SPORTLIFE BC PRIVACY AND COOKIE POLICY

Last updated: 28 October 2026

This Privacy and Cookie Policy (the "Policy") describes the rules for collecting, using, disclosing and protecting personal data in connection with the services of SPORTLIFE BC, including its website, digital services, applications, events, fitness club and other products and services offered by SPORTLIFE BC (collectively, the "Services"). The Policy also explains the rights of data subjects and how to contact the Controller.

1. Data Controller and contact details for data protection matters

The controller of personal data is SPORTLIFE BC spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), with its registered office in Warsaw at ul. Adama Naruszewicza 27, 02-627 Warsaw, Republic of Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS No. 0001016268, NIP 5214003837 (hereinafter "SPORTLIFE BC", the "Controller", "we", "us" or "our").

For all matters concerning privacy and the processing of personal data, including the exercise of rights under the GDPR, you may contact the Controller directly by email at bluecity@sportlife.pl or by post at the registered office address stated above.

Links to third-party websites

The Services may contain links to third-party websites, plug-ins and applications. Clicking such links or enabling connections may allow third parties to collect or share data. We do not control third-party websites and are not responsible for their privacy policies. After leaving our website, we recommend that you read the privacy policy of every website you visit.

2. What personal data we collect and when

We collect only data that are appropriate and necessary for specified processing purposes. The scope of the data depends on how the Services are used, in particular whether a person visits the website, contacts us, attends a trial training session, enters into a membership agreement, makes payments, uses the club or participates in an event.

Depending on the particular Service, the data may include, in particular:

·       identification data, including first name and surname and, where justified by the particular service, date of birth or address. As a rule, a PESEL identification number is not necessary to purchase a standard membership; it may be collected only in a specific case where there is a concrete, legally justified and necessary reason for doing so, of which the person will be appropriately informed;

·       contact details, including email address, telephone number and correspondence address;

·       account and authentication data, including username, account identifier and information used to secure access;

·       payment data to the extent made available to the Controller by the payment solution in use, including bank account number, transaction identifier and payment history;

·       data of a parent, legal guardian or other authorised person, where needed to provide the Services;

·       images captured by video surveillance and, where genuinely necessary for a particular service, photographs supplied for that purpose. Standard entry control at the club does not use biometric facial identification;

·       data relating to the use of the club and Services, including the type and duration of the agreement, membership number, entry history, date and time of visits, class bookings and attendance, access to additional services and purchase history;

·       data provided in correspondence, complaints, contact forms, questionnaires or other submissions;

·       technical and usage data, including IP address, connection date and time, browser and device type, operating system, language settings, referring page, request status and system log data.

We obtain data primarily directly from the data subject or from their parent or legal guardian. Some data are also generated when the Services, access control system, website or other systems of the Controller are used. Where applicable, we may receive data from a partner providing access to the club or another entity authorised to disclose them. If data have not been obtained directly from the person concerned, we provide the information required by Article 14 GDPR unless a statutory exception applies.

3. Special categories of personal data

Entering into and performing a standard fitness services agreement does not, as a rule, require the disclosure of health information. If, in connection with a particular service or matter, we receive information belonging to special categories of data, including health data, we process it only to the extent necessary, after establishing both a suitable legal basis under Article 6 GDPR and a condition under Article 9(2) GDPR. We do not use such information for routine marketing profiling.

Where the applicable condition under Article 9(2) GDPR is explicit consent (point (a)), the person may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. In exceptional circumstances, other conditions specified in Article 9(2) GDPR may also apply, including protection of the vital interests of a person who is incapable of giving consent (point (c)), or the establishment, exercise or defence of legal claims (point (f)), provided that their statutory requirements are met.

4. Children's privacy

We process children's data only to the extent necessary to organise and deliver Services intended for them, taking into account the role of a parent or legal guardian and the applicable law. Where Article 8 GDPR applies in a specific case involving an information society service offered directly to a child and processing based on consent, we verify who is entitled to give the required consent. This does not mean that every agreement for a minor's use of a club is subject to Article 8 GDPR.

If we become aware that a child has provided us with personal data in breach of this Policy or applicable law, please contact us at bluecity@sportlife.pl.

