1. Introduction

Welcome to Gymtonico ("we", "our", "us", or "Company"), a fitness and wellness service provider operating in India. We are committed to protecting your privacy and ensuring the security of your personal data in accordance with Indian data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000.

This Privacy Policy explains how we collect, use, process, disclose, and safeguard your personal data when you visit our website, use our application, purchase gym memberships, engage with our fitness services, or interact with us at our facilities across India.

This policy applies to all users of our services, including website visitors, registered members, personal training clients, transformation program participants, and consultation enquiry submitters. By accessing or using Gymtonico's services, you provide your consent to the collection, use, and disclosure of your personal data as described in this Privacy Policy.

If you do not agree with the terms of this Privacy Policy, please discontinue use of our services immediately. You have the right to withdraw your consent at any time by contacting us as specified in Section 15 of this policy.

2. Information We Collect

We collect personal data that you provide directly to us, information we obtain automatically when you use our services, and information necessary for providing fitness and wellness services. The types of personal data we may collect include:

2.1 Personal Identification Information

When you register for an account, purchase a membership, or request a consultation, we collect:

• Full name (first and last name)
• Email address
• Mobile phone number (Indian mobile number)
• Date of birth and age
• Gender
• Residential address (city, state, PIN code)
• Emergency contact information (name and phone number)
• Photograph for member identification (if applicable)

Your mobile number is verified via a one-time password (OTP) sent during registration to ensure account security and prevent unauthorized access.

2.2 Payment and Financial Information

When you purchase memberships, personal training packages, or other services, we collect:

• Payment information (processed securely through our payment gateway)
• Billing address
• Transaction history and purchase records
• Invoice details and GST information (if applicable)
• PAN details (for transactions above ₹2 lakhs as per Income Tax regulations)

We do not store complete payment card details on our servers. All payment information is processed and stored by our PCI-DSS compliant payment gateway provider, CCAvenue, in accordance with RBI guidelines.

2.3 Membership and Service Information

For active members and service users, we maintain:

• Membership type, tier, and plan details
• Membership start and end dates
• Membership status (active, expired, suspended, cancelled)
• Facility access records and check-in/check-out history
• Personal training session bookings and attendance
• Group class reservations and participation records
• Preferred gym location and branch across India
• Locker assignment and facility usage details

2.4 Consultation and Communication Information

When you submit a consultation request or communicate with us, we collect:

• Name, email address, and phone number
• Area of interest (Personal Training, Transformation Program, Group Classes, etc.)
• Fitness goals and objectives
• Any additional comments, questions, or special requirements you provide
• Communication preferences (email, SMS, WhatsApp)

2.5 Location Information

With your explicit consent, we collect location data to:

• Automatically detect and suggest the nearest Gymtonico branch in your city
• Provide location-based services and recommendations
• Improve our service offerings based on geographic demand across India

You can disable location services at any time through your device or browser settings. We do not continuously track your location or store historical location data beyond what is necessary for service delivery.

2.6 Technical and Usage Information

We automatically collect certain technical information when you access our services:

• Device information (device type, model, operating system, browser type and version)
• IP address and general location information (city/state level)
• Log data (access times, pages viewed, links clicked, features used)
• Cookies and similar tracking technologies
• Application usage patterns and feature interactions

2.7 Health and Fitness Information (Optional and With Consent)

If you choose to participate in personal training, transformation programs, or fitness assessments, we may collect sensitive personal data with your explicit written consent:

• Fitness assessment results and body composition analysis
• Health conditions, medical history, or physical limitations relevant to safe training
• Fitness goals, progress tracking, and workout performance data
• Body measurements, weight, and other physical metrics (if voluntarily provided)
• Dietary preferences and nutritional information (if applicable)

This sensitive personal data is collected only with your explicit written consent through a separate consent form and is used solely to provide personalized fitness and wellness services. You are not required to provide health information to use our basic gym membership services. You may withdraw your consent at any time.

Note: As per Indian data protection laws, sensitive personal data requires heightened protection and your explicit consent before collection and processing.

2.8 CCTV and Security Footage

For the safety and security of our members and staff, our gym facilities are equipped with CCTV cameras in common areas (excluding changing rooms, washrooms, and private areas). This footage is:

• Used solely for security, safety, and incident investigation purposes
• Retained for a maximum of 30 days unless required for ongoing investigations
• Accessible only to authorized security personnel and management
• Shared with law enforcement authorities when legally required

Signage is displayed at all entry points informing you of CCTV surveillance.

