Privacy Policy
GR8 GYMS website and mobile app Last updated: 11 October 2026 1.Who we are This Privacy Policy explains how SMET LEGACY GROUP EOOD, registered in Bulgaria under company number UIC/EIK 208520909, with registered address at 6th September Blvd. 157 ap. 17, 4000 Plovdiv ("GR8 GYMS", "we", "us"), collects and uses personal data when you use our website, our mobile app, and our gym services. We are the "controller" of your personal data under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Bulgarian law. Contact for privacy matters: smetlegacygroup@icloud.com | +359894986014 2.What data we collect Account and registration data. Name, email address, phone number, postal address, date of birth, gender, and your password (stored in encrypted form by our platform provider). Booking and membership data. Gym slots and personal trainer sessions you book, attendance, cancellations, the plans you hold (registration and monthly plans), and purchase history. Payment data. Payments are handled by our payment providers, [Stripe / PayPal]. We do not see or store your full card number. We receive confirmation of payment, the amount, and limited details such as the last four digits of the card. Shop orders. If you buy products from our members' shop: items ordered, delivery details, and order history. Health and fitness information (optional). If you choose to give us health information, emergency contacts, fitness goals, or similar details, we process these only with your explicit consent. You can leave these fields empty and still use the service. App and device data. Device type, operating system, app version, push notification token (if you allow notifications), and basic usage and error data. Communications. Messages you send us, support requests, and your marketing preferences. Website data. IP address, browser type, pages visited, and cookie data, as described in our Cookie Policy. GR8 GYMS Privacy Policy Page 1 of 5 3.Why we use your data and our legal basis Where we rely on consent, you can withdraw it at any time (see section 8). Withdrawing consent does not affect processing carried out before withdrawal. 4.Who we share your data with We do not sell your personal data. We share it only with: Wix.com Ltd. and its group companies, which host our website and app and provide our membership, booking and store tools. Payment providers ([Stripe / PayPal]) to process payments. Apple and Google, which operate the App Store and Google Play and deliver push notifications. Email and communication providers used to send confirmations and, with your consent, marketing messages. Accountants, legal advisers and auditors where needed. Purpose Legal basis (GDPR) Create and manage your account and membership Contract (Art. 6(1)(b)) Process registration fees, subscriptions and orders Contract (Art. 6(1)(b)) Manage gym slot and trainer bookings, send booking confirmations and reminders Contract (Art. 6(1)(b)) Keep accounting, tax and invoicing records Legal obligation (Art. 6(1)(c)) Prevent fraud, secure our systems, enforce our terms Legitimate interests (Art. 6(1)(f)) Respond to your questions and complaints Contract or legitimate interests Send marketing emails and offers Consent (Art. 6(1)(a)) Send push notifications Consent (Art. 6(1)(a)) Process health or fitness information you provide Explicit consent (Art. 9(2)(a)) Analyse and improve our website and app Legitimate interests or consent, depending on the tool GR8 GYMS Privacy Policy Page 2 of 5 Authorities, courts or regulators where we are legally required to. Delivery companies, if you order products from the shop. These providers act as our processors under written agreements, or as independent controllers where the law requires (for example, payment providers). 5.Transfers outside theEU/EEA Some of our providers may process data outside the European Economic Area. Where this happens, we rely on safeguards required by GDPR, such as an EU adequacy decision, or Standard Contractual Clauses approved by the European Commission. You can contact us for more information about these safeguards. 6. How long we keep your data Account and membership data: for as long as your account is active, and [12] months after it closes, unless a longer period is needed to handle claims. Accounting and payment records: for the period required by Bulgarian accounting and tax law. Marketing data: until you withdraw consent or unsubscribe. Health and fitness information: until you withdraw consent or delete your account. Support messages: [24] months after the matter is closed. When the retention period ends, we delete or anonymise the data. 7. Age Our services are for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, please contact us and we will delete it. 8. Your rights Under GDPR you have the right to: Access the personal data we hold about you and get a copy. Rectify inaccurate or incomplete data. Erase your data (the "right to be forgotten") in the cases the law provides. Restrict how we process your data in certain cases. GR8 GYMS Privacy Policy Page 3 of 5 Data portability: receive your data in a structured, commonly used format, and have it sent to another provider where possible. Object to processing based on our legitimate interests, and to direct marketing at any time. Withdraw consent at any time, where processing is based on consent. To use these rights, email smetlegacygroup@icloud.com. We will answer within one month. We may need to verify your identity first. You also have the right to complain to a data protection authority. In Bulgaria this is the Commission for Personal Data Protection (CPDP / КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg. If you live elsewhere in the EU, you can contact your local authority. 9. Deleting your account You can delete your account and personal data at any time: In the app: go to [Profile > Settings > Delete account] ([update to match your app]). By email: write to smetlegacygroup@icloud.com from the email address on your account. We will delete your account within [30] days, except for records we must keep by law (such as invoices). If you have an active subscription, cancel it first so you are not charged again. 10. Cookies and similar technologies Our website uses cookies. Essential cookies are always on. Analytics and marketing cookies are used only if you accept them in our cookie banner. See our Cookie Policy for details and how to change your choices. 11. Marketing We send marketing emails and push notifications only if you have agreed. You can unsubscribe using the link in every email, or switch off notifications in the app or your device settings. 12. Automated decisions We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. GR8 GYMS Privacy Policy Page 4 of 5 13. Security We use appropriate technical and organisational measures to protect your data, including encrypted connections, access controls, and use of reputable providers. No system is completely secure. If a breach affects your rights, we will notify you and the authorities as GDPR requires. 14. Links to other sites Our website and app may link to third-party sites. We are not responsible for their privacy practices. Please read their policies. 15. Changes to this policy We may update this policy from time to time. We will post the new version here with a new "Last updated" date, and notify you of material changes through the app or by email. 16.