1. In short
1.1. UPfit.today is the member app of your fitness club. Your club uses it to manage your membership, bookings, access and communication with you. The app is customised for each club and appears in the app stores under the club's name and details.
1.2. Your club decides which data it asks you for and what it does with them. The club is the controller of your member data.
1.3. We, UPfit, supply the software to the club. For your member data we are the club's processor: we process them only on the club's behalf and on its instructions.
1.4. We are a controller only for a few technical data of the app, described in section 6. We do not use your member data for our own purposes, we do not send you our own marketing and we do not sell your data.
2. Who we are and how to contact us
2.1. The app is developed by SC UPFIT SRL, with its registered office at Str. Teiului nr. 11, bl. 29, et. 8, ap. 32, Timișoara, Timiș County, Romania, registered with the Trade Register under no. J2017004049359, unique registration code RO38350968. In this document we refer to ourselves as "UPfit".
2.2. You can write to us at dpo@upfit.cloud, our contact point for data protection, or by post, at our correspondence address Bd. Cetății nr. 93, etaj 1, 300358 Timișoara, Romania.
2.3. For your member data, your first point of contact is your club. Its contact details are in the app and in its privacy policy.
3. What this policy covers
3.1. This policy covers the UPfit.today mobile app, for Android and iOS, in the customised version of any club, the club's online member account and the www.upfit.today website.
3.2. This policy does not replace your club's policy. In its own policy, the club tells you which data it collects, for what purpose, on what legal basis, how long it keeps them and to whom it discloses them. You can find it in the club's app, next to this document, or you can ask the club for it.
3.3. This policy does not cover UPfit's presentation websites. For those, the policy at https://en.upfit.cloud/privacy-policy applies.
4. The data your club processes through the app
4.1. Through the app, your club may process, depending on how it has configured its services:
- account data: first name, last name, email, phone number, gender and date of birth, requested at registration;
- member data: membership, bookings, visits, the QR access code, payment history;
- your profile photo, if you upload one or if your club asks for it;
- the messages your club sends you by email, SMS or push notifications.
4.2. Data concerning health. If your club uses the member engagement and retention module, the app may ask for your height, weight and weight-loss goals. These are data concerning health. The app asks for them only after you give your explicit consent, through a separate tick box. If you do not tick it, you can use the rest of the app without any restriction. You can withdraw your consent at any time from the app, and the data are deleted.
4.3. Facial recognition. If your club uses access terminals with facial recognition, you are enrolled only under the conditions set by the club, which explains separately which biometric data it processes and on what legal basis.
4.4. The purpose, the legal basis and the retention period for these data are set by your club, and you can find them in its policy. We keep the data for as long as the club uses the platform, and when the contract with the club ends we delete them according to its instructions.
5. Payments
5.1. When you buy a membership or a service through the app, you buy from the club. The club is the seller, sets the price and the terms, and issues your invoice.
5.2. Card payments are processed by the payment processor contracted by the club, NETOPIA. You enter your card details directly on the processor's page. Neither UPfit nor the club sees or stores your full card number.
6. The data we process as controller
| Data | Why | Legal basis | How long we keep them |
|---|---|---|---|
| Technical app data: device identifiers, operating system type and version, app version, error logs | Running, troubleshooting and improving the app | Legitimate interest | 12 months |
| Security and access logs | Platform security and fraud prevention | Legitimate interest | 12 months |
| Data of www.upfit.today visitors: IP address, pages visited, cookie data | Running and securing the website; statistics, only with your consent | Legitimate interest; consent for optional cookies | Server logs: 60 days; cookies: according to the cookie policy |
6.1. The cookies on www.upfit.today are described in the cookie policy at https://en.upfit.cloud/cookie-policy. Optional cookies are switched on only after you accept them in the website's banner.
6.2. We do not use the data in this table to build a marketing profile of you, and we do not combine them with your member data for any purpose other than running the app.
7. Who else receives the data
7.1. To host and run the app we use the following providers, with whom we have data processing agreements:
| Provider | What it does | Where |
|---|---|---|
| DATANODE SRL and DIGI ROMANIA SA | Hosting and storage | Timișoara, Romania |
| Amazon Web Services EMEA SARL, Luxembourg | Email delivery | Ireland |
| Google LLC and Google Ireland Limited, Firebase Cloud Messaging | Push notification delivery | EU and United States |
| WEB2SMS SRL | SMS delivery | European Union |
7.2. Your club may have its own providers, for example the payment processor or an SMS provider for its campaigns. You can find them in the club's policy.
7.3. We disclose data to authorities only when the law requires us to.
8. Transfers outside the European Economic Area
8.1. Push notifications pass through Google's infrastructure, which may process data in the United States. The transfer is based on Google's certification under the EU-US Data Privacy Framework and on the standard contractual clauses adopted by the European Commission.
8.2. All other data are hosted in Romania and in the European Union.
9. How we protect the data
9.1. The data are hosted in data centres in Timișoara. Access requires authentication and is role-based and logged, and communications are encrypted. Each club's data are kept separate from those of the other clubs.
9.2. If a security incident affects your member data, we notify the club within 24 hours at the latest, so that it can inform you and notify the authority.
10. Your rights
10.1. You have the right of access to your data, to rectification, to erasure, to restriction of processing, to data portability and to object. Where processing is based on consent, you can withdraw it at any time, without affecting the processing carried out before.
10.2. For member data, contact your club. If you write to us, we forward your request to the club within 5 working days at the latest and help it answer you.
10.3. For the data in section 6, write to us at dpo@upfit.cloud. We answer within one month at the latest, a period that may be extended under Article 12(3) of Regulation (EU) 2016/679.
10.4. You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing, www.dataprotection.ro.
11. Deleting your account
11.1. Your member account belongs to your relationship with the club. You can ask the club to delete it, or you can write to us at dpo@upfit.cloud and we forward the request to the club.
11.2. The club may keep some data after the account is deleted, if the law requires it to, for example invoices.
12. Minors
12.1. Your club decides whether it accepts minors as members and, where applicable, obtains the parents' consent. For services offered directly to a child on the basis of consent, the law requires parental consent below the age of 16.
13. Changes to this policy
13.1. We may change this policy, for example when we add a new feature or a new provider. The version in force is the one published, with the date and version number in section 14.
13.2. For substantive changes, we notify you in the app before they take effect.
14. Document version
14.1. Version in force: 1.0, published on 5 November 2026.
14.2. This document replaces the policy previously published at the same address, dated 10 September 2018.
14.3. This is a translation. If the English and the Romanian versions differ, the Romanian version prevails.