DREAM GYM PRIVACY POLICY
- Who processes your personal data
Data controller: Dream Gym s. r. o.
Registered office: Ještědská 171, Hněvousice, 295 01 Mnichovo Hradiště
Company identification number (IČO): 05222681
Commercial Register: Registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File No. 260228
Premises: Dream Gym, Štefánikova 1303, 293 01 Mladá Boleslav
Email for enquiries and requests concerning personal data: dreamgymmb@gmail.com
Telephone: +420 737 940 203
Contact person: Roman Maršálek
Website: dreamgym.cz
Effective from: 1.9.2026
This Privacy Policy explains how we process the personal data of our customers, gym visitors, website users and other individuals who communicate with us. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, referred to below as the “GDPR”, and related legislation, including Czech Act No. 110/2019 Coll., on the Processing of Personal Data.
This document does not itself constitute consent to the processing of personal data. Where consent is required for a particular purpose, we request it separately.
- What personal data we collect and where it comes from
2.1. The personal data we process depends on the services you use. It may include your first name, surname, date of birth or other information necessary to verify your age, contact and billing details, customer identifier, and information about memberships, passes, bookings, visits, orders and payments. We also process related correspondence and records of how we have handled your requests or complaints.
2.2. We obtain personal data primarily from you when you register, place an order, visit our premises or communicate with us. In the case of minors, their legal guardian may provide the information. We also receive payment information from payment service providers. Other data is generated when you use our customer system or website, or visit areas monitored by CCTV.
2.3. We only require information that is proportionate to the particular purpose. When collecting personal data, we distinguish between mandatory and optional information. Without the information necessary to process an order, verify an entitlement to enter the gym or provide an agreed service, we may be unable to fulfil the relevant request. Refusing optional marketing consent does not prevent you from using the gym’s ordinary services.
2.4. Where we need to verify identity, age or eligibility for a discount, we inspect only the relevant information. We do not make copies of identity documents or accept them as a deposit.
- Why we process personal data
3.1. Registration, service provision and customer communication
We use identification, contact and service-related information to create and manage customer accounts, maintain records of entry entitlements, manage bookings and the use of services, process orders and communicate with customers about these matters. This includes, for example, booking confirmations, notifications of changes to bookings and resolving issues relating to purchased services.
The legal basis is the performance of a contract or taking steps at your request before entering into a contract, under Article 6(1)(b) GDPR. We rely on this legal basis only for data that is genuinely necessary for the relevant purpose.
3.2. Payments, accounting and legal obligations
We use order and payment information to verify payments, assign purchased services to customers, issue receipts or invoices, process refunds and resolve payment discrepancies. This may include the amount, date, payment method, payment status and transaction identifier, as well as other necessary information depending on the payment method, such as an account number for a refund.
Processing necessary to arrange payment for a service is based on the performance of a contract, under Article 6(1)(b) GDPR. Processing for accounting, taxation and other statutory purposes is based on compliance with a legal obligation, under Article 6(1)(c) GDPR.
You enter payment card or bank account authentication details in the relevant secure payment environment. We do not ask you to disclose your card security code or online banking login credentials by email or to our staff.
3.3. Handling requests, security and protecting legal rights
We process information necessary to respond to general enquiries, protect customer accounts, prevent misuse of entry entitlements and document the rights and obligations of both parties on the basis of legitimate interests, under Article 6(1)(f) GDPR.
These interests include safe operations, the protection of property and individuals, effective communication, and the ability to establish, exercise or defend legal claims. When handling complaints and other requests, we also take into account the relevant contractual and legal obligations.
We do not use personal data beyond what is necessary for the particular matter. You may object to processing based on legitimate interests as described in Section 9.
3.4. Marketing communications and offers
We may send you news and offers on the basis of your consent, under Article 6(1)(a) GDPR.
We may also send existing customers offers relating to our own similar services on the basis of legitimate interests, but only where the conditions of Section 7(3) of Czech Act No. 480/2004 Coll. are met. This includes giving customers the opportunity to refuse such use of their contact details when those details are collected and in every subsequent marketing communication.
You may opt out at any time, easily and free of charge, using the option provided in the relevant message or by contacting us at our email address. Opting out of marketing does not prevent us from sending necessary communications about your order or an agreed service.
- Minors, photographs and health-related data
4.1. Visitors under the age of 18
We process information necessary to verify age, meet entry requirements, record a legal guardian’s permission, document completed safety instruction and record any restrictions on exercise. We also use the legal guardian’s contact details for necessary communications relating to the child’s safety.
