Protection of Personal Data

Terms of Personal Data Processing

These Terms of Personal Data Processing (hereinafter: Terms) describe the manner in which the company GymBeam s.r.o., with its registered office at Rastislavova 93, 04001 Košice, Slovak Republic, ICO 46 440 224, registered in the Commercial Register of the District Court Košice I, Section Sro, File No. 35719/V (hereinafter: Company or we), processes Your personal data for the purpose of providing our services, which consist of the sale and distribution of dietary supplements, sportswear, and fitness equipment via the online store (hereinafter: Services) on the website www.gymbeam.hr (hereinafter: Website), as well as via the GymBeam application (hereinafter: Application), as well as via other means of distance communication.

The Company is responsible for the processing of personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.4.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [hereinafter "GDPR"] and Act No. 18/2018 Coll. on the protection of personal data and on amending and supplementing certain acts, in the currently valid version [hereinafter "Act No. 18/2018 Coll."].

The Company has taken all appropriate technical and organizational measures to ensure the protection of personal data.

"Personal data": data relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Processing of personal data": any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

WHAT INFORMATION DO WE COLLECT? AND FOR WHAT PURPOSE?

We collect the following personal data (hereinafter Personal Data) about You, depending on the manner and extent to which You use our Website, Application and/or Services:

1. Data necessary for registration and access to the Website and Application

For the purpose of registration on our Website and in the Application and subsequent logging in to our Website and Application and access to our personalized services on the Website and in the Application, we process the following personal data: (i) Your first name, (ii) last name, and (iii) email address.

The processing of this data is necessary for the performance of a contract to which You are a party. The legal basis for the processing of this data is Article 6(1)(b) of the GDPR.

1. Data necessary for the provision of Services

For the purpose of providing our Services (i.e. [delivery of ordered goods / provision of purchased service]), we process the following personal data: (i) Your first name, (ii) last name, (iii) address, (iv) email address, (v) telephone number, and (vi) data regarding Your payment card (specifically card number, expiration date, and CVV code).

The processing of this data is necessary for the performance of a contract to which You are a party. The legal basis for the processing of this data is Article 6(1)(b) of the GDPR.

1. Data collected for marketing purposes

For the purpose of receiving our newsletters and/or leaflets, information about discounts, updates, improvements, and offers, and other marketing material in the form of emails, SMS messages, or postal mail and/or notifications, we process Your: (i) first name, (ii) last name, (iii) email address, (iv) telephone number, and (v) address.

We process this personal data based on Your explicit consent. The legal basis for the processing of this data is Article 6(1)(a) of the GDPR.

 If You decide that You no longer wish to receive such messages, You have the right to withdraw Your consent by clicking on the hyperlink directly in the email communication and/or available here: https://gymbeam.hr/newsletter/manage/. Withdrawal of consent may result in You no longer receiving notifications about discounts, updates, improvements, and offers. It is not possible to withdraw consent for receiving emails containing notifications related to the provision of Services.

1. Data collected through the use of our Website and Application

For the purpose of continuously improving our Services and developing Your user experience when using our Website and/or Application, we process data relating to: (i) Your computer and/or mobile device, (ii) Your visits to or use of our Website, Application and/or our Services (including Your IP address, geographical location, type and version of Your browser/operating system, referral sources, duration of visits to viewed pages, and navigation on our Websites and/or in the Application, or any similar information that the Company may obtain directly or indirectly from third-party providers), (iii) generated during Your use of our Website and/or Application and/or Services or generated during the use of our Services (including schedule, frequency, and patterns of use of the Website and/or Application).

We process this personal data based on Your explicit consent. The legal basis for the processing of this data is Article 6(1)(a) of the GDPR.

1. Data collected by leaving Your comment / review

For the purpose of leaving a review or posting a comment on our Website or in the Application, we will process the personal data You leave with the review/comment on our Website and/or in the Application, which are: (i) first name, (ii) last name, (iii) nickname chosen for leaving the comment/review, and (iv) any other data You decide to include in the review/comment.

We process this personal data based on Your explicit consent. The legal basis for the processing of this data is Article 6(1)(a) of the GDPR.

1. Data collected during communication with us

For the purpose of communicating with us for any reason (e.g., support for using the Website and/or Application, using Services, complaints, resolving any issues, etc.), we will process the following personal data: (i) Your first name, (ii) last name, (iii) address, (iv) email address, (v) telephone number, (vi) content of the communication, (vii) metadata related to the communication, and (viii) any other necessary data You decide to include in the communication.

