Privacy Policy
1. Who are we?
Gymies is a platform that connects personal trainers and clients. Gymies acts as the data controller within the meaning of the General Data Protection Regulation (AVG/GDPR) for the personal data processed through the Platform. Trade name: Gymies (trade name of MDJI Group) Business name: MDJI Group Legal form: Sole proprietorship (Eenmanszaak) Registered address: Karel Klinkenbergstraat 81-3, 1061 AJ Amsterdam, the Netherlands Chamber of Commerce number (KvK): 98545205 VAT identification number: NL005338010B46 Email address: gymiesapp@hotmail.com Website: https://www.gymies.nl Contact form: gymies.nl/contact Gymies has not appointed a Data Protection Officer (DPO/FG), as this is not legally required given the nature and scale of the data processing. For all privacy-related questions, you can contact us using the details above.
2. Scope of this policy
This Privacy Policy applies to all personal data that Gymies collects and processes through: a) the website gymies.nl and all subdomains; b) the mobile application "Gymies" (available via the Apple App Store and Google Play Store); c) email communication with Gymies; d) the contact form on the website; e) Gymies social media channels (where applicable). This policy applies to all Users of the Platform, both Clients and Trainers, as well as visitors who access the Platform without creating an Account.
3. What personal data do we collect?
Gymies collects and processes the following categories of personal data: a) Account data: name, email address, phone number, password (stored encrypted), profile photo (optional), city, language preference and (optional) your gender under "I am". We only use gender for the "Female trainer" filter and for Women only trainers, who train women only. For a Trainer we only share whether she is a woman; a Trainer never sees a Client's gender. b) Trainer profile data: in addition to the above, sports, the outcome of the certificate check per sport (we delete the certificate file itself after the check), description ("about me"), prices, availability, training location(s), photos and videos, Chamber of Commerce (KvK) details and bank details (IBAN) for payouts. c) Trainer verification data: the data and documents Gymies asks for in the verification process. We use these solely to verify who the trainer is; after approval the profile shows the label "Checked by Gymies". The app explains which details the trainer must make unreadable on a copy. As soon as Gymies has reviewed a document (approved or rejected), we delete the file. We only keep the fact that it was checked, when, and with what outcome. d) Booking data: date, time and location of Sessions, type of training, payment method and booking status (requested, confirmed, cancelled, completed, no-show). e) Payment data: transaction details, payment method (type, not the full card or account number), amounts, service fees, refunds and payouts. Payments themselves are processed by Mollie; Gymies does not store full card numbers. f) Communication data: chat messages between Clients and Trainers, support requests and email correspondence with Gymies. g) Training notes: Trainers can keep notes per Session in the client file (for example focus, progress and points of attention). By default a note is visible only to the Trainer; the Trainer can deliberately share a note with the Client. Only share health information with your Trainer that is needed for safe training. h) Intake preferences: goals, level and preferred times that the Client can optionally fill in to see more suitable Trainers. i) Location data: see Section 11a. j) Usage statistics (only with consent): which screens and features in the app are used. See Section 11b. k) Technical data: IP address, device type, operating system, app version, language setting, push token and error reports (crash reports). l) Waitlist data: email address and city of people who sign up for the waitlist of a region where Gymies is not yet open. m) Reviews: star ratings, review texts and Trainers' responses to them. n) Feedback: a private rating after a Session (stars, optional comment), a short reason when cancelling or rescheduling, and for Trainers a satisfaction score about Gymies. Private feedback is not public. The Trainer only sees it if you choose so, and a public review is only posted if you separately choose to. If you ask for help, we create a support request.
4. What do we use your data for?
Gymies processes your personal data for the following purposes: a) Account management and security: creating and securing your Account. After 14 days without activity you are logged out automatically; administrators after 7 days. b) Trainer verification: checking who the Trainer is before they become bookable and receive the label "Checked by Gymies". c) Search and matching: showing Trainers based on your location, filters and (optional) intake preferences, and ranking Trainers (see Section 10). We only show and book a Women only trainer for Clients who chose Woman under "I am" or have not chosen yet; booking requires "Woman". d) Bookings: processing, confirming, rescheduling and cancelling Sessions, including reminders in advance. e) Payments: processing payments, refunds and service fees, creating invoices and processing Trainer payouts to their registered bank account. Customer payments are processed via Mollie. f) Communication: chat between Client and Trainer, notifications about bookings and payments (push and email), and for Trainers a daily and weekly overview of their Sessions. g) Reminder to book again: if you have not trained for a few weeks and have nothing planned, you may receive a push notification to plan a new Session with your Trainer (at most once every 30 days). You can turn this off in the app under Settings. h) Customer service: answering questions, complaints and disputes. i) Improving the Platform: analysing usage statistics (only with your consent) and error reports, so we can fix errors. j) Security and fraud prevention: preventing and investigating fraud, abuse and violations of the Terms of Service. k) Marketing: newsletters and offers by email, only with your consent. l) Legal obligations: including tax retention obligations. m) Reviews: showing reviews to help other Users choose.