Depending on the particular relationship, the legal basis is the performance of a contract or our legitimate interest in providing services safely and documenting the minor’s permission to use them.
A legal guardian’s permission for a minor to visit the gym does not automatically constitute consent to marketing, the publication of the child’s photographs or any unrelated processing.
4.2. Photographs
Providing a photograph for a customer profile is optional. Where we use such a photograph on the basis of your consent, its purpose is to visually verify the identity of the person entitled to enter. If you refuse or withdraw consent, another proportionate means of verification may be used.
The use of a customer’s recognisable image in advertising or on social media requires a separate assessment and an appropriate legal basis. Neither a photograph provided for a customer account nor entry to the gym authorises its use for advertising.
4.3. InBody measurements and other individual services
When measuring body composition or providing individual consultations, we may process information about body measurements, measurement results or health-related restrictions. Where this information reveals a person’s state of health, it constitutes a special category of personal data. The legal basis of contractual performance alone is not sufficient for its processing.
For these optional services, we require explicit consent under Article 9(2)(a) GDPR to process health data, unless another lawful condition applies in the particular circumstances. Before collecting the information, we explain its scope, purpose, recipients and retention period. Refusing consent may prevent us from carrying out the particular measurement or individual service, but does not in itself prevent ordinary access to the gym.
Retention of measurement results and related information
Body composition measurement results are stored on the InBody device and on the connected computer. Access is restricted to authorised individuals who have been trained to perform measurements and handle the results, and only to the extent necessary to provide this service.
We retain measurement histories on the basis of the customer’s explicit consent to compare individual measurements and monitor long-term changes in body composition. We retain the data only for as long as necessary for this purpose, and in any event for no longer than three years from the most recent measurement. If a further measurement is taken, this period starts again from the date of that measurement.
Consent may be withdrawn at any time by emailing dreamgymmb@gmail.com or in person at reception. Following withdrawal of consent, the end of the processing purpose or expiry of the stated retention period, we delete the results without undue delay. This does not affect the necessary retention of specific information for the establishment, exercise or defence of legal claims where permitted by the GDPR.
Evidence of a health-related reason for suspending membership
We assess health-related requests to suspend membership separately and process only the information necessary to handle the request. A certificate confirming a health-related obstacle to using the service and the period concerned is sufficient. We do not require a diagnosis or complete medical records.
We use the information provided solely to assess and handle the request. Once the request has been resolved, we retain only the records necessary to document the membership suspension and address any related legal claims, rather than unnecessary details about the customer’s health.
- CCTV system
5.1. Purpose and legal basis
The CCTV system is used to protect individuals and property, prevent theft, damage to equipment and other security incidents, and investigate such incidents.
The legal basis is the legitimate interest of the controller and the individuals concerned under Article 6(1)(f) GDPR. Processing is not based on consent inferred from entering the premises.
5.2. Areas monitored and system operation
Cameras monitor the gym’s exercise areas, bar area and corridors. Each camera’s field of view is limited to what is necessary for the stated security purposes. Changing rooms, showers, toilets and other areas intended for changing clothes are not monitored.
The system provides a live view and records video footage. Audio is not captured, transmitted or recorded.
5.3. Retention period
Ordinary video recordings are retained for no more than 72 hours from the time of recording. They are then automatically deleted or overwritten.
Where a recording captures a specific security incident, the necessary extract may be retained separately for as long as required to investigate the event and establish, exercise or defend related legal claims. Once this reason for retention no longer applies, the extract is also deleted.
5.4. Access to recordings and disclosure
Access to the live view and recordings is restricted to authorised individuals to the extent necessary for the stated purposes. Recordings are not made public or used for advertising.
Where justified and necessary, recordings may be disclosed to the police, courts, other competent public authorities, an insurer or a legal representative in connection with a specific incident and related claims.
5.5. Information for visitors
CCTV-monitored areas are identified by signs before visitors enter the cameras’ fields of view. Further information about the controller, contact details and the rights of individuals, including the right to object, is provided in this Privacy Policy and is also available at reception.
- Website, cookies and similar technologies
6.1. Use of the website may generate technical information, such as your IP address, access time, browser information or technical error logs. We process information necessary for security and resolving technical issues on the basis of our legitimate interest in operating a secure and functional website.
6.2. Cookies and similar technologies that are necessary for the operation of a service you have requested may be used without consent to their storage. Analytics and marketing cookies or similar tracking technologies are activated only after you have given prior consent. Refusing them must not prevent basic use of the website. Merely browsing the website or closing the information banner does not constitute consent.
