Privacy Policy

Version: 2026-10-12.v3. Information updated on 12 October 2026. This Policy covers the Fitibook website, customer app and processing on the platform.

1. Controller and contact

The controller for global customer accounts and operation of the platform is Kreokracja Piotr Dębowski, ul. Jaworowa 12/e, 32-020 Wieliczka, Poland, tax identification number (NIP) 6782805932 (the “Operator”). Contact: hello@fitibook.pl, telephone +48 507 018 061. No data protection officer has been appointed. Questions, data requests and consent withdrawal may be sent to this email or postal address.

2. Independent clubs and studios

A Business selected by the User is a separate controller where it determines how and why it manages its customers, classes, attendance, passes, balances and settlements. It is then responsible for its own privacy information and legal bases. Fitibook acts as a processor when performing operations solely on the Business’s documented instructions. A global account does not disclose its data to every Business: access relates to membership, a selected service or another User action at that Business and its staff permissions.

3. Categories and sources of data

We receive data from Users, their website and app activity, Businesses providing their services, and providers needed for payments, communications and security. The scope depends on the features used.

• Account and contact: first and last name, email, telephone, account identifier, language, account and verification status, recorded document versions and consent decisions.
• Optional profile: photo and date of birth. A date of birth may also be used for birthday greetings at a linked Business and can be removed in profile editing.
• Authentication and security: password hash, session identifiers and expiry, access tokens, sign-in attempts, IP address, browser or device information and security events. Staff and administrator accounts may also have multifactor authentication or passkey data.
• Service use and fitness activity: linked Businesses, bookings, waitlists, cancellations, attendance and absence records, passes, credits, balances, class participation, booking preferences and notes or recommendations shared in customer service.
• Sports cards: provider and product variant, custom label, saved final digits, preferred settlement method and verification or settlement data. Saving a card does not retrieve its full history from the card provider.
• Payments: order and transaction identifiers, Business, amount, currency, payment or refund status and time, linked booking or top-up and settlement events. Fitibook does not store full card numbers or CVV/CVC codes.
• Content and contact: reviews, photos, support requests, complaints, correspondence and service messages. Public reviews include the rating, text, date and author label shown in the interface; they should not contain other people’s private data.
• Notifications and diagnostics: a push token linked to an account or session, device platform and language, installation identifiers used by the push provider, notification content and status, message reads and operational or error logs needed to maintain the service.

Fitibook does not require medical records to create an account and does not currently integrate with Apple Health/HealthKit or Health Connect. Participation history describes fitness activity, not medical measurements. If a Business collects special-category health data, it is responsible for identifying the purpose, Article 9 GDPR condition and access rules. Do not unnecessarily provide such information in general profile fields, reviews or support requests.

4. Purposes and legal bases

Account operation, authentication, selected bookings, passes, settlements and service messages necessary to provide services rely on performance of a contract or pre-contractual steps under Article 6(1)(b) GDPR. Mandatory form fields support those features; not providing them may prevent registration or the order. Optional fields are not a condition for a basic booking.

Tax and accounting obligations, statutory requests and cooperation with competent authorities rely on Article 6(1)(c), to the extent the particular obligation applies to the Operator. Abuse prevention, security, diagnostics, ordinary enquiries, legal claims and necessary operational statistics rely on Article 6(1)(f). The Operator’s interests are maintaining a secure platform, investigating events and protecting rights while taking the User’s rights into account.

Optional marketing relies on appropriate consent under Article 6(1)(a), together with the required communication-channel consent. Withdrawal does not affect lawful processing before withdrawal. Reading this Policy is not blanket consent to all operations; accepting the Terms establishes the agreement and does not subscribe the User to a newsletter.

5. Newsletters, promotions and greetings

Contact details, first and last name and account identifier may be used for newsletters and promotions within the consent given. Registration, a purchase, providing a telephone number or granting system push permission alone does not permit unrestricted advertising. Refusing or withdrawing marketing consent does not prevent account access or bookings. To stop Operator marketing, contact hello@fitibook.pl, use an unsubscribe mechanism where provided, or use the same channel through which consent was given. For Business marketing, also contact that sender.

