PRIVACY POLICY

PERSONAL DATA PROCESSING PRINCIPLES
COOKIES AND WEBSITE PROCESSING POLICY
INFORMATION ON THE USE OF FINGERPRINT READERS

Form Factory Slovakia s.r.o.
Prievozská 14, 821 09 Bratislava
Zapísaná v OR OS Bratislava 1, Oddiel sro, Vložka č.: 137901/B
IČO: 52386660, DIČ: 2121036665
IČ DPH: SK212 103 66 65

FitCamp s.r.o
Prievozská 14, 821 09 Bratislava
Zapísaná v OR OS Žilina, Oddiel sro, Vložka č.: 85634/L
IČO: 56442114, DIČ: 2122312203
IČ: DPH SK2122312203, podľa §4, registrácia od 25.10.2024

PERSONAL DATA PROCESSING PRINCIPLES
INFORMATION FOR CLIENTS AND BUSINESS PARTNERS

Content

Basic information and contact details

Form Factory Slovakia s.r.o., with its registered office at Prievozská 14, 821 09 Bratislava – Ružinov district, Company Registration No.: 52 386 660, registered in the Commercial Register, (hereinafter referred to as the “Company”, “we”, “Controller”, or “Form Factory”) regards the protection of personal data as an important part of its business. This Privacy Policy explains how we process the personal data of visitors to our websites, prospective service recipients, our customers, persons who contact us, business partners, job applicants and other data subjects.

In processing personal data, we act primarily in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) (hereinafter also referred to as the “Regulation” or “GDPR”) and Act No. 18/2018 on the Protection of Personal Data and on Amendments and Supplements to Certain Acts, as amended (hereinafter also referred to as the “Act” or “Act No. 18/2018”) and other applicable legislation.

We may amend or update these Policies from time to time, in particular in the event of changes to legislation, our processes, technologies used, or the group structure relevant to the processing of personal data.

The current version will always be published on our website.

Who is the controller of your personal data

The controller of your personal data is:

Form Factory Slovakia s.r.o.
Prievozská 14
821 09 Bratislava – Ružinov district
Company Registration No.: 52 386 660

Registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 137901/B
e-mail: osobneudaje@formfactory.sk

How to contact us

For matters concerning the protection of personal data, you may contact us by email at osobneudaje@formfactory.sk or in writing at our registered office.

Should we appoint a data protection officer in the future and publish his or her contact details, we will include such details in this document or on our website.

What personal data we process

The scope of personal data processed depends on your relationship with our Company. Such data may include in particular:

  • identification data, in particular first name, surname, title, date of birth or another identifier where required for a specific service;
  • contact data, in particular email address, telephone number, correspondence address or residential address;
  • contractual and membership data, in particular data relating to the conclusion, duration and termination of membership, type of service, payments, use of services, reservations and communications with us;
  • website and online services usage data, in particular IP address, device data, logs, technical identifiers, data obtained through cookies and similar technologies, and data about your activity on the website or in the online interface;
  • communications data, meaning the content of your messages, requests, complaints, enquiries and other communications with us;
  • data processed in connection with the exercise of data subjects’ rights, complaints, legal claims and inspections;
  • CCTV footage from premises monitored by a closed-circuit television system, should you enter such premises (such premises are always specifically marked).

Where necessary, we may also process other data where required for the provision of a specific service, compliance with a legal obligation or the protection of our legitimate interests.

Sources from which we obtain personal data

We obtain personal data primarily directly from you, in particular when:

  • you visit one of our fitness clubs;
  • you visit our website, use the online functionalities (E-fitness), or our My Form Factory Slovakia application;
  • you complete a form, order, request or other registration;
  • you enter into a contract with us or request our services;
  • you contact us by email, telephone, in person or via social media networks;
  • you enter monitored premises;
  • you file a job application with us.

In justified cases, we may also obtain personal data from third parties, such as your employer, a person who registered you for a specific service, providers of payment or IT services, our business partners or from publicly available registers, where this is necessary and lawful.

Purposes and legal bases for processing

Provision of services, conclusion and performance of contracts

We process your personal data for the purposes of concluding contracts, managing memberships, providing our services, processing reservations, recording payments, communicating in relation to the contract, and fulfilling rights and obligations arising from the contractual relationship.

The legal basis is the performance of a contract pursuant to Article 6(1)(b) GDPR (resp. Section 13(1)(b) of the Act), or the taking of steps at your request prior to entering into a contract.

