Data Privacy Policy EGYM

Data protection is a matter of trust and your trust is very important to us. We respect your privacy and personal sphere. The protection and the lawful collection, processing and use of your personal data are therefore an important concern for us.

To ensure you feel safe when visiting and using our offers, we strictly observe the legal regulations when processing your personal data and in the following would like to inform you in detail about the processing of your personal data when using our products/services.

We have aligned this privacy policy with both the European General Data Protection Regulation ("GDPR") and the Swiss Data Protection Act ("DSG"). Where this privacy policy refers to personal data within the meaning of the GDPR, personal data within the meaning of the DSG is also covered. The same applies to other legally defined terms (for example, "processing" under the GDPR corresponds to "Bearbeitung" under the DSG).

Under the DSG, no justification is generally required in order to process personal data. Within the scope of the GDPR, by contrast, the processing of personal data is only lawful if it can be based on an appropriate legal basis. This privacy policy and the cookie policy therefore also state the legal bases on which the processing relies, insofar as the GDPR applies. Where consent is obtained for the processing and this privacy policy refers to consent under the GDPR, consent under the DSG is also covered in each case, insofar as it is required for the processing. Whether the GDPR or the DSG applies depends on the individual case.

1. Scope; EGYM products/services concerned

The privacy policy below applies to the following EGYM products and services.

By clicking on the product/service in question, you can directly access the product or service-specific information:

• EGYM Website(s) (available at www.egym.com)

• EGYM Fitness Hub (Smart and digital training innovation for simplified onboarding of end-users in the fitness facility, conducting tests and measurements)

• EGYM Smart Strength equipment (Training equipment in a fitness facility*), as well as strength and cardio equipment from other manufacturers using the EGYM training software

• EGYM Fitness App (End customer application for smartphone, available for iOS (Apple) and Android (Google))

• EGYM Branded Member App (End customer application of your fitness facility*, available for iOS (Apple) and Android (Google)

• EGYM Fitness Finder (Platform to identify a suitable fitness facility for end customers)

• EGYM Trainer App (Application for fitness facilities* and personal trainer for the iPad)

• EGYM Genius (Product innovation for fully connected and personalized training plans with AI technology)

• EGYM presences on social media platforms

*The term "fitness facility" includes in particular gyms, health centres and physiotherapeutic practices.

2. Controller and contact details of the data protection officer

The controller for the collection, processing and use of your personal data is is EGYM SE, Einsteinstraße 172, 81677 Munich, Germany (hereinafter EGYM).

If you have any concerns regarding data protection at EGYM, please contact us via the following channels:

EGYM SE

Einsteinstraße 172

81677 München

Germany

E-mail: datenschutz@egym.de

You can contact our data protection officer by e-mail at datenschutz@egym.de or by post to the aforementioned address with the addition "data protection officer" at any time for data protection-related concerns.

3. Processing of personal data within the scope of using our products and services

3.0 EGYM ID – one-time registration to use all products/services of the EGYM group

a) In order to use the following EGYM products and services, prior registration is usually required. Registration for EGYM products and services requires your email address, your first and last name, your date of birth (to verify that you have reached the minimum age required to use our products), your language and a password of your choice. After registering, you will receive an email asking you to confirm your registration, your EGYM user account (EGYM ID) will be activated after clicking on the link. We set up a password-protected direct access (user profile) for each user who registers accordingly. The legal basis for the aforementioned processing is the implementation of a contractual or user relationship with you (Art. 6 para. 1 sentence 1 lit. b) GDPR).

You may also use your EGYM ID, once activated, to sign up for any other EGYM products and services listed in this section below. Once you have signed up to use EGYM, e.g. on the EGYM website or on an EGYM weight machine, you can also use your access details to log in to the EGYM Fitness App or an EGYM Branded Member App provided by your fitness centre. When using an EGYM product or service for the first time, you will be asked whether you already have an EGYM ID.

An EGYM user account is only created if you actively register yourself to use an EGYM product or service (for example in the EGYM Fitness App, an EGYM Branded Member App of your fitness facility, or as part of onboarding at an EGYM Fitness Hub). Fitness facilities cannot create or set up an EGYM user account without your active registration. Mere membership of a fitness facility or the use of a facility access system therefore does not automatically result in the creation of an EGYM user account.

b) Cross-facility use of your EGYM user account

Your EGYM user account (EGYM ID) can be used in connection with various EGYM products and services, including where these are provided in different fitness facilities. If you use the same EGYM user account in several fitness facilities that use EGYM technology (for example EGYM strength machines, the EGYM Fitness Hub or access systems with an EGYM integration) and you have registered the same email address with those fitness facilities, certain usage events will be assigned to your EGYM user account. This may include, in particular, so-called check-in or access events, which arise when an access credential (for example a barcode, QR code, RFID chip or membership card) is used at a fitness facility access system that is connected to EGYM systems. These events are assigned to your EGYM user account where the access credential used, or the underlying membership, is linked to your EGYM user account. Your user account can in this way provide you with a consolidated overview of your activity events, for example an overview of your check-ins at the facilities you have visited in the EGYM Branded Member App. The consolidation takes place exclusively within your personal EGYM user account. Fitness facilities do not thereby obtain access to data from other fitness facilities. Each fitness facility can only view the data made available to it in connection with the use of the EGYM services at that facility with your express consent.

c) If your fitness facility offers this, you can also use your EGYM ID for convenient log-in on the website of your gym in order to log in there with your EGYM user account and to make use of functionalities offered on the website of your gym, such as course bookings, self-service services, etc.. For the log-in with your EGYM ID in the app or on the website of your studio, EGYM is the controller pursuant to Art. 4 No. 7 GDPR. We store only that you have registered with your EGYM user account data for the website of your studio and the times of the log-ins. For the studio-related functionalities offered on websites, on the other hand, your fitness facility is the controller, i.e. we do not receive any data or information in particular about which studio-related functionalities you have used or visited on the studio's website. You can find information on this in the privacy policy of your studio.

d) If you are already a member of our group company EGYM Wellpass, we will offer you another (voluntary) option of also signing up to the use of our EGYM products/services with your EGYM Wellpass login details. In this case, your existing profile will be enlarged to include the use of EGYM products and you will be able to use it to log in for all EGYM products/services in the future without having to create a separate/additional EGYM ID. EGYM’s General Terms and Conditions and this Privacy Policy, including the processing of personal data when using EGYM products/services as described herein, also apply if you sign up using your EGYM Wellpass login data. You will be informed of this when you register for an EGYM product using existing EGYM Wellpass login details.

3.1. EGYM Website Usage

3.1.1 Log files/ Information transmitted by your browser

You can visit our websites (www.egym.com or e.g. www.fitness-finder.com) and obtain information without having to provide personal data. When using our website for information purposes only, we only collect the data that your browser sends to our server.

