Privacy Policy
This is a courtesy English translation. The German version is the legally binding original.
When you use our website and the services of our fitness studio, we process personal data relating to you, which is why we are obliged under Art. 13 GDPR to inform you of certain circumstances of this processing. We are pleased to fulfil this obligation with this privacy policy:
A. Explanations
For the sake of better transparency, we first explain general terms relating to the processing of personal data. The specific information obligations under Art. 13 GDPR are fulfilled under section B.
I. Personal data
Personal data is any data that can be personally attributed to you, e.g. name, address, email addresses, user behaviour, but also biometric characteristics such as facial data.
II. Data processing agreement (DPA)
If personal data is processed by a provider on our behalf, a data processing agreement is required under Art. 28 GDPR. This is a contract mandated by data protection law that ensures the provider processes the personal data of our website visitors and members only according to our instructions and in compliance with the GDPR.
III. Withdrawal
If you have given consent for data processing under Art. 6(1)(a) GDPR, Section 25(1) TDDDG or Art. 9(2)(a) GDPR (e.g. when using Face ID), you may withdraw that consent at any time vis-à-vis the controller, Art. 7(3) GDPR. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
IV. EU-US Data Privacy Framework
This is an agreement on data exchange between the European Union and the United States of America. It ensures the rights of data subjects whose data is processed in the USA. There is an adequacy decision by the European Commission within the meaning of Art. 45 GDPR, according to which an adequate level of protection has been established.
B. Information pursuant to Art. 13 GDPR
I. Controller and data protection officer
1. Controller
The controller within the meaning of Art. 4(7) GDPR is:
Die Turnhalle - Das EGYM Premium Fitness
Am alten Fliegerhorst 2a
26419 Schortens
Owner: Stefan Brüling
Phone: 04461 / 917 96 47
Email: die-turnhalle@web.de
2. Data protection officer
We are not legally required to appoint an external data protection officer. For questions about data protection or to exercise your rights, please contact the owner directly: Stefan Brüling (contact details as above).
II. Your rights
You have the following rights against the controller regarding the personal data concerning you:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to data portability (Art. 20 GDPR)
You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent supervisory authority is:
Der Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection Lower Saxony)
Prinzenstraße 5, 30159 Hannover
Phone: 0511 120-4500 | Email: poststelle@lfd.niedersachsen.de
III. Specific processing activities
1. Provision of the website (hosting) and log files
Our website is operated by an external service provider (hosting provider).
When you visit our website, the provider records various log files including your IP addresses. Use of this provider is based on Art. 6(1)(f) GDPR (legitimate interest in a technically error-free and secure presentation of the website) and on a data processing agreement concluded under Art. 28 GDPR.
The provider automatically collects:
- Browser type and version / operating system used
- Referrer URL / host name of the accessing device
- Time of the server request / IP address
2. Online contract conclusion and member administration
If you take out a membership on our website, we collect the data required to establish and perform the contractual relationship (last name, first name, date of birth, address, email address, phone number, bank details).
Legal basis: Art. 6(1)(b) GDPR (contract performance and pre-contractual measures).
Retention period: After the membership contract ends, this data is stored for 10 years in accordance with retention obligations under tax and commercial law (Section 257 HGB, Section 147 AO) and then deleted.
3. Digital access system via GymID (QR code and Face ID)
To control 24/7 access, we use the GymID system (a platform of collective mind GmbH).
Option A (QR code): If you use the GymID app on a mobile device, a temporary QR code is captured at check-in to verify your access authorisation. The legal basis is Art. 6(1)(b) GDPR (contract performance).
Option B (biometric facial recognition / Face ID): If you expressly consent, we use local facial recognition at the terminal. This involves the processing of special categories of personal data.
Special protection: All biometric data (facial templates) is stored exclusively locally on a physical server at the studio, which is completely separated from the internet by an air gap. At no time is any data transferred to a cloud or to external servers.
Legal basis: Art. 9(2)(a) GDPR (voluntary, explicit consent). Use of Face ID is voluntary; the QR code is available as an alternative. Consent can be withdrawn at any time with effect for the future. The data is deleted when the contract ends or immediately after withdrawal.
4. Use of the EGYM and training infrastructure
To enable you to train on our connected EGYM, EGYM Flex and software-controlled smart cardio equipment, device-specific training data (e.g. machine settings, strength measurements, training history) is processed and assigned to your personal EGYM access wristband or your local profile.
Legal basis: Art. 6(1)(b) GDPR (contract performance). Processing is strictly necessary to provide automatic machine adjustment and the contractually owed training analysis.
Retention period: Training data is retained for the duration of your active membership and deleted after the contract ends.
