GDRP EN

Privacy Policy

We value the trust you place in us when sharing your personal data, and we are committed to protecting your personal data so that you feel safe with us. In this document, we would like to inform you about how we handle your personal data, how you can contact us if you have questions regarding the processing of your personal data, and other important information about the processing of your personal data.

In processing your personal data, we act in accordance with Act No. 18/2018 Coll. on the Protection of Personal Data, as amended (hereinafter the “Act”), and Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter “GDPR”), and related legislation.

Where certain terms are not defined in this document, the definitions set out in the General Terms and Conditions for the Provision of Services at GOLEM CLUB facilities, published at https://golemclub.sk/sk, shall apply.

Who We Are

The Controller responsible for the processing of your personal data is:

PREMIUM FIT, s.r.o.

Registered office: Einsteinova 18, 851 01 Bratislava

Company ID No.: 35 817 721

Email: gdpr@golemclub.sk

Categories of Personal Data We Process

We process the following categories of personal data about you:

–   common personal data, such as name, surname, date of birth, place of residence, e-mail address, telephone number, and photograph;

–   special categories of personal data – data concerning health.

How the Kiosk Processes Data from Your Identification Document

During registration via the Kiosk device, a so-called hash – a unique technical code – is generated from the machine-readable zone (MRZ) at the bottom of your identification document.

·        This code is generated directly within the device and replaces the original data from the document.

·        A one-way cryptographic algorithm is used, meaning the original document data (such as name or date of birth) cannot be derived from the code.

·        The original data are not stored, archived, or transmitted – only this technical code is retained in the system.

·        The code is used solely for technical verification of whether the same document has previously been used, in order to prevent duplicate registrations or account misuse.

·        This procedure helps protect your personal data, as we do not retain any readable data from the document, thereby reducing the risk of misuse.

Purposes, Legal Bases and Retention Periods

1.   Recruitment

Purposes and legal bases:

Recruitment process: Personal data for recruitment purposes are processed on the basis of your application for employment (pre-contractual relations).

Retention period:

Your personal data will be retained only until the conclusion of the recruitment process.

2.   Contractual Relations

Purposes and legal bases:

Performance of contract: Where you are a party to a contract concluded with us, the processing of your personal data is necessary for the performance of the subject matter of that contract and the related liability obligations (complaints, liability for defects). Such processing shall be carried out on the basis of the contract and applicable special legislation, in particular Act No. 250/2007 Coll. on Consumer Protection, as amended, Act No. 40/1964 Coll. (Civil Code), as amended, and Act No. 513/1991 Coll. (Commercial Code), as amended.

Processing of your personal data for the purpose of contract performance may also occur where you are not a contractual party to the relevant contract but are otherwise connected to it – for example, as a contact person (employee) of our contractual partner (your employer) named in the contract. In such case, we process your personal data on the basis of our legitimate interest, as we require such data to the extent strictly necessary to carry out our business activities and fulfil the contract.

Retention period:

We retain your personal data for the duration necessary to fulfil the processing purpose (proper performance of the contract) and until the expiry of the limitation period for any potential claims, but for a maximum of 4 years from the fulfilment of the subject matter of the contractual relationship. Accounting documents related to contracts are retained for 10 years following the year to which they relate, for the purposes of bookkeeping and record-keeping of accounting and financial documents.

3.   Provision of Services

Purposes and legal bases:

Where you have made a reservation for services you are interested in, we will process your personal data within the framework of this pre-contractual relationship, the purpose of which is the proper provision of the services you have reserved at the agreed time.

Client registration and service provision: In order to use our services, it is necessary to (i) create a Customer Account and (ii) conclude a Contract with us and/or activate a service. On that basis, we will subsequently provide our services to you under the agreed conditions.

Rehabilitation: At certain facilities, we are also able to provide healthcare services – physiotherapeutic procedures. For the provision of healthcare in the field of physiotherapy, it is necessary to process data concerning your health, which we carry out on the basis of and in accordance with Act No. 576/2004 Coll. on Healthcare, Services Related to the Provision of Healthcare, and on Amendments to Certain Acts.

Retention period:

We retain your personal data for the duration of the Contract. For the purpose of providing physiotherapy services, we retain your personal data for 20 years from the date of the provision of healthcare.

4.   Communication

Purposes and legal bases:

Mutual communication: Where you contact us in any matter through any communication channel (by post, e-mail, or telephone), we process your personal data for the purposes of mutual communication with you. Personal data for communication purposes are processed on the basis of your request. Records of incoming and outgoing correspondence are processed on the basis of applicable legislation.

Retention period:

We will retain your personal data for a period of one (1) year from the conclusion of the respective communication. Records of incoming and outgoing correspondence will be retained for 5 years following the year to which they relate.