Every time you use the Internet, your web browser automatically transmits certain information, which is stored by us in so-called log files. These are the following data, which is necessary to display our website and to guarantee stability and security: IP address (Internet Protocol address), date and time of the request, content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, website from which the request originates, browser, operating system and its interface, language and version of the browser software. It is not possible for us to draw conclusions about individual persons based on this data. The IP addresses of users are deleted or anonymised after termination of use. This data is stored by us for reasons of technical security, e.g. to prevent attacks on our web server. We evaluate the log file data records in anonymised form in order to further improve our offers and make them more user-friendly, to find and correct errors more quickly and to control server capacities.

3.1.2 Optional addition of further profile data

On the EGYM website, you can add further information to your user profile, such as profile photo, body weight and height, gender, language, date of birth, address, telephone number, e-mail and newsletter settings, fitness level, training experience, training frequency, preferred training days, length of a training session as well as profession, typical work posture, hobbies and practiced sports, in order to enable targeted support and to have a training plan created by your trainer based on analyses. Please note that the above information is optional and that you can decide for yourself whether and to what extent you wish to store this data. The legal basis for the processing described above is the execution of a contractual or user relationship with you (Art. 6 para. 1 sentence 1 lit. b) GDPR). Please note, however, that for the use of certain EGYM functionalities and services such as BioAge, some of the data mentioned above as optional is required for the provision of the requested service/functionality, otherwise the requested service/functionality cannot be provided properly. Such data/information is marked as mandatory for the respective functionality/service accordingly.

3.1.3 Subscription to the newsletter

If you would like to subscribe to the EGYM newsletter, your email address is required in order to send you the newsletter. The newsletters may contain information about offers from EGYM, (product) updates, invitations to events and webinars, as well as other EGYM marketing messages or requests to take part in user surveys and user interviews or requests to take part in product tests. The legal basis for sending an EGYM newsletter to which you have subscribed is your consent in accordance with Article 6 (1) sentence 1 lit. a) GDPR.

We would like to point out that we use the so-called double opt-in procedure for sending the EGYM newsletter, i.e. we will only send you a newsletter by e-mail if you have expressly confirmed to us in advance that you have registered under the corresponding e-mail address. For this purpose, we will send you a notification e-mail and ask you to confirm that you have registered under this e-mail address by clicking on a link contained in this e-mail. You can unsubscribe from receiving the newsletter at any time (e.g. by clicking on the unsubscribe link in each newsletter).

3.1.4 Processing of your data for the purpose of direct advertising via email

If you request free information material from us (for example white papers or brochures) or take part in a free webinar, we process your email address, including for the purpose of advertising and informing you about our offers and services: information about offers from EGYM, (product) updates, invitations to events and webinars, as well as other EGYM marketing messages or requests to take part in user surveys and user interviews and requests to take part in product tests. You can object to the future use of your data at any time.

In the case of advertising sent by email, you can object at any time, for example by clicking the unsubscribe link contained in every email. Furthermore, you can exercise your right to object at any time by contacting us using the contact details provided in section 2 above.

The legal basis for the processing described above is Art. 6 para. 1 sentence 1 lit. f) GDPR in conjunction with Sec. 7 para. 3 of the German Act against Unfair Competition (UWG). We have a legitimate business interest in informing people who have already shown interest in our offers or who have taken part in our free webinars or requested demos or materials about our own offers by e-mail.

3.2 EGYM Fitness Hub

The EGYM Fitness Hub is a smart and digital training innovation that enables end-users to simplify their onboarding into the world of EGYM services at the fitness facility, including conducting tests and measurements, and is connected to all EGYM devices. This allows for fully automated adjustment of all EGYM strength training machines (see Section 3.2) to the user’s measurements, training goals, and needs, and stores test results and progress in the EGYM Fitness App (Section 3.4) and the EGYM Branded Member App (see Section 3.5), provided the end-user uses these services. The results are also used to create personalized training plans based on the end-user’s selected fitness goal.

The EGYM Fitness Hub, equipped with advanced 3D camera technology, captures and analyzes the physical attributes and performance of the end-user through self-service mode tests and detects and corrects any improper movements while performing predefined movement patterns. The EGYM Fitness Hub is connected to fitness carts from third-party providers, which offer additional measurements. Depending on the provider of the fitness scale, further data will be collected by the respective provider under their responsibility, and additional information can be found on the screen of the fitness scale connected to the EGYM Fitness Hub.

The measurement and test results are displayed to the end-user on the EGYM Fitness Hub screen, and they can be accessed later by the end-user through login with the RFID chip or fitness band on the EGYM Fitness Hub or in the EGYM Fitness App and/or EGYM Branded Member App.

Certain features within the EGYM Fitness Hub (e.g., Squat Feature) involve photographic recordings of your person, allowing you to view the recordings for personal posture correction after performing a movement sequence/test. The recordings are stored in your EGYM account, so you can also review them at later times, for example, for progress tracking on the EGYM Fitness Hub.

When using the EGYM Fitness Hub after prior registration on the Fitness Hub screen, we process your personal data in the form of your registration data (see Section 3.0), which enables login on the Fitness Hub. We also store data about your physical attributes such as gender, weight, and height; as well as results from strength and progress measurements on the Fitness Hub, including strength, cardio, metabolism (BMI, weight, body fat, body water, extracellular and intracellular water, basal metabolic rate, skeletal muscle mass) and flexibility (based on measurements of hip, hamstrings, chest, and neck after performing exercises on the Fitness Hub); the latter serves as the basis for visualizing your biological age (BioAge), a metric that compares the end-user’s biological age with their actual chronological age and provides a holistic assessment of physical condition and fitness level. Metabolism data comes from the smart body scales connected to the Fitness Hub (see above). Additionally, device settings (for EGYM strength machines) and training plans, heart rate and performance data, and your fitness goals (e.g., weight loss, muscle building) are stored. When using specific features like the Squat Feature, photos of your person are also stored (see also above).

Please note that data related to your posture, strength, metabolism, cardio, flexibility, and the resulting BioAge metric, as well as heart rate and performance data, are considered health data. The processing of this health data is based on the explicit consent of the user in accordance with Art. 6 para. 1 sentence 1 lit. a) in conjunction with Art. 9 para. 2 lit. a) GDPR, which is provided during registration for EGYM services. The user can withdraw consent at any time with future effect. However, the lawfulness of the data storage up to the withdrawal remains unaffected. Please note that, due to the broad interpretation of the term health data under GDPR, which includes not only training data or information about your BioAge but also details like your height or weight, meaningful use of our EGYM products will no longer be possible or feasible, and in the event of withdrawal of consent for the processing of health data, your EGYM account will be deleted. If you are unsure or have any questions, please feel free to contact us, for example, by email at datenschutz@egym.de.