The processing of this data is necessary for the performance of a contract to which You are a party. The legal basis for the processing of this data is Article 6(1)(b) of the GDPR.

1. Data collected during the complaint procedure

During the complaint procedure based on Your complaint regarding goods or services we provided to You, we will process personal data primarily to the following extent: (i) first name, (ii) last name, (iii) email address, (iv) telephone number, (v) address, and (vi) IBAN.

The processing of this personal data is necessary for compliance with our legal obligations, in particular under Act No. 250/2007 Coll. on consumer protection, as amended, and Act No. 40/1964 Coll. Civil Code. The legal basis for the processing of this data is Article 6(1)(c) of the GDPR.

ON WHAT OTHER GROUNDS MAY WE PROCESS YOUR PERSONAL DATA?

Except as stated above, we have the right to process Your Personal Data for the purpose of fulfilling our legal obligations under Article 6(1)(c) of the GDPR or for the protection of our legitimate interests under Article 6(1)(f) of the GDPR, for example for the purpose of fraud prevention, network and information security, and direct marketing.

We will process Your Personal Data in accordance with applicable legal regulations and will protect them from abuse and/or unlawful disclosure.

HOW DO WE SHARE YOUR PERSONAL DATA?

To enable access to our Website, Application and/or Services (and if appropriate given the circumstances), we have the right to disclose Your Personal Data (and You agree to such disclosure) in accordance with the principle of minimization to a limited circle of persons, namely our employees, subcontractors, officials, advisors, commercial agents, suppliers, or related persons of the Company and service providers, to the extent reasonably necessary to achieve the purpose stated in these Terms, specifically the following persons:

(i) Global Payments s.r.o., organizational unit, with its registered office at Vajnorská 100/B, 831 04 Bratislava, ICO: 50 010 301, registered in the Commercial Register of the District Court Bratislava I, Section: Po, File No. 3016/B

(ii) General Logistics Systems Croatia d.o.o., Stupničke Šipkovine 22, Donji Stupnik, Croatia

(iii) DPD Croatia d.o.o., Slatinska ulica 7, 10360, Croatia

(iv) Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02X525, Ireland

(v) Google Ireland Limited (registration number: 368047), with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland

(vi) nabava.net, Aplos d.o.o., Modruška 9, 10000 Zagreb, Croatia

(vii) Glami, Inspigroup s.r.o., Újezd 450/40, 118 00 Praha 1 - Malá Strana, Czech Republic

(viii) Dognet, Lead Media, s.r.o. Karpatská 6, 81105 Bratislava, Slovakia

(ix) Adyen N. V., PO Box 10095, 1001 EB Amsterdam, Netherlands

(x) Jeftinije.hr, sMind d.o.o., Ulica grada Vukovara 269 D, 10000 Zagreb, Croatia 

Furthermore, we may disclose Your personal data:

(i) to the extent required by applicable administrative regulations,

(ii) in connection with any current or future legal proceedings, or

(iii) for the purpose of establishing, exercising, or defending our legal rights (including providing Your Personal Data to third parties for the purpose of preventing fraud and reducing payment risk).

Data on the basis of which You are not identified: We have the right to provide Your Personal Data, on the basis of which You cannot be identified (including anonymous data on the use of our Website and/or Services, entry/exit pages and URL addresses, platform types, number of clicks, etc.) to third parties interested in such information in order to understand usage patterns of certain services.

We do not share Your Personal Data, on the basis of which Your identification or location is possible, with third parties for the purpose of direct marketing.

We may allow certain third parties to display advertisements and marketing information on our Website. Such third parties use technology that sends offers or links to offers directly to Your browser, which are then displayed as part of the viewed webpage. In this case, they automatically receive information about Your IP address. They may also use other technologies (e.g., cookies, JavaScript, or web beacons) to measure the effectiveness of their advertisements and personalize the ad content displayed to You. We do not allow such third parties access to information that would enable them to personalize data collected in this manner. Please note that if an advertiser asks us to display an advertisement to a specific group of customers and You respond to that advertisement, such advertiser or ad server may conclude that You belong to the group they wish to target. The purpose of these Terms is not to regulate Your relationship with any third party using the technologies mentioned above. For more information, please read the terms of personal data processing of such advertisers.

