Privacy Policy

PRIVACY POLICY - GYM FREAKS GROUP s.c.
Publication/update date: 2025-09-30

1. Personal data controller

Your personal data controller is:
Gym Freaks Group civil partnership
Address: ul. Kazimierza Dzięcielskiego 6B/14, 84-200 Wejherowo, Poland
Email: store@gym-freaks.eu
Phone: +48 785 961 286
VAT-EU: PL5882519355
REGON: 529706510

2. Data Protection Officer (DPO)

We have not appointed a Data Protection Officer in our organization.
For data-related matters, please contact us at: store@gym-freaks.eu.

3. Scope and purposes of data processing and legal bases (GDPR)

We process personal data depending on the purpose:

1. Order fulfillment and delivery

   • Scope: name, delivery address, email address, phone number, order details.

   • Legal basis: Art. 6(1)(b) GDPR (contract performance).

2. Issuing invoices and accounting

   • Scope: invoice details (name, VAT number, address), order details.

   • Legal basis: Art. 6(1)(c) GDPR (legal obligation).

3. Handling complaints and claims

   • Scope: order details, correspondence, documents.

   • Legal basis: Art. 6(1)(b) and (f) GDPR.

4. Payments (Tpay, Paynow)

   • Scope: data necessary for payment processing provided to payment operators (tpay.pl, paynow.pl).

   • Legal basis: Art. 6(1)(b) GDPR (contract performance).

5. Marketing and newsletter

   • Scope: email address, marketing preferences; remarketing (Google Ads).

   • Legal basis: Art. 6(1)(a) GDPR (consent) or - in justified cases - Art. 6(1)(f) GDPR (legitimate interest). Consent is required where data usage for marketing requires consent (e.g., newsletter sending).

6. Analytics (Google Analytics)

   • Scope: anonymous/pseudonymized data on traffic, user preferences.

   • Legal basis: Art. 6(1)(a) GDPR (consent) - if permitted by local law, in anonymized form, Art. 6(1)(f) GDPR (legitimate interest) may also apply. Our service requires consent for analytical cookies before launching Google Analytics.

7. Security / fraud prevention

   • Scope: server logs, IP address, user-agent.

   • Legal basis: Art. 6(1)(f) GDPR.

4. Categories of personal data

Processed data include: identification data (name, surname), contact details (address, email, phone), invoice data (tax identification number), transactional data (order history), payment data transmitted to payment operators (Tpay, Paynow), and technical data (IP, logs).

5. Data recipients (processors / data processing entities)

Data may be disclosed to the following categories of recipients:

• Payment operators: Tpay S.A. (tpay.pl), Paynow (paynow.pl) - to the extent necessary for payment processing.

• Courier / logistics companies: InPost, DPD, GLS or other selected carrier - address and contact data for delivery of the shipment.

• IT service providers and hosting: hosting company, email service operator, backup providers - based on data processing agreements.

• Analytics and advertising service providers: Google LLC (Google Analytics, Google Ads), Meta Platforms (if used).

• Accounting office / accounting - to the extent necessary for accounting purposes (based on data processing agreement).

6. Transfer of data outside the EEA

If data is transferred outside the European Economic Area (e.g., services by Google LLC, which may process data in the USA), we apply appropriate safeguards (e.g., standard contractual clauses, other legal mechanisms indicated by providers). Details are available in the privacy policies of individual providers.

7. Data retention period

• Order-related data and accounting documentation: 5 years (tax and accounting requirement).

• Customer account data (address, order history): until account deletion + 5 years for evidential purposes.

• Marketing data (newsletter, remarketing): until consent withdrawal.

• Server logs: 90 days.

• Complaints and claims: until the expiration of claims under applicable law.

8. Rights of data subjects

You have the right to:

• • access data,

rectification of data,

• deletion of data ("right to be forgotten"),

• restriction of processing,

• data portability,

• objection to processing,

• withdrawal of consent at any time (without affecting the lawfulness of processing before withdrawal).

To exercise your rights, send a message to: store@gym-freaks.eu or a letter to the company's headquarters. We will respond within 30 days (if necessary, the deadline may be extended by an additional 60 days — we will inform you).

You also have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (UODO).

9. Cookies and similar technologies — details and table

Our website uses cookies and similar technologies. Some are necessary for the store to function, others are for analytics or marketing purposes. Analytical and marketing scripts are only activated after user consent (cookie banner).

Cookies table (example)

How to manage consents:

• Use the cookie banner available on the website to give or withdraw consent for cookie categories.

• You can also manage cookies in your browser settings.

• To disable personalized Google ads: https://adssettings.google.com.

10. Specifically: Google Analytics, Tpay, Paynow

• Google Analytics / Google Ads (Google LLC) - we use it to analyze traffic and optimize ads. We run analytical scripts only after obtaining user consent. Data is processed in accordance with Google's policy. We use IP address anonymization (anonymize_ip) where possible.

• Tpay S.A. (tpay.pl) - a payment operator handling transactions in the store; processes data necessary for payment processing. Details regarding data processing at Tpay are available on the tpay.pl website.

• Paynow / Paynow.pl - an alternative payment operator; payment data is transmitted only to the extent necessary to process payments; details at the provider.

11. Automated decision-making and profiling

We do not make automated decisions (including profiling) significantly affecting user rights, except for marketing profiling (remarketing), which is done only with user consent.

12. Security measures

We apply technical and organizational measures appropriate to the risk, including: transmission encryption (HTTPS), access control to systems, regular backups, data minimization procedures, entrustment agreements with processing entities.

13. Children and minors

The service is not directed at persons under 13 years of age. We do not knowingly collect data from minors; if we suspect that personal data of a minor has been provided without the consent of a legal guardian, we will take action to remove them upon receiving the appropriate notification.

14. Changes to the privacy policy

The policy may be updated - each update will be marked with the publication date at the top of the document. In case of significant changes, we will inform users prominently.

15. Procedure for exercising rights / contact

Please direct requests to the email address: store@gym-freaks.eu or in writing to the company's registered office. We respond within 30 days of receiving the request. Possible extension by another 60 days in complex cases - we will notify you accordingly.

16. Complaints and supervisory authority

You have the right to lodge a complaint with the supervisory authority - in Poland: President of the Personal Data Protection Office (UODO).