Body composition analysis with integrated seca technology at the EGYM Fitness Hub:

In certain variants of the EGYM Fitness Hub, such as the EGYM Fitness Hub seca edition, body composition analysis is fully integrated into the device. The Fitness Hub seca edition combines digital onboarding with a medically precise bioelectrical impedance analysis (BIA) based on seca technology. Members log in at the Fitness Hub with their EGYM account, complete the measurement process and receive their analysis results immediately as part of the digital workflow. The body composition analysis is carried out and evaluated via an application provided and operated by seca which is integrated into the Fitness Hub. For data protection purposes, seca acts here as a processor of the respective fitness facility in which the Fitness Hub is operated, and processes the measurement data required for the analysis on behalf of that facility. The fitness facility is the controller for carrying out this measurement process. EGYM receives only the calculated results of the body composition analysis from seca. EGYM processes these results as a separate controller in order to store them in your EGYM user account and to display them to you at the EGYM Fitness Hub and, depending on your settings, in further EGYM applications. Responsibility under data protection law for the collection and processing of additional information within the seca application, and for obtaining and documenting the corresponding consents, rests exclusively with the respective fitness facility or with seca as its processor.

3.3 EGYM Smart Strength

EGYM Smart Strength machines are both those marked with an EGYM logo and those of other brands with the EGYM training software. In order to be able to train on strength or cardio equipment with the EGYM training software, an EGYM user profile is required (see 3.0. above).

3.3.1 Equipment settings

If necessary, the equipment settings are adjusted by the trainer at your fitness facility before the first workout. These equipment settings (gender, height, range of motion, weights) are stored so that they can be automatically adjusted to the user for all subsequent workouts on the equipment for that user and you do not have to apply any settings yourself. The legal basis for the processing of the aforementioned data is the fulfilment of a contract (Art. 6 para. 1 sentence 1 lit. b) GDPR).

The processing of health data is based on the user's consent pursuant to Art. 6 para. 1 sentence 1 lit. a) in conjunction with Art. 9 para. 2 lit. a) GDPR. The user can revoke the consent at any time with effect for the future. However, this does not affect the lawfulness of the storage carried out on the basis of the consent until the revocation. Please note that in this case you will no longer be able to use the functionalities concerned.

3.3.2 Strength testing, storage of training data/training results (health data)

Training data (training device(s), weights, repetitions, distance and duration) is stored to enable strength testing and analysis of the training on the machines using the EGYM training software, which is designed to help you train ideally, taking into account your physical characteristics. In addition, training results can also be recorded and documented manually by yourself using the EGYM Fitness App (see section 3.3 below).

The processing of health data is based on the consent of the user in accordance with Art. 6 para. 1 sentence 1 lit. a) in conjunction with Art. 9 para. 2 lit. a) GDPR. The user can revoke the consent at any time with effect for the future. However, the legality of the storage that has taken place on the basis of the consent up until the revocation is not affected by this. Please note that due to the broad interpretation of the term health data according to the GDPR, which already includes information such as your height or weight in addition to training data or information about your BioAge, a meaningful use of our EGYM products is no longer possible and feasible, so that we will delete your EGYM account in case of a revocation of your consent to the processing of health data. If you are not sure or have any questions about this, you are also welcome to contact us, for example, by email at datenschutz@egym.de.

3.4. EGYM Fitness App

Scope of processing, purposes and legal basis:

• To use the EGYM Fitness App, prior registration/creation of an EGYM user account is required (see 3.0. above)

• With the EGYM Fitness app, the user can document their fitness training and create training plans. The EGYM fitness app also stores the results of the strength tests on the EGYM equipment if the user is exercising on EGYM equipment. In addition, training units and results can also be recorded and documented manually by users themselves by means of the EGYM Fitness App. In addition to the documentation of the training and the training progress, the data mentioned above also allows analyses of maximum strength, muscle imbalances, biological age ("BioAge") and activity level. The processing of this health data is based on the user's consent in accordance with Art. 6 Para. 1 S. 1 lit. a) in conjunction with Art. 9 Para. 2 lit. a) GDPR. You can withdraw a consent already given at any time with effect for the future. Please note that once consent has been withdrawn, the functionalities concerned can no longer be used.

• Users of the Fitness App also have the option of sharing their training progress with friends or other studio members of the fitness facility and comparing them in a ranking list (approval required).

• In addition, there is the option for users to connect to external partners and third-party services/devices (e.g. fitness trackers and other wearables), for example to document training results using other services. In order to establish this connection, for each service to which you wish to connect, you will be asked in advance for your consent to data processing (Art. 6 para. 1 p.1 lit. a) GDPR).

3.5 EGYM Branded Member App

The EGYM Branded Member App is a mobile application of your fitness facility (if it offers one), which combines functionalities for the administration and optimal use of your membership in the respective fitness facility with functionalities of EGYM for the documentation and analysis of the user's training. In order to use the functions of the app, you must register (see section 3.0 above).

Scope of processing, purposes and legal bases:

• Verification of your membership: In order to verify your membership of the fitness facility listed in the app, we use bar codes or other forms to verify your membership of the respective fitness facility so that you can use the specific functionalities applicable to your fitness facility, e.g. view group course schedules of the fitness facility, book a course or participate in promotions of your fitness facility. The legal basis for the processing described above is Art. 6 para. 1 sentence 1 lit. b) GDPR (processing is necessary for the fulfilment of a contract).

• Training data/fitness activities (health data): If you wish to use the relevant training functionalities of the app, we will also store health-related data in your user profile with your consent. This is information about your fitness and physical characteristics that is required to provide you with a requested training history, progress towards your fitness goals, challenges and participation in reward programmes, as well as information about your gender, weight, the name of your personal trainers, your training plan, your training data (such as length and intensity of the training, training time, equipment used, calories burned, distance and average speed) as well as information about your biological age (BioAge) and activity level. The legal basis for the processing described above is Art. 6 para. 1 sentence 1 lit. a) GDPR in conjunction with Art. 9 para. 2 a) GDPR (consent of the data subject).

• Display of check-in information: Display of check-in and access events (date, time and name of the facility) in connection with the use of EGYM systems, which arise when you use the access systems of a fitness facility that are connected to EGYM technology. This information is merely presented in the app from your EGYM user account (see section 3.0 above). The app itself does not generate or record these events, and no access to your location takes place for this functionality. If your EGYM user account is used in several fitness facilities that use EGYM technology, corresponding events from those facilities can be displayed together in the activity overview of your EGYM user account.

• Connection to compatible fitness trackers/wearables, (fitness) devices (information from other sources): If, for example, you wish to link or synchronise data from compatible fitness trackers/wearables, fitness devices, etc. from third-party providers in the app with your user profile, we will process the data transmitted by these third-party providers, including and depending on the third-party provider, with your consent, including health-related data for the purpose of the link/synchronisation you have requested in your user profile. You can disable the link at any time in the app settings. The legal basis for the processing described above is Art. 6 para. 1 sentence 1 lit. a) GDPR in conjunction with Art. 9 para. 2 a) GDPR (consent of the data subject).

• Data in connection with rewards, recommendations, challenges and promotions: We collect information about offers / promotions in which you participate in the App, which you save, claim and use, reward points which you collect and spend and the number of referrals you submit. The legal basis for the aforementioned processing is Art. 6 para. 1 sentence 1 lit. b) GDPR (processing is necessary for the performance of a contract).