2.9 Information We Do Not Collect

We do not collect:

• Aadhaar number or biometric data (fingerprints, iris scans, facial recognition data)
• Caste, religion, or political affiliations
• Bank account details or credit/debit card information (handled by payment gateway)
• Sensitive health information beyond what you voluntarily provide for training purposes
• Information from children below 18 years of age without parental/guardian consent

3. Purpose and Lawful Basis for Processing Personal Data

We process your personal data for specific, legitimate purposes with your consent and in compliance with Indian data protection laws. The purposes for which we use your personal data include:

3.1 Service Delivery and Account Management

• Create, maintain, and manage your Gymtonico member account
• Verify your identity through OTP-based mobile number authentication
• Process membership registrations, renewals, and upgrades
• Manage facility access, check-in/check-out, and locker assignments
• Schedule and coordinate personal training sessions, group classes, and transformation programs
• Display your membership details, purchase history, and account information in your profile
• Provide access to multiple Gymtonico branches across India (if applicable to your membership)

3.2 Payment Processing and Financial Transactions

• Process payments for memberships, personal training, and other services through secure payment gateways
• Generate and send GST-compliant invoices and payment receipts
• Manage billing cycles, automatic renewals, and subscription payments
• Handle refunds, cancellations, and payment disputes as per our refund policy
• Prevent fraudulent transactions and ensure payment security
• Comply with Income Tax Act requirements for high-value transactions

3.3 Communication and Customer Support

• Send transactional communications including payment confirmations, membership updates, and account notifications via email and SMS
• Respond to consultation requests, enquiries, and feedback
• Provide customer support and address technical issues
• Send important service announcements, facility updates, and policy changes
• Notify you of membership expiration, renewal reminders, and payment due dates
• Communicate class schedules, trainer availability, and facility maintenance updates

3.4 Personalization and Service Improvement

• Detect and suggest your nearest Gymtonico branch based on your location
• Personalize your experience and recommend relevant fitness services and programs
• Develop and deliver customized fitness programs and training plans
• Analyze usage patterns to improve our website, application, facilities, and services
• Conduct research and analytics to enhance member experience and satisfaction
• Understand peak usage times and optimize facility resources

3.5 Safety, Security, and Legal Compliance

• Maintain facility security and member safety through CCTV surveillance in common areas
• Prevent fraud, unauthorized access, theft, and other illegal activities
• Comply with legal obligations under Indian laws including IT Act 2000, DPDPA 2023, Income Tax Act, GST regulations, and other applicable laws
• Enforce our terms of service, membership agreements, and facility rules
• Respond to legal requests from law enforcement and government authorities
• Investigate incidents, accidents, or disputes at our facilities
• Contact emergency contacts in case of medical emergencies or safety incidents

3.6 Marketing and Promotional Communications (With Explicit Consent)

• Send promotional offers, membership deals, and special discounts (only with your explicit opt-in consent)
• Inform you about new services, fitness programs, classes, and events at Gymtonico
• Share health and wellness tips, fitness advice, and educational content
• Send festive greetings and special occasion messages

You can opt out of marketing communications at any time by:

• Clicking the unsubscribe link in promotional emails
• Replying STOP to promotional SMS messages
• Updating your communication preferences in your account settings
• Contacting us directly at the details provided in Section 15

Important: Opting out of marketing communications will not affect transactional or service-related communications necessary for your membership.

4. Disclosure and Sharing of Personal Data

We respect your privacy and do not sell, rent, or trade your personal data to third parties for their marketing purposes. We may share your personal data only in the following limited circumstances and in compliance with Indian data protection laws:

4.1 Payment Gateway and Financial Service Providers

We share necessary information with trusted payment service providers to process your transactions:

• CCAvenue (Payment Gateway): We share your name, email address, mobile number, and transaction amount with CCAvenue for secure payment processing. CCAvenue is PCI-DSS compliant and operates under RBI guidelines. All payment card information is handled directly by CCAvenue and is not stored on our servers.
• Banks and Financial Institutions: Transaction details may be shared with your bank or financial institution for payment authorization and processing.