Where you make use of a one-time entry or another entry without a specific membership agreement (i.e. without registration through our website or the E-fitness application, such as when you are entering as a holder of the Multi-sport card), we may process your personal data for the purposes of recording entry, verifying that entry conditions have been met, ensuring security within the club, protecting our property and establishing or defending potential legal claims. For these purposes, we process in particular identification and contact data, or data confirming that entry to the club was made; where necessary, we may also request that you prove your identity by presenting an identity document (for the purpose of protecting the health of children and minors, or where you have caused damage to our equipment). The legal basis for processing is the performance of a contract pursuant to Article 6(1)(b) GDPR, where the processing concerns the provision of a one-time entry or other ordered service, and our legitimate interest pursuant to Article 6(1)(f) GDPR, where the processing concerns entry records, monitoring compliance with club rules, ensuring safety, protecting property and establishing or defending legal claims. We retain personal data for these purposes only for as long as is necessary to fulfil the stated purposes.

Operation of the website, online platform and IT security

We also process personal data for the purposes of ensuring the proper operation of the website, online accounts, the E-fitness online functionality, the My Form Factory Slovakia application, system administration, incident prevention, error detection, network protection and information security.

The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR (resp. Section 13(1)(f) of the Act), consisting in ensuring the functionality, stability and security of our systems and services.

Communications, handling of enquiries, requests, complaints and submissions

When you contact us, we process your data for the purpose of handling your enquiry, submission, complaint, request or other communication.

The legal basis is either the performance of a contract, compliance with a legal obligation, or our legitimate interest in the proper handling of communications and the protection of the Company’s legal positions pursuant to Article 6(1)(f) GDPR (resp. Section 13(1)(f) of the Act).

Compliance with legal obligations

We also process personal data where required to do so by legislation, in particular in the fields of accounting, taxation, consumer protection, personal data protection or otherwise.

The legal basis is compliance with a legal obligation pursuant to Article 6(1)(c) GDPR (resp. Section 13(1)(c) of the Act).

Direct Marketing

Where permitted by law, we may process your personal data for the purposes of direct marketing of Form Factory’s own similar services, in particular for sending newsletters, offers, information about products, memberships, promotions, clubs and services provided within the Form Factory network in Slovakia, including clubs or facilities whose premises or related infrastructure may be owned or managed by other companies of the Form Factory group in Slovakia, provided that such services are provided to the customer by Form Factory. You may object to the use of your personal data for direct marketing purposes or unsubscribe at any time.

Where consent is required under applicable laws, we will conduct such marketing only on the basis of your consent. In other cases, we may rely on our legitimate interest in the reasonable promotion of our own services.

The legal basis is Article 6(1)(a) GDPR (resp. Section 13(1)(a) of the Act) or Article 6(1)(f) GDPR (resp. Section 13(1)(f) of the Act), depending on the specific case and the communication channel used, in conjunction with Section 116(14) and (15) of the aforementioned Act No. 452/2021 Coll. on electronic communications.

Analytics, traffic measurement and service improvement

We may process data on the use of the website, applications or online interfaces for the purposes of analytics, statistics, traffic measurement, functionality evaluation, content and service improvement, and user experience optimisation.

Where required, such processing is carried out on the basis of your consent given through the so-called “cookie banner” or another appropriate mechanism. In other cases, we may rely on legitimate interest, where the analytics are strictly necessary or proportionate without undue interference with your privacy.

The legal basis is Article 6(1)(a) or (f) GDPR (resp. Section 13(1)(a) or (f) of the Act).

Establishment, exercise and defence of legal claims

We may also process personal data for the purposes of protecting our rights, establishing, exercising or defending legal claims, resolving disputes, enforcing receivables or protecting against misuse of services.

The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR (resp. Section 13(1)(f) of the Act).

Protection of property and personal safety

Where you enter monitored premises, we may process your personal data in the form of CCTV footage for the purposes of protecting property, ensuring personal safety, preventing incidents, detecting unlawful conduct and responding to security events. Premises of our clubs that are monitored in this manner are always specifically marked.

The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR (resp. Section 13(1)(f) of the Act).

Recruitment – job applicants

In connection with recruitment and the hiring of new employees, we process the personal data of job applicants, in particular identification and contact data, as well as other data contained in a curriculum vitae or provided during the recruitment process, primarily data relating to education, qualifications, previous work experience, completed training, knowledge of foreign languages, and any other relevant data pertaining to a specific position. To the extent necessary, we may also process data concerning the preferred Form Factory club or information on medical fitness, where such data is required for a specific position under special legislation.