5.   Marketing

Purposes and legal bases:

Contacting and sending current information, offers and membership benefits: We will send newsletters (marketing communications) only to the extent and at intervals that are not burdensome to you. Personal data for marketing purposes are processed on the basis of your consent. For the purpose of creating useful and personalised advertising (personalised newsletter), you may equally grant us consent to use the data you have provided as well as automatically generated data. Consent is always voluntary and may be withdrawn at any time.

For the purpose of informing the public about events we have organised, and for the purpose of our external presentation, we may publish your photographs or video recordings in various promotional materials and media, on our website or on social networks. We will always duly inform you in advance about the taking of photographs or video for this purpose. Photographs and video are taken and published on the basis of your consent or our legitimate interests.

Retention period:

We will retain your personal data obtained on the basis of consent for 5 years from the date on which your consent was obtained. Personal data obtained on the basis of consent for the purposes of personalised advertising (personalised newsletter) will be retained for the duration of the consent to the processing of personal data for marketing purposes (newsletter). Personal data obtained on the basis of our legitimate interest will be retained for the duration of the grounds for such processing.

6.   Protection of Property, Security and Health

Purposes and legal bases:

The legal basis for the processing of personal data is our legitimate interest, which consists in the protection of public order and safety, the detection of crime, and the protection of property or health. This concerns the processing of personal data for the purposes of protecting a legitimate interest: protection of public order and safety, detection of crime, protection of property or health, including, for example, the use of a camera system to monitor our premises.

Retention period:

Recordings from camera systems are retained for a maximum of 15 days from the date of their creation. Upon expiry of the retention period, we shall ensure the immediate destruction of your personal data.

7.   Enforcement of Claims and Conduct of Legal Proceedings

Purposes and legal bases:

We may process your personal data for the purposes of enforcing claims and conducting legal proceedings. The legal basis for such processing is our legitimate interest in defending and asserting our legal claims.

Retention period:

Personal data for this purpose are retained for a maximum of 10 years following the final conclusion of the legal proceedings or until the claim has been recovered.

Fulfilment of Our Legal Obligations

In the course of processing your personal data for the individual purposes set out above, your personal data may also be processed on the basis of various special regulations imposing specific obligations on us, such as the processing of accounting records and financial documents, records management, the provision of data to state and other authorities exercising supervisory powers over our activities or resolving disputes, or in the enforcement of decisions. Such special regulations include, for example, Act No. 40/1964 Coll. (Civil Code), Act No. 102/2014 Coll. on Consumer Protection in the Sale of Goods or Provision of Services under Distance Contracts or Contracts Concluded Away from Business Premises, Act No. 222/2004 Coll. on Value Added Tax, Act No. 431/2002 Coll. on Accounting, and Act No. 395/2002 Coll. on Archives and Records Management.

Retention period:

This will depend on the obligation which we are required to fulfil under the applicable special legislation.

Necessity of Providing Personal Data

Where the provision of personal data constitutes a statutory or contractual requirement, or a requirement necessary for the conclusion of a contract, the data subject is obliged to provide the personal data. Failure to do so will result in the inability to fulfil the processing purpose which the Controller intended to pursue upon receipt of the personal data.

Disclosure and Transfer of Your Personal Data

We may generally disclose and/or transfer your personal data to other entities, such as tax authorities, state administration bodies and public authorities exercising control and supervisory functions (e.g. labour inspectorate), courts, law enforcement authorities, accountants, auditors, legal counsel, trainers, IT system and support providers, and other external professional advisors, as well as to other companies providing us with products and services. We bear responsibility for the adequate protection of your personal data disclosed and/or transferred to other entities acting as processors. An up-to-date list of specific recipients of personal data may be provided upon request via our e-mail address.

Transfer of Personal Data to Third Countries or International Organisations

The Controller does not carry out, nor does it intend to carry out, any transfer of personal data to a third country or international organisation.

Automated Decision-Making

No automated decision-making is carried out in the processing of personal data for the purposes set out above.

Profiling

For the purposes of optimal customer care, we retain records of customer activities in order to adopt relevant and targeted measures aimed at improving customer satisfaction and loyalty, and to tailor our services on an individual basis.

For the purpose of creating useful and personalised advertising, we use data provided by you and automatically generated data. This includes, for example, information about your name, the time and frequency of visits to our facilities, goods purchased and services used, and your activity at events organised by us. We use this information only where you have granted us consent to the processing of personal data for marketing purposes.

For the purpose of avoiding the targeting of undefined customer groups (and minimising the processing of data) in direct marketing, we retain records of your behaviour in using our services – such as the time and frequency of visits to our facilities, goods purchased and services used, and your activity at events organised by us – and derive from these records specific personal interests. We use these assessed interests to send targeted, interest-specific offers and advertisements to customers, in particular for the dissemination of advertising with a view to achieving customer satisfaction and loyalty, and to prevent the targeting of undefined customer groups in advertising.

