Join Now
EN

Join Now
EN

Privacy policy

(effective from 20 June 2025)

I. INTRODUCTION

  1. Grawiton spółka z ograniczoną odpowiedzialnością with its registered office in Grodzisk Mazowiecki at ul. Gen. L. Okulickiego 21, 05-825 Grodzisk Mazowiecki is the controller of personal data collected via the Website available at https://grafit.biz.pl (hereinafter referred to as the “Website”), i.e. the entity deciding on how your personal data will be used (hereinafter referred to as the “Controller”).
    Contact with the Controller:

    1. e-mail: manager@grafit.biz.pl,
    2. correspondence address: Grawiton sp. z o.o., ul. Gen. L. Okulickiego 21, 05-825 Grodzisk Mazowiecki.

    The Controller is responsible for the security of the personal data transferred and for the processing thereof in accordance with the law.

  2. In matters relating to the processing of personal data and the exercise of data subjects’ rights resulting from the personal data protection regulations, you can contact the Controller using the e-mail address: manager@grafit.biz.pl or the correspondence address provided above.
  3. Your personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “GDPR”) and other currently applicable personal data protection regulations.
  4. During your visit to the Website, the following information is collected:
    1. personal data provided by the user of the Website,
    2. data obtained and recorded automatically.
  5. The purpose and scope of personal data used by the Controller are specified in detail hereinafter.

II. COLLECTED DATA – BASIC INFORMATION

  1. The information below refers to all the methods of using your personal data by the Controller, as specified in Chapters III and IV.
  2. Personal data will not be used by the Controller to make decisions based solely on automated processing of personal data, including profiling within the meaning of Article 22 of the GDPR.
  3. While maintaining all data security guarantees, personal data processed via the Website may be transferred to other entities, including:
    1. entities authorized to receive it in accordance with legal regulations,
    2. entities processing them on behalf of the Controller, e.g. providers of IT support services and suppliers of software or IT and technical services, hosting service providers, analytical service providers, including those providing the Controller with IT solutions for user service,
    3. other data controllers to the extent necessary to perform the contract, provide services and meet legal requirements, e.g. entities providing accounting, legal or auditing, marketing, postal and courier services, other contractors providing services to the Controller on the basis of concluded contracts, including advisory services.
  4. The Controller will not transfer your personal data to countries outside the European Economic Area (countries other than European Union countries and Iceland, Norway and Liechtenstein).
  5. The Controller informs that in connection with the processing of personal data obtained via the Website, each data subject has the right to submit a request regarding:
    1. access to data (including obtaining information on what data is processed by the Controller and to what extent, as well as obtaining a copy thereof – details: Article 15 of the GDPR),
    2. rectification of data (i.e. its correction if the data processed by the Controller is incorrect or incomplete – details: Article 16 of the GDPR),
    3. deletion of data (e.g. if the data is no longer necessary to achieve the purposes for which it was collected or the Controller has no legal basis for processing the data – details: Article 17 of the GDPR),
    4. restriction of data processing (e.g. if you question the accuracy of the personal data used by the Controller, if the data is no longer needed by the Controller but must be processed due to your claims – details: Article 18 of the GDPR),
    5. objection to the processing of personal data, including profiling (if personal data is processed on the basis of the legitimate interest of the Controller or is used for direct marketing purposes – details: Article 21 of the GDPR),
    6. transfer of data to another controller (if the processing of data provided to the Controller is carried out in an automated manner, on the basis of consent or on the basis of a contract – details: Article 20 of the GDPR),
    7. if the processing is based on consent (e.g. consent to use data for marketing purposes, consent to use image), you have the right to withdraw your consent at any time in any manner (however, the withdrawal of consent does not affect the processing of data that took place before the declaration of withdrawal of consent was made).
  6. Every person whose data is processed also has the right to lodge a complaint with the President of the Personal Data Protection Office (supervisory authority) if they believe that the processing of personal data violates the law (more information available at: https://uodo.gov.pl/pl/83/155).
  7. The data was obtained by the Controller directly from you. The Controller may also process:
    1. personal data of other people provided by the user of the Website when using the services described in this Privacy Policy,
    2. personal data obtained from entities with whom the Controller cooperates, on the basis of concluded contracts (e.g. data of persons participating in events organized by the Controller),
    3. personal data obtained from other entities cooperating with the Controller, where the data was shared with the Controller based on your consent,
    4. data obtained from publicly available sources, e.g. from the National Court Register, Central Registration and Information on Economic Activity (CEIDG), websites.