We process applicants’ personal data primarily for the purposes of assessing the suitability of a candidate, conducting the recruitment process and taking steps prior to concluding an employment contract or a contract for work performed outside an employment relationship. The legal basis is the performance of pre-contractual measures at the applicant’s request pursuant to Article 6(1)(b) GDPR. Where an applicant gives us consent to be included in the internal candidate database, we may also process their personal data for the purpose of approaching them with other suitable job offers; in such cases, the legal basis is consent pursuant to Article 6(1)(a) GDPR.

We obtain personal data primarily directly from the applicant, namely from the curriculum vitae, contact form, email correspondence, during a face-to-face or online interview, or through other mutual communications. In justified cases, we may also obtain such data from our employee, where that employee has referred the applicant and it is evident that such referral occurred with the knowledge of the data subject.

The provision of personal data to the extent required for the recruitment process is necessary in order for us to include the applicant in the recruitment process and assess their suitability for the position. If such data is not provided, we may not be able to proceed with the applicant in the recruitment process. This does not apply to data provided solely on the basis of consent.

Where an applicant is unsuccessful in the recruitment process, fails to meet the required criteria, the position has already been filled or the recruitment process is cancelled, we will erase without undue delay the personal data processed for the purposes of that specific recruitment process, unless another statutory ground for further retention exists. This does not apply where the applicant has given consent to their inclusion in the internal database for future suitable job opportunities. In such case, we retain the data for a period of up to one year from the date of granting consent, unless consent is withdrawn earlier.

Structured overview of purposes and legal bases for processing

For greater transparency, we set out below a structured overview of the main purposes and legal bases for processing. This overview complements the information provided above and may describe certain processing situations in a more detailed or specific manner.