VIRTUAL CLOTHING TRY-ON ("Virtual Try-On")

By using the "Virtual Try-On" feature on our clothing product pages, users can upload a personal photo to generate a virtual representation of how a selected garment might look on them. The uploaded image is processed via the Google Vertex AI system, which automatically analyzes the photo to appropriately position the garment. According to Article 9 of the GDPR, this constitutes the processing of biometric data. Processing is carried out exclusively based on the explicit consent of the user in accordance with Article 6(1)(a) and Article 9(2)(a) of the GDPR, which is given by voluntarily uploading the image. We state that Google Vertex AI is a third-party tool used for this function. The photo is processed only temporarily during the duration of the virtual try-on and is automatically and permanently deleted immediately after the generated image is displayed to the end user. Neither GymBeam nor Google store or retain any voluntarily provided user data (in this case, images).

DO WE TRANSFER YOUR PERSONAL DATA TO THIRD COUNTRIES?

Personal data we collect may be stored or otherwise processed and transferred within countries where we conduct our business activities, all for the purpose of achieving the processing purpose established in these Terms. For the same purpose, Your data may be transferred between Member States of the European Union or the European Economic Area and countries considered by the European Commission to ensure an adequate level of protection of personal data, according to the list published from time to time by the Office for Personal Data Protection on its website: https://dataprotection.gov.sk/uoou/sk/content/prenos-do-krajin-zarucujucich-primeranu-uroven-ochrany

HOW LONG WILL WE PROCESS YOUR PERSONAL DATA?

If not otherwise prescribed by applicable legal regulations, we have the right to process Your Personal Data in a form that allows Your identification for as long as necessary to achieve the purpose for which the Personal Data were provided (this may include the period during which You visit our Website and/or Application or use our Services and/or the entire period during which the purpose of processing Personal Data lasts), unless otherwise stated, within the following periods:

1. Data necessary for registration and access to the Website and Application

We will process data necessary for registration and access to the Website and/or Application from the date of Your registration on the Website and/or in the Application until 30 days from the date You cancel Your registration. We will process this data during this period (i.e., 30 days from cancellation of registration) only for the purpose of terminating the contractual relationship between us and You, which arose from Your registration on the Website or in the Application, resolving any disputes that may arise from it, and protecting any of our legitimate interests.

1. Data necessary for the provision of Services

We will process data necessary for the provision of Services from the date You ordered the Service until its provable delivery (i.e., until the date the goods were delivered to You and the price was paid).

1. Data collected for marketing purposes

We will process data collected for marketing purposes from the date You give us consent for such processing until the date of (i) withdrawal of Your consent or (ii) cancellation of registration on the Website or in the Application.

1. Data collected through the use of our Website and/or Application

We will process data collected for marketing purposes from the date You give us consent for such processing until the date of (i) withdrawal of Your consent or (ii) cancellation of registration on the Website or in the Application.

1. Data collected by leaving Your comment / review

We will process data collected for marketing purposes from the date You give us consent for such processing until the date of (i) withdrawal of Your consent or (ii) cancellation of registration on the Website or in the Application.

1. Data collected during communication with us

We will process data collected during communication with us from the date of their collection until the date Your request arising from email communication is resolved.

1. Data collected during the complaint procedure

We will process data collected during the complaint procedure from the date You provide them to us, for the archiving period prescribed by specific legal regulations and supervisory authorities.

We have the right to process Your personal data for longer than the period stated above if necessary (i) to fulfill our legal obligations, (ii) for the purpose of establishing, exercising, or defending our legal rights (including providing information to third parties for the purpose of preventing fraud and reducing payment risk).

CONSEQUENCES OF FAILURE TO PROVIDE PERSONAL DATA

Providing certain personal data (such as name, address, contact details, and payment data) is necessary for concluding a contract and providing services by GymBeam s.r.o.. Failure to provide this data may lead to the inability to conclude a contract, deliver ordered goods, provide access to the application, or personalized services. Providing data not marked as mandatory is voluntary, and their absence will not affect the fulfillment of the contract.

VOLUNTARINESS AND OBLIGATORINESS OF DATA

In cases where personal data are necessary for the fulfillment of a legal or contractual obligation, failure to provide them may lead to the inability to fulfill the contract or provide the service.

HOW CAN YOU WITHDRAW YOUR CONSENT?

You may withdraw Your consent at any time based on Your own decision via email or telephone contact, which You can find here: [email protected], +385 1 3445 859. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

HOW CAN YOU DELETE YOUR ACCOUNT IN THE APPLICATION?