5. Video surveillance in the studio
To prevent vandalism and break-ins and to ensure the safety of our members – especially during unstaffed night and off-peak hours of 24/7 operation – the training areas (indoors) and the entrance areas (outdoors) are under video surveillance. Sanitary facilities and changing rooms are expressly excluded from any surveillance.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in exercising domestic authority, protecting property and protecting the life and limb of members during unstaffed operation).
Special protection & retention period: Image data is stored exclusively on the local studio server, which is isolated from the internet. Recordings are automatically overwritten after a maximum of 72 hours, unless they are needed in a specific case to investigate criminal offences or to secure evidence.
6. Contact form and email contact
When you contact us by email or via a contact form, the data you provide (name, email address, message) is stored in order to answer your enquiry. The legal basis is our legitimate interest in effective customer communication (Art. 6(1)(f) GDPR) or the implementation of pre-contractual measures (Art. 6(1)(b) GDPR). The data is deleted once your enquiry has been fully resolved and no statutory retention obligations apply.
7. Consent tool and cookies
We use technically necessary functions of our website without consent. All other services (e.g. external media such as Google reCAPTCHA, or marketing services) are only loaded after you have consented via our consent tool. The legal basis for this is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
To obtain and manage your consent, we use our own, self-operated consent tool. It runs exclusively in your browser; no data is transmitted to third parties or to servers outside this website. Your selection (which categories you allow), the time of your selection and a version identifier are stored locally in your browser's so-called "local storage". Personal data such as your IP address is not processed in this process.
Your selection remains stored until you change or withdraw it or clear your browser's local storage. You can adjust or withdraw your settings at any time via the "Cookie settings" link in the footer of the website. The legal basis for storing your selection is our legal obligation to document consent given (Art. 7(1) GDPR) pursuant to Art. 6(1)(c) GDPR.
8. Google reCAPTCHA (online withdrawal)
To protect the online contract withdrawal form against misuse by automated requests (bots), we use the reCAPTCHA service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA is only loaded after you have consented to the "External media" category. In this process, data such as your IP address, date and time, referrer URL, information about your browser, operating system and device settings, and any existing Google cookies are transmitted to Google.
A transfer to the USA is possible. Google is an active participant in the EU-US Data Privacy Framework (see A. IV.). Further information can be found in Google's privacy policy: https://policies.google.com/privacy.
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent). Without consent, you can declare your withdrawal at any time by email or letter, or use the linked withdrawal page of our management software.
9. Magicline management software (trial session, membership, cancellation and withdrawal)
For appointment, customer and member administration, we use the Magicline software of Magicline GmbH, Raboisen 6, 20095 Hamburg, Germany. The provider processes the data on our behalf; a data processing agreement under Art. 28 GDPR has been concluded. The following data is transmitted to Magicline via our website:
- Booking a trial session: gender, last name, first name, date of birth, email address, phone number, preferred appointment and, optionally, address and country. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). If no contract is concluded, the data is generally deleted after the three-year limitation period.
- Taking out a membership: the contract data listed under item 2, including account holder and IBAN for the SEPA direct debit mandate, and training and contract start dates. The legal basis is Art. 6(1)(b) GDPR. We pass your payment data on to our house bank to process the direct debit.
- Cancellation button: first name, last name, date of birth, membership number, cancellation date, reason for cancellation and any additional information. We are legally obliged to provide a cancellation button under Section 312k BGB; the legal basis is Art. 6(1)(c) GDPR. The data is deleted three years after the membership contract ends, unless statutory retention obligations apply.
- Online withdrawal: the details required to identify and process your withdrawal (e.g. name, date of birth, email address, contract data). The legal basis is Art. 6(1)(c) GDPR (statutory right of withdrawal, Section 355 BGB).
10. Our presence on Instagram
We operate a presence on Instagram (https://www.instagram.com/die_turnhalle_das_egym/), a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Our website only links to this profile; no Instagram content is embedded. Only when you follow the link does Meta collect, among other things, your IP address and information from cookies on your device, and provide us with statistical analyses of interactions with our profile. We are jointly responsible with Meta for these statistics (Art. 26 GDPR).
Data may be transferred to countries outside the EU, in particular the USA. Meta is an active participant in the EU-US Data Privacy Framework (see A. IV.). We do not know how Meta uses the data for its own purposes, how long it is stored or whether it is passed on to third parties. Details can be found in Meta's privacy policy: https://privacycenter.instagram.com/policy.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting our studio). You can exercise your data subject rights against both us and Meta. If you interact with us via Instagram (e.g. by direct message), we process your details as described under item 6.
Privacy policy last updated: October 2026