Effective from: 14 December 2025

IMPORTANT INFORMATION

CityFit’s mission is to provide members with the widest possible range of opportunities to develop their passion for sport. That is why we have launched the CityFit mobile app, which allows members to, amongst other things, manage their membership, purchase passes, book fitness classes and personal training sessions, purchase additional products such as a Medicover medical package, and take advantage of loyalty schemes and discounts (hereinafter collectively referred to as „Services”). At the same time, whilst providing you with our Services, we remain committed to protecting your privacy; therefore, we have set out our Privacy Policy below, which describes how we collect and process Personal Data via our app.

We encourage you to read this Privacy Policy, as well as our Terms and Conditions [https://cityfit.pl/regulamin/] (hereinafter referred to as „Terms and Conditions”).

BY DOWNLOADING, INSTALLING AND USING THE APPLICATION, YOU CONSENT TO THE COLLECTION, USING AND TRANSFERRING YOUR PERSONAL DATA FOR THE PURPOSES OF PROCESSING AS DESCRIBED IN THIS PRIVACY POLICY. If you choose not to provide us with your personal data, you will not be able to make full use of our Services.

Who we are

We are CityFit Membership sp. z o.o., with its registered office in Warsaw at ul. Jana Pawła II 27, 00-867, one of the companies in the CityFit Group. We provide Services via a mobile app linked to our website www.cityfit.pl („Mobile app”). In addition, the App may link to other websites dedicated to current competitions, promotional campaigns or special offers.

Information about your personal data

This Privacy Policy relates to data concerning you, your devices and your interactions with our Services.

„Personal data” refers to information that can be used to identify you, either directly or indirectly, on its own or in combination with other information. This most commonly includes data such as your first name and surname, email address, telephone number, precise location, device identifiers, certain cookies and network identifiers, contacts, fitness data and performance history.

CityFit collects, uses and processes personal data in accordance with this Privacy Policy, for the purpose of providing, operating and improving the Services, including to provide you with innovative fitness services, for advertising and marketing purposes, to enable you to take part in competitions and promotional campaigns, and to purchase specific third-party products, as described in this Privacy Policy. Separately, information regarding CityFit’s processing of personal data without the use of the mobile app can be found in the Terms and Conditions.

In the course of providing the Services to you, we may generate personal data which is subsequently anonymised by removing data elements (such as your full name, email address or a linked identifier that enables tracking) that allow you to be identified, or by using other anonymisation techniques. Our use of anonymised data is not subject to this Privacy Policy.

How do we collect and use personal data?

We collect your personal data in various ways and for various purposes, including:

1. When you register for an account or interact with our Services.
2. When you enter data relating to your physical fitness into our Services, or when you use Services that collect or infer such data based on sensors in mobile devices.
3. When you use or interact with a wearable device or other connected device.
4. When you consent to the collection of location data using your device’s features.
5. When you contact us or sign up to receive promotional material.
6. When you take part in special classes, offers or programmes.
7. When you interact with our online communities on social media platforms (Facebook) or view an advert displayed by us.
8. When you access products and services provided by third parties.
9. When you connect with us via social media (by logging in using third-party accounts).
10. When we use cookies, device identifiers, QR codes, your location and data from your device’s operating system.
11. When we monitor your activity in the CityFit shop.
12. When you use the features of the mobile app and connect with friends on various external platforms, you send them information from the mobile app.
13. When we present you with special rewards for specific activities at CityFit clubs.
14. When we act in accordance with the requirements imposed on us by applicable legislation (tax obligations, archiving requirements, the rights of judicial authorities, etc.).

Identifiers

Our mobile apps and services may provide us with device identifiers and location data. Device identifiers include identifiers associated with mobile device hardware, such as IMEI numbers, platform-specific identifiers such as Android ID, Google AID or Apple’s IDFA; as well as identifiers that are part of the device’s hardware, such as the Wi-Fi MAC address and serial number. The exact details of which device identifiers are transmitted may depend on your mobile device’s platform and operating system version. Location data, in turn, can be obtained from GPS services, based on triangulation of mobile phone masts or the known locations of nearby Wi-Fi access points. In addition, to manage entry to our clubs, we use alphanumeric, two-dimensional graphic codes (QR codes).