You may delete and cancel Your account in the Application at any time based on Your own decision, directly in the Application in the "Need Help?" section, or You can contact our customer support via email [email protected] or by phone at +385 1 3445 859. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

WHAT ARE YOUR RIGHTS AND OBLIGATIONS?

You have the right:

To access Your Personal Data

Specifically to request information about:

• the purpose of processing Personal Data,
• categories of processed personal data,
• recipients to whom Personal Data are provided, and
• the period of storage of Your Personal Data,
• the right to request from us the correction of personal data concerning You, their erasure, or restriction of their processing, or the right to object to the processing of personal data,
• the right to submit a request to initiate proceedings for the protection of personal data before the Office for Personal Data Protection,
• the source of personal data, if personal data were not obtained from You.

The Company will provide You with Your personal data it processes without delay, in a manner consistent with Your requests. For repeated provision of personal data You request, we may charge a reasonable fee corresponding to administrative costs. 

Correction of Personal Data

In case You find out that we are processing Your inaccurate Personal Data, please inform us, and we will correct such inaccurate data without undue delay. You also have the right to request the completion of incomplete personal data.

Erasure of Personal Data (Right to be Forgotten)

We will erase Your Personal Data if: (i) Personal Data are no longer necessary for the purpose for which they were collected, (ii) You withdraw Your consent for the processing of personal data under the conditions stated in these Terms, (iii) You object to the processing of Personal Data, (iv) we have obtained Your Personal Data unlawfully, (v) we have a legal obligation to erase Your Personal Data, or (vi) Personal Data were collected in connection with the offer of information society services.

In case of erasure of personal data upon Your request, we will simultaneously take reasonable security measures to notify other controllers processing Your personal data of this request, so that they also erase links to such personal data and their copies or reproductions.

Restriction of Processing of Personal Data

You have the right to restrict the processing of Your Personal Data if: (i) You contest the accuracy of Personal Data, for the period allowing us to verify their accuracy, (ii) the processing of Your Personal Data is unlawful, and You request restriction of their use instead of erasure, (iii) we no longer need Your Personal Data for processing purposes, but You need them for the establishment, exercise, or defense of legal claims, or (iv) You object to the processing of Personal Data, pending verification whether our legitimate grounds override Yours.

If the processing of personal data is restricted, except for storage, we process personal data only with Your explicit consent or for the purpose of establishing, exercising, or defending legal claims, protecting the rights of others, or for reasons of public interest.

Data Portability

You have the right to receive Your Personal Data processed by us in a structured, commonly used, and machine-readable format for the purpose of transferring such Personal Data to another controller.

Object to the processing of Personal Data

You have the right to object to the processing of Personal Data for the purpose of direct marketing, including profiling to the extent that it is related to direct marketing.

Initiate proceedings before the supervisory authority

If You suspect that Your rights related to the protection of Your Personal Data have been violated, You have the right to submit a request to initiate proceedings before the supervisory authority – the Office for Personal Data Protection under § 100 et seq. of Act No. 18/2018 Coll.

DO WE USE AUTOMATED DECISION-MAKING AND PROFILING?

In the provision of our services, we do not carry out automated decision-making, including profiling, under Article 22 of the GDPR (i.e., decision-making which produces legal effects concerning You or similarly significantly affects You and is based solely on automated processing without human intervention).

We carry out profiling, as defined in Article 4 of the GDPR (i.e., we process Your Personal Data and analyze Your behavior on our Website and in our Application to adapt our services to Your needs, analyze Your interests or preferences). However, such profiling does not lead to decision-making that would have legal effects on You or similarly significantly affect You.

AUTOMATED DECISION-MAKING CARRIED OUT BY THE PAYMENT SERVICE PROVIDER

When processing payments, we cooperate with service providers, and these providers may carry out automated decision-making, including profiling, based on their own internal rules and risk assessments (e.g., approving purchases or rejecting transactions).

Your personal data are disclosed to these entities exclusively for the purpose of payment processing and security assessment of transactions. All such processing is governed by the personal data protection rules of these service providers. Our company does not make decisions regarding the approval or rejection of these transactions.

DO WE PROCESS PERSONAL DATA OF CHILDREN?

