data may be transferred to credit agencies in accordance with Art. 6(1) f GDPR based on PayPal's legitimate interest in assessing your creditworthiness. PayPal uses the result of the credit check regarding the statistical probability of payment default to decide whether to offer the respective payment method. The credit check may include probability values ​​(so-called score values). If score values ​​are included in the result of the credit check, they are based on a scientifically recognized mathematical-statistical procedure. Address data is among the data used, but not the only data, in the calculation of the score values. For further information on data protection, including the credit agencies used, please refer to PayPal's Privacy Statement: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

13. Contacting you to send a review reminder

Own review reminder (not sent via a customer review system)

We use your email address to send you a one-time reminder to submit a review of your order for our rating system, provided you have given us your explicit consent to do so during or after your order in accordance with Art. 6(1) a GDPR.

You can withdraw your consent at any time by sending a message to the data controller.

Review reminder via ShopVote

If you have given us your express consent in accordance with Art. 6(1) a GDPR during or after your order, we will transmit your email address to the review platform ShopVote of Blickreif GmbH, Alter Messeplatz 2, 80339 Munich (www.shopvote.de), so that they can send you a review reminder by email.

You can withdraw your consent at any time by sending a message to the data controller or to the rating platform.

14. Use of social media: Videos

Using YouTube videos

This website uses the YouTube embedding function to display and play videos from the provider "YouTube", which belongs to Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

This uses enhanced privacy mode, which, according to the provider, only initiates the storage of user information when the video(s) are played. When embedded YouTube videos are played, the provider "YouTube" sets cookies to collect information about user behavior. According to YouTube, this information is used, among other things, to collect video statistics, improve user-friendliness, and prevent misuse. If you are logged into Google, your data will be directly associated with your account when you click on a video. If you do not want this association with your YouTube profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and analyzes them. This analysis is carried out, in particular, pursuant to Art. 6(1) f GDPR, based on Google's legitimate interests in displaying personalized advertising, conducting market research, and/or designing its website to meet user needs. You have the right to object to the creation of these user profiles, and to exercise this right, you must contact YouTube. When using YouTube, personal data may also be transferred to the servers of Google LLC in the USA.

Regardless of whether the embedded videos are played, a connection to the Google network is established every time this website is accessed, which may trigger further data processing operations beyond our control.

Further information on data protection at “YouTube” can be found in the provider's privacy policy at: https://www.google.de/intl/de/policies/privacy

Where legally required, we have obtained your consent for the processing of your data as described above, in accordance with Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. To exercise your right of withdrawal, deactivate this service in the "Cookie Consent Tool" provided on the website by consentmanager.net (section 4 of this privacy policy).

15. Processing of personal data in embedded widgets and modules

Our services can be integrated by partner studios or third-party providers via embeddable components such as shop widgets, booking widgets, voucher widgets, membership widgets, or other iframe-based modules ("widgets"). These widgets display Fitness Nation content on external websites; however, all data processing described below takes place exclusively on servers of Fitness Nation GmbH .

The partner website serves only as a display interface and does not process any personal data as a controller .

15.1 Categories of data processed in widgets

Depending on the user's actions within the widget, we process the following data in particular:

  • Identification data (name, address, email, telephone number)
  • Login and account details
  • Order and contract data (products, memberships, vouchers, tickets)
  • Payment-related metadata (transaction IDs, payment status; no storage of raw card or account data)
  • Billing and shipping information
  • IP address as well as device and browser information
  • Technical log files (timestamps, pages visited, operating system)
  • Session cookies and functional widget cookies
  • Entries in Local Storage and Session Storage (e.g. shopping cart contents, session IDs)
  • If used: Messages transmitted as part of an integrated customer or support chat.

15.2 Purpose of processing

The processing within the widgets takes place for the following purposes:

  • Presentation of products, services, memberships and offers
  • Processing of online orders, payments, vouchers, tickets and bookings
  • Creation and management of customer accounts
  • Delivery of digital products and purchases
  • Fraud prevention, abuse detection and ensuring system security
  • Technical operation of the widget and the embedded interfaces
  • Managing cookie consents within the widget environment
  • Provision of customer and support communication

15.3 Legal Basics

The processing of personal data within the widgets is based on:

  • Article 6(1) c GDPR – Contract performance (orders, bookings, account creation)
  • Article 6(1) c GDPR – Legitimate interest (security, fraud prevention, stability, logging)
  • Article 6(1) c GDPR – Consent (e.g. for cookies requiring consent or marketing)
  • Article 6(1)(c) GDPR – Legal obligations (tax and retention obligations)

15.4 Recipients and sub-processors

Depending on how the widget is used, personal data may be transmitted to the following recipients:

  • Hosting & CDN: Cloudinary, Fitness Nation's internal hosting infrastructure
  • Payment service providers: PayPal, Stripe and other supported payment providers
  • Logistics service providers: DHL Fulfillment, DHL Paket, UPS, Monta Germany GmbH
  • Communication: Brevo (Sendinblue)
  • Consent Management: consentmanager (Jaohawi AB)
  • Accounting: sevDesk GmbH

All sub-processors operate on the basis of data processing agreements; necessary third-country transfers are legally secured by Standard Contractual Clauses (SCCs) .

