PRIVACY POLICY

of the company New Fitness Distribution d.o.o. Beograd – Vračar

for the FitFlix application

Version 2.0  |  enters into force on the date of its publication

 

  1. Data Controller and contact

The Controller of your personal data is New Fitness Distribution d.o.o. Beograd – Vračar, with its registered office at Rudnička broj 1, 11000 Belgrade, registration number 21460087, tax identification number (PIB) 111310591 (hereinafter: the “Controller”, “we” or the “Merchant”).

The privacy and trust of our users (hereinafter: the “User” or “you”) are very important to us. This Privacy Policy (hereinafter: the “Policy”) explains which personal data we collect when you use the website fitflixgroup.com and the FitFlix application (hereinafter: “FitFlix” or the “application”), for what purposes we process them, with whom we share them and which rights belong to you. Please read it carefully.

For any questions and requests regarding the protection of personal data, you may contact us:

  • by post to the address of the Controller’s registered office: Rudnička broj 1, Belgrade;
  • by e-mail to: info@fitflixgroup.com.
  1. General provisions and principles of processing

All activities of the Controller regarding the collection and processing of personal data are carried out in accordance with the Law on Personal Data Protection of the Republic of Serbia (“Official Gazette of the RS”, no. 87/2018 – hereinafter: the “Law”) and other applicable regulations.

We process data lawfully, fairly and transparently, we collect them for specific and explicit purposes, to the extent necessary for those purposes (the principle of minimization), and we retain them only for as long as necessary. The provision of data is voluntary; you freely decide which data you will provide to us. However, if you do not provide the data necessary for the provision of the Services, i.e. for the conclusion of the contract (e.g. first and last name, e-mail), we reserve the right to refuse to provide those Services.

  1. What data we collect, for what purposes and on what legal basis

With your explicit consent, or on another appropriate legal basis, we process the following categories of data:

Category of data

  • Account and contact data: first name, last name, gender, e-mail address, telephone number
  • Subscription and transaction data: subscription status, purchase identifier
  • Health and fitness data (via Health Connect and HealthKit): see Section 4
  • Contact data for marketing: first name, last name, e-mail, telephone number

Purpose of processing

  • Creation and administration of the user account, provision of the Services and performance of the contract, communication and user support
  • Billing and subscription management (incl. reconciliation of the subscription across platforms)
  • Displaying your health and fitness metrics within the application and calculating indicators (e.g. readiness/recovery score)
  • Sending offers and notifications about the Services and analysis of sales activities

Legal basis

  • Performance of the contract (Art. 12(1)(2) of the Law); for gender – consent (Art. 12(1)(1))
  • Performance of the contract (Art. 12(1)(2))
  • Explicit consent (Art. 17(2)(1) of the Law)
  • Consent (Art. 12(1)(1) of the Law)

Retention period

  • For the duration of the account and up to 1 year after its termination, except for longer statutory periods
  • Up to 10 years (accounting regulations)
  • Until withdrawal of consent or deletion of the account
  • Until withdrawal of consent

Data by which you can be identified will not be used for any purpose other than those set out in this Policy, i.e. those for which you have given your consent.

  1. Health and fitness data – connection with the Health Connect and HealthKit platforms

In order to enable you to use additional functionalities, FitFlix, with your explicit consent, connects with the Health Connect platform of the company Google and the HealthKit platform of Apple Inc. for the purpose of displaying your health and fitness data within the application.

Health data constitute a special category of personal data within the meaning of Article 17 of the Law and are processed exclusively on the basis of your explicit consent (Article 17(2)(1) of the Law), which you may withdraw at any time.

4.1. Types of data we access via Health Connect and HealthKit:

  • number of steps, distance traveled and calories burned (active and total) and basal metabolism;
  • heart rate and resting heart rate;
  • workout and training data;
  • sleep analysis and sleep stages;
  • blood oxygen saturation (SpO₂);
  • history of health data (for the purpose of displaying long-term trends).

4.2. How we use these data

We use these data exclusively in order to display to you, within the application, your personal health and fitness metrics (on the home screen and on the activity, sleep and details screens) and to calculate indicators such as the readiness/recovery score. The data are synchronized with your FitFlix account so that your history is available to you across different devices.

4.3. Sharing and limitations (Limited Use)

We do NOT use the health data obtained via Health Connect and HealthKit for advertising or marketing, we do not sell them and do not share them with third parties, nor do we use them for profiling or credit scoring. The note on marketing activities in this Policy refers exclusively to contact data (name, e-mail, telephone), and not to health data. Our use of data obtained via Health Connect and HealthKit complies with the limited use policies (Health Connect and HealthKit Permissions / Limited Use) of Google and Apple Inc.

4.4. Transfer and security

All of your data, including health data, are transmitted over a secured connection with the application of modern encryption (HTTPS/TLS) and are stored in a secure manner.

