Privacy Policy

Controller

GYMONE AG
Sonnenrainweg 8
8834 Schindellegi
Switzerland

E-Mail: info@gymone.ch
Phone: +41 (0)44 431 28 38

1. About this notice

This Privacy Notice explains how GYMONE AG / the platform Future of Sports (“GYMONE”, “we”, “us”) collects and processes personal data when you use our website, app, membership services, booking functions, communications and related digital services.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP/DSG) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. What personal data we process

Depending on how you use our services, we may process the following categories of personal data:

Account and identity data
First name, last name, phone number, email address, account identifiers, profile photo, preferred language, date of birth and gender.

Membership and transaction data
Membership type, subscription start and end dates, cancellation status, auto-renewal-related settings, payment status, transaction references, payment metadata, receipts and billing-related records.

Profile and personalisation data
Height, weight, fitness level, fitness goals, coach profile information, training preferences, communication preferences and notification settings.

Usage and activity data
Gym attendance, class attendance, personal training bookings, in-app notification history, technical logs, device and app usage information, push registration details and related delivery data.

Website and app analytics data
Information about how you use our website and app, including device-related identifiers, crash reports, performance data and product analytics data, where enabled.

Special category / sensitive data
Where you choose to use optional personalisation, fitness features or health data tracking and analysis, we may process health-related or fitness-related data such as height, weight, fitness level and fitness goals. Additional wearable, body scan or similar health metrics will only be processed if and when those features are activated and you have given the required explicit consent.

3. Why we process your data

We process personal data for the following purposes:

to create and manage user accounts;
to provide memberships, bookings, training services and app functionality;
to process payments and administer subscriptions;
to communicate with you about your account, bookings, memberships and service matters;
to manage your preferences, notifications and support requests;
to provide personalisation and training-related features;
to operate, secure, maintain and improve our website, app and services;
to perform analytics, troubleshooting and service monitoring;
to comply with legal, tax, accounting and regulatory obligations;
to send marketing communications where you have consented or where otherwise permitted by law.

4. Legal bases

Where GDPR applies, we rely on the following legal bases:

performance of a contract or steps taken at your request before entering into a contract;
compliance with legal obligations;
legitimate interests, for example to secure, administer and improve our services, prevent misuse, and manage operational communications;
consent, where required, including for marketing communications, certain cookies or similar technologies, and explicit consent for special category health data.

Where processing is based on consent, you may withdraw that consent at any time with future effect.

5. Health data

Some fitness and personalisation features are mandatory and involve health-related data. We only process such data where you have provided separate explicit consent. If you do not provide that consent, you can still use the core service, but certain optional features may not be available.

If additional health integrations are introduced in future, such as wearable or body composition data, we will update this Privacy Notice and obtain any further consent required before processing starts.

6. Marketing and communications

We use your contact details to send service messages relating to your account, memberships, bookings, payments and platform operation.

We only send marketing messages by email, SMS, push or similar channels where you have opted in, or where otherwise permitted under applicable law. You can unsubscribe or change your preferences at any time in your account settings or by contacting us.

7. Cookies, similar technologies and analytics

Our website and app may use cookies and similar technologies for functionality, security, analytics and, where applicable, marketing.

Where required by law, we will ask for your consent before using non-essential cookies or similar technologies. You can manage your preferences through our cookie banner or relevant device/app settings.

Analytics and Session Replay

With your prior consent, we use Amplitude Analytics and may use Amplitude Session Replay on selected, non-sensitive parts of our website and mobile application. The provider is Amplitude, Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA, acting as our data processor.

Session Replay creates a reconstruction of how users interact with our website or mobile application. Depending on the platform, this may include navigation between pages or screens, clicks, taps, scrolling, gestures, cursor movements, device and session identifiers, page URLs, and technical information about the device, browser or application. Session Replay does not create a conventional video recording or screen recording of the user.

We use this information to understand how our website and mobile application are used, identify usability problems and technical errors, and improve our services.