15.5 Storage durations

The following retention periods apply in particular to widget-related processing:

  • Order and invoice data: 10 years (legal requirements)
  • Technical log files: 30–90 days
  • Session cookies: until the end of the session
  • Persistent cookies: according to the storage duration set in the browser.
  • Chat data (if used): 5 years , stored encrypted.
  • Account details: for the duration of the customer relationship

15.6 Relationship to product-specific data protection notices

Certain widgets (e.g., the shop widget) contain additional product-specific privacy notices that provide more detailed information about the respective functions.

These notes are part of this privacy policy and always apply when a user interacts with the corresponding widget.

16. Health and fitness data

Our app can collect health-related data to help users monitor their performance, track progress, and receive personalized fitness analyses. This data can be entered manually or collected through integrations (e.g., Google Fit or similar platforms).

The following health-related data can be collected or retrieved:

  • Distance – used to record the distance covered during a training session (e.g., running, walking, or cycling).
  • CyclingPedalingCadence / ExerciseSession – for recording cadence and details of cycling sessions.
  • Steps / Step frequency – to display the number and frequency of steps during running or walking workouts.
  • Speed ​​– to display the current and average speed during a session.
  • Total CaloriesBurned – to estimate calories burned based on the intensity and duration of the activity.
  • Heart rate – for monitoring training intensity and supporting training in specific heart rate zones.

We do not share this data with third parties without the explicit consent of the users. All data is processed securely and stored in accordance with applicable data protection laws.

17. Fitness Nation BeneFits

You have the option to participate in our loyalty program and the loyalty programs of your chosen partner studios when making purchases through our online shop and when participating in various special features. If you collect BeneFit points through our portal or from partner companies, we will, after the collection period is complete, transmit the following data to the respective studio or partner for the purpose of crediting and redeeming BeneFit points, based on our legitimate interest in the user-friendly design and optimal marketing of our website in accordance with Art. 6(1) f GDPR: first name, last name, email address, number of BeneFit points, and the basis for the credit or redemption. You can deactivate participation in the BeneFit points loyalty program in your profile settings.

18. Use of a live chat system

Proprietary live chat system

This website collects and stores your chat name and chat content as data for the purpose of operating a live chat system that answers live inquiries. During the chat, the chat and your chat name are stored exclusively in RAM (Random Access Memory) and afterwards only in encrypted form once we or you have ended the chat conversation. This encrypted storage lasts for five years and serves solely to enable us to provide information in the event of official requests (e.g., regarding illegal content), insofar as there is a legal obligation to do so.

Cookies are used to operate the chat function. Cookies are small text files that are stored locally in the cache of the website visitor's internet browser. These cookies enable the website visitor's internet browser to be recognized, thus ensuring that individual users of the chat function on our website can be distinguished (see section 4 of this privacy policy).

If the information collected in this way relates to a person, the processing is carried out in accordance with Art. 6(1) f GDPR on the basis of our legitimate interest in effective customer support.

To prevent cookies from being stored, you can configure your internet browser to block all cookies from being placed on your computer in the future or to delete cookies that have already been stored. However, disabling all cookies may prevent the chat function on our website from working.

19. Accounting via sevDesk

For our accounting, we use the sevDesk service, the cloud-based accounting software from sevDesk GmbH, Hauptstraße 115, 77652 Offenburg.

SevDesk processes incoming and outgoing invoices, as well as, if applicable, our company's bank transactions, in order to automatically record invoices, match them to transactions, and create financial accounting from this data in a semi-automated process.

If personal data is also processed in this context, the processing is carried out in accordance with Art. 6(1) f GDPR on the basis of our legitimate interest in an efficient organization and documentation of our business processes.

Further information about sevDesk GmbH, the automated processing of data and the data protection regulations can be found at https://sevdesk.de/sicherheit-datenschutz/

20. Google Fonts

This website uses web fonts provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") for consistent font display. We have integrated the Google Web Fonts we use directly on our own servers and, through appropriate settings, have prevented a connection to Google servers when our website is accessed. Therefore, no data is transmitted to Google.