6.3. You may refuse consent and subsequently change or withdraw it through the website’s cookie settings. For the subsequent processing of personal data for optional analytics and marketing, we rely on consent under Article 6(1)(a) GDPR.
Overview of cookies and related tools used:
- Who may receive personal data
7.1. We disclose personal data only to the extent necessary for a specific purpose. In addition to authorised staff, recipients may include providers of customer and booking systems, web hosting, email and other IT services, accounting services and payment services. A trainer or another person delivering a selected service may also receive the information necessary to provide that service.
7.2. Suppliers processing personal data on our behalf must be bound by appropriate contractual terms and instructions. Some recipients, such as payment service providers when fulfilling their own legal obligations, act as independent controllers. Personal data may also be disclosed to public authorities where required by law or to the extent necessary to protect legal claims.
7.3. Transfers outside the European Economic Area. The use of certain internet, email or cloud services may involve processing outside the European Economic Area. Any such transfer must be supported by an appropriate legal mechanism under the GDPR.
Information about the safeguards used and how to obtain a copy is available by contacting us at the email address given in Section 1.
- How long we retain personal data
8.1. Customer accounts and service records
We retain information necessary to manage an account, membership and the use of services for as long as those services are provided. The following rule applies to inactive accounts:
8.2. Contracts, complaints and legal claims
After a service ends, we retain only the information necessary to document rights and obligations, until the relevant limitation periods have expired. If a dispute or proceeding is ongoing, the necessary records are retained for the duration of its resolution and settlement.
This purpose does not justify retaining the entire customer history indefinitely.
8.3. Accounting and tax documents
We retain accounting and tax documents for the periods required by law. VAT documents are retained for 10 years from the end of the tax period in which the taxable supply took place. This obligation does not automatically apply to all information in a customer account.
8.4. General correspondence
We retain information from enquiries that do not lead to an order for the time necessary to handle the enquiry and related correspondence. If the correspondence becomes part of a contractual relationship or a complaint, the relevant retention rules above apply.
8.5. Consent and marketing
We retain information processed on the basis of consent for the period covered by that consent, but no longer than until consent is withdrawn.
Where offers to existing customers are based on legitimate interests, processing for that purpose ends no later than when the customer opts out or when the reason justifying such communications no longer applies.
A record of consent or an opt-out may continue to be retained to the extent necessary to demonstrate the lawfulness of processing and ensure that no further marketing is sent contrary to the customer’s wishes.
8.6. Other categories of data
Photographs, health data, CCTV recordings and cookies are subject to the purposes and retention periods set out in this Privacy Policy and in the specific information provided when the data is collected. When there is no longer a reason to retain the data, we delete it or irreversibly anonymise it.
- Your rights and how to exercise them
9.1. Access, rectification, erasure, restriction and portability
Subject to the conditions of the GDPR, you have the right to receive information about processing and access your personal data, and to request its rectification, completion, erasure or restriction of processing.
Where personal data you have provided is processed by automated means on the basis of consent or a contract, you may also exercise the right to data portability.
9.2. Right to object
You may object to processing based on legitimate interests on grounds relating to your particular situation. Following an objection, we will no longer process the data for that purpose unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for legal claims.
You may object to processing for direct marketing at any time and without giving a reason. We will then stop processing your personal data for that purpose.
9.3. Withdrawal of consent
You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. It also does not prevent the retention of specific information where there is a separate lawful basis for doing so.
9.4. How to submit a request
You may exercise your rights by emailing dreamgymmb@gmail.com, writing to our registered office or visiting reception in person.
Where we have reasonable doubts about your identity, we may verify it in a proportionate manner. We do not automatically require a copy of your identity card.
We will respond without undue delay and no later than one month after receiving your request. Where justified, this period may be extended by up to a further two months. We will inform you of the extension and the reasons for it within the first month.
Requests are generally handled free of charge. Statutory exceptions may apply, for example, to manifestly unfounded or excessive requests.
9.5. Right to lodge a complaint
If you believe that we are processing personal data in breach of applicable legislation, you may contact the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, website: uoou.gov.cz.
You are not required to contact Dream Gym before lodging a complaint with the supervisory authority.
- Data security and changes to this Privacy Policy
We process personal data electronically and in paper form. Access is restricted according to assigned duties and the purpose of processing. We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse.
The current version of this Privacy Policy is available on our website and at reception, together with its effective date. If the purpose or material conditions of processing change, we will provide the relevant information before that processing begins. A change to this document does not replace any requirement to obtain new consent.