4.2 Service Providers and Business Partners

We engage trusted third-party service providers who assist us in operating our business. These providers have access to personal data only to perform specific tasks on our behalf and are contractually obligated to maintain confidentiality:

• Cloud Hosting Providers: We use secure cloud infrastructure providers based in India or with data centers in India to store and process your data
• SMS and Email Service Providers: We use communication service providers to send OTPs, transactional messages, and service notifications
• Customer Support Platforms: We may use third-party platforms to manage customer inquiries and support tickets
• Analytics Providers: We may use analytics services to understand usage patterns and improve our services (data is anonymized where possible)

4.3 Legal and Regulatory Authorities

We may disclose your personal data when required by Indian law or when we believe in good faith that disclosure is necessary to:

• Comply with legal obligations, court orders, summons, or government requests under Indian laws
• Respond to requests from law enforcement agencies, police, or other government authorities
• Comply with Income Tax Department, GST authorities, or other tax-related requirements
• Protect the rights, property, or safety of Gymtonico, our members, staff, or the public
• Detect, prevent, or address fraud, security breaches, or illegal activities
• Enforce our terms of service, membership agreements, or facility rules

4.4 Medical Emergencies

In case of medical emergencies or safety incidents at our facilities, we may share your personal data and emergency contact information with:

• Emergency medical services, hospitals, or healthcare providers
• Your designated emergency contacts
• Insurance providers (if applicable and with your consent)

4.5 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or business transfer, your personal data may be transferred as part of that transaction. We will:

• Notify you via email and/or prominent notice on our website at least 30 days before the transfer
• Inform you of any changes in data handling practices
• Provide you with options regarding your personal data
• Ensure the acquiring entity agrees to protect your data in accordance with this Privacy Policy

4.6 With Your Explicit Consent

We may share your personal data with third parties when you have given us explicit consent to do so, such as:

• Sharing fitness data with health tracking apps or wellness partners you authorize
• Participating in partner programs or promotional campaigns
• Sharing testimonials or success stories (with your explicit written consent)

4.7 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. This may include statistical data about member demographics, usage patterns, and trends for business analysis, research, or industry reporting purposes.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and improve our services.

5.1 What Are Cookies

Cookies are small text files stored on your device that help us recognize you and remember your preferences. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device until deleted or expired).

5.2 Types of Cookies We Use

• Essential Cookies: Required for basic site functionality, authentication, and security
• Performance Cookies: Help us understand how visitors interact with our website and application
• Functionality Cookies: Remember your preferences and settings
• Analytics Cookies: Collect information about usage patterns to improve our services

5.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. However, disabling cookies may affect the functionality of our services and limit your user experience.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

6.1 Retention Periods

• Active Accounts: We retain your information for the duration of your active membership and account
• Inactive Accounts: Information from inactive accounts may be retained for up to 7 years for legal and business purposes
• Transaction Records: Financial and transaction data is retained for at least 7 years to comply with tax and accounting regulations
• Marketing Data: Contact information for marketing purposes is retained until you opt out or request deletion

6.2 Deletion and Anonymization

When personal information is no longer needed, we will securely delete or anonymize it. Some information may be retained in anonymized or aggregated form for analytical purposes.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is 100% secure.

7.1 Security Measures

• Encryption of data in transit using SSL/TLS protocols
• Secure storage of data with encryption at rest
• Regular security assessments and vulnerability testing
• Access controls and authentication mechanisms
• Employee training on data protection and privacy practices
• PCI-DSS compliant payment processing through CCAvenue
• Regular backups and disaster recovery procedures

7.2 Your Responsibility

You are responsible for maintaining the confidentiality of your account credentials. Please:

• Use a strong, unique password for your account
• Do not share your password with others
• Log out after using shared or public devices
• Notify us immediately if you suspect unauthorized access to your account

7.3 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law, and take appropriate steps to mitigate any harm.

8. Your Privacy Rights

You have certain rights regarding your personal information. The availability of these rights may depend on your location and applicable privacy laws.

8.1 Access and Portability

• Right to Access: You can access your personal information through your profile page in the application, including registration details, membership information, and transaction history
• Right to Data Portability: You can request a copy of your personal information in a structured, commonly used, and machine-readable format

8.2 Correction and Update

• Right to Rectification: You can update or correct inaccurate or incomplete personal information through your account settings or by contacting us
• We will make reasonable efforts to update your information promptly upon request

8.3 Deletion and Erasure

• Right to Deletion: You can request deletion of your account and associated personal information
• We may retain certain information as required by law or for legitimate business purposes (e.g., transaction records for tax compliance)
• Deletion requests will be processed within 30 days, subject to legal retention requirements

8.4 Consent and Preferences

• Right to Withdraw Consent: Where processing is based on consent, you can withdraw your consent at any time
• Location Services: You can disable location access through your browser or device settings at any time
• Marketing Communications: You can opt out of promotional emails by clicking the unsubscribe link in any marketing email or contacting us

8.5 Restriction and Objection

• Right to Restrict Processing: You can request that we limit how we use your personal information in certain circumstances
• Right to Object: You can object to processing of your personal information for direct marketing purposes or based on legitimate interests

8.6 Exercising Your Rights

To exercise any of these rights, please contact us using the information provided in Section 12. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

8.7 Right to Lodge a Complaint

If you believe we have not handled your personal information properly, you have the right to lodge a complaint with your local data protection authority or supervisory body.

9. Children's Privacy

Our services are not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

For users between 13 and 18 years of age, we require parental or guardian consent before creating an account or purchasing memberships. We may request verification of parental consent.

If we discover that we have collected personal information from a child under 13 without proper parental consent, we will take steps to delete that information as quickly as possible.

10. International Data Transfers

Your personal information may be transferred to, stored, and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country.

When we transfer your information internationally, we take appropriate safeguards to ensure your information remains protected in accordance with this Privacy Policy and applicable data protection laws. These safeguards may include:

• Standard contractual clauses approved by relevant authorities
• Ensuring service providers are certified under recognized privacy frameworks
• Implementing additional technical and organizational security measures

By using our services, you consent to the transfer of your information to countries outside your country of residence.

11. Third-Party Links and Services

Our website and application may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to third-party services.

We are not responsible for the privacy practices or content of third-party services. We encourage you to review the privacy policies of any third-party services before providing them with your personal information.

Examples of third-party services may include:

• Social media platforms
• Payment processors (such as CCAvenue)
• Fitness tracking applications
• External content providers

12. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email if the changes are material and affect your rights
• Post a prominent notice on our website or application

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our services after any changes constitutes your acceptance of the updated Privacy Policy.

If you do not agree with any changes, you should discontinue use of our services and may request deletion of your account.

13. Data Localization and Cross-Border Transfers

As a company operating in India, we prioritize storing and processing your personal data within India in compliance with Indian data protection laws and regulations.

13.1 Data Storage in India

Your personal data is primarily stored on servers located in India or with cloud service providers that maintain data centers within India. This ensures:

• Compliance with Indian data localization requirements
• Faster access and better performance for Indian users
• Protection under Indian legal jurisdiction

13.2 Limited Cross-Border Transfers

In certain limited circumstances, your personal data may be transferred outside India for specific purposes:

• Payment processing through international payment gateways (with appropriate safeguards)
• Cloud backup and disaster recovery services
• Technical support and maintenance by global service providers

When we transfer data outside India, we ensure:

• The destination country has adequate data protection laws
• Appropriate contractual safeguards are in place
• Your explicit consent is obtained where required by law
• Compliance with RBI and other regulatory guidelines for financial data

14. Your Rights Under Indian Data Protection Laws

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable Indian laws, you have specific rights regarding your personal data. We are committed to facilitating the exercise of these rights.

14.1 Right to Access (Section 11 of DPDPA)

• You have the right to obtain confirmation of whether we are processing your personal data
• You can access your personal data through your profile page, which displays your registration details, membership information, transaction history, and invoices
• You can request a summary of personal data we hold about you
• You can request information about the purposes of processing and categories of data processed

14.2 Right to Correction and Updation

• You have the right to correct inaccurate or incomplete personal data
• You can update your information through your account settings or by contacting us
• We will update your information promptly upon verification of your identity
• Certain information (like transaction records) cannot be modified for legal and audit purposes

14.3 Right to Erasure and Data Deletion (Section 12 of DPDPA)

• You have the right to request deletion of your personal data when it is no longer necessary for the purposes for which it was collected
• You can request account deletion and erasure of associated personal data
• We will process deletion requests within 30 days, subject to legal retention requirements
• Certain data may be retained for legal compliance (e.g., financial records for 7 years as per Income Tax Act, GST records for 6 years)
• CCTV footage, transaction records, and data required for ongoing legal proceedings may be retained