• Information about your goals and challenges: When you set your goals and/or accept a challenge, we collect and store your goal information (name, type, requirement, status, progress) and challenge information (challenges accepted, completed, ranking, including the usernames of other competitors). The legal basis for the processing described above is Art. 6 para. 1 sentence 1 lit. b) GDPR (processing is necessary for the fulfilment of a contract).

• You will be informed by email about news and announcements relating to EGYM and the process, targets and challenges in which you are involved, provided you gave express consent to do so during the registration process. You can unsubscribe from email notifications at any time by clicking on the corresponding link provided in every email.

• App access rights: You have the option of granting us the following access rights listed below to use a number of our app's features. These rights enable us to access certain functions of your device. When opening the app or when using the respective function for the first time, you will be asked once to agree to the corresponding access rights being given. Granting such access rights is naturally done so on a voluntary basis. If you do not grant the corresponding access rights, you will be unable to use the respective function in our app. Your consent forms the basis for processing your data within the scope of the following access rights listed below (point (a) of Art. 6(1)(1) GDPR). Specifically, we process the following data if you grant us the following access rights listed below:

• Location: Location data are only used by us to check the location of your device and to provide the respective location-based functionalities (e.g. to show the nearest fitness centre to the user's location).

• Push notifications: If you have activated push notifications, you will receive information about your studio directly on your screen as a push notification.
• Calendar: If you enable access to your calendar, we will only use your calendar to enter courses booked by you in the app.
• Camera: Access to your camera must be granted if you would like to scan bar codes using the app.
• Photo library: Access to your photo library is solely for cases where you would like to store a photo in your user profile using an image from your photo library.
• Apple Health (for iOS devices): It is only necessary to grant access rights to Apple Health if you want to store data from the app using Apple Health or, conversely, synchronise data held using Apple Health with the app.
• Contacts: Your stored contacts are only accessed if you would like to use the "refer a friend" function to be able to inform certain contacts that you are using the app.

You may revoke your consent for any rights given at any time by going to the settings on your Android/iOS device and then either tapping on "Authorisations" (Android devices) or "Privacy" (iOS devices), where you can then deactivate individual or all rights granted for our app. If you remove the app from your device, any rights granted are automatically deleted.

Please note that if your fitness facility offers optional paid additional services/extensions/extras to your membership in the fitness facility in the Branded Member App (these could include additional services such as towel service, parking offers, nutrition coaching, etc.), which you can purchase in the Branded Member App, your fitness facility is responsible for the processing of your personal data related to such services, particularly in connection with the conclusion of the contract for such additional services, payment processing, and the processing of your data during the provision of these additional services. EGYM acts solely as a data processor according to Art. 28 GDPR on behalf of your fitness facility, also see the further information in Section 4. If you book such an additional service in the Branded Member App, we will transmit your name, email address, date, and the specific additional service booked to your fitness facility. The subsequent contract conclusion occurs directly between you and your fitness facility, including the collection and processing of the necessary payment data. EGYM does not collect or process your payment data. If you cancel additional services that you booked in the Branded Member App, depending on the parameters set by your fitness facility, we will forward this information to your fitness facility.

3.6 Usage and behavioural data in the Branded Member App

When you use the Branded Member App, we process information about how you interact with the app and its functions. This includes, in particular, information about which functions and content you use and access, which actions you carry out (for example starting or completing a training plan) and technical usage information such as app version, operating system, platform, time zone or device model. This usage and behavioural data is processed for the purposes of analysis, error correction and the further development and improvement of our app and its functions.

a) Anonymised processing without consent

Where you have not given consent to the personalised processing of your usage and behavioural data, we collect and process this data exclusively in anonymised form. In that case, the usage events are processed without direct or indirect identifiers, so that no conclusion can be drawn about you as an individual. The anonymised processing serves the statistical evaluation of app usage and general product optimisation.

b) Personalised processing on the basis of your consent

Where you have expressly consented, we process your usage and behavioural data in personalised or pseudonymised form. In that case, the usage events can be linked to your user account or to a device in order to better understand how individual functions are used and to improve the navigation, content and functions of the app in a targeted manner. The personalised processing covers, in particular, events such as opening certain areas of the app, the use of individual functions or the completion of certain steps within the app. No specific health or analysis values (for example measurement values, training results, BioAge or heart rate data) are processed. Only the fact that a corresponding action was carried out is recorded, not its result. The legal basis for the personalised processing of your usage and behavioural data is your express consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future in the settings of the Branded Member App. From the time of withdrawal, your usage and behavioural data will only be processed in anonymised form. The lawfulness of the personalised processing carried out before withdrawal remains unaffected.

3.7 EGYM Fitness Finder

In order to use the services of the platform fitness-finder.com to request vouchers for testing sessions at participating gyms, your name and e-mail address are required. The telephone number is required for making an appointment or for queries on the part of EGYM and the fitness studios you have chosen. The legal basis for the processing of the above-mentioned data is the fulfilment of a contractual relationship (Art. 6 I b) GDPR), in this case specifically the sending of a voucher selected by you for the fitness studio in question. The processing of the aforementioned data is necessary for the fulfilment of the contract. Your data will not be used for advertising purposes without your consent.

3.8 EGYM Trainer App

In order for a trainer at your fitness facility to support your training via the EGYM Trainer App, in addition to the data required for registering an EGYM user account (see Section 3.0 above), the following EGYM data must be provided to your fitness facility: name, RFID assignment, device settings. Where you have separately consented (Art. 6 para. 1 sentence 1 lit. a) in conjunction with Art. 9 para. 2 lit. a) GDPR), trainers at your fitness facility can view certain data stored in your EGYM user profile via the EGYM Trainer App in order to support you professionally during your training. Depending on your consent, this includes, in particular, information about your training history, training plans, your activity level and further training and fitness-related information, including health data, such as your BioAge or the results of strength and progress measurements; this also includes personalised training plans created by the trainer. You can of course deactivate the connection between your EGYM profile and your trainer's Trainer App at any time by unlinking it in your profile settings.

The aforementioned data is displayed to trainers for viewing exclusively within the EGYM Trainer App. No separate transfer or permanent storage of this data at your fitness facility takes place in this context. The legal basis for making the aforementioned data visible is your express consent pursuant to Art. 6 para. 1 sentence 1 lit. a) in conjunction with Art. 9 para. 2 lit. a) GDPR. You can remove the link between your EGYM user profile and the Trainer App, and withdraw your consent, at any time in the privacy settings with a single click. Further transfers of data to your fitness facility, for example in the form of structured reports containing usage and status information, take place exclusively on the basis of a separate consent and are described in more detail in section 4.3.