5. Purposes and legal bases of processing

For each processing operation, we identify its purpose and an appropriate legal basis. Data are used only to the extent necessary for that purpose and in accordance with the principles of lawfulness, fairness, transparency, data minimisation and purpose limitation.

Entering into and performing an agreement or taking steps before entering into it - Article 6(1)(b) GDPR

On this basis, we process data necessary for registration, conclusion and performance of a membership agreement, account administration, enabling entry to the club and use of the Services, class registration, payment processing, communications relating to performance of the agreement, and steps taken at a person's request before entering into an agreement, including trial training, a visit or presentation of an offer.

Compliance with legal obligations - Article 6(1)(c) GDPR

We process data to the extent necessary to comply with obligations arising under the law, in particular tax, accounting and consumer protection laws and obligations towards competent authorities. Data are processed only to the extent required by the specific legal obligation.

Legitimate interests - Article 6(1)(f) GDPR

We may process data where necessary for the purposes of a legitimate interest pursued by the Controller or a third party, in particular in order to:

·       prevent fraud, abuse, theft and other incidents that threaten persons, property or safety;

·       ensure the security of IT systems, keep logs, detect errors and incidents, and protect against unauthorised access;

·       handle complaints, conduct correspondence, assess satisfaction and improve the quality of the Services;

·       carry out analyses and statistics related to the delivery of the Services and optimise our offering, to an extent proportionate to the purpose; the use of analytical technologies that store or access information on a device and for which consent is required is subject to the separate requirements of Article 399 of the Polish Electronic Communications Law;

·       perform internal administration and organise business processes;

·       establish, exercise or defend legal claims and preserve evidence;

·       use video surveillance within the scope described in section 6 of this Policy;

·       market our own products or services to the extent permitted by the GDPR, provided that sending commercial information, including direct marketing, by means covered by Article 398 of the Polish Electronic Communications Law requires the prior consent of the subscriber or end user where that provision applies;

Where processing is based on Article 6(1)(f) GDPR, before starting it we assess the existence of a legitimate interest, the necessity of processing and its impact on the rights and freedoms of the data subject. The person has the right to object under the conditions described in section 11.

Protection of vital interests - Article 6(1)(d) GDPR

In exceptional emergencies, we may process data where it is genuinely necessary to protect the life or health of the data subject or another natural person and another legal basis cannot be applied or would not be sufficient.

Consent - Article 6(1)(a) GDPR

Where consent is the legal basis for processing personal data, we request it freely, specifically, on an informed basis and unambiguously. Consents to receiving commercial information through the relevant communication channels, where required under Article 398 of the Polish Electronic Communications Law, and consents to optional cookies or similar technologies are collected separately, according to their respective scopes. Refusal to consent to marketing or optional technologies does not prevent use of the core Services. We enable withdrawal of consent and document its granting or withdrawal to the extent required by the accountability principle.

Contact forms, email and other enquiries

We use data provided in a contact form, email or other submission to handle the enquiry. Where the contact relates to entering into or performing an agreement, the legal basis is Article 6(1)(b) GDPR; otherwise the basis may be Article 6(1)(f) GDPR, namely the legitimate interest in conducting correspondence, handling enquiries and preventing abuse. Technical data related to submitting a form may be processed for system security purposes.

Recruitment

If we allow job applications to be submitted, we process applicants' data to the extent required or permitted by labour law and for the purposes of the recruitment process. Data beyond the scope required by law are processed on the basis of voluntary consent where that is the appropriate basis. Further use of data for future recruitment is permitted only where a separate legal basis exists, in particular appropriate consent.

Personalisation, profiling and automated decisions

Within the limits of the applicable legal bases, we may segment audiences and analyse use of the Services, including, where required consent has been obtained, using analytics and tailored advertising on the website. We do not make decisions based solely on automated processing which produce legal effects concerning an individual or similarly significantly affect them within the meaning of Article 22(1) GDPR. If such a process were introduced, we would provide the appropriate information and safeguards required by law. An objection to processing for direct marketing purposes is effective without the need to demonstrate any particular circumstances.