We configure Session Replay to mask input fields and exclude sensitive parts of the user journey. In particular, we do not use Session Replay on phone-verification, booking, payment, profile or account screens, free-text fields, or screens that display or collect health-related information. These safeguards are intended to limit the collection of personal and sensitive information.

Amplitude data is ingested and hosted using Amplitude’s EU data centre in Germany. Amplitude also uses subprocessors, and limited support or other processing may in some cases take place from countries outside Switzerland or the European Economic Area. Where required, these transfers are protected through recognised safeguards, such as adequacy decisions or standard contractual clauses.

Amplitude Analytics and Session Replay may use cookies and similar technologies, including local storage on the user’s browser or device, to associate analytics events and reconstructed interactions with a session.

We activate Analytics and Session Replay only after you have provided optional analytics consent for the relevant website or mobile application. You may change or withdraw your consent at any time through the cookie settings on our website or the relevant privacy or analytics settings in our mobile application. Withdrawal applies to future collection and does not affect processing that took place before consent was withdrawn.

Session Replay data is retained for 30 days and is then deleted.

8. Sources of personal data

We usually collect personal data directly from you. We may also generate certain data through your use of the platform, for example attendance records, booking records, notification history, app usage logs and technical diagnostics.

9. Who we share personal data with

We may share personal data with carefully selected service providers and processors who support the operation of our business and platform, including:

Microsoft Azure (cloud infrastructure, storage and related communications services) – associated with the United States, but all our data is stored in Europe exclusively.
Stripe (payments and billing) – associated with the United States and Ireland.
GatewayAPI / ONLINECITY.IO - Passion for Platforms (SMS services) – associated with Denmark and operations in Germany.
Amplitude (product analytics) – associated with the United States; EMEA presence includes the Netherlands.
Sentry (crash and error monitoring) – associated with the United States.
Expo / 650 Industries, Inc. (push notification infrastructure, where used) – associated with the United States.

We may also disclose personal data to coaches, affiliated gym staff, professional advisers, auditors, authorities or courts where necessary and legally permitted.

10. International data transfers

Some of our service providers may process personal data outside Switzerland or the EEA/UK. Where this happens, we take appropriate steps to ensure that personal data remains adequately protected, for example by relying on adequacy decisions, standard contractual clauses or other recognised safeguards, as applicable.

11. How long we keep personal data

We keep personal data only for as long as necessary for the purposes set out in this Privacy Notice, including to provide the services, comply with legal obligations, resolve disputes and enforce agreements.

In general:

invoices, accounting records, consent records, agreements, and similar legally required records are kept for the applicable statutory retention period, which is ten years after termination of the agreement;
other account and service data is kept for the duration of the customer relationship and for up to 3 years afterwards;
where data is no longer required, we delete it or irreversibly anonymise it, unless continued retention is required by law or for the establishment, exercise or defence of legal claims.

Where possible, we may irreversibly anonymise data instead of deleting it.

12. Security

We apply appropriate technical and organisational measures to protect personal data, including access controls, role-based permissions, authentication controls, encryption in transit, secure cloud infrastructure and monitoring. Access to personal data is limited to those who need it for their role.

13. Your rights

Subject to applicable law, you may have the right to:

request access to your personal data;
request correction of inaccurate data;
request deletion of your data;
request restriction of processing;
object to certain processing;
receive data portability, where applicable;
withdraw consent at any time where processing is based on consent;
lodge a complaint with a competent data protection authority.

To exercise your rights, please contact us at info@gymone.ch.

If you are in Switzerland, you may also contact the Federal Data Protection and Information Commissioner (FDPIC). Under both GDPR and the Swiss FADP, individuals have information and correction-related rights, and GDPR also expressly requires transparency on erasure, objection, restriction and portability where applicable.

14. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. The latest version will be made available on our website and, where relevant, in the app. We encourage you to review it regularly.

Privacy policy