Personal Data Processing Policy
Personal Data Processing Policy – GDPR
We value the trust you place in us when you entrust us with your personal information and are committed to protecting your personal
information so that you feel safe with us. Therefore, in this document we would like to inform you about how we handle your
personal data, how you can contact us if you have questions about how we process your personal data and other important
information about the processing of your personal data.
When processing your personal data, we are governed by Act No. 18/2018 Coll. on the Protection of Personal Data, as amended (hereinafter
2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data
data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as “GDPR”) and related regulations.
In the event that certain terms are not defined in this document, the definition of terms in the General Terms and Conditions of Business
Terms and Conditions for the Provision of Services in PALACE GYM Establishments published at www.palacegym.sk
We are the controller in the processing of your personal data:
MP Body Performance Ltd.
based at Kragujevská 12, 010 Žilina
ID: 54774756
Email: info@palacegym.sk
What personal data we process
We process the following categories of personal data about you:
■ Common personal data, such as name
■ surname
■ date of birth
■ place of residence
■ e-mail, telephone number
■ likeness
■ a special category of personal data – health-related data.
Zásady spracúvania osobných údajov – GDPR
1. Career
Purposes and legal bases:
Selection procedure: we process personal data for the purposes of the selection procedure on the basis of your application for employment
(pre-contractual relationship).
Retention period:
We will only keep your personal data until the end of the selection procedure.
2. Contractual relations
Purposes and legal bases:
Performance of a contract: If you are a party to a contract with us, the processing of your personal data is necessary
for the performance of the subject matter of this contract and the related liability relationships (claims, liability for defects) and this
processing will be carried out on the basis of this contract and specific legal provisions, such as in particular Act no.
250/2007 Coll. on Consumer Protection, as amended, Act No. 40/1964 Coll. on the Civil Code, as amended
513/1991 Coll., the Commercial Code, as amended.
The processing of your personal data for the purpose of performance of a contract may occur even if you are not a party to the contract
you are not a party to the contract, but the contract is otherwise related to you, e.g. you are a contact person (employee) for our contractual partner (your
employer) named in the contract and so we will process your personal data on the basis of our legitimate interest as we need it to the extent necessary
to process as there is a relationship between you and our contractor and without processing your personal data we would not be
be able to properly conduct our business and perform the contract.
Retention period:
We retain your personal data for as long as it is necessary to fulfil this processing purpose (proper performance of the contract) and
the expiry of the time limit for the exercise of any claims, however, for a maximum of 4 years from the fulfilment of the object of the contractual relationship. Accounting
documents relating to contracts are kept for 10 years after the year to which they relate for the purpose of processing and keeping
accounting, bookkeeping and economic documents.
3. Provision of services
Purposes and legal bases:
If you have made a booking with us for the services you are interested in, we will process your personal data in the context of this
pre-contractual relationship, the purpose of which is the proper provision of the services you have booked at the agreed time.
Registration of Clients and provision of services to them.
enter into a Contract and/or perform a Service Activation. On the basis of this, our Service Provider will then provide you with our
Services.
Rehabilitation: we can also provide you with medical services – physiotherapy services at some of our locations. For
the provision of health care in the field of physiotherapy (physiotherapy treatments), it is necessary to process your data
concerning your health, which we do on the basis of and in accordance with Act No. 576/2004 Coll. on health care, services
related to the provision of health care and on the amendment and supplementation of certain acts.
Retention period:
We retain your personal data for the duration of the Contract. For the purpose of providing physiotherapy services, we keep
Your personal data for a period of 20 years from the date of provision of healthcare
4. Communication
Purposes and legal bases:
Mutual communication: if you contact us on any matter through any communication channel (by mail,
email or telephone) we process your personal data for the purpose of contacting you. Personal data
We process personal data for communication with you based on your request. We process records of incoming and outgoing mail on the basis of
a specific law.
Retention period:
We will retain your personal data for a period of (1) one year from the end of the individual communication. Incoming and outgoing mail records
sent mail will be kept for 5 years after the year to which it relates
5. Marketing
Purpose and legal basis:
Contacting and sending updates, offers and member benefits: newsletter (marketing information) we will
will only be sent to the extent and at intervals that will not be a nuisance to you. We process personal data for marketing purposes for
on the basis of your consent. For the creation of useful and personalized advertising (personalized newsletter) you can also provide us with
consent to the use of the data provided by you as well as automatically generated data. Consent is still voluntary and
you can withdraw it at any time.
For the purpose of informing the public about the events we have organized, our presentation to the outside world,
we may publish your photographs or video footage on various promotional materials and media, our website or social networks. About taking photographs or videos for
this purpose, we will always inform you in advance. We take and publish photographs and videos on the basis of your
consent or our legitimate interests.