3.9 EGYM Genius

EGYM Genius is a feature of the EGYM platform that can be used by end-users within the EGYM Branded Member App in self-service mode after onboarding the end-user at the EGYM Fitness Hub. It uses artificial intelligence (AI) and intelligent algorithms to personalize and optimize the training experience of the end-user and enhance the effectiveness and efficiency of the training through training plans tailored to the needs of the end-user. Users can optionally provide additional information about their current training situation, their physical condition or their training preferences via a chat or text input function at the level of their training plan or of an individual training session. EGYM Genius analyses these inputs automatically, can ask any necessary follow-up questions and summarises the resulting adjustment requests for the user. EGYM Genius takes into account the entire training area of the fitness facility and all digital/smart training devices available there, such as EGYM strength training machines or those from third-party providers, as well as analog training devices. EGYM Genius processes data from various sources, including EGYM strength machines, the EGYM Branded Member App, the EGYM Fitness Hub, and wearables you have explicitly connected, as well as data from an internal database operated by EGYM, which combines fully anonymized training data from end-users and evaluation data from sports science findings to create personalized training plans.

To create personalized training plans, EGYM Genius analyzes the training data of an end-user and dynamically adjusts the training plans. EGYM Genius considers and processes factors and data such as fitness level, progress, personal training goals such as muscle building, weight loss, rehabilitation, endurance improvement, chat or text inputs from the user, as well as user feedback. EGYM Genius evaluates the collected training data and provides direct feedback to enhance the effectiveness of the end-user’s training. The system can also suggest targeted exercises for the end-user. Progress is made visible to the end-user in the EGYM Branded Member App.

As part of the optional/voluntary creation of personalized training plans using EGYM Genius, we store data about your person/physical condition such as gender, weight, and height; the results of strength and progress measurements at the Fitness Hub, your BioAge, your fitness goals (e.g., weight loss, muscle building), your training data (from EGYM strength machines or self-entered training in the EGYM Branded Member App), and fitness activities (e.g., activities entered by you in the EGYM Branded Member App inside and outside your fitness facility), data from compatible fitness trackers/wearables, and the personalized training plan created for you as well as, where you use the chat function, the chat content you have entered, the history of the chat communication, the responses of the system and the summaries of your training goals and adjustment requests derived from these.

We process this data in order to provide the chat function, to understand your inputs, to ask follow-up questions where necessary, to implement the adjustments to your training plan or to individual training sessions confirmed by you, and to verify the functionality, security and quality of EGYM Genius. The chat histories and the summaries derived from them are stored on a user-related basis in the EGYM backend and deleted no later than four hours after they are collected. Summary information about your training preferences, such as "more focus on the upper body", is generally stored for the duration of your use of the Genius function or until it is overwritten by new summary information.

Please note that the processed data related to your BioAge, training activities, and results from strength and progress measurements, and, depending on the specific content, also your chat or text inputs, are or may be health data. This applies in particular where you provide information about your physical condition, pain, complaints, injuries or illnesses. Where chat or text inputs do not contain health data, they are processed in order to provide the function you have requested on the basis of Art. 6 para. 1 sentence 1 lit. b) GDPR. The processing of health data, including health-related chat content, is based on the explicit consent of the user pursuant to Art. 6 para. 1 sentence 1 lit. a) in conjunction with Art. 9 para. 2 lit. a) GDPR. The user can withdraw consent at any time with future effect, and for example, delete a training plan created using EGYM Genius.

3.10 Provision of usage data to your fitness facility

Where you have expressly consented, we provide your fitness facility with certain data on your use of the EGYM products via an interface. The provision takes place once a day and covers your interactions with the EGYM products from the preceding day. Only the following are transferred:

• Identification data: first name, last name, email address, chain or facility, EGYM ID, your membership number in your fitness facility management system (where a corresponding interface exists) and the status of your consent.
• Times at which certain functions were used: first and last BIA measurement at the EGYM Fitness Hub, flexibility test carried out at the EGYM Fitness Hub, strength test carried out on a specific EGYM Smart Strength machine.
• Use of the EGYM Smart Strength machines: time of use, designation of the machine (for example EGYM Squat), user status (guest or logged in), operating mode (Circuit or EGYM Pro), training method and training visualisation. This data is provided for each completed set on the machine.

The data shows only whether and when you used a particular function or a particular machine. We do not transfer results or measurement values. In particular, your fitness facility does not receive any BioAge values, any results of your strength or flexibility measurements, any body composition or BMI values and no information on training volume, repetitions, weights or training programmes via this interface. The sole purpose of the transfer is to enable your fitness facility to support you better, for example by identifying gaps in onboarding, optimising internal facility processes and approaching members who have not completed individual steps at the start of their training. The legal basis for the transfer is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR. You give this consent voluntarily and actively via one of the following EGYM products: EGYM Branded Member App, EGYM Wellpass App, EGYM Fitness Hub, EGYM Smart Strength machines, EGYM Trainer App or the EGYM website. You can withdraw your consent at any time with effect for the future. The lawfulness of the transfers made up to the withdrawal remains unaffected. Once it has received the data, your fitness facility decides independently on its further processing and is a separate controller within the meaning of the GDPR in that respect. The privacy policy of your fitness facility applies to that processing. Please assert your data subject rights in relation to that processing directly with your fitness facility.

3.11 Use of Anonymized Training Data for Statistical Purposes

We use the training data collected from our digital strength machines (EGYM strength machines), demographic data (age, gender, height), body measurements (weight, strength measurements, body fat measurements), end-user activities (e.g., exercises performed), metadata from our exercise database (e.g., which exercises activate which muscle groups), including health data, exclusively and fully anonymized for statistical analyses and store these anonymized data in a separate database.

The analysis and evaluation of anonymized data aims to generate general and aggregated insights (e.g., average training patterns, correlations between training and goal achievement) and improve our products and services. For example, insights from anonymized training data are used to generate personalized training plans via EGYM Genius for other users (see Section 3.9 above). The processing in the form of anonymization for statistical purposes is aimed solely at deriving general, aggregated insights. In no case will the data be traced back to individuals or result in individualized outcomes for the person whose data was anonymized.

We ensure that all data are fully anonymized before statistical analysis and storage. This means that under no circumstances can conclusions be drawn about the identity of the affected persons, and the anonymization cannot be reversed. The further processing of data collected through the use of EGYM services in the form of anonymization for statistical purposes is based on Art. 6 para. 4 GDPR in conjunction with Art. 5 para. 1 lit. b) GDPR. For the further processing of health data in the form of anonymization for statistical purposes, the legal basis is Art. 9 para. 2 lit. j) GDPR in conjunction with Art. 5 para. 1 lit. b) GDPR. Please note that the strict and complete anonymization of your data as an additional security measure ensures that no link to your identity can be made.

3.12 Use of Anonymized Data for Sports Science Studies

For the purpose of sports science studies, partly in collaboration with research institutions, universities, and institutes, we process anonymized and aggregated, that is summarized, user data about user training behavior to derive sports science insights, e.g., regarding training intensity and frequency, and publish studies. Your training data is fully anonymized, so EGYM cannot make any conclusions about individual users, and the anonymization cannot be reversed. Research institutions, universities, and institutes receive only anonymized data sets for evaluation.

