Privacy policy

Last updated: 15 November 2026.

1. Controller The controller of personal data on gym.com.hr is the site operator ("we"). For any question about personal data or to exercise your rights, write to info@gym.com.hr.

2. What we process and why - Account: email address, display name, chosen language and, if you sign in with Google, your Google account identifier. Purpose: sign-in and account management. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). - Reviews and ratings: review text, ratings, date and display name (shown abbreviated, e.g. "Ivan H."). Purpose: publishing user reviews of gyms and trainers. Legal basis: contract and our legitimate interest (Art. 6(1)(f)) in a reliable directory. - Advertising orders: billing details (name, address, tax ID if you enter it), amount, payment status. Purpose: processing orders and meeting statutory accounting duties. Legal basis: contract and legal obligation (Art. 6(1)(b), (c)). - Enquiries and content reports: your message and email if provided. Purpose: replying and moderation. Legal basis: legitimate interest. - Technical data: IP address and server logs, used only for security, abuse prevention and rate limiting. Legal basis: legitimate interest (service security). - Statistics: we count page views and clicks per gym or trainer, without personal identifiers and without tracking individuals.

3. Location We use your device's precise location only if you explicitly allow it after clicking the relevant button, and only to show nearby gyms. Coordinates are not stored. We may suggest an approximate city from data supplied by our network infrastructure (country and city of the request), without storing it. Your chosen city is remembered in a cookie for 180 days.

4. Cookies We only use strictly necessary cookies: the sign-in session and your chosen city. We use no advertising cookies and no third-party analytics, so consent is not required. See the "Cookies" page.

5. Recipients and processors - Cloudflare, Inc. and group companies (hosting, database, network protection, email sending, bot protection via Turnstile). Data may be processed outside the EEA under appropriate safeguards (standard contractual clauses / EU–US Data Privacy Framework). - Google LLC, only if you choose to sign in with Google. We do not sell your data or share it with third parties for marketing.

6. Retention We keep your account and reviews until you delete your account or ask for erasure. Order records are kept as long as accounting law requires. Security logs are kept briefly and deleted automatically.

7. Your rights You have the right of access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interest. You can export your data and delete your account in your account settings. Send requests to info@gym.com.hr; we reply within one month. You may also lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr.

8. Security and changes We apply technical and organisational safeguards (encrypted transport, access control, rate limiting). We will announce material changes to this policy on this page.