Purpose of Processing:Legal Basis:
Conclusion, administration and performance of membership agreements and other contracts for the provision of Form Factory services, included, but not limited to, where the contract is concluded, managed or performed through our website, the E-fitness online interface or the My Form Factory Slovakia application (Section 2.1 above) Performance of a contract or taking steps at your request prior to entering into a contract, where the processing is necessary for the conclusion, administration or performance of the relevant membership agreement or other contract for the provision of Form Factory services (Article 6(1)(b) GDPR; Section 13(1)(b) of Act No. 18/2018) Where the processing concerns the provision of a one-time entry or other ordered services without a specific membership agreement, including the entries based on the Multi-sport card, and our legitimate interest pursuant to Article 6(1)(f) GDPR (Section 13(1)(f) of Act No. 18/2018), where the processing concerns entry records, monitoring compliance with club rules, ensuring safety, protecting property and establishing or defending legal claims.  Should we offer, at a specific club, additional forms of entry identification based on physical appearance or biometric features, we will process such data solely on the basis of your freely given and explicit consent in accordance with Article 9(2)(a) GDPR and the relevant provisions of Act No. 18/2018.
Operation, administration, maintenance and security of our website, E-fitness online interface, My Form Factory Slovakia application and related IT systems (Section 2.2 above)Our legitimate interest in ensuring the proper operation, functionality, stability, security and protection of our websites, applications, online services and IT infrastructure (Article 6(1)(f) GDPR; Section 13(1)(f) of Act No. 18/2018)
Facilitating the use of our website, online interfaces and application, maintaining statistics, measuring traffic, evaluating functionality, improving and developing our services, content and user experience, including, where applicable, through cookies or similar technologies (Section 2.6 above)Where consent is required for the use of cookies or similar technologies, or for the related processing of personal data, the legal basis is your consent (Article 6(1)(a) GDPR; Section 13(1)(a) of Act No. 18/2018). In other cases, i.e. where the processing is strictly necessary for the operation of the service or consists of proportionate internal analytics that do not unduly interfere with your privacy, the legal basis is our legitimate interest in improving and developing our services, content and user experience (Article 6(1)(f) GDPR; Section 13(1)(f) of Act No. 18/2018).
Provision of services involving special categories of personal data (e.g. health data), where relevant for a specific serviceYour explicit consent (Article 9(2)(a) GDPR; Section 16(2)(a) of Act No. 18/2018).
Displaying clubs or premises nearest to your location in the search engine or applicationOur legitimate interest in assisting you to locate the nearest club or premises, subject to your consent to access location data (Article 6(1)(f) GDPR; Section 13(1)(f) of Act No. 18/2018).
Organising a contest or prize draw, including selection of the winner, delivery of the prize and publication of the winner’s personal data, where requiredOur legitimate interest in organising a contest or prize draw (Article 6(1)(f) GDPR; Section 13(1)(f) of Act No. 18/2018) or Article 6(1)(b) GDPR (Section 13(1)(b) of Act No. 18/2018) if the contest or price draw is organised in the framework of a performance of a contract.
Operating our profiles and pages on social media networksOur legitimate interest in promoting our products and services, including maintaining statistics on the use of our social media profiles and pages (Article 6(1)(f) GDPR; Section 13(1)(f) of Act No. 18/2018).
Direct marketing of our products and servicesOur legitimate interest in promoting our own products and services, in particular in relation to existing customers, or your consent, in particular where marketing is addressed to non-customers or where required by law (Article 6(1)(f) or Article 6(1)(a) GDPR; Section 13(1)(f) or Section 13(1)(a) of Act No. 18/2018). Where the use of a particular communication channel is regulated by Act No. 452/2021 Coll. on electronic communications, we comply with the applicable consent or opt-out requirements, including any statutory exception.
Displaying advertisements or offers tailored to your interests, activity on websites and applications, or your locationOur legitimate interest in promoting our products and services and in measuring the effectiveness of our advertising activities (Article 6(1)(f) GDPR; Section 13(1)(f) of Act No. 18/2018); where such advertising or personalisation relies on cookies, similar technologies or location data, the relevant processing is based on your consent, where required by law (Article 6(1)(a) GDPR; Section 13(1)(a) of Act No. 18/2018, in conjunction with Act No. 452/2021 Coll. on electronic communications).
Delivering marketing content (personalised or non-personalised) through communication channels such as email, push-notifications, SMS/MMS or telephoneOur legitimate interest in direct marketing of our products and services, or your consent, where required by law or where marketing is addressed to non-customers (Article 6(1)(f) or Article 6(1)(a) GDPR; Section 13(1)(f) or Section 13(1)(a) of Act No. 18/2018). Where the use of a particular communication channel is regulated by Act No. 452/2021 Coll. on electronic communications, we comply with the applicable consent or opt-out requirements, including any statutory exception.
Conducting analytics, marketing statistics, service satisfaction surveys and profiling, i.e. using data about your interests for the purpose of tailoring offers and contentOur legitimate interest in evaluating the effectiveness of marketing activities, improving the quality of customer service and improving our products and services; in the case of special categories of personal data, your explicit consent (Article 6(1)(f) and, where applicable, Article 9(2)(a) GDPR; Section 13(1)(f) and, where applicable, Section 16(2)(a) of Act No. 18/2018).
Entering into and performance of contracts and maintenance of cooperation with business partners, customers and other partnersWhere you are a party to the contract, we process your data for the purpose of entering into and performing that contract (Article 6(1)(b) GDPR; Section 13(1)(b) of Act No. 18/2018). Where you are a representative or contact person of our partner, the processing is based on our legitimate interest in being able to properly conclude and perform the contract and to cooperate with our partner (Article 6(1)(f) GDPR; Section 13(1)(f) of Act No. 18/2018).
Handling of a matter you have notified to us, including responding to your enquiry or processing a complaintOur legitimate interest in handling enquiries and complaints and in ensuring a high quality of service; or compliance with a legal obligation, where your request constitutes the exercise of a right under the GDPR or another statutory claim (Article 6(1)(f) or (c) GDPR; Section 13(1)(f) or (c) of Act No. 18/2018).
Compliance with legal obligations, in particular obligations arising from accounting and tax regulationsThe applicable statutory provision and compliance with a legal obligation (Article 6(1)(c) GDPR; Section 13(1)(c) of Act No. 18/2018).
Establishment, exercise or defence of legal claimsOur legitimate interest in being able to establish or defend a legal claim; in the case of special categories of personal data, also, where applicable, Article 9(2)(f) GDPR (Section 13(1)(f) of Act No. 18/2018 and, where applicable, Section 16(2)(f) of Act No. 18/2018).
Operation of the CCTV system in our clubs and premisesOur legitimate interest in protecting property, ensuring personal safety, preventing incidents, detecting unlawful conduct and responding to security events (Article 6(1)(f) GDPR; Section 13(1)(f) of Act No. 18/2018).

CCTV System

Our fitness clubs may operate a CCTV system. Monitored premises are always specifically marked.

CCTV footage is used exclusively for the purposes stated above (protection of property, personal safety, prevention of incidents, detection of unlawful conduct and response to security events). Access to footage is restricted to authorised persons and only to the extent necessary to fulfil the purpose of processing.