We consider the protection of Your children's privacy to be particularly important. For this purpose, we do not knowingly collect any personal data from persons under the age of 16. If You are under 16 years of age, please do not send us any of Your Personal Data, including Your name, home address, telephone number, or email address. No one under the age of 16 is authorized to enter Their Personal Data on the Website. If we discover that any Personal Data we process belongs to a person under the age of 16 whose legal guardian has not given consent, we will erase such Personal Data without delay. If You suspect that we may be processing data from or about persons under the age of 16, please contact us at +385 1 3445 859.

HOW DO WE PROCESS FINANCIAL TRANSACTIONS?

All financial operations and transactions performed electronically on our Website or in the Application or in connection with our Services will be processed via the online payment service provider Global Payments s.r.o., organizational unit, Tomášikova 48, 831 04 Bratislava. You can find the terms of personal data processing of these providers here: https://www.globalpaymentsinc.com/sk-sk/gdpr. We disclose Your Personal Data to the aforementioned online payment service providers only to the extent necessary for processing payments You make via our Website or Application, for refunds of such payments, and for resolving complaints and inquiries related to such payments and refunds.

HOW DO WE COOPERATE WITH THIRD-PARTY WEBSITES?

Our Website contains hyperlinks and details about third-party websites.

We have no control over the terms and procedures of third parties regarding the processing of personal data, nor do we bear responsibility for them.

DO YOU HAVE ANY OTHER QUESTIONS?

If You wish to contact us regarding the processing of personal data, including cases where You wish to exercise any of the rights stated in these Terms, please send us an email to: [email protected] or call us at +385 1 3445 859.

HOW DO WE UPDATE OUR TERMS OF PERSONAL DATA PROCESSING?

We reserve the right to amend these Terms. In case we amend the Terms or procedures, we will publish these amendments on the Website or in the Application so that You always have an overview of what information we collect, how we use it, and under what circumstances we may disclose it to third parties. It is important that You regularly review these Terms to ensure You are aware of any changes.

WHAT COOKIES DO WE USE?

A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and stored in the browser on Your mobile device or computer for Your identification (most often based on anonymous identifiers). This identifier is then sent back to the server every time the browser requests a page to be displayed, for the purpose of identifying Your visit to a particular page, the list of advertisements You have responded to, the type of browser You are using, and to remember data You have entered into our Website or Application.

We use cookies to personalize the content and advertisements displayed to You, to enable the use of social media features, and to analyze traffic. We provide information about the use of our Website to our partners in the fields of social media, advertising, and analytics, who may combine it with other data You have provided to them or that they have collected due to Your use of their services.

We use cookies to adapt to Your needs, to distinguish You from other users, to prevent the display of advertisements in Your browser that are not interesting to You, and so that You do not have to log in to our Website repeatedly.

We use either "persistent" or "session" cookies: persistent cookies will be stored in Your web browser until the date specified as their expiration, unless You remove them earlier; session cookies, on the other hand, expire the moment You close the web browser.

We also use third-party cookies: Third-party cookies are cookies set by a different site, not our Website or Application. For example, "Like" buttons for social networks placed on their website. Such a button may download cookies which can then be read by the operator of those social networks. The purpose of these third-party cookies is usually to collect certain data for research in the field of behavior, demographics, and ultimately for targeting for marketing purposes.

Cookies usually do not contain data by which You could be identified, but Your Personal Data we store may be linked to data collected and stored in cookies.

Technical cookies: to ensure our online store functions correctly (e.g., so You can create a user account, log in to it, and purchase goods and services), we use technical cookies. Without them, our online store would not be able to function at all.

Functional cookies: so that You do not have to log in repeatedly and do not have to adjust your settings every time (e.g., language settings for the display of our online store), functional cookies help You. In this case, Your password is always encrypted. The use of these cookies is not necessary, but it greatly facilitates and makes your visit to our online store via the Website or purchase via the Application more pleasant.

Analytical cookies: analytical cookies help us improve our Website and Application, from which You ultimately benefit. Analytical cookies on our website and in the Application are collected by a script from Google Inc., which then anonymizes this data. After anonymization, it is no longer personal data, as anonymized cookies cannot be linked to a specific user, i.e., a specific person. We use only cookies in anonymized form. Therefore, we cannot determine from them how a specific user behaved on our website or in the application (which pages they visited, which product they viewed, etc.).

We also use insights from these cookies for advertising purposes, whereby we may display advertisements to You on other websites that we believe would be relevant to You.

Please note that blocking and/or deleting cookies may negatively affect Your ability to use the Website, Application, and/or our Services.

Last updated: 19.01.2026