Further information about Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google's privacy policy: https://www.google.com/policies/privacy/

21. Rights of the data subject, in particular your right to object

21.1 The applicable data protection law grants you comprehensive rights as a data subject (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:

  • Right of access pursuant to Article 15 GDPR: You have, in particular, the right to information about your personal data processed by us, the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients to whom your data have been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, lodging a complaint with a supervisory authority, the origin of your data if they were not collected from you by us, the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved and the significance and the envisaged consequences of such processing for you, as well as your right to be informed of the safeguards pursuant to Article 46 GDPR relating to the transfer of your data to third countries;
  • Right to rectification pursuant to Art. 16 GDPR: You have the right to immediate rectification of inaccurate data concerning you and/or completion of incomplete data stored with us;
  • Right to erasure pursuant to Article 17 GDPR: You have the right to request the erasure of your personal data if the conditions of Article 17(1) GDPR are met. However, this right does not exist, in particular, if the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.
  • Right to restriction of processing pursuant to Article 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data, which you have contested, is being verified; if you object to the erasure of your data due to unlawful data processing and instead request the restriction of the processing of your data; if you need your data for the establishment, exercise or defence of legal claims after we no longer need this data for the purposes for which it was collected; or if you have objected to processing on grounds relating to your particular situation, pending the verification whether our legitimate grounds override yours.
  • Right to information pursuant to Article 19 GDPR: If you have asserted your right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to communicate this rectification, erasure, or restriction of processing to all recipients to whom your personal data have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
  • Right to data portability pursuant to Art. 20 GDPR: You have the right to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller, insofar as this is technically feasible;
  • Right to withdraw consent pursuant to Article 7(3) GDPR: You have the right to withdraw your consent to the processing of your data at any time with effect for the future. In the event of withdrawal, we will delete the data concerned immediately, unless further processing can be based on a legal basis that does not require consent. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
  • Right to lodge a complaint pursuant to Article 77 GDPR: If you believe that the processing of your personal data infringes the GDPR, you have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

21.2 Right to object

If we process your personal data based on our overriding legitimate interest as part of a balancing of interests, you have the right to object to this processing at any time on grounds relating to your particular situation, with effect for the future.

If you exercise your right to object, we will cease processing the data in question. However, further processing remains reserved if we can demonstrate compelling legitimate grounds for the processing which override your interests, fundamental rights and freedoms, or if the processing serves the establishment, exercise or defense of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. You can exercise this right to object as described above.

If you exercise your right to object, we will cease processing the data in question for advertising purposes.

22. Child Protection Guidelines

We are fully committed to protecting the safety and well-being of all users, including children and minors who may interact with our app. Although our app is intended for a general audience and is not specifically targeted at children, we take strict measures to prevent any misuse or exploitation.

Zero-tolerance policy towards sexual exploitation and abuse of children (CSAE)

We have a zero-tolerance policy regarding the sexual abuse, exploitation, or any form of endangerment of children. Any content, communication, or behavior that exploits, endangers, or incites minors is strictly prohibited and will result in immediate removal and reporting to the appropriate authorities.

Compliance and prevention measures

Our app complies with child protection guidelines and all applicable laws for the protection of minors.

We regularly monitor our systems and, where applicable, user-generated content to ensure that there are no materials or behaviors that violate these statuses.

Reporting concerns

If you become aware of any content or activity within the app that could endanger a child or violate these guidelines, please contact us immediately.
You can reach our child protection contact at:
info@fitness-nation.com

We will promptly review all reports and take appropriate action, including cooperating with law enforcement agencies or other competent authorities if necessary.

Obligation to provide information

We encourage all users to act responsibly, protect personal information, and contribute to a safe community. By using this app, you agree to report suspicious or harmful activity that could endanger the safety of others.

23. Duration of storage of personal data

The duration of the storage of personal data is determined by the respective legal basis, the processing purpose and – if applicable – additionally by the respective statutory retention period (e.g. commercial and tax law retention periods).

When processing personal data on the basis of explicit consent pursuant to Art. 6(1) a GDPR, this data will be stored until the data subject withdraws his or her consent.

If statutory retention periods exist for data processed in the context of contractual or quasi-contractual obligations on the basis of Art. 6(1) b GDPR, this data will be routinely deleted after the expiry of the retention periods, provided that it is no longer required for the performance of a contract or for initiating a contract and/or we no longer have a legitimate interest in its continued storage.

When processing personal data on the basis of Art. 6(1) f GDPR, this data will be stored until the data subject exercises their right to object pursuant to Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the purpose of establishing, exercising or defending legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6(1) f GDPR, this data will be stored until the data subject exercises his or her right to object pursuant to Art. 21 para. 2 GDPR.

Unless otherwise stated in the other information in this declaration regarding specific processing situations, stored personal data will be deleted when they are no longer necessary for the purpose for which they were collected or otherwise processed.

Published under:

Data protection

www.fitness-nation.com/support/datenschutz

Privacy settingsPrivacy settings