PERSONAL DATA PROCESSING NOTICE (Arts. 13-14 of Regulation (EU) 2016/679 – GDPR)

1. Data controller

The data controller is GYM Prova, (address to be specified), VAT no./tax code (to be specified). Contact: .

2. Data processed

Personal and contact details (first name, surname, date of birth, tax code, email, telephone), data relating to registration, payments and membership plans, attendance and access, courses attended and sporting results. For activities that require it, also health data: the medical certificate of fitness for sport and, if provided, meal plans and personalised workout plans. For minors, the data of the person exercising parental responsibility.

3. Purposes and legal bases

a) To manage registration, the membership plan, payments and access to the premises, and to provide the services requested (performance of the contract).
b) To verify fitness for sport through the medical certificate and to comply with legal, tax and insurance obligations (legal obligation). Health data is processed only for this purpose and for the training and nutrition services you request, with your explicit consent.
c) To control access by means of the QR membership card and gates, to protect security (legitimate interest).
d) Service communications about due dates, classes and changes (performance of the contract).
e) Sending news and promotions, only if you give optional consent, which may be withdrawn at any time.

4. Recipients

The data is processed by authorised staff (administration, instructors, nutritionists, within the limits of their remit) and by suppliers who assist us, appointed as data processors: software management, hosting, payment services, tax advisers. We do not disseminate your data. Any disclosures to federations or sports promotion bodies take place only where necessary for registration with them or participation in competitions.

5. Retention

The data is retained for the duration of the relationship and, after it ends, for the period required by legal obligations (normally 10 years for accounting data). Health data and plans are retained for the time necessary for the services requested and then deleted or anonymised.

6. Your rights

You may at any time request access, rectification, erasure, restriction, portability and objection to processing, and withdraw any consent given, by writing to the controller's contact details. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).

7. Nature of the provision of data

Providing the data marked as mandatory is necessary in order to register and use the services; without it, registration cannot be completed.