Hybrid Performance may process basic identity and contact information such as your name, address, email address, phone number, date of birth, gender, and in some cases a photo or a form of identification. It can also include account information you create, membership and visit details, purchase and payment information such as billing details and IBAN, and communications you have with the team via email, phone, or social channels. When you use the website, technical and online identifiers may be processed as well, such as cookie data and device or network information (for example IP address). If you train at the facility, there may also be camera images recorded on-site for security and safety purposes.

Yes, this can happen if it’s necessary for providing training and coaching safely and effectively, or if you voluntarily share it. This may include information related to your physical condition, training goals, injuries or limitations, and other health-related details that help coaches support you responsibly. The policy also indicates that, in limited cases and only when you provide it, data relating to criminal matters could be processed, but this is not typical for day-to-day gym operations.

Your data is mainly used to deliver the services you request and to manage your membership, bookings, payments, and communication. In many cases the legal basis is the performance of a contract, meaning your membership or agreement with the gym. Hybrid Performance may also process data because it is required by law, such as certain tax or administration duties. In other situations the processing is based on legitimate interests, for example improving services, preventing fraud, ensuring security, or informing existing members about relevant updates and offers. Where consent is required, such as certain types of marketing to non-members or specific cookie categories, the gym relies on your explicit permission.

Marketing can occur, but the policy distinguishes between existing customers and people who are not members. Existing members may receive communications that are relevant to the relationship with the gym based on legitimate interest, while marketing toward non-members is typically done on the basis of consent. You should always be able to unsubscribe from marketing emails, and you can withdraw consent at any time when consent is the basis for processing.

Hybrid Performance may share data with service providers that help run the business, such as payment processors, software tools used for administration, email delivery, analytics, website hosting, or customer communication. Sharing can also happen when necessary for legal compliance or to protect the gym’s rights and safety. When third parties process data on behalf of the gym, they are expected to act under instructions and appropriate safeguards, such as data processing agreements where required.

Yes, the website can use cookies and similar technologies to make the site work properly, to analyze usage, and potentially to support marketing activities. Some cookies are strictly necessary for functionality, while others are used for analytics or advertising purposes. Where required, you should be asked for consent through the cookie banner or settings, and you can usually change your preferences later.

Data is not kept forever. Hybrid Performance typically retains personal information only as long as it is needed for the purpose it was collected, such as managing your membership and providing services, and then longer only if retention is required by law or necessary for legitimate business needs like dispute resolution or financial administration. The exact retention period can vary depending on the type of data and the legal obligations that apply.

The policy indicates that appropriate technical and organizational measures are used to protect personal data. In practice, this usually includes access control, secure systems, and limiting data access to people who need it to perform their role. While no system can guarantee absolute security, the intent is to reduce risk and prevent unauthorized access, loss, or misuse.

You have rights under privacy law, which can include requesting access to your data, correcting inaccurate information, requesting deletion in certain situations, restricting processing, objecting to certain uses (like direct marketing), and asking for data portability where applicable. You can typically exercise these rights by contacting the gym through the contact details listed in the Privacy Policy. If you believe your rights are being violated, you may also have the right to lodge a complaint with the relevant supervisory authority.

You can request deletion, and the gym should assess what can be removed and what must be retained. Certain data may need to be kept for legal or administrative reasons, such as financial records that have mandatory retention periods. Where there is no legal requirement and the data is no longer needed, it can generally be deleted or anonymized.

It is possible if some of the tools or service providers used by the gym operate internationally. In that case, the policy should indicate that appropriate safeguards are used, such as contractual protections, to ensure the data remains protected in line with EU/EEA standards. If you want certainty, this is a good point to clarify by listing the main tools used and whether they host data within the EEA.