Unless a specific recording is required to document a security incident, damage, unlawful conduct, or to support a legal claim, CCTV recordings are generally retained for 72 hours from the time of their creation, after which they are automatically deleted.

Where a specific recording is required to clarify an incident or to protect the rights of the Company or third parties, or in specific situations that require a prolonged retention period (such as public holidays or a prolonged closure of the premises), we may retain it for a longer period as necessary to achieve the purpose of the processing. Similarly, CCTV footage may, to the extent strictly necessary, be disclosed to third parties where required by special legislation or where necessary to protect the rights and legitimate interests of the Company or third parties. This applies in particular to public authorities (e.g. the Police, courts, law enforcement authorities) in connection with investigating unlawful conduct, as well as to insurers or legal representatives in the context of establishing or defending legal claims. In all cases, disclosure takes place only to the extent necessary to achieve the intended purpose and in compliance with the principle of data minimisation.

Marketing and social media networks

General information

The manner in which we process personal data for marketing purposes depends on the type of relationship between us and you (for example, whether you have registered on our website or in the mobile application, whether you are our customer with a membership agreement, a visitor of our clubs based on another legal relationship or a user of our online services) and on the consents you have granted to us.

Our marketing activities may include displaying advertisements on websites or in applications, presenting offers or advertisements through a communication channel such as email or telephone (where you have permitted us to deliver marketing content through a communication channel of your choice, for example by email, SMS/MMS, by telephone or via push notifications), sending traditional marketing communications, conducting analyses and statistics for marketing purposes and service satisfaction surveys, including contacting you through the communication channel of your choice. We may also conduct profiling for marketing purposes.

Personalised marketing

We may process your personal data for marketing purposes, including profiling, in particular in the following cases:

  • where you consent to the storage of cookies or similar technologies on your device, we may use information obtained through such technologies to display advertisements or offers tailored to your presumed interests, which we identify on the basis of the content you browse and your activity. For example, if you browse pages relating to membership or our club services, we may display advertisements for these or other of our services on other websites and in applications; detailed information on the technologies used, their purposes, legal bases and options for adjusting settings or withdrawing consent can be found in our separate Cookies Policy;
  • where you are a registered user of our website or application and you log in to your account, we may link to you information about the content you have browsed and use it for profiling purposes in order to better tailor marketing communications and offers to you;
  • where you consent to us delivering marketing content to you through a communication channel of your choice;
  • where we have an existing contractual or other relationship with you in connection with our services, website, application, clubs or other activities;
  • where you consent to the use of your device’s location information (e.g. smartphone) for marketing purposes, we may display advertisements or offers relevant to your location. For example, we may display an invitation to an event organised for the opening of a new club in your area;
  • for conducting analyses and statistics for our marketing needs and for testing your satisfaction with the services we provide, including by contacting you through the communication channel of your choice.

We may also display non-personalised advertisements and offers to you.

What is profiling for marketing purposes

Our processing of your personal data for the purposes of direct marketing may include profiling.

Profiling consists of the use of automated processing of your data to draw conclusions about your potential interests and preferences. Through profiling, we are able to tailor products, offers and advertisements to you as effectively as possible. In the course of profiling, we may also combine information that you leave us when using our various products and services, for example when visiting our website or application, using online functionalities, concluding a membership or using the services of our fitness clubs.

We also use tools provided by specialised third parties for profiling purposes. We strive to ensure that profiling brings you a tangible benefit, namely offers, promotions and advertisements that may be of interest to you. At the same time, we aim to avoid displaying to you content that may be unsuitable or uninteresting to you. For example, if we determine that you regularly attend a specific type of group exercise class at a particular club, this may indicate your interest in similar activities or new features at the same club, while content relating to an entirely different type of service or a distant location is less likely to be of interest to you.

On our website, we may for this purpose use cookies and similar technologies, in particular pixels, tags, SDKs, plug-ins and other identifiers, which enable us or our partners to collect information about website usage, measure traffic and campaign performance, personalise content and display relevant advertisements. These technologies may also be provided by third parties, including Meta and Google. Where consent is required for their use, we use them only on the basis of your consent given through the cookie banner. Detailed information on the technologies used, their purposes, legal bases and options for adjusting settings or withdrawing consent can be found in our separate Cookies Policy.