5. Legal basis for processing
Gymies processes personal data on the following legal bases (Article 6(1) GDPR): a) Performance of a contract: Account, bookings, payments, chat, booking notifications and reminders, and showing Trainer profiles. b) Consent: usage statistics in the app, use of your device's GPS location, push notifications (via your phone's permission) and marketing emails. You can withdraw consent at any time, in the app or via your phone's settings, without affecting earlier processing. c) Legitimate interest: security and fraud prevention, error reports to keep the app working, the ranking of Trainers, the reminder to book again (with an easy way to opt out) and handling disputes. We have weighed our interests against your privacy. d) Legal obligation: tax retention (7 years) and requests from supervisory authorities.
6. Sharing of personal data
Gymies shares your personal data only in the following cases: a) Between Client and Trainer: for a booking the Trainer sees your name, booking details and messages. Clients see Trainers' profile data, prices, reviews and the area where the Trainer trains. You only see the exact training address after a confirmed booking. b) Service providers working on our behalf (see Section 18), such as hosting, payments, email, push notifications and error reporting. c) Legal obligations: when we are legally required to, for example by order of a court or supervisory authority. d) Business transfer: in the event of a merger or acquisition, of which we inform Users in advance. Gymies never sells personal data and does not show third-party advertising.
7. Transfers outside the EEA
Gymies strives to process personal data exclusively within the European Economic Area (EEA). If a transfer to a country outside the EEA is necessary (for example, through the use of service providers with servers outside the EEA), Gymies ensures that an adequate level of protection is provided by means of: a) an adequacy decision by the European Commission (Art. 45 GDPR); b) Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c) GDPR); c) other appropriate safeguards in accordance with Chapter V of the GDPR. An overview of any transfers outside the EEA and the safeguards applied is available upon request via gymiesapp@hotmail.com.
8. Retention periods
Gymies does not retain personal data longer than necessary. We use the following periods: a) Account data: as long as the Account is active; deleted from active systems within 30 days after deletion. b) Booking data: 2 years after the Session, unless needed longer for an ongoing dispute. c) Financial data: 7 years (tax retention obligation). d) Chat messages: up to 24 months after the last activity. Messages in a support request or dispute: up to 7 years. e) Login sessions: a session expires after 14 days without activity (administrators: 7 days); expired sessions are deleted after 90 days. f) GPS location: not stored; only used to show Trainers nearby. g) Usage statistics and technical data: up to 26 months. h) Waitlist: until you unsubscribe or create an Account, up to 12 months. i) Reviews: as long as the Trainer profile exists; when the Client account is deleted, the author's name is removed. j) Verification documents: deleted immediately after review. The outcome of the check (date, approved or rejected) is kept as long as the trainer account exists. k) Backups: overwritten within 90 days. l) Data on your own device: see Section 12.
9. Your rights
Under the GDPR, you have the following rights with respect to your personal data: a) Right of access (Art. 15 GDPR): you have the right to know what personal data Gymies processes about you and to receive a copy thereof. b) Right to rectification (Art. 16 GDPR): you have the right to have inaccurate or incomplete personal data corrected or supplemented. c) Right to erasure / right to be forgotten (Art. 17 GDPR): you have the right to request that Gymies deletes your personal data, unless Gymies has a legal obligation to retain the data. d) Right to restriction of processing (Art. 18 GDPR): you have the right to restrict the processing of your personal data in certain circumstances, for example when you contest the accuracy of the data. e) Right to data portability (Art. 20 GDPR): you have the right to receive your personal data in a structured, commonly used and machine-readable format and to transfer this data to another data controller. f) Right to object (Art. 21 GDPR): you have the right to object to the processing of your personal data on the basis of legitimate interest, including profiling. Gymies will cease the processing unless there are compelling legitimate grounds that override your interests. g) Right to withdraw consent (Art. 7(3) GDPR): where processing is based on consent, you may withdraw it at any time. Withdrawal does not have retroactive effect. h) Right not to be subject to automated decision-making (Art. 22 GDPR): you have the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal effects concerning you or similarly significantly affect you. How to submit a request: Send a request via gymies.nl/contact or by email to gymiesapp@hotmail.com. Clearly state which right you wish to exercise. Gymies may ask for identification to verify your identity. Response time: Gymies will respond to your request within 30 days at the latest. In complex cases, this period may be extended once by 60 days, of which you will be informed. Costs: exercising your rights is in principle free of charge. In the case of manifestly unfounded or excessive requests, Gymies may charge a reasonable fee or refuse the request.