We may use identifiers for strictly necessary purposes: to provide the Services, to improve our App and carry out analyses, and to display adverts based on your interests.

How do we share personal data?

We may share your personal data with specific entities for the purposes described above:

1. To our companies within the CityFit Group.
2. Third parties with whom we collaborate in order to provide you with Services, such as technical infrastructure providers, application administrators, marketing service providers, or Medicover, which offers you healthcare packages.
3. Operators of social media platforms such as Facebook, Inc.
4. To other individuals, at your request, when you share, for example, your fitness test results.
5. Entities responsible for displaying adverts on the mobile app, including adverts based on your interests.
6. Entities that provide tools for analysing how you use the mobile app.
7. To state authorities for the purposes of complying with the law, enforcing the law and promoting public safety.

In order to ensure the Services are provided as effectively as possible, some of our Partners are based in countries outside the European Economic Area, where the level of personal data protection may not be comparable to that in the European Union (the USA). In such cases, however, we enter into appropriate agreements with our partners and include in them the Standard Contractual Clauses approved by the Commission: https://ec.europa.eu/info/law/law-topic/dataprotection/data-transfers-outside-eu/model-contracts-transfer-personal-data-to-third-countries_en and, in order to protect your rights and freedoms, we may apply additional safeguards set out in the guidelines applicable to such data transfers.

Legal basis for data processing

For the purposes of the applicable data protection legislation, CityFit Membership sp. z o.o. is the data controller for the personal data you provide to us when using the mobile app („Data controller”). As the data controller, we process the personal data we hold about you in accordance with this Privacy Policy and applicable legislation. If you have any questions or concerns regarding the processing of personal data, or if you have any queries regarding this Privacy Policy, please contact our Data Protection Officer, Mr Jacek Grabowski, at the following email address: iod@cityfit.pl.

We process your personal data for various purposes set out in this Privacy Policy, often on grounds other than specific consent. Where consent is required, you will be asked to give it within the mobile app itself, via the website www.cityfit.pl or by other means. In other cases, the legal basis for the processing of your personal data is:

1. Provision of Services (performance of the Contract entered into with you).
2. Compliance with legal obligations.
3. Our legitimate interest.

Details in the context of the GDPR requirements:

When you register an account or interact with our Services, such processing is necessary for the provision of our Services (Article 6(1)(b) of the GDPR).

Once you have provided data relating to your physical fitness as part of our Services, if this data constitutes sensitive personal data (including health data and biometric data) as defined in the GDPR, we process this data on the basis of your prior consent (Article 9(2)(a) of the GDPR).

In the case of non-sensitive personal data that we require to provide the Services (QR codes, email addresses, etc.), such processing is necessary (Article 6(1)(b) of the GDPR).

With regard to other non-sensitive personal data, we process such data on the basis of our legitimate interest (Article 6(1)(f) of the GDPR), and our legitimate interest is to improve the Services we provide.

When collecting precise location data, following your consent, we process such data on the basis of your prior consent (Article 6(1)(a) of the GDPR).

If you contact us or register to receive promotional materials, we process such data on the basis of our legitimate interest (Article 6(1)(f) of the GDPR), and our legitimate interest is to provide you with our promotional communications. In the case of marketing using direct communication channels and the sending of unsolicited commercial communications, as well as targeted advertising, the legal basis is your consent (Article 6(1)(a) of the GDPR).

Where we use and/or collect cookies, device identifiers, contextual data and other tracking technologies, we process such data on the basis of your consent (Article 6(1)(a) of the GDPR) and on the basis of our legitimate interest (Article 6(1)(f) of the GDPR), in which case we do not seek your consent, and our legitimate interest is to provide you with better Services or marketing.

When monitoring your purchases in our shop, we process such data on the basis of our legitimate interest (Article 6(1)(f) of the GDPR), and our legitimate interest is to improve your shopping experience, as well as to prevent losses or criminal offences.

