Privacy policy
Last updated: 30/10/2026
Who we are
TrainFit is an online application that gyms, martial arts schools and studios use to run their business and to give their members an app. It is operated by TrainFit, info@trainfit.gr.
Each gym decides what it records about its members and why: for its members' data the gym is the controller and TrainFit the processor, working only on the gym's instructions (see the Terms and the data processing agreement). For the accounts of gym owners and staff, TrainFit is the controller.
What data is kept
Members: name, contact details (email, phone, address), date of birth, details of a parent or guardian for children, membership, payments and receipts, attendance and bookings, belts and exams, equipment orders, health certificate dates and uploaded documents, photos, signed regulations and consents, training programmes and progress the member enters, posts in the gym's community, and the devices that receive notifications. Only what the gym chooses to record is kept.
Gym owners and staff: name, email, username, password (stored only as a one-way hash), role, sign-in times and security settings (two-step verification).
Prospective members who ask for a trial class: name, contact details and their message, with their consent.
Why it is used
To provide the service the gym and its members use: memberships and payments, receipts, attendance and the entrance kiosk, class bookings, reminders and notifications, the member app.
Legal bases: the contract between the member and the gym, and between the gym and TrainFit (GDPR Art. 6(1)(b)); legal obligations such as tax records (Art. 6(1)(c)); consent where it is asked, e.g. photos or the trial form (Art. 6(1)(a)); and the legitimate interest in keeping the service secure (Art. 6(1)(f)). Health certificate dates and documents are processed because the law requires a medical certificate for sports (Art. 9(2)(b), (h)).
TrainFit does not sell personal data, does not show advertising and does not use members' data for its own marketing.
Who else processes it
Hosting: a data centre in Germany (European Union), where the application, its database and its backups are kept.
Email and SMS: the email provider that delivers the app's emails, and the SMS provider the gym chooses (e.g. Apifon, Twilio, Vonage), only when the gym sends SMS.
Push notifications: the push services of the browser or phone maker (Google, Apple, Mozilla, Microsoft) carry the notification; they do not see member records.
AI assistant: when staff use the assistant, read a health certificate or an equipment photo, the question or the image is sent to an AI provider (Anthropic) to produce the answer; it is not used to train their models.
Online payments: the payment provider the gym connects (e.g. Viva Wallet, Nexi), when it does.
Your data is stored in the EU. Some of the other providers are outside the EU; transfers rely on the European Commission's standard contractual clauses or an adequacy decision.
How long it is kept
As long as the person is a member and afterwards for as long as the gym needs it: payments and receipts as long as tax law requires. A gym can erase a former member's personal data at any time (the amounts stay for its accounts) and can have it done automatically after a period it chooses. Trial requests that never became members can be deleted automatically too.
When a gym closes its account, its data is deleted within 90 days, and from backups within a further 14 days.
Your rights
You can ask for a copy of your data, for corrections, for erasure, to restrict or object to its use, and for your data in a portable format. Members can download their data and ask for its erasure from the app (Profile → Privacy); they can also ask their gym directly. TrainFit helps the gym answer within one month.
Questions or requests that do not reach your gym: info@trainfit.gr. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr).
Security
Connections are encrypted (HTTPS); each gym's data is kept separately from every other gym's; passwords are stored only as hashes; staff can use two-step verification; access is limited by role and failed sign-ins are throttled; nightly backups are kept for 14 days and only the server's administrators can read them.
Cookies
TrainFit uses only the cookies it needs to work: keeping you signed in, the gym you use, the language, and protection against forged requests. There are no advertising or analytics cookies, so no consent banner is needed. Settings such as light or dark appearance are kept in your browser.
Changes
When this policy changes, the date above changes; important changes are shown to gym owners in the app.