4.5. Management and deletion of health data

At any time you may revoke the FitFlix application’s access to Health Connect and HealthKit via the Health Connect/HealthKit application on your device (Settings → Security and privacy → Health Connect/HealthKit → App permissions). Revocation will result in certain functionalities of FitFlix that depend on the said data not being fully available to you, while you will be able to continue using the remaining functionalities without hindrance.

You may request the deletion of your health data from your FitFlix account by sending a request to info@fitflixgroup.com. Upon deletion of the account, the health data associated with it are also deleted, unless applicable regulations provide otherwise.

  1. Marketing activities

With your consent, we may use certain contact data (first name, last name, e-mail and telephone number) for marketing activities and analysis of sales activities, in order to present our offer of Services to you in the best possible way. The marketing tools we use may be e-mail, SMS, MMS or printed material.

At any time you may request, by sending a request to info@fitflixgroup.com, that we not use your data for marketing activities, i.e. you may withdraw your consent, and this will not affect the duration of our contractual relationship nor the lawfulness of the processing carried out prior to the withdrawal.

  1. Recipients of data and processors (third parties)

The Controller will not sell, distribute, cede or in any other way make your personal data available to anyone without your explicit consent, except: (i) if you have permitted it in order to gain access to the desired Services, and (ii) if we are obliged to do so by law or by a decision of a competent authority.

For the purpose of providing and maintaining the application, we engage service providers (processors) who process the data exclusively in accordance with our instructions and to a limited extent, for example for: development and maintenance of the application, hosting and storage of data, subscription management, sending notifications (push notifications) and sending e-mail. With all processors we conclude data processing and confidentiality agreements in accordance with Article 45 of the Law, so that your data remain secure and are handled exclusively for permitted purposes.

  1. Transfer of data to other countries

Certain of our processors (e.g. providers of storage, notification or subscription-management services) may process data outside the Republic of Serbia. In that case, we carry out the transfer exclusively with the application of appropriate protective measures in accordance with Articles 63–69 of the Law (transfer to a country, part of a territory or international organization for which an adequate level of protection has been established, i.e. subject to appropriate safeguards such as standard contractual clauses), so that the level of protection of your data remains preserved.

  1. Data retention period

We retain your data for as long as is necessary to achieve the purpose for which they were collected, i.e. for the duration of the contractual relationship and the use of our Services, and thereafter within the periods provided for by applicable regulations (e.g. accounting and tax regulations).

Data that we process on the basis of consent we retain until the withdrawal of consent. Upon receipt of a request for deletion, we will delete your data, except for those which we are obliged to retain on the basis of the regulations of the Republic of Serbia.

  1. Data security

Your personal data are stored in databases protected by access passwords and other technical and organizational protective measures. We take all reasonable precautions in order to ensure the security of your data. Although we make efforts to protect your data, we cannot unconditionally guarantee the absolute security of the transmission of data over the internet.

  1. Your rights

In accordance with the Law, you have the following rights with respect to the processing of your personal data:

  • the right of access to data (Article 26);
  • the right to rectification and supplementation (Article 29) and the right to erasure (Article 30);
  • the right to restriction of processing (Article 31);
  • the right to data portability (Article 36);
  • the right to object (Article 37);
  • the right to withdraw consent at any time, whereby the withdrawal does not affect the lawfulness of the processing carried out prior to the withdrawal (Article 15);
  • the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Article 82), if you consider that the processing has been carried out contrary to the Law.

You may submit a request for the exercise of your rights in writing to the address of the Controller’s registered office or to info@fitflixgroup.com.

It will be of help to us if you notify us of any change in your data so that we can ensure their accuracy and currency.

  1. Automated decision-making and profiling

FitFlix may generate for you individualized training and/or nutrition plans on the basis of the data you enter or that are synchronized from Health Connect and HealthKit. These functionalities may include elements of automated processing in order to adapt the content to your goals (your wishes regarding the manner of generating, i.e. the content of, the training or nutrition plan).

FitFlix will not carry out automated decision-making that produces legal consequences for you or significantly affects you, including profiling, except in the manner described above, all in accordance with Article 38 of the Law.

FitFlix does not provide medical or diagnostic services and the displayed content does not constitute medical advice.

  1. Data of minors

FitFlix is intended for users aged 16 years and above. With respect to the processing of the data of minors, the provisions of Article 16 of the Law apply.

Persons under 18 years of age may use the application exclusively under the supervision of a parent or guardian.

  1. Publication of amendments to this Policy

The Controller will duly post any amendments to this Policy on its website and in the application and/or deliver them to your e-mail address, prior to the entry into force of those amendments. If you do not agree with the amendments, you may at any time request the deletion of your personal data.

  1. Contact

For any questions or requests regarding your personal data, the Services and current offers, you may contact us:

  • by post to the address of the Controller’s registered office: Rudnička broj 1, Belgrade;
  • by e-mail to: info@fitflixgroup.com.

This Privacy Policy enters into force on the date of its publication.