When we disclose Personal Data to affiliated entities, partners, service providers and vendors: where your consent is required by law in such cases, we process such data on the basis of your prior consent (Article 6(1)(a) of the GDPR). If there is no legal requirement to obtain your consent, in such cases, such processing is necessary for the provision of our Services (Article 6(1)(b) of the GDPR) or we process such data on the basis of our legitimate interest (Article 6(1)(f) of the GDPR), and our legitimate interest is to provide you with better Services and marketing.

When we carry out our legal obligations, we process data in accordance with the applicable legislation (Article 6(1)(c) of the GDPR).

Agreement

We may ask for your consent in the following circumstances: when checking your location; when carrying out marketing activities targeted at you via direct communication channels; when collecting sensitive data (health data); when profiling the content displayed to you; and when sending you commercial information.

You may withdraw your consent at any time with future effect and without affecting the lawfulness of the processing of your personal data based on the consent given prior to its withdrawal by contacting us at: iod@cityfit.pl.

Constitutional states

You have the following rights:

Right of access to your personal data (Article 15 of the GDPR): You have the right to ask us to confirm whether we are processing your personal data and to access your personal data and related information regarding such processing (e.g. the purposes of the processing or the categories of personal data).

Right to rectify personal data (Article 16 of the GDPR): You have the right to have your personal data rectified in accordance with the law.

Right to erasure (Article 17 of the GDPR): You have the right to request that we erase your Personal Data, in accordance with the law. This right may be exercised, amongst other things: (i) where your Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed; (ii) where you withdraw your consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) of the GDPR and there is no other legal basis for the processing; (iii) where you object to the processing of your data in accordance with Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or where you object to the processing of your data in accordance with Article 21(2) of the GDPR; or (iv) where your Personal Data has been processed unlawfully.

The right to restrict data processing (Article 18 of the GDPR): You have the right to request that we restrict our processing of your data in certain circumstances, including: where you contest the accuracy of your personal data; where the processing is unlawful and you object to the erasure of your personal data and request that its use be restricted instead; or where you object to the processing of your data in accordance with Article 21(1) of the GDPR, pending verification as to whether legitimate grounds override your interests.

Right to data portability (Article 20 of the GDPR): You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another controller, including direct transmission, where technically feasible. The first copy of the data is free of charge.

Right to object (Article 21 of the GDPR): You have the right to object to our processing of your personal data, in accordance with the law. This right is limited to the processing of data on the basis of Article 6(1)(e) or (f) of the GDPR and covers profiling on the basis of those provisions, as well as the processing of data for direct marketing purposes. After this time, we will no longer process your personal data, unless we are able to demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

You also have the right to contact the supervisory authority responsible for matters relating to personal data, which in Poland is the President of the Office for Personal Data Protection. You have the right to lodge a complaint with the supervisory authority.

Processing time

We will retain your Personal Data for as long as you use the App and/or hold a club membership, or for as long as is necessary to provide you with the Services. We will also retain your Personal Data where necessary to comply with our legal obligations, resolve disputes and enforce the agreements we have with you.

Should we no longer need to process your Personal Data for the purposes set out in this Privacy Policy, we will delete your Personal Data from our systems.

Where permitted, we will also delete your Personal Data at your request. You may make such a request by contacting us at iod@cityfit.pl.

Further details regarding processing times can be found in the Terms and Conditions.

Safety

We implement appropriate technical and organisational safeguards to protect against unauthorised or unlawful processing of Personal Data, and against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Please note that this Privacy Policy does not apply to the activities of organisations over which we have no control, or to individuals whom we do not employ or supervise. Our Services may contain links to, or otherwise provide access to, third-party websites. We provide these links solely for your convenience. Our Privacy Policy does not apply to third-party websites, and any data you provide on third-party websites is done so at your own risk. We encourage you to review the privacy policies of any third-party websites with which you interact.

Children

We do not knowingly collect Personal Data from children under the age of 16. If you become aware that a child has provided us with Personal Data without their parents’ consent, please contact us. If we become aware that a child under the age of thirteen has provided us with Personal Data without their parents’ consent, we will take steps to delete the data and close the child’s account.

How can you get in touch with us?

If you have any questions, comments or concerns regarding the way in which we handle your personal data, please contact us by sending an email to iod@cityfit.pl.