10. Automated decision-making and profiling
Gymies uses automated systems for: a) Ranking of Trainers: the order in the search results is determined by distance, reviews, the number of completed Sessions, response speed in the chat and the completeness of the profile. Trainers can see in the app how their visibility is built up and how to improve it. A Client's intake preferences can influence the order for that Client. b) Fraud detection: flagging suspicious activity, such as unusual login attempts or payment patterns. This can lead to a temporary suspension, after which a person always reviews the case. c) Payment checks: if a payment confirmation from Mollie does not arrive, the system automatically checks the status again, so that a paid booking does not lapse incorrectly. Gymies does not take decisions with legal effects based solely on automated processing.
11. Location, map, usage statistics and cookies
a) Location and map: with your consent the app uses your device's GPS location to show Trainers nearby; that location is not stored. On the map you only see Trainers as an area (rounded to about 2 kilometres), never an address. The map images are loaded from OpenStreetMap, which receives your IP address in the process. b) Usage statistics in the app: only if you choose "Yes" when you first open the app do we record which screens and features you use, via Google Firebase Analytics and our own statistics. Without that consent the app does not collect this data. Advertising features are always off. You can change your choice under Privacy in the app. c) Error reports: if the app crashes or shows an error, we send a technical error report (via Firebase Crashlytics and Sentry), without your name or email address. This is needed to keep the app working. d) Website: the website uses necessary and functional cookies (such as login, language choice and remembering your cookie choice). Analytics cookies (to measure how the website is used) and marketing cookies (to measure and show ads) are only placed if you consent in the cookie notice; declining is as easy as accepting. The website loads Google Tag Manager. Without your consent, analytics and advertising cookies stay off (Google Consent Mode), but Google does receive technical data such as your IP address when a page loads. You can change your choice at any time via 'Cookie settings' at the bottom of every page, and delete or block cookies via your browser.
12. Security
Gymies takes appropriate technical and organisational measures (Article 32 GDPR), including: a) Encryption: all connections use HTTPS; passwords are stored with a one-way hash function; chat messages typed by Clients and Trainers are stored encrypted. b) Access: only authorised persons have access to personal data, with unique login details and two-step verification where possible. Login sessions expire automatically (see Section 8). c) Hosting: our servers are located within the European Union (Amazon Web Services, Frankfurt) and are updated regularly. d) Data on your device: to keep the app usable without internet, the app stores a copy of your latest sessions on your phone. Trainers can view their client files offline; that copy is stored encrypted (in your phone's Keychain or Keystore) and contains at most 20 files. When you log out, this data is erased from your phone. e) Calendar link: if you link your sessions to your calendar, you receive a personal, secret link. Anyone with that link can see your sessions, so do not share it. Your calendar fetches your sessions automatically as long as you use the link. If the link is not used for 90 days, it expires. You can always create a new one in the app, which invalidates the old one immediately. f) Backups and incidents: we make regular encrypted backups and have a procedure for data breaches (see Section 13).
13. Data breaches
Gymies has established procedures for dealing with data breaches (personal data breaches) in accordance with Articles 33 and 34 of the GDPR. a) Notification to the Autoriteit Persoonsgegevens (Dutch Data Protection Authority): if a data breach poses a risk to the rights and freedoms of data subjects, Gymies will report this without undue delay and, where possible, within 72 hours of discovery to the Autoriteit Persoonsgegevens. b) Notification to data subjects: if a data breach poses a high risk to the rights and freedoms of data subjects, Gymies will notify the affected Users without undue delay. The notification will contain at least a description of the incident, the potential consequences, the measures taken and contact details for further information. c) Record-keeping: Gymies maintains a register of all data breaches, regardless of whether notification to the supervisory authority or data subjects is required. If you suspect a data breach has occurred, we kindly ask you to report it as soon as possible via gymiesapp@hotmail.com.