Consequences of not providing data

Providing data necessary to enter into or perform an agreement is voluntary, but without such data it may not be possible to enter into the agreement or provide a particular Service. Providing data processed on the basis of consent, in particular for marketing or optional cookies, is voluntary, and withholding consent does not affect the possibility of using the core Services, except for functions that technically require the relevant information.

6. Video surveillance

Video surveillance is used in selected areas of the club to protect persons and property and to investigate incidents that threaten safety. As regards customers and visitors, the legal basis is the Controller's legitimate interest (Article 6(1)(f) GDPR), subject to an assessment of necessity and proportionality. To the extent that surveillance covers employees, we also take account of the specific requirements of Article 22² of the Polish Labour Code.

Areas covered by surveillance

·       the club entrance area;

·       selected parts of the training area.

Storage and access

Recordings are stored using appropriate technical and organisational measures to protect against unauthorised access. Recordings are accessed only where necessary to investigate incidents, establish, exercise or defend claims, or comply with legal obligations. Access to data is restricted to authorised persons.

Surveillance is limited to clearly defined and marked areas, to the extent necessary for the stated purposes. It does not cover changing rooms, toilets, showers or other rooms intended for activities of a particularly private nature. Camera placement is assessed for necessity, proportionality and data minimisation; we do not use surveillance for routine assessment of staff performance.

Areas under surveillance are marked so that a person can review the relevant information before entering the cameras' field of view. Detailed rules for employee surveillance, including the required notices and retention periods, are established and communicated in accordance with the Polish Labour Code.

Recipients of surveillance data

Recordings may be disclosed only to authorised recipients and only to the extent justified by the circumstances, in particular to:

·       law enforcement agencies and other competent authorities;

·       courts, where the recordings are relevant as evidence;

·       insurers in connection with claims handling;

·       lawyers and other authorised entities for the purposes of establishing, exercising or defending claims;

·       injured parties or witnesses to the extent necessary for pursuing legitimate claims and permitted by law.

Retention period

Unless a recording needs to be preserved in connection with a specific incident, recordings are automatically deleted after 72 hours. If a recording is preserved as evidence or for pursuing claims, it may be retained for the period necessary for that purpose.

7. Recipients and disclosure of personal data

We disclose data only where necessary for a specified purpose and where there is an appropriate legal basis. The scope of data disclosed to a recipient is limited to what is needed for the relevant process.

Categories of recipients

Recipients of data may include, in particular:

·       internal departments and authorised personnel involved in customer service, accounting, finance, security, IT, marketing or legal support;

·       providers of IT, hosting, communications, analytics, maintenance and customer support services, where they act on behalf of the Controller under Article 28 GDPR;

·       payment service providers, banks and other parties involved in payment processing, depending on their legal role;

·       law firms, advisers, auditors, accountants, insurers and entities supporting the establishment, exercise or defence of claims;

·       debt collection service providers where the data disclosure is lawful and necessary;

·       partners, affiliated entities or co-organisers of services and events, where necessary to deliver the relevant service and the person has been appropriately informed;

·       courts, law enforcement agencies, public authorities and other entities authorised under applicable law.

Processors acting on our behalf operate only on documented instructions and under appropriate agreements. Where a recipient acts as an independent controller or joint controller, we determine the allocation of responsibilities and information obligations in accordance with the GDPR.

Ownership changes and reorganisations

In the event of a sale, merger, reorganisation, financing or transfer of all or part of the business, data may be disclosed to the extent necessary to prepare and carry out the transaction, subject to measures restricting access and compliance with data protection law.

Transfers of data outside the EEA

Where personal data are transferred outside the European Economic Area, we apply an appropriate mechanism under Chapter V GDPR. Depending on the recipient and country, this may be a European Commission adequacy decision, including the EU–U.S. Data Privacy Framework in respect of US entities actually covered by that mechanism, or Standard Contractual Clauses together with supplementary safeguards where required. Information about the specific safeguards used for a particular transfer and how to obtain a copy is available from the Controller.

8. Data security and accountability

We implement technical and organisational measures appropriate to the risks, nature of data, scope and purposes of processing. These include, in particular, restricting access on a need-to-know basis, managing permissions, confidentiality obligations, safe use of systems, protection against unauthorised access, incident response procedures and periodic reviews of the adequacy of safeguards. When designing new processes, we apply the principles of data protection by design and by default under Article 25 GDPR.