14.4 Right to Withdraw Consent

• You have the right to withdraw your consent for processing of personal data at any time
• Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal
• You can withdraw consent for marketing communications, location services, and optional data collection
• Withdrawal of consent for essential services may affect your ability to use certain features or services

14.5 Right to Nominate (Section 15 of DPDPA)

• You have the right to nominate another individual who may exercise your rights in the event of your death or incapacity
• You can submit a nomination request to us in writing with appropriate documentation
• The nominee will be able to access, correct, or request deletion of your personal data

14.6 Right to Grievance Redressal

• You have the right to lodge a complaint regarding processing of your personal data
• You can contact our Grievance Officer (details in Section 15)
• We will acknowledge your complaint within 24 hours and resolve it within 30 days
• If unsatisfied, you may approach the Data Protection Board of India

14.7 How to Exercise Your Rights

To exercise any of these rights:

• Log in to your account and update information through account settings
• Contact our Grievance Officer via email at info@gymtonico.com
• Submit a written request to our registered office address
• Visit any Gymtonico branch and speak with our staff

We may require identity verification before processing your request to ensure data security. We will respond to your request within the timelines specified under Indian law (typically within 30 days).

15. Grievance Officer and Contact Information

In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer to address your privacy concerns and complaints.

15.1 Grievance Officer Details

15.2 General Contact Information

15.3 How to File a Complaint

If you have any concerns about how we handle your personal data, you can file a complaint by:

• Sending an email to our Grievance Officer at info@gymtonico.com
• Writing to us at our registered office address
• Calling our Grievance Officer during working hours

When filing a complaint, please include:

• Your full name and email address associated with your account
• A clear description of your complaint or concern
• Any relevant documentation or evidence
• Your preferred method of communication for response

15.4 Escalation to Data Protection Board

If you are not satisfied with our response to your complaint, you have the right to approach the Data Protection Board of India established under the Digital Personal Data Protection Act, 2023.

Data Protection Board of India
Contact details will be made available by the Government of India

16. Consent and Acknowledgment

By creating an account with Gymtonico, using our services, visiting our facilities, or providing us with your personal data, you hereby provide your free, informed, specific, clear, and unambiguous consent to:

• The collection, use, processing, storage, and disclosure of your personal data as described in this Privacy Policy
• The processing of your personal data for the purposes specified in Section 3
• The sharing of your personal data with third parties as described in Section 4
• The storage of your personal data in India and limited cross-border transfers as described in Section 13
• CCTV surveillance in common areas of our facilities for security purposes
• Receiving transactional communications necessary for service delivery via email, SMS, and WhatsApp

16.1 Separate Consent for Sensitive Personal Data

For collection and processing of sensitive personal data (health information, fitness assessments, medical history), we will obtain your separate explicit written consent through a dedicated consent form. This consent is optional and not required for basic gym membership services.

16.2 Consent for Marketing Communications

We will seek your separate opt-in consent before sending promotional or marketing communications. You can manage your marketing preferences at any time through your account settings or by contacting us.

16.3 Withdrawal of Consent

You acknowledge that you have the right to withdraw your consent at any time by contacting our Grievance Officer. However, withdrawal of consent:

• Will not affect the lawfulness of processing based on consent before its withdrawal
• May result in our inability to provide certain services or features
• Will not affect data retention required by law

16.4 Minors and Parental Consent

If you are below 18 years of age, you confirm that:

• You have obtained consent from your parent or legal guardian before providing personal data
• Your parent or guardian has reviewed and agreed to this Privacy Policy
• Your parent or guardian will be responsible for exercising your rights under this policy

We may request verification of parental consent and reserve the right to deny service if adequate consent is not provided.

17. Governing Law and Jurisdiction

This Privacy Policy and all matters relating to your privacy and personal data protection shall be governed by and construed in accordance with the laws of India, including but not limited to:

• The Digital Personal Data Protection Act, 2023
• The Information Technology Act, 2000 and rules thereunder
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• Other applicable Indian laws and regulations

Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts located in [City Name], India.

By using our services, you consent to the jurisdiction and venue of such courts and waive any objection to such jurisdiction or venue.