14. Privacy of minors
The Platform is not aimed at children under the age of 16. Gymies does not knowingly collect personal data from children under the age of 16. If you are a parent or legal guardian and you suspect that your child under the age of 16 has provided personal data to Gymies without your consent, please contact us at gymiesapp@hotmail.com. Gymies will delete the relevant data as soon as possible. Users between the ages of 16 and 18 may use the Platform with the consent of a parent or legal guardian.
15. Third-party links
The Platform may contain links to websites, applications or services of third parties. Gymies is not responsible for the privacy policies or data processing practices of these third parties. Gymies advises Users to read the privacy policy of the relevant third party before providing any personal data. Following a link to a third-party website or service is at your own risk.
16. Social media
Gymies may be present on social media platforms (such as Instagram, Facebook, LinkedIn and TikTok). When you interact with Gymies via social media (by sending messages, posting comments or following pages), your data is also processed by the respective social media platform in accordance with their own privacy policy. Gymies is not responsible for the data processing carried out by social media platforms. For questions about the processing of your data by these platforms, we refer you to their respective privacy policies.
17. Push notifications
The app can send push notifications, for example about new, confirmed, rescheduled or cancelled Sessions, payments, chat messages, reminders (a day and two hours before a Session), for Trainers a daily and weekly overview, and the reminder to book again. Push notifications are delivered via Apple (APNs) and Google (Firebase Cloud Messaging). The app only asks for permission at a moment when notifications are useful. You can turn notifications off in your phone's settings; the reminder to book again can be turned off separately in the app. Notifications about bookings and payments then remain visible in the app and are also sent by email where applicable.
18. Processors and sub-processors
Gymies uses service providers that process personal data on our behalf. We have (processing) agreements with them. a) Amazon Web Services (EU, Frankfurt): hosting and storage. b) Mollie B.V. (the Netherlands): processing customer payments. For payment data Mollie is partly a controller in its own right. c) Brevo (France): sending emails. d) Google (Firebase): push notifications, crash reports and, only with consent, usage statistics. e) Apple: delivery of push notifications on iPhone. f) Sentry: technical error reports. g) OpenStreetMap Foundation: map images in the app. h) Google (Tag Manager): loading scripts on the website. i) Anthropic (Claude): translating messages written by the Gymies team itself (for example an announcement) into English, for users who have English as their language. Only the team's text is sent to Anthropic, no data about you. Where data ends up outside the EEA (for example with Google, Apple, Sentry or Anthropic in the United States), this is based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses (see Section 7). An up-to-date overview is available on request via gymiesapp@hotmail.com.
19. Data Protection Impact Assessment (DPIA)
Gymies assesses whether a Data Protection Impact Assessment (DPIA / gegevensbeschermingseffectbeoordeling) is required when new processing activities are introduced that may pose a high risk to the rights and freedoms of data subjects (Art. 35 GDPR). Gymies conducts a DPIA where there is: a) systematic and extensive evaluation of personal aspects (profiling); b) large-scale processing of special categories of personal data; c) systematic monitoring of publicly accessible areas. The outcomes of completed DPIAs are documented and, where necessary, submitted to the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).
20. Amendments to this Privacy Policy
Gymies reserves the right to amend this Privacy Policy. In the event of amendments, the "Last updated" date at the top of this policy will be adjusted. In the case of material changes, Users will be informed at least 30 days before the effective date via email and/or a notification on the Platform. Gymies advises Users to review this Privacy Policy regularly. Previous versions are available upon request via gymiesapp@hotmail.com. Continued use of the Platform after the amended version takes effect implies acknowledgement of the amended policy.
21. Supervisory authority
If you believe that Gymies processes your personal data unlawfully, you have the right to file a complaint with the Autoriteit Persoonsgegevens (AP), the Dutch supervisory authority for data protection. Autoriteit Persoonsgegevens PO Box 93374 2509 AJ The Hague Phone: 088 - 1805 250 Website: https://autoriteitpersoonsgegevens.nl We would appreciate it if you contact Gymies first in the event of a complaint, so that we can work together to find a solution.
22. Contact
For questions, comments or requests regarding this Privacy Policy or the processing of your personal data, you can contact Gymies: Email: gymiesapp@hotmail.com Contact form: gymies.nl/contact Website: https://www.gymies.nl Gymies aims to respond to general enquiries within 5 working days. For requests under your rights pursuant to the GDPR (Section 9 of this policy), a statutory response period of a maximum of 30 days applies.