Only persons who need data to perform their duties are granted access. In the event of a personal data breach, we follow procedures that allow us to assess the risk, document the incident and, where required by law, notify the President of the Personal Data Protection Office and the affected data subjects.

9. Specific rules for health data

Health information is not ordinarily required to enter into a standard membership agreement. If a customer voluntarily provides such information, for example in connection with an individual request regarding the provision of services or a complaint, we determine whether processing is genuinely necessary, for which specific purpose, and on which legal basis under Article 6 and condition under Article 9(2) GDPR it may take place. Where there is no suitable legal basis, we restrict any further use of such data.

Access to health data is limited to persons who need it for the relevant purpose, and disclosure to a third party requires a separate legal basis. We do not use health data for direct marketing or infer health conditions merely from visit history. Where the legal basis is explicit consent, it may be withdrawn without affecting the lawfulness of previous processing.

The rights described in section 11 of this Policy apply to health data, subject to the exceptions and limitations provided for in the GDPR and other applicable laws.

10. Data retention periods

We keep personal data no longer than necessary for the purposes for which they were collected, taking account of legal obligations and accountability. Where a specific period is not stated for a particular category of data, we apply the criteria described below.

·       data necessary to enter into and perform an agreement - for the duration of the agreement and subsequently for the period necessary to meet legal obligations and until the relevant limitation periods for claims have expired;

·       data concerning trial training, visits, contact forms or other enquiries - until the matter has been dealt with and subsequently, to the extent necessary, until the limitation period for potential claims expires;

·       data concerning club entry history, class reservations and delivery of Services - during the agreement and for the period necessary to handle related accounts, complaints or claims; once the purpose ends, they are deleted or anonymised unless there is a separate basis for retaining them;

·       data processed to comply with a legal obligation - for the period specified by the relevant laws, in particular tax and accounting laws;

·       data used for marketing based on consent - until consent is withdrawn or the purpose ceases earlier; limited data required to demonstrate the granting or withdrawal of consent and to honour objections may be stored for the period necessary to demonstrate compliance and prevent unwanted communications from being sent again;

·       data processed on the basis of legitimate interests - until a valid objection or earlier cessation of that interest, except for data necessary to establish, exercise or defend legal claims;

·       job applicant data - until completion of the relevant recruitment process, and longer only if there is a separate legal basis, in particular consent to participate in future recruitment or a need to defend claims;

·       technical data and logs - for a period justified by the nature of the particular system and the need for security, diagnostics and incident protection, in accordance with the retention rules adopted for that system; once these needs cease, the data are deleted or anonymised;

·       video surveillance recordings - in accordance with section 6, generally 72 hours, unless a recording has been preserved for a specific legal purpose;

·       information associated with cookies and similar technologies - for the operational period of each technology stated in the current list available through the consent management mechanism, subject to the right to withdraw consent; personal data associated with such technologies are retained in accordance with the purposes and legal bases of their processing.

After the applicable period, data are deleted or anonymised or, where there is a basis for further storage, segregated and used solely for the purpose justifying further retention.

11. Rights of data subjects

Data subjects have the rights set out in the GDPR to the extent and under the conditions provided for in that Regulation.

Access, rectification and erasure

You may request access to your data, obtain a copy, have inaccurate data corrected or incomplete data supplemented, and request erasure where the conditions set out in the GDPR are met. Some data may continue to be retained where necessary to comply with a legal obligation, establish, exercise or defend claims, or prevent abuse.

Objection

You may object to processing based on legitimate interests for reasons relating to your particular situation. You may also object at any time to the processing of data for direct marketing purposes.

Restriction of processing

You may request restriction of processing in the circumstances provided for in the GDPR, in particular where you contest the accuracy of data, processing is unlawful, the data are required to establish, exercise or defend legal claims, or an objection has been lodged and the assessment of overriding legitimate grounds for processing is pending.

Data portability

Where processing is automated and is based on consent or a contract, you may receive the data you provided to the Controller in a structured, commonly used and machine-readable format and, where technically feasible, request their transmission to another controller.