Your Rights as a Data Subject

Right of access

In simple terms, you have the right to know what data we process about you, for what purpose, for how long, where we obtain your personal data from, to whom we disclose it, who else processes it apart from us, and what further rights you have in connection with the processing of your personal data. If you are uncertain about which personal data we process about you, you may request confirmation as to whether personal data relating to you are or are not being processed by us, and if so, you have the right to obtain access to such personal data. Within the scope of the right of access, you may request a copy of the personal data being processed, whereby the first copy will be provided free of charge and any further copies will be subject to a fee. The rights of third parties shall not be prejudiced thereby.

Right to rectification

Personal data must be accurate, up-to-date and correct. If you discover that the personal data we process about you are inaccurate or incomplete, you have the right to require us to correct or supplement them without undue delay. Exercising this right will help us to keep your personal data accurate and current.

Right to erasure

In certain cases, you have the right to require us to erase your personal data. We will erase your personal data without undue delay if any of the following grounds are met:

–   your personal data are no longer necessary for the purposes for which they were processed;

–   you withdraw your consent to the processing of personal data, where the processing is based on your consent and there is no other legal basis or reason for further processing;

–   you exercise your right to object to the processing of personal data processed on the basis of our legitimate interests, and we determine that no such legitimate grounds on our part any longer override your legitimate grounds; or

–   you consider that the processing of personal data carried out by us is unlawful.

Please bear in mind, however, that even where one of the above grounds applies, this does not mean that we will immediately erase all of your personal data. This right shall not apply where the processing of your personal data continues to be necessary for compliance with our legal obligation, or for the establishment, exercise or defence of legal claims.

Right to restriction of processing

In certain cases, in addition to the right to erasure, you may exercise the right to restriction of processing of your personal data. This right allows you, in specific circumstances, to require that your personal data be marked and not be subject to any further processing operations – not permanently (as in the case of the right to erasure), but for a limited period. We are required to restrict the processing of personal data where:

–   you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of your personal data;

–   we process your personal data unlawfully, but you prefer restriction of such data to their erasure;

–   we no longer need your personal data for the stated processing purposes, but you require them for the establishment, exercise or defence of legal claims; or

–   you lodge an objection to the processing, for the period pending verification of whether your objection is legitimate.

Right to data portability

You have the right to receive from us all personal data which you yourself have provided to us and which we process. We will provide your personal data to you in a structured, commonly used and machine-readable format, and in this connection you may exercise your right to have those data transmitted to another controller, where such transmission is technically feasible. In order to facilitate easy transfer of data upon your request, this may apply only to data which we process by automated means in our electronic databases. The rights of third parties shall not be prejudiced thereby.

Right to object to processing

You have the right to object at any time to the processing of personal data carried out on the basis of our legitimate interest. We may no longer process such personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. You also always have the right to object to the processing of your personal data where such data are processed for the purposes of direct marketing, including profiling to the extent that it relates to such direct marketing. In that case, we will immediately cease processing your personal data for direct marketing purposes.

Right to lodge a complaint

If you believe that we are processing your personal data unlawfully or in a manner contrary to generally applicable legislation, you have the right to lodge a complaint against the processing of personal data carried out by us with the Office for Personal Data Protection of the Slovak Republic.

Right to withdraw consent

You have the right to withdraw your consent to the processing of personal data at any time, where personal data are processed on this legal basis.

How and Where to Exercise Your Rights

If you have any questions regarding this document or the use of your personal data, or if you wish to exercise the rights described in this document, you may do so by e-mail, in writing, or in person at the registered office address of our company.

We will respond to your request relating to the processing of personal data without undue delay and in any event within one month of its receipt. In exceptional cases, the period may be extended by a further two months; however, we will in any case inform you of the reasons for the extension within one month of receipt of the request. Information is provided free of charge. Should your requests be manifestly unfounded or repetitive, we may charge a reasonable administrative fee for their processing.

Security

We have adopted the necessary statutory, organisational, physical and technical measures to protect personal data in accordance with data security and privacy standards. Where we disclose and/or transfer personal data to a third party providing services necessary for the fulfilment of one of the purposes of processing, such third party, acting as a processor, has equally adopted appropriate measures to ensure the confidentiality, integrity and security of personal data. We have also taken the necessary steps to ensure that the personal data we process are reliable, accurate and complete for the purposes of their use.

Date: 1 August 2025

These Privacy Policy Principles are drawn up in the Slovak and English languages. In the event of any discrepancy between the Slovak and English versions, the Slovak language version shall prevail.