For the further processing of health data in the form of anonymization for (sports) scientific research purposes, the legal basis is Art. 9 para. 2 lit. j) GDPR in conjunction with Art. 5 para. 1 lit. b) GDPR. Please note that the strict and complete anonymization of your data as an additional security measure ensures that no link to your identity can be made.

3.13 Registration for Events, Photo and Video Recordings at Events

If you have received an invitation from us to one of our events, you may register for the respective event via the code or link provided in the invitation on our website. For the purpose of registration, we collect the data specified in the respective registration form. This may include your first and last name, your email address, and your company, with mandatory fields marked accordingly in the form. Upon successful registration, you will receive an email confirmation from us with further information about the event. The processing of the aforementioned data is necessary for the proper registration for the event. The legal basis for this data processing is Article 6(1)(b) of the GDPR (processing is necessary for the performance of a contract-like relationship with the data subject).

As part of your event registration, we will also ask for your consent to take photo and video recordings of you during your participation in the event and to use such recordings. Providing consent is voluntary, and the legal basis is Article 6(1)(a) of the GDPR. You may withdraw your consent at the event entrance by requesting a “No Photos/Videos” sticker from the designated trained staff and placing it visibly on your clothing (on the front upper part of your body), so that photographers and videographers commissioned by us or by sponsors can recognize that you do not wish to be photographed or recorded, nor have any images or recordings published. We will also inform you of this option at the event check-in via signage. You may withdraw your previously given consent at any time with future effect. Please note that withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Furthermore, please be aware that even after withdrawal, the deletion of already published photos or videos may be excluded if one of the exception cases under Article 17(3) of the GDPR applies.

4. Relationship to fitness facilities / order data processing

4.1. General Information

We offer fitness studios, health centers, physiotherapy clinics, fitness facilities, and similar clients various services and applications for member and training support (such as our Branded Member App and Trainer App) and, in this context, also process personal data of the members of the fitness facilities on behalf of the respective fitness facility based on a data processing agreement in accordance with Art. 28 GDPR or Art. 9 DSG. This also applies if you book paid additional services from your fitness facility in the Branded Member App (e.g., towel service, nutrition coaching, etc.). This privacy statement does not apply to the data collected by your fitness facility as part of your membership with the fitness facility, and the respective fitness facility is the data controller in the data protection legal sense. Data processing in this case is carried out in accordance with the respective fitness facility's own privacy policies and statements.

If you create and register an EGYM user account at your fitness facility and other EGYM services/applications (e.g. Branded Member App or Fitness App) when using our Smart Strength machines, this data privacy policy applies and EGYM is the controller under data protection law.

In summary: your fitness facility is generally responsible for the data processing in connection with your membership of the fitness facility (for example the membership contract, course bookings or other facility-related services). EGYM, by contrast, is responsible for the processing of personal data in connection with your EGYM user account and with the use of EGYM products and applications. Where data is exchanged between your fitness facility and EGYM, this takes place only in the cases described below in this privacy policy and on the basis of the relevant legal basis in each case.

4.2. Transfer/synchronisation of gym data to your EGYM user profile

With your consent, gym data from your fitness facility can be transferred to your EGYM user profile so that you can use the respective advanced functions (e.g. retrieval of the training plan created by the trainer in the Fitness App, administration of your membership in the fitness facility, etc.).The gym data that your fitness facility has collected from you as part of the membership contract includes: membership start/end, photo, date of birth, gender, training experience, training plans and templates. Your consent will be obtained for the transfer of your gym data to your EGYM user profile in order to use the additional functions in accordance with Art. 6 Para. 1 a) GDPR.

In addition, you can consent at the same time to certain master data, such as your email address, being automatically synchronised and corrected between EGYM and your fitness facility. The purpose of this processing is to ensure a correct and up-to-date set of data on both sides and to ensure the smooth technical operation of the EGYM services. The legal basis for this processing is your express consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future via your EGYM profile.

4.3 Making EGYM data visible and transferring it to your fitness facility

a) Making training and fitness data visible in the Trainer App

Where you have expressly consented, we make certain data stored in your EGYM user profile available to your fitness facility, or to the trainers working there, for viewing via the EGYM Trainer App, in order to enable professional support of your training. Depending on your consent, this includes, in particular, information about your training history and activities, training plans, your activity level, your BioAge, and further training and fitness-related information, including health data. No separate transfer or permanent storage of this data at your fitness facility takes place in this context. The data is displayed exclusively within the EGYM Trainer App. The legal basis for this processing is your express consent pursuant to Art. 6 para. 1 sentence 1 lit. a) in conjunction with Art. 9 para. 2 lit. a) GDPR.

b) Transfer of usage and status information in the form of reports

Where you have consented, we provide your fitness facility at regular intervals with structured reports (for example in CSV format) containing certain personal usage and status information on your use of the EGYM products. These reports contain, in particular, your name, your email address, your allocation to your fitness facility, the status of your consent and time stamps for certain usage events, for example the registration of your EGYM ID, the performance of a body composition analysis at the EGYM Fitness Hub, the use of EGYM strength machines or the creation and use of training plans. The reports expressly contain no specific health or analysis values, such as information on heart rate, biological age (BioAge), strength values or body composition, but only status and time information. The purpose of this transfer is to enable your fitness facility to follow your progress in the interests of improved training and member support and to assist you where needed, for example when supporting your onboarding to EGYM products and services or where usage steps have been interrupted. The transferred data is not used for marketing or advertising purposes. The legal basis for the transfer of the reports is your express consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR.

c) Responsibility under data protection law and withdrawal

EGYM is the controller under data protection law for the processing of your personal data up to the point at which the aforementioned data and reports are provided. After the reports have been transferred, your fitness facility also processes the personal data they contain under its own responsibility under data protection law. Your fitness facility alone is responsible for the further processing, including compliance with purpose limitation, the retention period and the handling of data subject rights.

d) Withdrawal of your consent

You can withdraw your consent to the processing described above at any time with effect for the future, for example via the privacy settings in your EGYM profile with a single click. In the event of a withdrawal, no further data will be transferred to your fitness facility or made visible in the EGYM Trainer App in the future. Where personal data has been transferred to a fitness facility in the form of reports on the basis of your consent, the further transfer of that data ends upon withdrawal of your consent. From that point onwards, the respective fitness facility alone is responsible for the storage and further processing of the data already transferred to it.

e) Supplementary information for users in Switzerland

If you are resident in Switzerland and use the EGYM services in a physiotherapy practice, we would additionally point out that your physiotherapy practice may also process the data transferred by EGYM with your prior consent in order to create summary reports in which the improvement of objective measurement values (weight, body fat percentage, resting heart rate, maximum strength, etc.) achieved on the basis of training with EGYM products is summarised, and which your physiotherapy practice may subsequently share with your doctor and your health insurer in order to examine the possibility of a prescription for training and the assumption of (partial) costs by your health insurer in Switzerland. You will receive further information on this and whether this applies to you directly from your physiotherapy practice in Switzerland. For the related processing of your data, including health data, your physiotherapy practice is exclusively responsible independently under data protection law.