Retention period:
We will retain your personal data obtained on the basis of consent for 5 years after we have obtained your consent. Your personal data
collected on the basis of consent for the purpose of personalised advertising (personalised newsletter) will be kept for the duration of
of your consent to the processing of your personal data for marketing purposes (newsletter). Personal data collected on the basis of our
legitimate interest, we will keep it for the duration of the reasons for such processing.
6. Marketing
Purpose and legal basis:
The legal basis for the processing of personal data is our legitimate interest in protecting public order and
security, the detection of crime, the protection of property or health. It is the processing of personal data for the purpose of protecting
legitimate interest: the protection of public order and safety, the detection of crime, the protection of property or health,
and the processing in question includes, for example, the use of CCTV to monitor our premises.
Retention period:
We keep CCTV footage for a maximum of 15 days after it is made. At the end of the retention period, we will ensure
immediate destruction of your personal data.
7. Debt recovery and litigation
Purposes and legal basis:
We may process your personal data for the purpose of debt recovery and litigation. The legal basis for
such processing is our legitimate interest in defending and pursuing our legal claims.
Retention period:
We retain personal data for this purpose for a maximum of 10 years after the final conclusion of the litigation or until recovery
the claim.
8. Epidemiological measures at entry into service
Purpose and legal basis:
In the event that you enter our premises, we will process your personal data for the purpose of the obligation to check
access to our premises under the chosen OP, OP+ or OTP regime in accordance with the currently valid decree of the Public Authority
Health Authority of the Slovak Republic and/or the relevant Regional Public Health Authority. We carry out this processing on the basis of legal
Article 6(1)(c) GDPR in conjunction with Article 9(2)(g)(i) GDPR (with particular reference to Act No. 355/2007 Coll. on protection,
promotion and development of public health and the currently valid decree of the Office of Public Health of the Slovak Republic and/or the relevant
regional public health authority).
Retention period:
There is no data retention.
9. Epidemiological measures at mass events
Purpose and legal basis:
In the event of organising or holding a mass event, it is necessary to carry out access control to the premises where
where the mass event is to take place for the purposes of compliance with the chosen OP, OP+ or OTP regime and epidemiological
investigation. This processing is carried out on the legal basis of Article 6(1)(c) GDPR in conjunction with Article 9(2)(i) GDPR (with particular reference to Act No. 355/2007 Coll. on the protection, promotion and
development of public health and the currently valid decree of the Office of Public Health of the Slovak Republic and/or the relevant regional
public health authority).
Retention period:
Two weeks from the end of the mass event.
Fulfillment of our legal obligations
When processing your personal data for individual purposes, we also process your personal data on the basis of
various specific regulations which impose various obligations on us, e.g. accounting, bookkeeping and economic processing
documents, registry management, provision of data to state and other authorities supervising our activities
or to resolve disputes, or in the implementation of decisions. Such special regulations are e.g. Act No 40/1964 Coll., Civil Code
Code, Act No. 102/2014 Coll. on consumer protection in the sale of goods or provision of services under a contract
concluded at a distance or a contract concluded away from the seller’s business premises and on amendment and supplementation of certain
Act No. 222/2004 Coll., on value added tax, Act No. 431/2002 Coll., on accounting, Act No. 395/2002 Coll. on
archives and registers.
Retention period:
It will depend on the obligation we have to fulfil based on a specific regulation.
Necessity to provide personal data
If the provision of personal data is a legal or contractual requirement, or a requirement that is necessary for
the conclusion of a contract, the data subject is obliged to provide the personal data. Otherwise, the purpose cannot be fulfilled
of the processing which the controller intended to carry out in the case of the provision of personal data.
Provision and disclosure of your personal data
We may generally disclose and/or provide your personal data to other entities such as the tax authorities,
government authorities and public authorities for inspection and supervision (e.g. labour inspectorate), courts, law enforcement authorities
law enforcement, accountants, auditors, lawyers, trainers, IT systems and support suppliers and other external professional advisors, and other
companies that provide products and services to us. We are responsible for the proper protection of your personal information,
that is provided and/or disclosed to others as an agent. A current list of specific
recipients of personal information can be provided upon request via our email address.
Transfer of personal data to a third country or international organisation
The controller does not transfer, and has no intention of transferring, personal data to a third country or international
Automated decision making
The processing of personal data for the purposes set out above does not involve automated decision-making.
Profiling
For the purposes of optimal customer care, we store customer activities in order to take relevant and targeted
measures and thus improve customer satisfaction and thereby customer loyalty, as well as to individually tailor services.
To create useful and personalised advertising, we use the data provided and automatically generated. This includes
e.g. information on the name, time and number of visits to our stores, goods purchased and
services used, your activity at events organised by us. We only use this information if you have provided us with
you have given your consent to the processing of your personal data for marketing purposes.
