Website privacy notice
Information on the processing of personal data — website fitloop.net (Articles 13 and 14 GDPR)
- 1. Controller and contacts
- 2. Scope
- 3. Data, purposes, legal bases and retention
- 4. Provision of data
- 5. Recipients
- 6. Transfers outside the EU
- 7. Security
- 8. Minors
- 9. Your rights
- 10. Automated decision-making
- 11. Possible transfer of the controller role
- 12. Updates
1. Controller and contacts
The controller is Fit & Social S.r.l. Unipersonale, registered office Viale Risorgimento 19/A, 25060 Cellatica (BS), Italia, tax code and VAT no. 04041980980, represented by its legal representative pro tempore Nicola Finazzi (the "Controller").
For any question about your personal data and to exercise the rights in section 9, write to info@fitloop.net (subject: "Privacy"), by certified e-mail to fitandsocial@pec.it, or by post to the address above. App user support: help@fitloop.net; gyms and studios: business@fitloop.net.
Data Protection Officer (DPO): the Controller is appointing an external DPO under Article 37 GDPR; the DPO's contact details will be published on this page as soon as the appointment is completed.
2. Scope
This notice covers the website fitloop.net and its informational subdomains (including the FitLoop Business pages and the launch pages). It does not cover the FitLoop user app, the FitLoop Business app and web panel, or the web store for subscription purchases: those services have their own notices, available inside the respective applications.
3. Data, purposes, legal bases and retention
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Browsing and security | IP address, browser and device type, date and time, pages visited, technical logs generated by the hosting service | Legitimate interest of the Controller in the security and proper functioning of the site (Art. 6(1)(f) GDPR) | Technical logs: up to 30 days, unless needed to investigate abuse |
| Contact, access or demo request for FitLoop Business ("Start at €0" form) | Club name, name, work e-mail, members range, source page, browser language, date and time, consent record | Pre-contractual steps taken at your request (Art. 6(1)(b)) and legitimate interest in replying (Art. 6(1)(f)) | 24 months from the last contact; if a contract follows, for its duration and the statutory terms |
| Sending the download link and communications about the App ("Send me the link" form) | E-mail address, date and time, consent | Consent (Art. 6(1)(a)), confirmed by double opt-in | Until consent is withdrawn and in any case no longer than 24 months of inactivity |
| E-mails to info@, help@ and business@fitloop.net | The data you send us and what is needed to reply | Pre-contractual or contractual steps (Art. 6(1)(b)); legitimate interest in handling requests (Art. 6(1)(f)) | 24 months after the request is closed |
| Cookieless usage statistics | Aggregated counts of visits and pages, with a derived daily identifier that cannot be traced back to a person; no cookies, no cross-site tracking | Legitimate interest (Art. 6(1)(f)); Art. 122(5) of the Italian Privacy Code | Aggregated data, no personal identifiers |
| Analytics and marketing cookies | See the Cookie policy | Consent (Art. 6(1)(a); Art. 122 Italian Privacy Code), given through the banner and revocable at any time | Consent valid for 6 months; the lifetime of each cookie is in the Cookie policy |
4. Provision of data
Fields marked as required in the forms are necessary to handle your request: without them we cannot reply. Consent to communications about the App and to non-necessary cookies is optional and can be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.
5. Recipients
Data are processed by the Controller's authorised and instructed staff, and by suppliers acting as processors under Article 28 GDPR:
| Supplier | Role | Activity | Data location |
|---|---|---|---|
| Vercel Inc. | Processor | Website hosting and content delivery network; cookieless statistics | USA (EU servers where available) — EU-US Data Privacy Framework |
| Brevo SAS | Processor | Sending reply e-mails and communications about the App; managing subscriptions | European Union (France) |
| Celonis SE (Make.com) | Processor | Automated forwarding of form requests | European Union (Germany) |
| ClickUp (Mango Technologies, Inc.) | Processor | Handling FitLoop Business sales requests (CRM) | USA — standard contractual clauses / Data Privacy Framework |
| Google LLC | Processor (only with your consent) | Analytics and campaign measurement, if enabled through the banner | USA/EU — Data Privacy Framework |
Data may also be disclosed to consultants and professionals bound by confidentiality and to public authorities where required by law. Data are not disseminated.
6. Transfers outside the EU
The Controller favours suppliers that process data within the European Union. Where data are transferred to the United States (Vercel, ClickUp, Google), the transfer is made to organisations certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or on the basis of the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR), supplemented where necessary by additional measures. A copy of the safeguards can be requested at the contacts in section 1.
7. Security
The site is served only over an encrypted connection (HTTPS). Form data are transmitted encrypted, stored with access limited to authorised staff and protected by technical and organisational measures appropriate to the risk (Art. 32 GDPR). The site does not collect photographs, body measurements or any other health data: that processing takes place only in the App, under its own notice.
8. Minors
The site and the FitLoop services are not intended for people under 15. The Controller does not knowingly collect data from children under that age; if it becomes aware of unintended collection, it will delete the data.
9. Your rights
You have the right to access your data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability (Art. 20), to object to processing based on legitimate interest (Art. 21) and to withdraw any consent at any time. Send requests to the contacts in section 1: you will receive a reply within thirty days, free of charge. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of the Member State where you live or work.
10. Automated decision-making
The site does not carry out processing involving decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
11. Possible transfer of the controller role
The Controller may transfer the role of controller for the processing described in this notice to Sportechlabs Software S.r.l., without any change to purposes, legal bases, retention periods or your rights. Notice of the transfer will be given on this page.
12. Updates
This notice may be updated; the version in force, with its date, is always published on this page. In case of substantial changes to consent-based processing, consent will be requested again.