A voluntarily supplied date of birth may be used by a linked Business for birthday greetings if it enabled that feature. Removing it prevents further birthday determination from that field. Promotional greetings are subject to marketing requirements. Customer contact lists are not supplied to Meta or Google to create advertising audiences.

6. Notifications, permissions and on-device data

Push uses Google’s Firebase Cloud Messaging and, on Apple devices, Apple Push Notification service. These providers process installation and delivery identifiers and information needed to transmit messages. Fitibook links the push token to the account or session, platform and language to route the message. Content may appear on the lock screen according to device settings. Push can be disabled in app or system settings without deleting the account or bookings. Local reminders are scheduled on the device. Email supports verification, security and service events. SMSAPI delivers SMS codes for phone number verification, including customer registration. We provide the recipient phone number, code message and technical information needed for delivery. SMS messages are currently used only for verification, not marketing.

With system permission, location in the customer app calculates distance to clubs on the device. This feature does not send those coordinates to the Fitibook API or track movement in the background. A manually entered search location is a separate search parameter. Opening an external map or navigation service uses that provider’s service and privacy rules.

Selecting a profile photo shares the selected file with Fitibook, not the whole photo library. Adding a booking to the calendar passes that booking to the system editor; the app does not retrieve the entire calendar. Face ID or Touch ID provides an authentication result, not a face image, fingerprint or biometric template. Preferences, session data and some operational app data may be stored locally and removed through the relevant settings or app uninstallation; this does not delete the server account.

7. PayU payments

When starting payment, Fitibook sends PayU order data, amount, currency, identifiers, description and IP address needed to process and secure the transaction. Users provide further payment details on PayU’s or their chosen provider’s page. Fitibook receives payment and refund results and settlement data. PayU S.A. acts as a separate controller for its service, legal obligations and payment security. Its checkout privacy notice and https://poland.payu.com/prywatnosc/polityka-prywatnosci-payu/ explain processing and rights against PayU.

8. Recipients and transfers outside the EEA

Data is received by authorised Operator staff, the relevant Business and providers of hosting, file and backup storage, IT maintenance, email and notification delivery as needed for their tasks. Push providers include Google/Firebase and Apple; payment providers include PayU and the chosen payment-method provider. Recipients may also include authorised advisers and legally entitled authorities. Public reviews, photos and Business content are accessible to the audience of the relevant page or app.

A provider acting on instructions is subject to appropriate processing terms. Separate controllers, including a Business or PayU within their remit, are responsible for their own legal bases, obligations and retention. Global Google and Apple services and their subprocessors may process data outside the European Economic Area. Depending on the recipient and service, transfers rely on a valid adequacy decision or appropriate safeguards, particularly standard contractual clauses. Contact the Operator for recipient details, the applicable transfer basis and how to obtain a copy of safeguards. We do not state that all provider operations occur only in Poland or the EU.

9. Retention and account deletion

Profile data supports the account while it is active. After successful account deletion, access is disabled, sessions and related tokens are revoked or removed, and core profile data is deleted or replaced by a technical deleted-customer label. This includes the date of birth, review content, photo association and wallet data as handled by the deletion feature. Physical photo-file deletion uses a deletion queue and may be retried after an error.

Booking, settlement, payment, pass, required-document and audit history may remain under a technical identifier where needed to settle a service, fulfil an obligation or protect claims. This limits identification; it is not a promise of complete, immediate anonymisation of all events. Profile deletion does not automatically erase every financial record. Documentation remains until the relevant legal duty ends or limitation period expires, and, in a dispute, until its final resolution. Each Business is responsible for records it maintains for its own purposes.

Marketing data is used until consent is withdrawn or the purpose ends. Limited proof of consent, opt-out or objection may remain for accountability, legal claims and preventing unwanted repeat contact. Correspondence is retained while handling a matter and, where justified, for related legal-claim periods. Diagnostic and security data is retained to the extent and for the period needed to maintain the service, investigate incidents and preserve evidence; it is not intended for indefinite advertising profiling.