III. PERSONAL DATA PROVIDED BY THE USER

III. A. E-MAIL OR BY PHONE CONTACT DETAILS

  1. The Controller processes personal data, in particular name and surname, telephone number, e-mail address and other information provided by you, to the extent necessary to process applications and respond to inquiries, including to communicate and answer questions asked, with the use of the e-mail address and contact telephone number provided on the Website (legal basis: Article 6 (1) (f) of the GDPR – legitimate interest).
  2. Provision of data is voluntary, but necessary to respond to the submitted question or to properly handle the application and comply with your request. Failure to provide personal data may result in the inability to respond or handle comply with your request.
  3. The Controller has the right to process personal data for the period necessary to process the notification and fulfil the query, including responding to the sent message or dealing with matters in connection with which correspondence or telephone conversation is conducted.

III. B. CONTACT FORM

  1. The Controller may collect your personal data via the contact form available on the Website, in particular:
    1. e-mail address,
    2. IP address,
    3. other information you provide via the form (e.g. first name, telephone number).
  2. The Controller processes personal data only to the extent necessary:
    1. to receive and process the application, including to communicate and respond to applications and questions submitted via the contact form (legal basis: Article 6 (1) (f) of the GDPR – legitimate interest),
    2. to establish contact (via the selected communication channel) and to prepare and present a dedicated offer in response to the request of the Website user submitted via the form (legal basis: Article 6 (1) (b) of the GDPR – taking action at the request of the data subject before concluding a contract).
  3. The Controller has the right to process personal data for the period necessary to achieve the above-mentioned purposes. Depending on the legal basis, this will be:
    1. the time necessary to process the application and handle the request sent by the user via the contact form,
    2. the time necessary to prepare and deliver a dedicated offer.
  4. Provision of the personal data indicated in the contact form is voluntary, but necessary for the proper handling of the application, responding to the submitted request, or preparing and presenting a dedicated offer. Failure to provide personal data may result in the inability to respond, handle your request or present an offer.

III. C. USER ACCOUNT REGISTRATION AND PURCHASE OF A GYM PASS VIA THE WEBSITE

  1. The Controller processes personal data provided by you in the course of registering a user account and purchasing a gym pass via the “Buy Pass” (“Kup Karnet”) tab, in particular: name and surname, telephone number, e-mail address, date of birth, other data provided voluntarily by the user.
  2. Data is processed for the purpose of:
    1. registering and maintaining a user account,
    2. conclusion and performance of a contract on maintaining a user account on the Website (legal basis: Article 6 (1) (b) of the GDPR – performance of a contract or actions prior to the conclusion thereof),
    3. conclusion and performance of a contract for the use of services of a sports club (legal basis: Article 6 (1) (b) of the GDPR – performance of a contract),
    4. complying with obligations arising from legal regulations, including those relating to documenting transactions and settlements (legal basis: Article 6 (1) (c) of the GDPR – legal obligation incumbent on the controller),
    5. complying with legal obligations related to withdrawal from a contract concluded at a distance (legal basis: Article 6 (1) (c) of the GDPR – legal obligation incumbent on the controller).
  3. The Controller has the right to process personal data:
    1. for the duration of contract on maintaining a user account on the Website and the contract for the use of services of a sports club, and for the time necessary to perform the obligations arising therefrom,
    2. until the expiry of the limitation period for claims.
  4. Provision of personal data is voluntary, but necessary to register an account, purchase a gym pass and use the club’s services. Failure to provide data will result in the inability to use these services.

III. D. REGISTRATION FOR PERSONAL TRAINING

  1. The Controller may process personal data provided by you in order to register for personal training, in particular: name and surname, telephone number, e-mail address, age or date of birth, other data provided voluntarily by the user.
  2. Data is processed for the purpose of:
    1. handling the registration for personal training,
    2. concluding and performing a contract for the use of services of a sports club (legal basis: Article 6 (1) (b) of the GDPR – performance of a contract or actions prior to the conclusion thereof),
    3. exchanging messages related to setting a training date or conducting it (legal basis: Article 6 (1) (f) of the GDPR – legitimate interest of the controller).
  3. The data will be processed for the period necessary to perform the contract and to pursue or defend against any potential claims.
  4. Provision of data is voluntary, but necessary to sign up for training. Failure to provide it prevents the registration and provision of the service.