4.4. Duplicate/Multiple User Accounts – Deletion (Outdated) Data

Please note that in some cases, two or more user accounts may be maintained in our systems for the same member/user. This may be due to the personal data stored by the fitness facility about you (see Section 4.1 regarding the data we process on behalf of the fitness facility), or data from your EGYM or EGYM-Wellpass user account (see Section 3.0 d)) or both.

We refer to this as a “duplicate account.” Such a duplicate account can lead to issues with your current user account, for example, not being able to train on EGYM strength machines or being unable to log in to our website or the Branded Member App with your user account.

Typically, such duplicate accounts are created, for instance, if you previously trained at a fitness facility, and your email address and name were used for your profile there, and now a new user profile is created with the same email address at your new fitness facility. The issue could also arise from a typo, meaning the fitness facility made an error when creating your user profile in our Trainer App, which causes it to differ from the data in their member management system. The same issue can occur if you originally created a user account in a Branded Member App for your fitness facility or as an EGYM-Wellpass member, and a new user account is created through your fitness facility’s member management software or via a website.

In all such cases, we do our best to preserve all data and information in your user account(s). However, sometimes this is not possible, and we may need to delete one of the user accounts to allow you to continue using your current user account. In such cases, we consider the activity in the account, e.g., which user account was last updated, contains more recent training data, or was last used, for example, on a strength machine or for check-in at the fitness facility. In these cases, we only delete the user account we are certain is no longer actively used by you (e.g., a user account linked to an old fitness facility that shows no activity or check-ins) or that contains less recent data/training data, so that you can use your current user account with, for example, your current settings for the EGYM strength machines. In this way, we ensure that the deleted data are always minimized and do not have any negative or permanent consequences for the use of your user account at the fitness facility or the use of our EGYM products both inside and outside the fitness facility. If the issue with the duplicate account relates to your EGYM-Wellpass account, we will delete the account that is not linked to EGYM Wellpass to ensure you do not experience problems with your Wellpass membership.

5. Data transfer to third parties / recipients, use of service providers

Your personal data will only be passed on or transmitted by us to third parties if this is necessary to fulfil the contract with you, if there is a legitimate interest on our part, if you have given your consent to do so and/or if we are obliged to do so by law or by official or court orders.

Your personal data will be transmitted by us to third parties in the cases and for the purposes described below:

• E-mail dispatch service providers: For the dispatch of our e-mails to you, e.g. transaction e-mails such as the dispatch of a registration or order confirmation and for the dispatch of a newsletter ordered by you, we use e-mail dispatch service providers who use your e-mail address on our behalf and only within the scope of our instructions on the basis of order processing agreements pursuant to Art. 28 GDPR or Art. 9 DSG for the purpose of sending the respective message, but not for other purposes and not for the e-mail dispatch service providers to contact you themselves.

• Service providers/cloud and software providers/processors: We also use service providers who provide web hosting services on our behalf and also use third-party cloud- or web-based software solutions that enable us to manage and host personal information in the cloud at external service providers to reduce the load on our own servers and to work effectively with new software solutions. We have concluded order processing agreements with the respective service providers to ensure that the respective service providers do not process the data for their own purposes, but only within the scope of our instructions and on our behalf. The legal basis for the use of the service providers is Art. 6 para. 1 sentence 1 lit. f) GDPR (processing is necessary to safeguard the legitimate interests of the data controller) in conjunction with Art. 28 GDPR (commissioned processing).

To analyse and evaluate usage and behavioural data we use technical service providers as processors, in particular providers of analytics and data platforms. They process the data exclusively on our behalf and in accordance with our instructions, in order to produce usage analyses, ensure the stability and security of the app and further develop functions and content.

• EGYM group companies: We also use other companies in the EGYM Group as contract processors who also process personal data for us in accordance with the legal provisions on the basis of a contract processing agreement, e.g. in connection with the provision of development and support services for our services and applications.

• Fitness facilities/trainers: A transfer of data from EGYM to your fitness facilities/trainers will take place if you have expressly consented thereto, see also above section 3.8 (Trainer App) and section 4), if this is necessary for the performance of a contract concluded with you and/or insofar as there is a legitimate interest in this on the part of your fitness facility. If you use the EGYM Branded Member App, data will be shared with your fitness facility if this is absolutely necessary for the provision of the service requested by you, e.g. so that you can bindingly register for a course of your fitness facility, call up courses of your fitness facility or participate in a promotion/challenge of your fitness facility. Furthermore, as part of the use of the Branded Member App, data/information may also be shared with your fitness facility such as whether you are using the app as a member of the fitness facility, the date of the first login/last login, frequency of use and feedback/ratings on the app. The transfer of this data to your fitness facility is based on the legal basis of the legitimate interest of your fitness facility. The legitimate interest is to be able to track how many/which members actually use the Branded Member App, whether they are satisfied and/or use the app frequently, in order to be able to determine whether the economic investments in the Branded Member App are worthwhile for the fitness facility.

Where you have expressly consented, we transfer personal usage and status information to your fitness facility in the form of structured reports, in order to enable your fitness facility to provide improved training and member support. The transferred information contains, in particular, time stamps for certain usage events in the EGYM products as well as master data such as name and email address, but no specific health or analysis values. The legal basis for this transfer is Art. 6 para. 1 sentence 1 lit. a) GDPR. After the transfer, your fitness facility processes this data under its own responsibility under data protection law.

• Other EGYM users/ social features : If the user has explicitly activated this in the privacy section of his profile, the users can compare themselves with friends and other users at the fitness facility within the social features of EGYM and thus motivate themselves. For this purpose, the following information is available/visible to all other EGYM users at the same fitness facility in the "Ranking" section when activated by the user: user name or EGYM alias (if no user name is entered, the EGYM alias consists of the so-called local part of the email address, i.e. the part before the @ sign), profile picture, EGYM points, name of the fitness facility and whether the user is a trainer and/or EGYM Premium User. These details are not made searchable by public search engines. This function can be manually switched on and off at any time in the privacy section of the profile. You can also create your own fitness team by sending friendship requests to users who have also activated the social features or by accepting friendship requests from other users.

• Manufacturer-connected devices with EGYM software (e.g., LifeFitness cardio fitness equipment): There are fitness devices from other manufacturers that are equipped by EGYM with Smart Cardio software, allowing you to log in and train on these devices with your EGYM ID or RFID chip/armband. This applies, for example, to cardio fitness equipment from the manufacturer LifeFitness. In this case, the manufacturer of the fitness devices equipped with EGYM’s Smart Cardio software acts as a data processor under Art. 28 GDPR, meaning that the required personal data is processed by the manufacturer according to our instructions. The manufacturer of the fitness devices processes the following data about you on our behalf: date of birth, height, weight, gender, RFID ID, and preferred devices for the purpose of setting up the devices for your use. The manufacturers of the fitness devices may also use this data in anonymized form, which does not allow identification of you, for their own statistical purposes.