Backups rotate and may temporarily contain earlier data; they are not used for routine operation of a deleted account. Effective deletion and restriction requests must be reapplied on restoration before data returns to normal use. Independent controllers and providers delete data under their own applicable obligations and procedures. Contact the Operator about a particular category and basis for further retention.

10. Individual rights

Subject to GDPR, rights include access and a copy, correction, erasure, restriction, portability and consent withdrawal. Users may object to processing based on legitimate interests and object to direct marketing at any time. Send requests to hello@fitibook.pl or the Operator’s postal address. For a Business’s independent processing, also contact that Business; the Operator helps identify the responsible entity. Identity may be checked proportionately to risk without requesting a password by message.

We generally respond within one month. If complexity or the number of requests permits a lawful extension, we notify the User of it and its reason within that period. Complaints may be submitted to the President of the Polish Personal Data Protection Office, uodo.gov.pl. Account deletion can be initiated under Account in the app or at fitibook.pl/en/konto/usun. Withdrawing marketing consent does not require deleting the account.

11. Cookies, analytics and automated rules

The website uses necessary cookies and similar mechanisms for sessions, form protection, security and selected language or appearance. At this update, production settings do not activate Google Analytics 4, Google Tag Manager or Meta Pixel. The customer app version described here does not use Firebase Analytics or Crashlytics. Firebase for push is not an advertising audience list. Optional tracking requires advance information and the appropriate consent mechanism.

The system automatically applies availability, waitlist order and rules, booking conditions, cancellation deadlines and security controls. These rules perform the selected service and do not assess Users for employment, insurance or credit. The Operator does not perform cross-app advertising profiling or solely automated decisions concerning individuals within Article 22 GDPR. Incorrect results can be reported to the Business or Fitibook support.

12. Updates and security

We use encrypted connections, permission controls, separation of Business data, secure password storage, auditing and backups. Policy updates describe current operations and do not replace obtaining consent where required. Material changes in purposes, recipients or rules affecting Users’ rights are appropriately communicated before new processing begins. The current document and publication date are available on this page.

13. Fitibook Klub application details

This Policy also covers Fitibook Klub, the application for authorized Business staff. The Operator is the controller for staff-account security, platform operations and support. Each Business remains the controller of customer and staff data where it determines the purposes of processing; the Operator acts on its instructions as described in section 2.

The application uses the staff-account identifier, email address, role, permissions, session, authentication information and data needed to manage schedules and customers. Depending on permissions, it may display or record contact information, profiles, bookings, attendance, passes, balances, settlements, notes and instructor profiles. Operations are associated with the Business and the acting account. This does not provide access to all clubs.

The camera is used to scan a booking code after system permission is granted. Camera images are processed locally; Fitibook does not upload or store a photo or video of the scanned code. The decoded booking identifier is sent to the API to find the booking. Camera permission may be declined and the number entered manually.

Face ID and Touch ID use system mechanisms. The Operator does not receive biometric templates, face images or fingerprints. A saved session uses secure system storage; biometrics protects local unlocking. Additional staff sign-in verification uses the configured email code or authenticator application.

This Fitibook Klub release does not use Firebase Analytics, Crashlytics, advertising device identifiers, GPS location, HealthKit or Firebase push notifications. Customer-app functions described elsewhere in this Policy do not imply that the club app uses the same permissions.

The Contact form sends a name, email address, topic, message, language and the Fitibook Klub application label to Fitibook support. The information is used to handle the enquiry, prevent abuse and, where needed, defend claims on the grounds described in section 4. The form does not transmit staff passwords or session tokens. Requests concerning staff accounts and data may be directed to the relevant Business or hello@fitibook.pl; deleting a staff profile does not automatically erase business records that must lawfully be retained.

This also covers a facility address entered by staff, the recorded payment method, balance and payment history, and technical connection and security logs. The app does not ask staff to enter payment card numbers.