III. E. REGISTRATION OF A TRAINER ACCOUNT AND PURCHASE OF A TRAINER PASS

  1. The Controller processes personal data provided by persons registering as trainers, in particular: name and surname, telephone number, e-mail address, PESEL number, address of residence, other data provided voluntarily by the user.
  2. Data is processed for the purpose of:
    1. registering a trainer account,
    2. purchasing a trainer pass,
    3. concluding and performing a contract for the use of services of a sports club (legal basis: Article 6 (1) (b) of the GDPR – performance of a contract or actions prior to the conclusion thereof),
    4. compliance with obligations arising from legal regulations, including those relating to documenting transactions and settlements (legal basis: Article 6 (1) (c) of the GDPR – legal obligation incumbent on the controller).
  3. The data will be processed for the duration of the contract and until the expiry of the limitation period for claims, and for the period resulting from fiscal or accounting regulations.
  4. Provision of data is voluntary, but necessary to conclude a contract and purchase a trainer pass. Failure to provide it will prevent using the offer for trainers.

III. F. USE OF IMAGE

  1. The Controller informs that in connection with the conducted activity, the image of natural persons (in particular clients, event participants, guests of the sports club and trainers cooperating with the Controller) may be recorded and used in the form of photographs, audio-video recordings or live broadcasts, made on the premises of the Controller or during events organized by the Controller.
  2. The image may be used by the Controller for promotional, marketing, information, documentation and archival purposes – in particular through publication on the Controller’s website, in social media, printed or digital materials.
  3. In the case of trainers or other persons cooperating with the Controller, image processing may also serve to promote their professional activities and the offer of services provided on the premises of the club or as part of the club’s activity.
  4. Image processing is based on:
    1. Article 6 (1) (a) of the GDPR – voluntary, prior consent of the data subject,
    2. Article 6 (1) (f) of the GDPR – legitimate interest of the Controller consisting in conducting promotional and marketing activities (in the case of public events – group photos or information materials).
  5. Expressing consent to the use of the image is voluntary and the consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
  6. The person whose image is processed has all the rights specified in Chapter II, point 5 of this Privacy Policy, including the right to access data, rectify it, delete it, limit its processing, object and lodge a complaint with the supervisory authority.
  7. If a person does not consent to the recording or publication of his/her image, he/she should inform the Controller directly, and in the case of participation in events – also the providers of photo services or organizers.

IV. DATA COLLECTED AUTOMATICALLY

  1. Use of the Website available at https://grafit.biz.pl involves sending queries to the server, which are automatically saved in event logs.
  2. Event logs record data relating to user sessions. This in particular includes: IP address, device type and name, information about the web browser and operating system, date and time of visits to the Website.
  3. Data recorded in event logs is not associated with specific individuals.
  4. Access to the contents of event logs is available to persons authorized by the Controller to administer the Website.
  5. A chronological record of information about events is only auxiliary material used for administration purposes. Analysis of event logs allows in particular detecting threats, ensuring proper security of the Website and creating statistics to learn how the Website is used by its users.
  6. Data relating to user sessions is used by the Controller to diagnose problems related to the functioning of the Website and to analyze possible security breaches, to manage the Website and to prepare statistics (legal basis: Article 6 (1) (f) of the GDPR – legitimate interest).
  7. We use cookies on the Website. More information can be found in the “Cookie Policy” available at https://grafit.biz.pl/en/cookie-policy/.

V. FINAL PROVISIONS

  1. This Privacy Policy is for informational purposes and applies in particular to the Controller’s Website operating at https://grafit.biz.pl.
  2. The Website may contain links to other websites, in particular to the websites of service providers and partners of the Controller, social networking sites (Facebook, Instagram). The Controller recommends that each user, after going to the websites of other entities, should read the privacy policies applicable to such websites.
  3. The Controller reserves the right to introduce changes to the applicable version of the Privacy Policy, in particular in the case of:
    1. technology development,
    2. changes to generally applicable legal regulations, including those relating to personal data protection or information security,
    3. development of the Website, including the implementation of new services and functionalities.
  4. The Controller will notify users of relevant changes to the content of the Privacy Policy, in particular by posting an announcement on the Website.