Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)
This Privacy Notice describes the processing of personal data carried out by Gymtrainer s.r.l. in connection with the creation and management of a BookyWay account and the use of the administration platform.
This Privacy Notice applies in particular to the Customer, the Account Owner, Managers, Personal Trainers, Instructors and other persons authorised by the Customer to use, manage or interact with the BookyWay services.
The processing of personal data relating to End Users entered into or managed by the Customer through BookyWay is also governed by Section 12 below, which explains the different allocation of data protection roles between the Customer and Gymtrainer s.r.l.
For the purposes of this Privacy Notice:
Customer: the natural or legal person, entity, association or other organisation on whose behalf a BookyWay account is created and used.
Account Owner: the natural person who holds the primary credentials for the BookyWay account and is authorised to carry out the operations reserved for the account holder.
End User: the person who uses BookyWay as a recipient of the services, activities or features made available by the Customer.
Data Subject: the natural person to whom the personal data being processed relates.
BookyWay: the software platform and related services provided by Gymtrainer s.r.l.
For processing carried out for its own purposes, the Data Controller is:
Gymtrainer s.r.l.
Via XX Settembre 32/A
San Martino Buon Albergo (VR), Italy
VAT No. 04643350236
Certified email (PEC): admin@pec.gymtrainer.net
Email: support@bookyway.com
For requests relating to the protection of personal data, the contact details above may be used.
Depending on the features used and the relationship with Gymtrainer s.r.l., the following categories of personal data may be processed:
Gymtrainer s.r.l. does not normally require the Customer, for the purpose of managing the contractual relationship, to provide data belonging to special categories of personal data under Article 9 GDPR. The Data Subject is asked not to include such information in communications or free-text fields unless strictly necessary.
Personal data may be collected:
a) directly from the Data Subject when the account is created or activated, including through any registration or self-registration features made available by BookyWay, when using the Platform, purchasing services or communicating with Gymtrainer s.r.l.;
b) from the Customer, the Account Owner or other authorised persons when they add or enable additional Managers, Personal Trainers, Instructors or collaborators;
c) automatically through use of the Platform, limited to the technical and operational information necessary for the operation, security and management of the service;
d) from payment service providers or other providers involved in the provision of the services, limited to information necessary for managing the relationship.
6.1 Creation and management of the account and contractual relationship
Personal data is processed to:
Where the Data Subject is directly a party to the Agreement, the legal basis is performance of the Agreement or taking steps at the Data Subject’s request prior to entering into the Agreement, pursuant to Article 6(1)(b) GDPR.
Where the data relates to representatives, Managers, collaborators or other persons acting on behalf of the Customer, the processing is based on the legitimate interests of Gymtrainer s.r.l. and the Customer in the proper management of the contractual relationship and account, pursuant to Article 6(1)(f) GDPR.
6.2 Billing, administration and legal obligations
Personal data may be processed for the issuance and retention of invoices, administrative and accounting management, compliance with tax, corporate and regulatory obligations, and responding to lawful requests from competent authorities.
The legal basis is compliance with legal obligations pursuant to Article 6(1)(c) GDPR and, where necessary, performance of the Agreement.
6.3 Payments
Where electronic payment services are used, the data necessary to execute, record and verify the payment may also be processed by the payment service provider used.
Gymtrainer s.r.l. may receive and retain the information necessary to verify the status and outcome of transactions and to manage Subscriptions, renewals, billing and payment reconciliation.
The legal basis is performance of the Agreement and, where applicable, compliance with legal obligations.
6.4 Security, prevention of abuse and protection of rights
Gymtrainer s.r.l. may process data relating to access, operations performed and use of the Platform in order to:
The legal basis is the legitimate interest of Gymtrainer s.r.l. in the security of the service, prevention of abuse and protection of its rights, pursuant to Article 6(1)(f) GDPR, as well as compliance with any applicable legal obligations.
6.5 Service communications
Gymtrainer s.r.l. may send communications that are necessary or otherwise strictly connected with the use of BookyWay, including communications relating to:
Such communications may be sent throughout the duration of the relationship with BookyWay and until the account has been permanently terminated or deleted, including where the account is temporarily inactive or has not been used for some time, where the communication concerns terms, changes or circumstances relevant to the account, the service or its potential future use.
Such communications are not marketing communications and do not require marketing consent where they are necessary for the performance or management of the contractual relationship, compliance with legal obligations or pursuit of a legitimate interest connected with provision of the service.