Our legitimate interest and your interests, rights and freedoms

We may process your personal data for marketing purposes, including profiling, on the basis of our legitimate interest (or, where applicable, on the basis of your consent, depending on the specific marketing activity and the applicable legal requirements). For this reason, we have assessed whether our interests are overridden by your interests, rights and freedoms (for example, the right to privacy). This assessment has shown that we may process your personal data in the manner described, because:

  • we process your personal data for marketing purposes only where we can reasonably expect that you may anticipate such processing, for example where you are our customer, club member, user of our website or application and have at the same time expressed interest in our marketing communications;
  • we will send you direct marketing communications by email, SMS/MMS or telephone only where the relevant legal basis is satisfied, in particular your consent where required;
  • we will send you marketing communications concerning products or services of third parties not affiliated with our group only where a separate legal basis exists for doing so, typically a specific consent;
  • we enable you to easily object to the processing of your personal data for direct marketing purposes and we inform you of this right;
  • our profiling for marketing purposes does not interfere disproportionately with your privacy; we focus on determining which products or services from our offering may be of interest to you; we do not wish to display to you content that may be unsuitable or uninteresting; on the basis of profiling, we do not make decisions that would have adverse legal effects for you (such as a refusal to conclude a contract) or that would similarly significantly affect you;
  • we implement appropriate technical and organisational measures to protect your personal data.

Social media networks (Facebook and Instagram)

You can also find us on the Facebook and Instagram social media networks. Where you visit our profiles, follow them or communicate with us through these platforms, your personal data is processed both by Form Factory Slovakia s.r.o. and by Meta Platforms Ireland Limited, registered in Ireland under number 550858, with its registered office at Merrion Road, Dublin 4, D04 X2K5, Ireland.

When using Facebook and Instagram, Meta Platforms Ireland Limited (hereinafter “Meta”) acts in general as a sole controller of your personal data for the purposes of operating these platforms, providing their functionalities, content personalisation, advertising, security, platform-level analytics and user account management in accordance with Meta’s own rules. This applies even where you merely visit our profile or view content published on our profiles.

When we act as sole controller

As sole controller, we process personal data that you make available to us or that we obtain in connection with the management of our profiles, in particular where you send us a message or otherwise communicate directly with us, publish a comment, reaction or other interaction on our profile, participate in a contest, campaign or other activity organised through our profile, or where we use communication from the social media network to handle your enquiry, request, complaint or submission. In these cases, we process personal data primarily for the purposes of managing our profiles, communicating with users, handling messages and submissions, promoting our services, organising marketing activities and protecting our rights. The legal basis is generally our legitimate interest pursuant to Article 6(1)(f) GDPR (resp. Section 13(1)(f) of the Act), consisting in the operation and management of our profiles, communication with the public and the promotion of the Form Factory brand and services. Where a specific activity requires a different legal basis, i.e. in particular consent, we will inform you thereof separately.

When Meta acts as sole controller

Meta acts as a sole controller to the extent that it itself determines the purposes and means of processing the data of Facebook and Instagram users, including the operation of the platform, user account management, the setting and display of advertisements, content personalisation, the use of cookies and similar technologies, security and Meta’s internal analytical processes. We do not exercise full control over such processing and are responsible only for those processing operations in which we ourselves are directly involved.

When joint controllership with Meta applies

In relation to certain statistical and analytical functionalities available to administrators of Facebook and Instagram profiles, joint processing may occur between us and Meta, in particular with regard to Page Insights / Insights functionalities or similar statistics on traffic, reach and interactions with our profile and content. In such cases, we jointly with Meta determine at least part of the purpose of the processing, which is to obtain statistical and analytical information about the use of our profiles in order to better configure our communications, content and marketing activities.

The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR (resp. Section 13(1)(f) of the Act), consisting in evaluating the performance of our profiles and improving our communications on social media networks. The joint controllership arrangement for Page Insights is governed by Meta in its Page Controller Addendum and in the information on Page Insights data, and Meta provides a similar explanation for Instagram.

When Meta may act as our processor

When using certain Meta advertising and measurement tools for businesses, Meta may in certain cases also act as our processor, in particular in the context of selected services such as Custom Audiences, measurement and analytics or other Meta Business Tools, where Meta processes data on our behalf and in accordance with our instructions to the extent determined by the relevant Meta terms and conditions.

This arrangement does not apply to the ordinary mere visit to our Facebook or Instagram profile. It applies only in those cases where we actually use specific Meta business tools in the advertising or analytical configuration of campaigns. Where we do not use these tools, Meta does not act as our processor in this regard.

