1. Controller and scope
The controller is Momentum Gym Torrevieja, tax number No facilitado / Not supplied, address Calle Concordia 81, 03182 Torrevieja, Alicante, Spain. Privacy contact: reception@momentumgym.org. No Data Protection Officer is represented as appointed until an appointment or duty to appoint is verified.
This policy covers visitors, account holders, purchasers, members, contacts and people entering the centre. Staff, candidates, minors, CCTV, promotional images and health information require separate notices if those activities are activated.
2. Data processed
- Account and identity: email, user identifier, name, telephone, date of birth, language and verification state.
- Profile and contact: address, nationality, home location and preferences needed for service.
- Contract and billing: product, price, promotion, order, legal acceptance, cancellation, and provider customer, checkout, payment, invoice and subscription references—not a full card number.
- Gym access: location, entry and exit time, result, limited denial reason, credits and reception review.
- Support, rights and security: communications, complaints, requests, audit events, IP address and technical data strictly needed to protect accounts and evidence operations.
3. Purposes and legal bases
Data is used to create and authenticate accounts, take pre-contract steps, perform memberships, collect payment, activate access, manage renewal and cancellation, provide support and meet tax, accounting, consumer, security and legal-claims duties. Depending on the activity, the bases are pre-contract steps and contract, legal obligation, and assessed legitimate interests in security and legal defence.
Electronic marketing needs consent or a permitted prior-customer basis, always with simple free objection. It is separate from contract acceptance. Health, biometric, CCTV, minor or promotional-image processing is not added to the general journey without a specific assessment, legal basis and notice.
4. Recipients and processors
Only authorised people with a need to know receive access. Hosting, authentication and database, payment, transactional email, security, support and professional providers may process data under appropriate terms and controls. Banks, tax bodies, authorities, courts, insurers or advisers may receive data where a documented legal need exists.
Before approval, Momentum must complete the actual processor, country, subprocessors and transfer-mechanism inventory. It will not claim all data remains in the EEA without evidence. Where an international transfer exists, the applicable mechanism and route to obtain safeguards will be explained.
5. Retention and security
Account and membership data is kept during the relationship and then erased or restricted under tax, accounting, consumer and claims duties. Access, technical, request and consent evidence follows periods proportionate to purpose. Backups expire through controlled cycles. The final retention schedule must be approved before real contracting.
Controls include access restriction, least privilege, authentication, encryption in transit, operation logs, environment separation, backups, provider review and incident response. No control promises zero risk; a high-risk breach will be communicated to affected people where GDPR requires it.
6. Rights
You may request access, correction, erasure, restriction, portability, objection, consent withdrawal and safeguards around automated decisions through reception@momentumgym.org. Exercise is normally free and answered within one month, extendable by up to two further months for complexity or volume with notice in the first month.
Momentum verifies identity proportionately, preferably through the authenticated account or information already held. Do not send passwords, full card details or an identity-document copy unless specifically justified through a secure route. You may also complain to the Spanish Data Protection Agency at aepd.es.
7. Automated checks and changes
The system automates objective checks for credential validity, entitlement, credits, opening hours and capacity. It must not make significant hidden-profile decisions; reviewable denials can be handled by reception. Public occupancy is aggregated.
Changes receive a new version and date. Current version: 2026-08-30.1. Effective date: 2026-08-30. A changed purpose or legal basis is notified first and a new choice is obtained where needed.