Try for free
EN
DATA PRIVACY

Privacy policy

for members and visitors

Last updated

1. Who processes your data

Your membership is managed by the gym where you are a member (the ‘Gym’). The Gym is the controller of your personal data: it decides why and how the data is processed.

The Gym uses InoGym software, maintained on its behalf and instructions by Luka Božić and Nikola Stanojević (the ‘Service Provider’ or ‘we’), acting as processor. We process data solely to enable the Gym to use the software.

When you visit inogym.net, send an enquiry or subscribe to updates, Luka Božić and Nikola Stanojević are the controllers of data generated by that use. Your Gym is not involved in that processing.

For questions about your data, contact your Gym first. You can also contact us at: privatnost@inogym.net

2. What data we process

Data entered by you or Gym staff

  • full name, email address and date of birth (required); phone number (optional);
  • member photo (optional; see section 4);
  • membership and payment data — payment methods are recorded as ‘cash’, ‘card’ or ‘bank transfer’. We do not process payment card numbers, CVV codes or payment intermediary data;
  • visit and usage history (check-ins), session/class bookings;
  • any staff notes and documents attached to your profile by the Gym.

Data generated through use

  • account and login data (encrypted password, never in readable form; email verification status; login time);
  • technical session and notification device data (such as device model and encrypted push notification token);
  • dropout risk estimates (internal analytical indicators derived from your activity).

Marketing website visitor data

  • data submitted through the demo/contact form: full name, gym name, email, phone and optional message;
  • the email address entered to subscribe to InoGym updates;
  • technical and analytical data described in section 6, only if you accept analytics cookies.

3. Why we process data (purposes and legal basis)

We process data for:

  • managing memberships, fees and payment records;
  • entry control (QR codes / visit records);
  • notifications about memberships, sessions and activities;
  • estimating occupancy and dropout risk to improve Gym operations;
  • meeting the Gym's legal obligations (such as accounting).

The Gym, as controller, determines the legal basis: membership contract, legal obligation, legitimate interest or your consent, for example for a photo or in-app analytics.

On the marketing website, we process enquiry data to answer your request and take steps before a potential contract, newsletter email addresses based on your subscription, and Google Analytics data solely with your consent. Necessary cookies support website operation, language preference and your analytics choice.

4. Member photo

A photo is optional and used solely for visual identification at reception: staff compare the person with the image on screen at entry.

  • We do not use facial recognition or any biometric analysis.
  • Metadata, including EXIF location/GPS data, is removed from uploaded images during processing.
  • Photos are stored privately and accessible only through short-lived authorised links lasting no more than five minutes; they are never publicly available.
  • You upload the photo, or staff upload it with your consent. You cannot change it yourself afterwards; Gym staff can remove it.

5. Mobile app analytics

The mobile app may use PostHog analytics, with EU servers, only with your consent. Analytics is off by default.

If you enable it, the following are processed:

  • a pseudonymous identifier that contains no name, email or phone number but is not fully anonymous;
  • technical device data: model, manufacturer, operating system, app version, language and time zone;
  • usage data, such as screens opened and successful or failed actions;
  • IP address, received automatically by the analytics service.

We do not record screens, use surveys or automatically capture content errors. You can withdraw consent in app settings.

6. Marketing website analytics and cookies

The website uses necessary cookies for basic functions and analytics cookies enabled only with your explicit consent. Refusing analytics does not affect access to the website, forms or content.

Necessary cookies

  • inogym_locale — remembers your chosen market and language version for up to 12 months;
  • inogym_cookie_consent — remembers whether you accepted or rejected analytics for up to 12 months.

Google Analytics 4

We use Google Analytics 4, measurement ID G-RDFGXYD873, to understand website traffic and improve content. The Google tag is not loaded and analytics cookies are not set until you choose ‘Accept analytics’.

  • data may include pages viewed, visit time and approximate duration, navigation and content interactions, referral source, approximate location, device type, operating system and browser;
  • Google automatically receives IP addresses for routing, security and approximate location; raw IP addresses are not available to us in Google Analytics reports;
  • _ga — distinguishes visitors; our configuration limits its duration to 12 months;
  • _ga_RDFGXYD873 — stores session state; our configuration limits its duration to 12 months.

Google Consent Mode is configured with advertising storage and processing, ad personalisation and Google signals disabled. We do not use this implementation for personalised advertising or intentionally send form entries to Google Analytics.

You can change your choice at any time using ‘Cookie settings’ in the footer. Withdrawing consent stops analytics processing and we attempt to remove existing Google Analytics cookies from your device. Withdrawal does not affect the lawfulness of earlier processing.

More about Google's data processing: Google Privacy Policy

7. Push notifications

If you allow notifications, your device receives a token stored in encrypted form and used to send notifications through Expo. You can disable notifications in the app or device settings.

8. Who receives data (processors and subprocessors)

We use trusted third parties to process data on our or the Gym's behalf. The current list is in the Subprocessors appendix. In brief:

  • hosting and backups (EU servers);
  • email delivery (ZeptoMail/Zoho, EU);
  • analytics (PostHog, EU, with consent only);
  • marketing website analytics (Google Analytics, with consent only);
  • protection of contact and newsletter forms from automated abuse (Cloudflare Turnstile);
  • mobile app notifications and technical services (Expo).

Some services, such as Expo and Google Analytics, may process certain technical data outside the EU; see section 10. We do not sell data or share it for third-party marketing.

9. How long we retain data

  • We retain active membership data while you are a member, and financial data for as long as accounting regulations require.
  • Technical data (sessions, one-time tokens, revoked notification tokens) is deleted or pseudonymised within short periods, from a few hours to 30 days after expiry.
  • Short-lived security data (QR codes, password reset codes, temporary passwords) remains valid from a few seconds to seven days.
  • We retain demo/contact enquiries for as long as needed to respond and maintain business communication, and newsletter addresses until you unsubscribe or withdraw your registration.
  • Necessary and Google Analytics cookies are limited to 12 months. Google Analytics data retention follows our account settings and Google's policies; aggregate reports may be retained longer.

10. Data transfers outside the EU

Most processing takes place in the EU. Certain technical services, particularly Expo and Google Analytics, may process technical data such as IP addresses and device data outside Serbia, Bosnia and Herzegovina or the EU, under contractual and other safeguards applied by their providers.

11. Your rights

You have rights of access, rectification, erasure, restriction of processing, objection and data portability, and the right to withdraw consent.

Address requests primarily to your Gym, the controller. On request, the Gym initiates deletion that removes or pseudonymises personal data: name, email, phone, photo and notes. Some data, such as financial records, pseudonymised visit history and audit records, may be retained with a legal basis or legitimate interest. Backups may temporarily contain earlier data until expiry, for no more than 12 months.

You can submit a complaint to a supervisory authority:

Serbia: Commissioner for Information of Public Importance and Personal Data Protection.

Bosnia and Herzegovina: Personal Data Protection Agency (AZLP).

12. Security

We apply technical and organisational measures: encrypted transfer (HTTPS/TLS), encrypted passwords and sensitive tokens, strict isolation between gyms, role-based access, mandatory two-factor authentication for system administrators and encrypted backups.

13. Changes

We may update this policy; each new version is published with a date. The new version will be published on the website and users will be notified by email at the address they registered, as described in the new policy version.