Purposes and legal bases for processing

In connection with our profiles on Facebook and Instagram, we may process personal data in particular for the following purposes:

  • management of our social media network profiles;
  • communication with users and handling of messages, comments and submissions;
  • promotion of our services, events and the Form Factory brand;
  • organising marketing campaigns, contests and related activities;
  • collecting statistical and analytical data on traffic, reach and interactions with our content;
  • measuring the performance of advertising campaigns and creating or using audiences in Meta’s advertising tools, where we use such tools.

The legal basis is generally our legitimate interest pursuant to Article 6(1)(f) GDPR (resp. Section 13(1)(f) of the Act). Where consent is required for a specific activity, we will inform you thereof separately. Where the processing relates to the handling of your request, complaint or the exercise of rights, the legal basis may also be compliance with a legal obligation or the taking of steps at your request, depending on the nature of the specific case.

What data we may process

This may include in particular data that is visible from your profile or that you make available to us when interacting with our profile, such as your name or username, profile picture, content of a message, comment or reaction, data on interaction with our content, or statistical data on audience and reach that Meta makes available to us through Insights or advertising tools. The scope of data depends on your privacy settings and on how you use Facebook or Instagram.

Important notice regarding the exercise of rights

As Meta processes a large part of the personal data of Facebook and Instagram users as a sole controller, it is most effective to exercise certain rights directly against Meta, in particular with regard to data processed within the user account itself, advertising preferences, activity history or platform settings. To the extent that we process personal data as controller or joint controller, you may of course also contact us.

For further information, we recommend consulting in particular the following official Meta documents:

  1. Facebook Privacy Policy
    https://www.facebook.com/privacy/policy/ 
  2. Facebook Page Controller Addendum
    https://www.facebook.com/legal/terms/page_controller_addendum
  3. Facebook Information about Page Insights Data
    https://www.facebook.com/legal/terms/information_about_page_insights_data 
  4. Instagram – information on joint controllership / Insights
    https://help.instagram.com/155833707900388 
  5. Instagram Privacy Policy / Privacy Center
    https://privacycenter.instagram.com/policy

Further important information

Are you required to provide personal data?

The provision of personal data is generally voluntary. However, in certain cases the provision of personal data is a statutory requirement, or a requirement necessary for concluding or performing a contract. Where the necessary data is not provided in such cases, we may not be able to conclude a contract with you, provide you with a service, handle your request or comply with a legal obligation.

In the context of specific forms or processes, we will inform you which data is mandatory and what the consequences of its non-provision are.

Recipients to whom we may disclose or transfer personal data

We may disclose or transfer your personal data in particular to the following categories of recipients:

  • our contractual partners and service providers who provide us with IT services, hosting, cloud solutions, system support, web and marketing services, payment services, customer support, accounting, audit or legal services and debt recovery agencies and other business partners, where required for the provision of a specific service, reservation, performance of a contract or handling of your request;
  • persons to whom we are required to provide data by law, in particular courts, public authorities, law enforcement authorities, administrative authorities or supervisory authorities;
  • companies within the Benefit Systems International group, especially where required for internal administration, provision of support, management of group processes, IT administration, reporting, compliance, legal services, security or the protection of legal claims;

Some of the recipients act as controllers and some as processors. Whatever the relation, the processing takes place to the extent necessary and on a lawful legal basis; in case a recipient acts as a processor, we conclude a proper agreement under Article 28 of GDPR.

Companies of Benefit Systems International group (hereinafter referred to as “BSI Group”)

Some of our documents, forms or notices may refer to the sharing of data with “group” companies. For the sake of transparency, we note that such a term should always be understood in a substantive rather than an unlimited sense. This means that personal data may be shared within group structures only where a specific purpose, proportionate scope, lawful legal basis and a genuine need to know the data exist.

Companies of the BSI Group in Slovakia

The BSI Group in Slovakia comprises:

  • the company Fitcamp s.r.o., with its registered office at Prievozská 14, 821 09 Bratislava – Ružinov district, Company Registration No.: 56 442 114, registered in the Commercial Register of the District Court Žilina, Section: Sro, Insert No. 85634/L;
  • the company MB CLASSY s.r.o., with its registered office at Prievozská 14, 821 09 Bratislava – Ružinov district, Company Registration No.: 51 751 941, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 129621/B;

Companies of the BSI Group in Poland (parent company and its affiliates)

The BSI Group in Poland comprises:

  • Benefit Systems International S.A., ul. Skierniewicka 16/20, Warsaw 01-230, Poland, registration number: 0000994323;
  • Fit Invest International Sp. z o.o., ul. Skierniewicka 16/20, Warsaw 01-230, Poland, registration number: 0000741564;
  • Benefit Systems S.A. Plac Europejski 2, Warsaw 00-844, Poland, registration number: 0000370919.

Transfer of personal data to third countries

We endeavour to process personal data preferentially within the EU/European Economic Area. However, given the use of certain IT, cloud, analytical or marketing tools, the transfer of personal data to third countries, in particular the USA, may in certain cases occur.

Where such a transfer takes place, we will ensure that it is carried out in accordance with the GDPR, in particular on the basis of an adequacy decision, standard contractual clauses or another lawful transfer mechanism.

If you wish to learn more about specific transfers and the safeguards applied, you may contact us using the contact details set out above.

How long we retain personal data

We retain personal data only for as long as is necessary to achieve the purposes for which it was collected, and thereafter for as long as is required to comply with legal obligations or to protect our legal claims.

As a general rule:

  • data processed for contractual purposes is retained for the duration of the contractual relationship and thereafter for as long as is necessary for establishing, exercising or defending legal claims, i.e. until the expiry of applicable limitation periods;
  • data processed for the purpose of complying with legal obligations is retained for the period specified by the applicable regulations (e.g. for compliance with archiving, accounting and tax obligations);
  • data processed on the basis of consent is retained until consent is withdrawn, but at most for the period for which consent was granted, unless a specific reason requires a shorter period;
  • data processed on the basis of legitimate interest is retained for the duration of the relevant legitimate interest, but at most until a successful objection to processing is lodged;
  • data from communications, complaints and legal disputes is retained for as long as is necessary to resolve the matter and thereafter to protect legal claims;
  • CCTV footage is generally retained for 72 hours, unless required for incident resolution or to support a legal claim.

Specific retention periods may also be set out in specific personal data processing notices, contracts, forms or internal retention policies.

Automated decision-making and profiling

Where we use profiling in connection with certain online or marketing processes, we will do so only in accordance with the GDPR and to a proportionate extent. Profiling may serve, for example, to better personalise content, measure the effectiveness of campaigns or improve user experience.

We will not make decisions about you based solely on automated processing that would have legal effects or similarly significantly affect you, unless there is a lawful ground for doing so and you are duly informed thereof.

Security of personal data

We implement appropriate technical, organisational and personnel measures to protect personal data against unauthorised access, loss, misuse, damage or unauthorised disclosure. These measures are continuously reviewed and updated as necessary.

Your rights

In connection with the processing of your personal data, you have the right to:

  • Access to your personal data, obtain information from us about their processing, as well as receive a copy of your data from us;
  • Update your personal data or request their rectification if they are incorrect;
  • Withdraw your consent to personal data processing at any time. This will not affect the lawfulness of our processing on the basis of the consent prior to its withdrawal;
  • Object to the processing of your data when the processing is based on a legitimate interest, and the objection is justified by your particular situation;
  • Object to the processing of your personal data for direct marketing purposes, including profiling;
  • Request restriction of processing of your personal data if:

(1) you question the accuracy of your data (for a period enabling us to verify the accuracy of the data);
(2) the processing is unlawful and you oppose the erasure of your personal data and request restriction of their use instead;
(3) we no longer need your personal data for our purposes, but these data are needed by you for the establishment, exercise or defence of legal claims, or
(4) you have objected to the processing of your data – until the objection is found effective;

  • Personal data portability – with respect to the processing of your data based on your consent or an agreement, you have the right to receive your personal data from us in a commonly used and machine-readable computer format. You can also request that we transfer your data to another data controller, but we will only do so if this transfer is technically feasible;
  • Request erasure of your personal data – you may request us to erase your data in the following cases:

(1) if your data are no longer necessary for the purposes for which they are processed;
(2) you have withdrawn the consent on which the processing is based, and there is no other basis for processing;
(3) you have effectively objected to the processing;
(4) your personal data have been unlawfully processed;
(5) your data must be erased because we are required to do so by law.


To exercise the above rights, please contact us. You can find contact details above in Section 1 of this document.

Your request will be handled within one month of its receipt. When we need more time, we will inform you about the prolonged time for considering your request and about the reasons for the prolongation. If your request is manifestly unjustified or excessive, we may refuse to take the requested actions.

  • You also have the right lodge a complaint with a supervisory authority competent for data protection in the EU Member State of your habitual residence, place of work or place of the alleged infringement. In Slovakia, the supervisory authority is the Office for Personal Data Protection of the Slovak Republic, Park One Building, Námestie 1. mája 18, 81106 Bratislava; https://dataprotection.gov.sk/sk/

May 2026

Form Factory Slovakia s.r.o.