EGYM may also allow the user to publish information in their profile (e.g. training results) or share it with third parties in social media (e.g. Facebook, Twitter etc.) by connecting the profile on EGYM with the social media account. This transfer of data initiated by the user is the sole responsibility of the user. EGYM assumes no responsibility for the third parties involved (e.g. Facebook) and their handling of the user's data.

Some of the service providers we use who process personal data on our behalf have locations both within the EU and the EEA, in Switzerland, and also in other countries worldwide, for example in the USA. Before transferring data to recipients outside Switzerland and the EU or EEA, we ensure that an adequate level of data protection exists at the recipient. For recipients in countries such as Canada and Israel, for example, this follows from an adequacy decision of the EU Commission or of the Swiss Federal Council (so-called safe third countries), and for other recipients from the conclusion of the EU standard contractual clauses before the start of processing by the respective recipient, where necessary with the amendments prescribed by the Federal Data Protection and Information Commissioner for data transfers from Switzerland that are subject to the DSG. In certain cases we may also transfer personal data without such standard contractual clauses in accordance with data protection requirements, for example where you have consented to the disclosure in question or where the disclosure is necessary for the performance of a contract, for the establishment, exercise or enforcement of legal claims, or for overriding public interests.

6. Data security and encryption

Your personal data is securely transmitted by us using encryption. We secure our website and other systems and applications against data loss, destruction, access, modification or distribution of your data by unauthorised persons by means of appropriate technical and organisational measures.

7. Storage periods and deletion of data

As a matter of principle, we store personal data only for as long as this is necessary to achieve the respective processing purposes or for as long as we are legally obliged to retain it. If the respective purpose ceases to apply or there is no legal basis for further storage, the data is deleted or, where applicable, its processing is restricted. In detail, the following principles apply in particular:

• Data in connection with your EGYM user account (EGYM ID) and the use of the EGYM services: we process personal data in connection with your EGYM user account (EGYM ID), your user profile and the use of the EGYM products and services generally for the duration of the existing user or contractual relationship. After the user relationship ends or your EGYM user account is deleted, this data is deleted unless its further storage is exceptionally necessary, in particular to settle outstanding contractual relationships, to handle support requests or to comply with statutory retention obligations.
• Training, measurement and health data: we generally store training data, results of strength, cardio, metabolism and progress measurements, body composition data, BioAge values and other health-related data for as long as your EGYM user account exists and your corresponding consent to the processing of this data is in place. If you withdraw your consent to the processing of health data, this data is deleted. Please note that in that case further use of the EGYM products and services is generally no longer possible and your EGYM user account will be deleted, because this data is necessary for the services to function.
• Usage and behavioural data in the Branded Member App: we generally store usage and behavioural data that we process in connection with the use of the Branded Member App only for as long as this is necessary for the analysis, error correction and further development and improvement of the app. Personalised usage and behavioural data is processed and stored only on the basis of your consent. Following withdrawal of your consent, this data is no longer processed in personalised form and is used exclusively in anonymised form. Anonymised data is not subject to any personal retention period.
• Check-in, usage and status information: we store time stamps and status information relating to certain usage events (for example registration, log-ins, performance of a body composition analysis or use of certain functions) for a limited period, insofar as this is necessary to ensure the proper operation of the EGYM services, to handle support requests or to ensure a consistent user experience. Once these purposes cease to apply, the data is deleted unless statutory retention obligations prevent this.
• Communication data: we generally store personal data from communications with us, for example in connection with support requests, contact forms or other enquiries, only for as long as this is necessary to handle your enquiry. Once the matter has been concluded, this data is generally deleted within six months. Where your communication relates to a contractual relationship, it is retained in accordance with the statutory retention obligations.
• Data in connection with the dispatch of newsletters: we store data that we process in connection with the dispatch of our newsletter for the duration of your newsletter subscription. Following unsubscription or withdrawal of your consent, the corresponding data is deleted.
• Anonymised or aggregated data: anonymised or aggregated data for which any personal reference is permanently excluded is not subject to any personal retention period. This applies in particular to anonymised training, usage and statistical data that we use for product improvements, quality assurance or sports science evaluations.

Please note that where statutory retention obligations prevent deletion, a restriction of processing takes the place of deletion. These obligations include, in particular, retention obligations under commercial and tax law (for example under Sec. 257 of the German Commercial Code (HGB) or Sec. 147 of the German Fiscal Code (AO)), under which certain contract and accounting-related documents (for example contractual correspondence) must be retained for periods of up to ten years. In those cases, the data concerned is blocked for other purposes and only deleted once the statutory retention periods have expired.

8. Obligation to provide personal data

In order to be able to use the product/service you have requested (see the description of the respective services according to section 3), it is necessary to provide the personal data required for this purpose in order to conclude the contract or to provide the product/service you have requested.

The provision of data which is not absolutely necessary for the relevant conclusion of the contract or for the provision of the service/service you have requested is voluntary and can be recognised by the fact that the relevant input fields are marked as "optional".

Any non-supply of the data required for the conclusion of the contract or for the provision of the requested service could have the consequence that we are not able to provide the respective contractual service or service in accordance with the contract.

9. Non-existence of automated decision making

We draw your attention to the fact that when using the EGYM services and making use of our services, you will not be subject to a decision based exclusively on automated processing - including profiling - which has a legal effect on you or which significantly affects you in a similar way.

10. Use of cookies / tracking

10.1 Use of cookies and tracking on our website

For the use of cookies and tracking technologies, please see the separate information in our cookie policy.

10.2 Use of cookies and tracking in our Branded Member App

The following guidelines apply to the use of tools and tracking technologies in our Branded Member app:

10.2 a) What do we use tools and tracking technologies for in the app?

We make use of tracking technologies when you use the app to enable you to access your user account, analyse and resolve app errors and stability problems, gain a better understanding as to how the app is used by the user, and to improve your user experience.

To this end, we make use of technologies from third-party providers listed by us under Item 2 and who act on our behalf within the scope of processing pursuant to Art. 28 GDPR or Art. 9 DSG, meaning that they only process data on our behalf and as instructed by us.

Some of the third-party service providers used by us and who, as processors pursuant to Art. 28 GDPR or Art. 9 DSG, process personal data on our behalf and as instructed by us, are based outside the EU/EEA, e.g. in the USA. Before transmitting data to processors outside the EU/EEA, we first ensure that the processor takes appropriate steps to safeguard data protection. This can be determined, for example, for processors in countries such as Canada and Israel by means of an adequacy decision adopted by the European Commission (referred to as safe third countries) and for other processors by agreeing on standard EU contract clauses before the respective processors starts processing data.

Where identifiable usage and behavioural data (e.g. user IDs, interaction events or personalisation-related usage data) is processed by means of tracking technologies in our app, this processing takes place only on the basis of your express consent pursuant to point (a) of Art. 6(1)(1) GDPR. You can give or withdraw this consent in the privacy settings of the Branded Member App at any time with effect for the future. For further details, please refer to the individual tools mentioned below.

10.2.b) