POLICY
Privacy notice on the processing of personal data pursuant to Articles 13 and 14 of EU Regulation 679/2016
and Legislative Decree 196/2003, as subsequently amended
Virgin Active Italia S.p.A. is the Data Controller (hereinafter:
“ Active” or
“Controller”) pursuant to EU Regulation 679/2016 (hereinafter:
“Regulation”) and Legislative Decree 196/2003, as subsequently amended (hereinafter:
“Privacy Code”), and considers privacy and the protection of your personal data to be one of the main objectives of its business. We therefore invite you to read this Privacy Notice carefully because it contains important information on the protection of your personal data.
What does “processing personal data” mean? It means carrying out any type of operation on information that allows you to be identified, such as, in this case, your first name and surname or your e-mail address. The operations may be of various kinds, for example: collection, recording, storage, modification, consultation, use, erasure or destruction. By reading this notice, you will find out which of your personal data will be processed by Virgin Active and why.
This Privacy Policy, in particular:
- informs you about your rights regarding the processing of your personal data, indicating how you can exercise them and the ways in which we will respond to your requests;
- allows you to know transparently how we collect and process your personal data and how we ensure their protection;
- informs you about how we process your personal data also in cases where they have not been provided directly by you but by a third party (for example, data provided by a friend who invited you to visit our Clubs or where someone has purchased a membership for you);
- is intended to be provided for the services supplied both at our Clubs (hereinafter: “Club”) and through the website www.virginactive.it (hereinafter: “Website”), including its e-commerce section (www.virginactive.it/ecommerce, hereinafter “E-commerce”); by way of example, below we list some of the services available through the Website and the Clubs to which this Privacy Policy refers:
- registration/purchase of memberships at our Clubs;
- registration/purchase of memberships through E-commerce;
- registration in the reserved area of the Website;
- service for booking medical examinations at the Club;
- gym training or personal training service;
- outdoor services: namely travelling workouts or classes, subject to booking, which take place in open spaces, mainly public parks;
- requests for information during external events (so-called outreach).
- It is NOT specifically intended to refer to the processing of personal data carried out by Virgin Active through the mobile application “Virgin Active Italia”: a specific notice is available both in the App Store at the time of download and on the Website. o As regards certain sections of the Website (e.g.: www.virginactive.it/academy, www.virginactive.it/revolution and www.virginactive.it/lavora-con-noi), in addition to this Privacy Policy, specific notices may be provided for the processing of personal data according to the purposes and types of data in each case.
The processing of your personal data is inspired by compliance with the principles of fairness, lawfulness, transparency, purpose limitation and storage limitation, minimisation and accuracy, integrity and confidentiality, as well as the accountability principle referred to in Article 5 of the Regulation. Your personal data are processed in accordance with the legal provisions of the Regulation and the Privacy Code, and with the confidentiality obligations provided therein.
Personal data means any information relating to you through which you may be identified or identifiable (hereinafter only “personal data”). This category includes data such as, for example:
name, date of birth, e-mail address, postal address, landline and mobile telephone number;information relating to PCs, tablets or smartphones (such as the IP address, which is a numerical label that uniquely identifies a device – host – connected to an information network that uses the Internet Protocol (IP) as its network protocol, or the IMEI code, which is the numerical code that uniquely identifies your smartphone);images depicting you contained, for example, in photographs.
By “processing of personal data”, the law means any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, comparison or interconnection, restriction, erasure or destruction.
The Controller may carry out processing activities directly or through parties external to its organisation, defined as Data Processors. These Processors process your data on the basis of the Controller's instructions and exclusively for the purposes established by the latter. Data Processors may include, for example, the parties that provide the technological infrastructure of the Website and E-commerce.
TABLE OF CONTENTS
Below we provide the table of contents of this Privacy Policy so that you can easily find the information that interests you most about the processing of your personal data. In the version published on the Website, by clicking on each individual item in the table of contents you will access the information contained therein.
- WHO WE ARE AND HOW YOU CAN CONTACT US
- WHAT PERSONAL DATA WE PROCESS
2.a. Browsing data
2.b. Data provided by you
2.c. Third-party data voluntarily provided by you
2.d. Data relating to you provided by third parties
2.e. Data processed in interaction with social networks
2.f. Special categories of data
2.g. Geolocation
2.i Cookies
- HOW WE USE YOUR PERSONAL DATA, WHY AND ON WHAT LEGAL BASIS
- WHO WE SHARE YOUR PERSONAL DATA WITH
- PERSONAL TRAINING SERVICE
- TRANSFERS OF YOUR PERSONAL DATA ABROAD
- HOW LONG WE RETAIN YOUR PERSONAL DATA
- WHAT YOUR RIGHTS ARE AS A DATA SUBJECT
- HOW WE MAY CHANGE THIS NOTICE
- HOW YOU CAN CONTACT US TO OBTAIN INFORMATION AND EXERCISE YOUR PRIVACY RIGHTS
***
- WHO WE ARE AND HOW YOU CAN CONTACT US
The data controller is the party that, when collecting your data, also decides the methods and purposes of the processing. In your case, the Data Controller of your personal data is Virgin Active Italia S.p.A., with registered office in Corsico (20094 - MI), Via Archimede no. 2, Tax Code and VAT number 03641880962, which manages fitness and wellness centres throughout Italy, where it provides its services to customers in the spirit of innovation and enjoyment.
Virgin Active has appointed a Data Protection Officer (“DPO”), namely a person whose task is to support the Controller in complying with privacy legislation and to monitor compliance with it. Virgin Active's DPO is available for any information concerning the processing of your personal data at the following address: dpo@virginactive.it.
- WHAT PERSONAL DATA WE PROCESS
The personal data processed are as follows:
2.a. Browsing data
The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users who connect to the Website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and IT environment. These data are used solely to obtain anonymous statistical information on the use of the Website, to check its proper functioning, to identify anomalies and/or abuse, and are deleted immediately after processing. The data could be used to establish liability in the event of hypothetical computer crimes against the Website or third parties.
2.b. Data provided by you
When registering with the Clubs (whether personally at the Club or online by purchasing a membership on the E-commerce platform), Virgin Active will process your personal data necessary for your accreditation or for the accreditation of the third party for whom you made the purchase (e.g. the minor over whom you exercise parental responsibility). The processing will concern both common data (for example, first name, surname, e-mail address, gender, date of birth, telephone number, tax code, identity document, address, any billing data, the photograph depicting you taken at the time of registration at the Club) and data falling within the so-called “special categories” pursuant to Article 9(1) of the Regulation, as better specified in paragraph 2.f below.
Other processing of your image may take place because a video camera system is installed inside the Club to protect property and people, and you too may be filmed by such cameras: the images collected are retained for only 24 hours (each day, in fact, the images recorded by the cameras overwrite those from the previous day). A specific notice for this processing is displayed at the Clubs and specific signs indicate the presence of video cameras (e.g. “Video-surveilled area”). For further clarification in this regard, you may contact your Club or write to the contact details indicated in section 10 “how you can contact us to obtain information and exercise your privacy rights” of this Privacy Policy.
Where it is of interest to you, you may benefit from the features made available by the Website by creating a My Virgin Active account through the dedicated section of the Website. You may register on the Website whether you are one of our customers (and in this case you may also register using your card) or whether you are not enrolled in our services. In the first case, from your personal area you may access information relating, for example, to the personal data you provided at the time of registration, the type of your membership, the expiry date of your medical certificate, the class timetable and the regulations of the various Clubs. If, on the other hand, you are not enrolled in our services, by registering you may save your data, book an appointment at a Club, keep your quotes, create a wish list and, where you expressly request it, be contacted by telephone on the day and in the time slot indicated by you or via WhatsApp message. From the reserved area you may also access the possible membership formulas, the personal data you provided when you registered, and the Club regulations.
2.c. Third-party data processed
In order to allow payment for a membership at our Clubs, Virgin Active allows a third party, holder of a credit card or an IBAN in their own name, to pay for your membership on your behalf, allowing you to use our services. The personal data of the person who owns the credit card or current account to which the payment is charged are collected at the time of subscription of the membership by the new Member or, subsequently, in the event of a request for changes, the payment holder will be required to sign this notice directly. In any event, there may be processing of personal data of third parties communicated by you to Virgin Active (for example, first name and surname of the third-party payment holder, credit card number/IBAN details). In such case, the origin of the payment holder's data may be the Member themselves, who is required to adequately inform the third party that their data will be processed for the purposes of “Provision of services”, “Response to requests” and “Compliance” detailed below, and retained by Virgin Active in accordance with paragraph “Data retention”. With respect to this hypothesis under point 2.c.i, we inform you that you act as an independent data controller, assuming all related legal obligations and responsibilities. In this regard, you grant the broadest indemnity against any dispute, claim, request for compensation for damage resulting from personal data processing, etc. that may be received by the Data Controller from such third parties whose personal data have been communicated to Virgin Active. In any event, where you provide or otherwise process personal data of third parties, you hereby guarantee – assuming all related responsibility – that such third parties have been previously informed by you that their personal data would be communicated to Virgin Active, which would process them as described in this notice also drawn up pursuant to Article 14 of the Regulation. The communication of third-party data must in fact be based on the prior acquisition by you of their consent to the processing of such data by Virgin Active.
Furthermore, where you publish on social networks or on any platforms used by you images/videos taken inside our Clubs (in all public access areas) depicting other Members, our collaborators or visitors, we inform you that in such cases Virgin Active does not carry out any processing of the personal data in question and that you act as an independent data controller, assuming all related legal obligations and responsibilities. In this regard, you grant the broadest indemnity against any dispute, claim, request for compensation for damage resulting from processing, etc. that may be received by Virgin Active, which in this case is not the data controller. In any event, we invite you always to behave respectfully towards our Members, collaborators and visitors, always making sure that they do not object to being filmed by you and always informing them about how you will use the
images depicting them. Above all, we recommend that you always request their consent before publishing images depicting them on social networks.
2.d. Data relating to you provided by third parties
It may happen that Virgin Active does not collect your data directly from you, but that they are provided by third parties, as explained in the preceding paragraph. For example, this could happen where one of our customers invites you to our Clubs by giving you a trial lesson or a free day, or where someone has purchased a membership for you through E-commerce. In these cases, the source from which your personal data originate is that described in this paragraph and in the previous one, namely they were provided to Virgin Active by a third party (for example, a person you know who invited you to the Club or gave you a trial day, or who purchased a membership of which you are the beneficiary). We inform you that you may at any time request information on the origin of your data and/or request their erasure by writing to the contact details indicated in the paragraph “How you can contact us to obtain information and exercise your privacy rights”.
2.e. Data processed in interaction with social networks
Where possible, in addition to filling in the dedicated forms for requesting services, you may also register, if you have a Google, Instagram, Linkedin or Facebook account, simply by clicking on the “Register with” button. In these cases, the selected channel will automatically send Virgin Active some of your personal data, specified in the relevant “pop-up” window displayed at the time of the request, and there will be no need for you to fill in any other forms.
Our Website uses the so-called plug-ins of certain social networks, such as Facebook, WhatsApp, Twitter, Linkedin and Instagram.
Further details on Facebook plug-ins and their features can be found at https://developers.facebook.com/docs/plugins; as regards further information on WhatsApp, see https://developers.facebook.com/docs/whatsapp/.
For Twitter, please refer to the link https://developer.x.com/en/docs/x-for-websites, while for Linkedin and Instagram, please refer respectively to https://www.linkedin.com/help/lms/answer/a423796/ and https://developers.facebook.com/docs/instagram. In any event, please refer to the respective privacy policies for any updates that may occur to their content.
To prevent the transmission and storage of data relating to Internet browsing through social networks, the user must log out of them before visiting our Website. To obtain further information on this topic, we invite you to read our Cookie Policy.
2.f. Special categories of data
As a customer of our Clubs, Virgin Active will also process data relating to your health contained in the medical certificate of fitness to carry out fitness&wellness activities, which you are required to provide when registering with the Club or where you request suspension of your membership because you are physically unable to train, or in the other cases provided for in your membership contract. Furthermore, Virgin Active staff may more generally become aware of information relating to your health during training sessions (for example, you may communicate information relating to your conditions that affect the exercises you can perform). This necessarily entails the processing by Virgin Active of personal data which, taken as a whole, may reveal your state of health and which therefore fall within the special categories of personal data referred to in Article 9 of the Regulation.