Only with the Data Subject’s specific consent may Gymtrainer s.r.l. use the email address to send newsletters, offers, promotions and other marketing communications relating to BookyWay or the services of Gymtrainer s.r.l.
The legal basis is the Data Subject’s consent pursuant to Article 6(1)(a) GDPR.
Consent is optional and may be withdrawn at any time, including through the link contained in marketing communications, without affecting the lawfulness of processing carried out before consent was withdrawn.
Failure to give consent, or withdrawal of consent, does not affect the ability to use BookyWay.
Providing the personal data necessary to create the account, manage the contractual relationship, billing, payments and service security is required.
Failure to provide such data may make it impossible to create or maintain the account or to use all or part of the BookyWay services.
Providing personal data for marketing purposes is optional.
Personal data is retained only for as long as necessary in relation to the purposes for which it is processed.
In particular:
At the end of the relevant retention periods, the data will be deleted or anonymised, subject to legal obligations and the technical time required to delete copies stored in backup systems.
Personal data may be processed by employees and collaborators of Gymtrainer s.r.l. who are authorised and instructed in relation to their respective duties.
Personal data may also be disclosed or made accessible, to the extent necessary, to external parties that provide services supporting the activities of Gymtrainer s.r.l. and the provision of BookyWay, such as:
Depending on the circumstances, such parties act as Data Processors, Sub-processors, independent Data Controllers or authorised persons, according to the role actually performed.
The up-to-date list of Sub-processors used by Gymtrainer s.r.l. to provide BookyWay is available on the BookyWay website.
For the provision of BookyWay services, Gymtrainer s.r.l. uses third-party providers that may act, depending on the circumstances, as Data Processors or Sub-processors, including providers of cloud infrastructure, communication services, technical services and other services necessary for operation of the Platform.
The up-to-date list of Sub-processors used by Gymtrainer s.r.l. to provide BookyWay is available at: https://bookyway.com/en/sub-processors/
Some providers may involve the processing or transfer of personal data outside the European Economic Area.
In such cases, Gymtrainer s.r.l. ensures that transfers are carried out in compliance with the GDPR, on the basis of an adequacy decision of the European Commission, where applicable, or using the safeguards provided for by law, such as Standard Contractual Clauses or other applicable legal mechanisms.
At the Data Subject’s request, Gymtrainer s.r.l. will provide available information relating to the safeguards used for any international transfers.
Gymtrainer s.r.l. implements technical and organisational measures appropriate to the risk, taking into account the nature of the data processed, the purposes of the processing, the state of the art and the characteristics of the service.
These measures are updated and developed over time in line with technological developments, the characteristics of BookyWay and the risks identified.
However, no IT system can guarantee an absolute level of security.
The obligations of Gymtrainer s.r.l. relating to security, confidentiality and management of any Personal Data Breaches are further governed by the BookyWay Terms and Conditions.
Where the Customer uses BookyWay to enter, collect, store or otherwise process personal data relating to its End Users or other persons in connection with its activities, the Customer acts as Data Controller and Gymtrainer s.r.l. acts as Data Processor pursuant to Article 28 GDPR.
By accepting the BookyWay Terms and Conditions, the Customer expressly appoints Gymtrainer s.r.l. as Data Processor for the personal data processed on its behalf through BookyWay.
Gymtrainer s.r.l. processes such data exclusively on behalf of the Customer and on the basis of the Customer’s documented instructions, to the extent necessary for the provision, operation, security and maintenance of the BookyWay services and features used by the Customer.
The Customer’s documented instructions include, among other things, the BookyWay Terms and Conditions, the settings and configurations implemented through the Platform, use of the available features and any additional requests or instructions sent to Gymtrainer s.r.l. through the channels made available.
By accepting the BookyWay Terms and Conditions, the Customer also grants Gymtrainer s.r.l. general authorisation to engage third-party providers and appoint Sub-processors for the personal data of End Users and other persons whose data is processed through BookyWay, to the extent necessary for the provision, security, maintenance and operation of the service.
Gymtrainer s.r.l. requires its Sub-processors to comply with appropriate personal data protection obligations that are substantially equivalent to those applicable to Gymtrainer s.r.l., to the extent required by law and in relation to the services they provide.
The up-to-date list of Sub-processors used to provide BookyWay is available at: https://bookyway.com/en/sub-processors/
Gymtrainer s.r.l. will inform the Customer of intended changes concerning the addition or replacement of Sub-processors, allowing the Customer to raise any objections based on grounds relating to the protection of personal data, in accordance with the BookyWay Terms and Conditions.
End User data may include, depending on the choices made by the Customer, identification and contact data, information relating to activities, bookings and use of the services, notes, communications, content and other information entered into or collected through BookyWay.
Where the Customer uses BookyWay to process special categories of personal data under Article 9 GDPR, including any health-related data, the Customer, as Data Controller, remains responsible for verifying the lawfulness of the processing, identifying the appropriate legal basis and complying with any additional obligations under applicable law.
Gymtrainer s.r.l. does not use personal data processed on behalf of the Customer for its own marketing or profiling purposes in relation to End Users.
The complete rules governing the appointment of Gymtrainer s.r.l. as Data Processor, the Customer’s instructions, Sub-processors, security, assistance to the Data Controller, Personal Data Breaches, any international transfers and the return or deletion of data are set out in Article 10 of the BookyWay Terms and Conditions.
The Customer may access the personal data of its End Users through the features made available by BookyWay and, within the limits allowed by the technical characteristics of the Platform, rectify, update or delete such data. Where a Data Subject request cannot be handled directly through the available features, Gymtrainer s.r.l. will provide the Customer with the reasonable assistance required in accordance with applicable law and the BookyWay Terms and Conditions.
Requests from End Users
An End User wishing to exercise rights in relation to personal data processed by the Customer through BookyWay should normally contact the Customer or the organisation using BookyWay, which acts as Data Controller.
Where Gymtrainer s.r.l. receives directly a request relating to personal data processed on behalf of the Customer, it will, where appropriate, forward the request to the relevant Data Controller and cooperate, within the limits provided for by law and the obligations undertaken in its capacity as Data Processor, in handling the request.
Upon termination of the processing services carried out on behalf of the Customer, Gymtrainer s.r.l. will, in accordance with the BookyWay Terms and Conditions and applicable law, return or delete the personal data processed on behalf of the Customer, subject to any retention obligations imposed by law.
In the cases expressly provided for in Article 10.7 of the BookyWay Terms and Conditions, where the Data Subject has directly requested Gymtrainer s.r.l. to delete their personal data without receiving a response from the Customer, or where the Customer can no longer be contacted, has ceased operations or is otherwise unable to handle the request, Gymtrainer s.r.l. may delete the account or remove the Data Subject’s association with the Customer’s account and delete the related personal data processed on behalf of the Customer, following reasonable verification of the identity of the requesting person and subject to any legal obligations or other legal grounds requiring retention of the data.
BookyWay may be used by the Customer to manage End Users who are minors.
The Customer, as Data Controller, is responsible for verifying the lawfulness of the processing of minors’ personal data and for obtaining any consents or authorisations required under applicable law.
Where processing is based on consent and the conditions set out in Article 8 GDPR concerning the direct offer of information society services to minors apply, the age limits established by applicable national law must be respected.
In Italy, a minor who has reached the age of fourteen may independently give consent in the cases provided for by Article 2-quinquies of Legislative Decree No. 196/2003.
This provision relates exclusively to consent to the processing of personal data and does not alter the legal capacity requirements for entering into the BookyWay Agreement as a Customer.
In the circumstances provided for by the GDPR, the Data Subject may exercise:
Requests may be sent to:
support@bookyway.com
or by certified email (PEC): admin@pec.gymtrainer.net
Gymtrainer s.r.l. may request the information reasonably necessary to verify the identity of the requesting person before acting on the request.
A Data Subject who considers that the processing of their personal data infringes applicable data protection law has the right to lodge a complaint with the competent Supervisory Authority.
For Italy:
Garante per la protezione dei dati personali.
The right to lodge a complaint is provided for by Article 77 GDPR and may be exercised in accordance with the procedures indicated by the Garante.
This is without prejudice to the Data Subject’s right to seek judicial remedies in the cases provided for by law.
BookyWay may integrate or allow the use of services provided by third parties, such as payment services, multimedia platforms or other tools connected by the Customer.
Where the Data Subject interacts directly with such services, the privacy notices and terms issued by the relevant providers may also apply.
For information relating to cookies and other technologies used on www.bookyway.com, please refer to the Cookie Policy published on the website.
Gymtrainer s.r.l. may update this Privacy Notice to reflect regulatory, technological or organisational changes or changes to BookyWay features.
The updated version will be published on the website with an indication of the date of the latest update.
Where changes have a material impact on the processing carried out or on the rights of Data Subjects, Gymtrainer s.r.l. will notify Data Subjects through the contact details or channels associated with the account, where appropriate in light of the nature of the changes.