Privacy policy

This privacy policy explains how Gym PA handles your personal data. We treat your data with care and never sell it to third parties.

1. Who we are

Gym PA is responsible for processing your personal data. Questions? Contact us at info@gym-pa.com.

Gym PA · Vrouw Avenweg 706, Den haag · Chamber of Commerce (KvK) 42124077

2. What data we process, why, and for how long

	Purpose	Legal basis	Retention
Ledenadministratie	PurposeBeheer van lidmaatschappen en contactgegevens	Legal basisUitvoering overeenkomst (art. 6.1.b)	RetentionDuur lidmaatschap + 24 maanden, daarna pseudonimiseren
Lesboekingen & aanwezigheid	PurposeInplannen en bijhouden van trainingen	Legal basisUitvoering overeenkomst (art. 6.1.b)	Retention7 jaar (onderdeel administratie), daarna pseudonimiseren
Betalingen & facturatie	PurposeInnen van betalingen en uitgeven van facturen	Legal basisUitvoering overeenkomst + wettelijke plicht (art. 6.1.b/c)	Retention7 jaar (fiscale bewaarplicht)
Intake & gezondheidsgegevens (special category data)	PurposeVeilige en passende trainingsbegeleiding	Legal basisUitdrukkelijke toestemming (art. 9.2.a)	Retention24 maanden na laatste activiteit, daarna verwijderen
E-mailcommunicatie	PurposeTransactionele berichten (bevestigingen, herinneringen)	Legal basisUitvoering overeenkomst (art. 6.1.b)	RetentionE-mailinhoud 90 dagen
Nieuwsbrief & marketing	PurposeVersturen van nieuws en aanbiedingen	Legal basisToestemming (art. 6.1.a)	RetentionTot intrekken van de toestemming
Beveiliging & logging	PurposeMisbruik detecteren en de dienst beveiligen	Legal basisGerechtvaardigd belang (art. 6.1.f)	RetentionIP 30 dagen, security-logs 1 jaar

3. Who we share data with

We use the following sub-processors. Each operates under a data processing agreement:

• Stripe (Ierland / VS) — Betalingsverwerking & uitbetalingen (Stripe Connect)
• Resend (VS) — Versturen van transactionele e-mail
• TransIP (Nederland) — Hosting van de applicatie en database
• SendCloud (Nederland) — Verzendlabels & track-and-trace voor webshop-bestellingen
• Cookiebot (Denemarken) — Cookie-toestemmingsbeheer (premium-optie)

For on-location sessions or services (for example home-visit personal training) we share your address details solely with the trainer assigned to you, and only as far as needed to carry out the appointment.

4. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. You can exercise these rights yourself via your account under "Privacy & data".

5. California residents (CCPA/CPRA)

If you live in California you have the right to know what data we collect, to request deletion, and to opt out of the sale of your data. We do not sell your personal information and do not share it for advertising purposes ("Do Not Sell or Share My Personal Information" therefore applies by default).

6. International visitors

Residents of Canada (PIPEDA) and Brazil (LGPD) have comparable rights to those above and can exercise them in the same way.

7. Cookies

Our website uses essential cookies and — only with your consent — functional, analytics and marketing cookies. You manage this via the cookie banner.

8. Complaints

Unhappy with how we handle your data? You can lodge a complaint with your national data protection authority.

Last updated: 02/11/2026