As better explained in the membership contract, in order to train inside Virgin Active Clubs, it is necessary to provide a medical certificate of fitness to carry out fitness&wellness activities. To this end, you may deliver a copy of the certificate issued by your doctor or use the medical examination booking services made available at our Clubs and undergo a check-up with Virgin Active's affiliated medical centres, often located at the Clubs themselves. In this second case, the medical certificate must typically be delivered by you to Virgin Active reception and, only in exceptional cases, Virgin Active may obtain it directly from the doctor who performed the examination. We remind you that, even when you undergo the medical examination at the Club premises, the doctors who examine customers act as independent data controllers and Virgin Active merely makes the premises available to them. This means that they decide the methods and purposes of the processing of the personal data of the patients they examine. In this regard, they will provide patients with a specific privacy notice explaining how they will process their data when they carry out that medical examination.
2.g. Geolocation
The desktop version of the Website, through the “locate me” function and subject to your express authorisation, processes data relating to your location in order to provide you with the service that allows you to find the Clubs nearest to you. If you click on the “locate me” button, a “pop-up” appears asking for authorisation to geolocate your device. As a user, you always have the option to deny the Website access to your location data through your device settings. In particular, to disable this function you must click on the padlock-shaped icon next to the URL and change the geolocation preferences.
As regards the mobile version of the Website, you may enable and disable geolocation according to your mobile phone settings.
2.i. Cookie
In addition to using technical cookies necessary for the proper functioning of the Website, we also use – subject to your consent – third-party cookies to pursue further purposes such as:
- functionality (for example, to remember the user's preferences);
- experience improvement (for example, to personalise browsing and interaction with the Website content);
- measurement (for example, to collect aggregate statistical information on the use of the Website);
- marketing, including the personalised ads service, which allows advertising content to be displayed based on your interests and browsing behaviour, including on third-party websites.
Full details relating to the cookies used, the< categories and providers, as well as the methods for giving or withdrawing consent, are available in our Cookie Policy at the following link: Cookie Policy.
For further information on Google's data processing practices in the context of its advertising services, we also invite you to consult Google's Privacy Policy at the following link: https://business.safety.google/privacy.
- HOW WE USE YOUR PERSONAL DATA, WHY AND ON WHAT LEGAL BASIS
Your personal data (whose nature and type are described in the section “WHAT PERSONAL DATA WE PROCESS“) will be processed with automated and non-automated tools. Specific security measures are observed to prevent data loss, unlawful or improper use and unauthorised access.
They will be processed, with your consent where necessary, for the following purposes, where applicable:
3.1. Provision of services: depending on the specific case, your data will be processed to allow you to conclude contracts for the provision by Virgin Active of fitness and wellness services, to allow you to browse the Website (including its E-commerce section), to allow you to take part in any prize operations and/or competitions organised from time to time and, in general, to receive the various services provided by Virgin Active, including any services that may be purchased through the Website. It should be specified that the provision of services also includes the sending of communications – including via WhatsApp - strictly related to the proper provision of Virgin Active services (for example, to notify you of the upcoming expiry of your medical certificate, to inform you of the approaching renewal of your membership, in the event of maintenance of one or more Club areas, or to send you a communication informing you of the temporary closure of the same), or related to the management of the pre-contractual or contractual relationship in place between you and Virgin Active (for example, to confirm and summarise the details of the meeting at the Club once an appointment has been booked by telephone, communications relating to membership payments, or where one or more payments relating to your contract are unpaid).
Through Virgin Active you may also use the medical examination booking services made available at our Clubs and undergo a check-up with Virgin Active's affiliated medical centres, in order to obtain the issue of a medical certificate of fitness to carry out fitness&wellness activities that will allow you to train at our Clubs. In these cases, Virgin Active processes your data only for the purpose of making bookings, while the doctors are independent controllers of these data, processing them in accordance with what is indicated in their data processing notices.
The processing of your personal data for the purpose of Provision of services (section 3.1) is necessary in order to provide you with the requested services. This processing is based on Article 6(1)(b) of the Regulation ([…]processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract). The provision of your personal data for this purpose is optional, but failure to provide them would make it impossible to activate or provide the services requested by you.
The processing of personal data relating to your state of health is based on your consent, in accordance with Article 9(2)(a) of the Regulation ([…]the data subject has given explicit consent to the processing of those personal data for one or more specified purposes). The provision of your consent is optional, but in its absence we will not be able to provide you with the requested service, in order to protect the safety of your training sessions, as the medical certificate is an indispensable requirement for being able to train in our Clubs.
3.2. Response to requests: specific requests addressed to Virgin Active, including any requests to receive specific information on Virgin Active services submitted through our platforms and/or through the completion of online forms or paper forms, also during external events (so-called “outreach” activities).
The processing of your personal data for the purpose of Response to requests (section 3.2) is necessary in order to provide you with the requested services. This processing is based on Article 6(1)(b) of the Regulation ([…]processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract). The provision of your personal data for this purpose is optional, but failure to provide them would make it impossible to activate or provide the services requested by you. For this purpose, we may also process special categories of data, for example where you request suspension of your membership.
3.3. Compliance: to fulfil any obligations provided for by applicable laws, regulations or EU legislation, or to satisfy requests from the authorities.
The processing of your personal data for this purpose is necessary to comply with legal obligations to which Virgin Active is subject. This processing is in fact based on Article 6(1)(c) of the Regulation ([…]processing is necessary for compliance with a legal obligation to which the controller is subject).
This processing may involve the communication of your personal data to the authorities and the retention of your data for accounting, tax or other obligations borne by Virgin Active.
3.4. Soft Opt-in: by e-mail, offers on products or services similar to those you have purchased, unless you expressly refuse to receive such communications, which you may do at any time.
This processing is lawful pursuant to Article 130(4) of the Privacy Code and does not require your consent, provided that these are communications about products or services similar to those that were the subject of your purchase and that you, having been adequately informed, do not refuse such use of your e-mail address, initially or in connection with subsequent communications received.
This means that you may object to the processing of your personal data for this purpose both when requesting the products and services available on the Website (by expressly denying consent to processing for Marketing purposes) and in connection with subsequent commercial communications related to your purchase received from the Controller, by writing to the contact details indicated in the section “how you can contact us to obtain information and exercise your privacy rights” of this notice.
3.5. Marketing: to carry out marketing activities such as: preparing market studies, research and statistics; sending you promotional material relating to the activities, services and products of Virgin Active and its commercial Partners (without any communication of personal data owned by Virgin Active to those Partners). Such communications may be made by e-mail, by SMS, by WhatsApp, by postal mail, by telephone with an operator and/or through Virgin Active's official pages on social networks and the placement of banners on third-party websites. It is specified that the Controller collects a single consent for the marketing purposes described here, pursuant to the General Provision of the Italian Data Protection Authority “Guidelines on promotional activity and combating spam”, dated 4 July 2013. The processing carried out for the Marketing purposes described in this section requires your prior consent pursuant to Article 6(1)(a) (“[…] the data subject has given consent to the processing of his or her personal data for one or more specific purposes”). The provision of your personal data for this purpose is therefore entirely optional and does not in any way affect the use of the services. This means that if you do not wish to give such consent, you may still use the services made available. The only consequence of your failure to give such consent will be that you will not be able to receive benefits, discounts, promotional codes, commercial offers and Virgin Active promotions reserved for its current or future customers.
In any event, if you wish to object to the processing of your personal data for Marketing purposes, you may do so at any time through the “Settings” of the MyVirginActive App if you use it, or by contacting the Controller at the contact details indicated in the section “How you can contact us to obtain information and exercise your privacy rights” of this notice. In the latter case, in order to allow you to exercise your rights in the best possible way and to withdraw all consents you may have given, if you have registered on Virgin Active systems with several e-mail addresses/telephone numbers, we ask you to specify the e-mail addresses and/or telephone numbers with respect to which you intend to withdraw your consent for communications for marketing purposes. Withdrawal of your consent may be requested by you at any time and does not affect the lawfulness of processing carried out before the withdrawal.
3.6. Profiling Virgin Active carries out different types of profiling:
– Necessary profiling. This type of profiling is necessary to allow you to conclude the membership contract where you wish to register by purchasing a membership online, because the Website is able to recognise whether you have already been a Virgin Active Member and whether there are any arrears or other cases of contractual non-performance attributable to you, in full compliance with the General Membership Conditions. In these cases, the Website suspends the possibility of completing the online purchase of the membership and invites you to go to the Club for personalised management of your renewal request. This processing is entirely analogous to that carried out offline at the Clubs in the event of membership renewal by a former Member: where Virgin Active finds that the former Member has not complied with the Club regulations or that there are unpaid amounts attributable to them or other cases of contractual non-performance, the new registration may be precluded. The processing of your personal data for the purpose of Necessary profiling is based on Article 6(1)(b) of the Regulation ([…]processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract) and on Article 22(2)(a) of the Regulation. The provision of your personal data for this purpose is optional, but failure to provide them would make it impossible to activate or provide the services requested by you.
– Profiling for marketing purposes. This type of profiling is aimed at taking your interests into account in order to provide you with personalised communications and content through the Virgin Active Website and commercial communication channels, without the use of cookies. For processing related to the use of cookies, please refer to the specific “Cookie” section of this Privacy Policy.
When you log in, the Virgin Active Website and its E-commerce section, by checking whether your e-mail address is already present in the database, are able to qualify you as a Virgin Active Member or not; send differentiated service communications to Members according to the Club they belong to; differentiate communications intended for Members from those for non-Members; send you specific communications relating to a particular additional service purchased by you.
This processing of your data is based on Virgin Active's legitimate interest in optimising and making its commercial communications more effective, as permitted by Article 6(1)(f) of the Regulation (“[…]processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party”). Virgin Active specifies that it has carried out a balancing exercise in this regard between its interest and the rights and freedoms of the data subjects, and that, based on the considerations made, it believes that in this case the interests and rights of the latter are not prejudiced by the processing in question.
In any event, if you wish to object to the processing of your personal data for Profiling for marketing purposes, you may do so at any time by contacting the Controller at the contact details indicated in the section “how you can contact us to obtain information and exercise your privacy rights” of this notice.
3.7 Improvement of the services offered to guarantee you the highest possible level of service. To do this, we may ask you for feedback on your experience at Virgin Active, precisely in order to improve the services offered to you and already purchased.
By way of example, here are some cases of how we may process your data for this purpose:
– when you register with our Clubs, there are certain activities to be carried out in order to correctly activate the membership; we may send you communications to make sure that you have correctly activated your membership and to collect your first feedback on the service purchased by you;
– where we detect that, despite payment of a monthly fee, you are unable to attend our Clubs, we may send you communications aimed at understanding the reason for such low attendance and also at helping you find alternative solutions, for example suspension of the membership or its transfer to a third party where you are unable to attend;
– in the event of cancellation of the membership, we may send you communications to obtain feedback on your experience at our Clubs.
This processing is based on the legal basis of Virgin Active's legitimate interest in improving its service and guaranteeing you the best possible service.
For all the processing described above based on legitimate interest pursuant to Article 6(1)(f) of the Regulation, Virgin Active has verified that the interests and fundamental rights of the data subject do not override the interests of the Data Controller, especially considering that the data subjects can reasonably expect such processing of their personal data by virtue of their relationship with the data controller (with whom there is a contractual relationship).
In any event, if you wish to object to the processing of your personal data for the purposes of Improvement of the services offered, you may do so at any time by contacting the Controller at the contact details indicated in the section “How you can contact us to obtain information and exercise your privacy rights” of this notice or, where available, through the “Settings” of the MyVirginActive App.
3.8 Statistics for statistical purposes, without it being possible to trace back to your identity.
It is specified that this processing is not carried out on personal data and may therefore be freely performed by Virgin Active.
- WHO WE SHARE YOUR PERSONAL DATA WITH
Your personal data may be shared, for the purposes referred to in section 3 of this Privacy Policy, with:
4.1. parties that typically act as data processors, namely: i) persons, companies or professional firms that provide assistance and consultancy to Virgin Active in accounting, administrative, legal, tax and financial matters; ii) parties delegated to carry out technical maintenance of the IT systems and the Website;
iii) credit institutions, insurance companies and brokers; vi) companies to which Virgin Active has entrusted the service of recovering its unpaid receivables (collectively “Recipients”). By way of example, the Website is created by Gamma Studio S.r.l., with registered office at 20124 - Milan (MI), Via V. Pisani no. 6, which operates as a data processor by virtue of a specific contract entered into pursuant to Article 28 of the Regulation;
4.2. parties, entities or authorities to whom it is mandatory to communicate your personal data pursuant to legal provisions or orders from the authorities;
4.3. parent, subsidiary and associated companies of Virgin Active, limited to the pursuit of internal administrative-accounting purposes connected with the performance of organisational, administrative, financial and accounting activities;
4.4. medical practices affiliated with Virgin Active, in the event of a request to book medical examinations with them for the purpose of issuing the medical certificate of fitness to carry out recreational-motor activity;
4.5. persons authorised by Virgin Active to process personal data necessary to carry out activities strictly related to the provision of services, who have undertaken confidentiality obligations or have an appropriate legal obligation of confidentiality, such as, by way of example, Virgin Active employees, floor assistants, Group Trainers, Gym Trainers and Personal Trainers.
Outside the cases indicated above, your data will not be disclosed except to parties, entities or Authorities to whom communication is mandatory pursuant to legal or regulatory provisions.
- PERSONAL TRAINING SERVICE
5.1. Virgin Active makes available to customers the possibility of training at Virgin Active Clubs or outdoors with a Personal Trainer (the “Personal Training” service). Such Personal Trainers act as persons authorised to process your personal data, which are controlled by Virgin Active. This means that, where you decide to train with a Personal Trainer, on the one hand they will have access to the personal data already provided by you to Virgin Active (such as the training data contained in the App and the contact data) and, on the other, they will process the personal data that you provide to them during the training session. In both cases, the Personal Trainer will process your personal data in accordance with the specific instructions provided by Virgin Active, which remains, also in these cases, the sole Data Controller of your personal data.
5.2. Where you use the Personal Training service, Virgin Active, as Data Controller, is informed of this by the Personal Trainer themselves; this information is necessary for organisational purposes and for the management of work and spaces, as well as to allow the management of your training sessions with the Personal Trainer. Your name, within Virgin Active's IT systems, will therefore be associated with that of your Personal Trainer, and vice versa: without this association, the Personal Training service cannot be provided.
- TRANSFERS OF YOUR PERSONAL DATA ABROAD
Some of your personal data are shared with Recipients who may be located outside the European Economic Area (“EEA”). Virgin Active makes every effort to ensure that the processing of your personal data by these Recipients takes place in compliance with the Regulation. Indeed, transfers may be based on an adequacy decision or on the Standard Contractual Clauses adopted from time to time by the European Commission for the transfer of Personal Data from a Controller established in the EU to an entity outside the EEA, or on standard data protection clauses adopted by the Commission according to the examination procedure referred to in Article 93(2) of the Regulation, or also on standard data protection clauses adopted by a supervisory authority and approved by the Commission according to the examination procedure referred to in Article 93(2) of the Regulation.
Further information is available by sending a written request to the Controller at the contact details indicated in the section “how you can contact us to obtain information and exercise your privacy rights” of this notice.