In order to avoid reaching undefined groups of customers (and to minimise data processing) in direct
marketing, we store your behaviour when using our services, such as the time and number of visits to our premises,
goods purchased and services used, your activity at events organised by us, and infer
specific personal interests. We use these evaluated interests to send targeted, interest-specific offers and
advertisements to customers. In particular, to disseminate advertisements to achieve customer satisfaction and loyalty and thus avoid reaching
undefined groups of customers when advertising.
Your rights as a data subject in the processing of personal data
a) Right of access
Put simply, you have the right to know what data we process about you, for what purpose, for how long, where your personal
we obtain, to whom we disclose it, who processes it besides us, and what other rights you have in relation to the processing of your
personal data. However, if you are not sure which personal data we process about you, you can ask us to confirm whether the personal
the personal data relating to you is or is not being processed by us and, if so, you have the right to access that personal
data. As part of your right of access, you may ask us for a copy of the personal data we are processing, the first copy of which will
We will provide the first copy free of charge and subsequent copies with a fee. However, the rights of third parties may not be restricted thereby.
b) Right to rectification
The personal data must be correct, up-to-date and true. If you discover that the personal data we process about you is inaccurate
or incomplete, you have the right to have it corrected or completed without undue delay. By exercising this right
you will help us to keep your personal data correct and up-to-date.
c) Right to erasure
In some cases, you have the right to have us delete your personal data. Your personal data without undue delay
We will delete it if any of the following reasons are met:
■ We no longer need your personal data for the purposes for which we processed it
■ you withdraw your consent to the processing of your personal data, which is data for which you have consented to the processing
it is necessary and we have no other basis or reason for further processing
■ you exercise your right to object to the processing of personal data processed by us on the basis of our
legitimate interests and we find that no such legitimate grounds on our part no longer outweigh your
legitimate grounds; or
■ you believe that the processing of your personal data by us has been unlawfully carried out.
But please note that even if it is one of these reasons, it does not mean that we will immediately delete all your personal
data. Indeed, this right is not permitted if the processing of your personal data is still necessary for the fulfilment of our legal
obligation or to prove, exercise or defend our legal claims.
d) Right to restriction of processing
In some cases, in addition to the right to erasure, you may exercise the right to restrict the processing of personal data. This
right allows you in certain cases to request that your personal data be marked and not
subject to any further processing operations – but in this case not permanently (as in the case of the right to erasure), but after
for a limited period of time. We must restrict the processing of personal data when:
■ you deny the accuracy of the personal data for a period of time that allows us to verify the accuracy of your personal data
data
■ we process your personal data unlawfully, but you will prefer only to delete such data before
restriction
■ We no longer need your personal data for the stated purposes of the processing, but you require it for demonstration purposes,
to assert or defend your legal claims, or
■ you object to the processing for a period of time during which we determine whether your objection is justified
e) Right to data portability
You have the right to obtain from us any of your personal data that you yourself have provided to us and that we are processing. Your personal data
We will provide it to you in a structured, commonly used and machine-readable format and you may use your
right to transfer this data to another data controller if such transfer is technically possible. In order to enable us to
your request, the data may only be data that we process automatically in our electronic
databases. However, the rights of third parties may not be restricted thereby.
f) Right to object to processing
You have the right to object at any time to the processing of your personal data which is based on our legitimate interest.
We may not further process this personal data unless compelling legitimate grounds for such processing are demonstrated,
which override your interests, rights and freedoms, or for the establishment, exercise or defence of
legal claims. You also always have the right to object to the processing of your personal data if it is processed for the purposes of
direct marketing, including profiling to the extent that it is related to such direct marketing. In this case
we will immediately stop processing your personal data for direct marketing purposes.
g) Right to lodge a complaint
If you believe that we are processing your personal data unlawfully or in breach of generally binding
legal regulations, you have the right to lodge a complaint with the Office for the Protection of Personal Data against the processing of your personal data by us
Personal Data of the Slovak Republic.
h) Right to withdraw consent
You have the right to withdraw your consent to the processing of your personal data at any time if your personal data is processed on this
legal basis.
How and where you can exercise your rights
If you have any questions about this document or the use of your personal data or wish to exercise your
rights described in this document, you can do so by email, in writing or in person at our registered office.
We will respond to your request regarding the processing of your personal data without undue delay in any case within
one month after receipt. In special cases, the time limit may be extended by a further two months, but in any
in any case, we will inform you of the reasons for the extension within one month of receipt of the request. The information shall be provided
free of charge. However, if your requests are excessive or repetitive, we may require a reasonable administrative
fee for their processing.
Security
We have taken the necessary legal, organisational, material and technical measures to protect personal data in accordance with
data security and privacy standards. If we provide and/or disclose personal data to a third party,
which provides services necessary for the fulfilment of any of the purposes of the processing of personal data, such third party in
as a processor shall likewise have appropriate measures in place to protect the confidentiality, integrity and security of personal
of the data. We have also taken the necessary steps to ensure that the personal data we process is reliable, accurate and
complete for the purpose of their use.
In Žilina on 01.02.2023