Withdrawal of consent

Where processing is based on consent, you may withdraw it at any time as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal or processing based on other legal grounds.

Complaint to the supervisory authority

You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if you believe that the processing of your personal data infringes the GDPR. Current information on how to submit a complaint is available at uodo.gov.pl.

To exercise your rights, contact us at bluecity@sportlife.pl or by post at our registered office address. As a rule, exercising your rights is free of charge. If a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act, in accordance with the GDPR.

We may ask for information necessary to verify identity and protect data against disclosure to unauthorised persons. We respond to requests within the time limits set by the GDPR, generally within one month, subject to extensions in the cases provided for by law.

12. Cookies

The website uses technologies necessary to deliver requested functions and ensure security. In addition, after obtaining appropriate consent where required, it may use cookies, browser local storage, pixels and similar solutions (collectively, "Technologies") for functional, analytical or marketing purposes. To the extent that such information constitutes personal data, the applicable provisions of the GDPR also apply.

Types of cookies

We categorise Technologies according to their purpose, rather than solely by cookie name or provider:

Strictly necessary cookies

Technologies necessary for operating the website, maintaining security, providing a requested function and remembering consent preferences. They do not require separate consent only where the conditions for the exception under Article 399(3) of the Polish Electronic Communications Law are met.

Analytical cookies

They may be used to measure visits, the use of features and navigation around the website. If they store or access information on a device and no statutory exception applies, they are activated only after appropriate consent has been obtained.

Functional cookies

They allow additional preferences, which are not necessary for the website's basic operation, to be remembered. Where no statutory exception applies, their use requires the user's prior consent.

Advertising, tracking or targeting cookies

They may be used to measure advertising effectiveness, create audience groups and display tailored messages with the participation of external providers. Technologies requiring consent are activated only after it has been obtained.

Consent management: users may reject optional Technologies, accept them or select specific categories. Rejecting is as easy as accepting. A tool is available on the website to change preferences or withdraw consent. Merely continuing to use the website or closing the cookie notice does not constitute consent to optional Technologies.

Storing information on, or accessing information from, a terminal device is governed by Article 399 of the Act of 12 July 2024 - the Polish Electronic Communications Law. Technologies not covered by a statutory exception require prior information and consent before they are activated. Under the GDPR, processing of personal data may be based, as appropriate, on consent (Article 6(1)(a)) or another applicable legal basis, depending on the specific purpose.

Consent to optional Technologies does not constitute consent to receiving marketing messages by email, SMS or telephone. The consents required for marketing communications are obtained separately in accordance with Article 398 of the Polish Electronic Communications Law. Withdrawal of consent to Technologies does not affect the lawfulness of processing that took place before withdrawal.

The rules described apply to the website at https://sportlife.pl and its subpages to the extent that SPORTLIFE BC is the Controller. Other applications or websites may use their own technologies and provide separate privacy notices.

A detailed and up-to-date list of the Technologies in use, including their names, providers, specific purposes, categories and retention periods, is available in the website's consent management tool. Further information can be obtained by contacting the Controller at bluecity@sportlife.pl.

Session Technologies generally expire at the end of a session. Persistent Technologies remain on the device for the period specified for the particular tool or until earlier deletion; specific periods are given in the current list of Technologies. Users may also manage them through browser settings.

13. Updates to the Policy

This Policy may be updated periodically in response to changes in the Services, technologies, processing methods or applicable law. The updated version will be published on the website. If the Controller intends to further process data for a purpose other than the one for which they were collected, it will provide the information required by Article 13(3) or Article 14(4) GDPR, as applicable, before starting such processing.

This Policy and SPORTLIFE BC's processing of personal data are governed by the GDPR, the Polish Act of 10 May 2018 on Personal Data Protection, the relevant provisions of the Polish Electronic Communications Law and other applicable Polish and European Union law.

14. How to contact us

For questions, requests or complaints concerning this Policy or the processing of personal data, please contact:

·       SPORTLIFE BC sp. z o.o., ul. Adama Naruszewicza 27, 02-627 Warsaw, Republic of Poland;

·       email: bluecity@sportlife.pl;

·       website: https://sportlife.pl/.