- HOW LONG WE RETAIN YOUR PERSONAL DATA
We will retain your personal data for different periods depending on the purpose for which we collected them:
- Provision of services and Response to requests (sections 3.1 and 3.2): we will retain the data for the time strictly necessary to achieve the purposes related to each individual service or request. In any event, since these are processing operations carried out for the provision of services, Virgin Active will avail itself of the possibility allowed by law (Article 2946, Italian Civil Code) to retain the personal data necessary to protect its interests for the period provided by law. In particular, we will retain medical certificates for a period of 5 years from their expiry date and the data processed in the context of your membership for a period of 10 years from the termination of the membership itself. In the event of a request to be contacted again pursuant to purpose 3.2 (Response to requests), where you are not a Member, your personal data will be erased once the purpose has been fulfilled, unless there is a valid legal basis for their further processing. In general, once the envisaged retention period has expired, we will delete them. This processing is based on Virgin Active's legitimate interest in defending itself in court and, in general, protecting its rights, as permitted by Article 6.1.f) of the Regulation, and is carried out downstream
of an assessment of the prevalence of that interest over the fundamental rights and freedoms of the data subjects, which in this case Virgin Active does not consider to be prejudiced;
- Compliance (section 3.3): we will retain the data for the time provided by the specific applicable legal obligation or rule;
- “Soft Opt-in” (section 3.4): we will retain the data until you have objected to the processing, requesting not to be the recipient of commercial communications any longer;
- Marketing (section 3.5): as a general rule, we will retain the data until withdrawal of your consent and/or request for erasure of the data;
- Profiling (section 3.6): in the case of Necessary profiling, we will retain the data for the time strictly necessary to achieve the purposes related to each individual service or request, as better specified in the first paragraph of this section 7. In the case of Profiling for marketing purposes, for the entire duration of the provision of the service and as long as you do not object to such processing;
- Improvement of the services offered (section 3.7): we will retain the data for the entire duration of the provision of the service and as long as you do not object to such processing.
Further information regarding the data retention period and the criteria used to determine that period may be requested by sending a written request to the Controller at the contact details indicated in the section "how you can contact us to obtain information and exercise your privacy rights " of this notice. In any event, Virgin Active's right to retain your personal data for the period of time provided for and permitted by Italian law to protect its interests remains unaffected (Article 2947, paragraphs 1 and 3, Italian Civil Code).
- WHAT YOUR RIGHTS ARE AS A DATA SUBJECT
Pursuant to Articles 15 et seq. of the Regulation, you have the right to ask Virgin Active, at any time, for access to your personal data, their rectification or erasure, or to object to their processing pursuant to Article 21 of the Regulation. You also have the right to request restriction of processing in the cases provided for by Article 18 of the Regulation, as well as to obtain, in a structured, commonly used and machine-readable format, the personal data concerning you in the cases provided for by Article 20 of the Regulation.
With specific reference to your right to obtain erasure of your personal data, we wish to clarify that the applicable legislation provides that personal data that are necessary cannot be erased (pursuant to Article 17(3) of the Regulation). Consequently, when you request erasure of your personal data, the erasure cannot also include the data described above.
To exercise the above rights, requests must be addressed in writing to the Controller at the contact details indicated in the section “how you can contact us to obtain information and exercise your privacy rights” of this notice.
We inform you that, in order to correctly respond to your requests to exercise rights, Virgin Active needs to identify you adequately within its systems. For this reason, we hereby ask you, when exercising your rights, to kindly provide us with any information useful to identify you uniquely and to specify, for example, first name, surname, e-mail address and mobile phone number.
Furthermore, we inform you that, for security reasons, before responding to requests for access and portability, our internal procedures require us to ask you for a copy of your identity document.
In any event, you always have the right to lodge a complaint with the competent supervisory authority (Italian Data Protection Authority), pursuant to Article 77 of the Regulation, or to apply to the competent ordinary judicial authority where you believe that the processing of your data is contrary to the legislation in force.
- HOW WE MAY CHANGE THIS NOTICE
Virgin Active reserves the right to update the content of this notice, in part or in full, also due to changes in the applicable legislation. Where the changes concern substantial changes in the processing operations or have a significant impact on customers, Virgin Active will duly notify them. Virgin Active therefore invites you to visit this section of the Website regularly, where you can always find the most recent and updated version of the Privacy Policy, so that you are kept up to date on the data collected and how Virgin Active uses them.
- HOW YOU CAN CONTACT US TO OBTAIN INFORMATION AND EXERCISE YOUR PRIVACY RIGHTS
To exercise your privacy rights or for any other request for information regarding the processing of your personal data, you may write to the Data Controller: Virgin Active Italia S.p.A., Corso Como 15, Milan (MI).
In addition, the DPO is available at the following address: dpo@virginactive.it.
(Website / E-commerce / Members Privacy Policy 1.1 - U.V. 28.04.2025)
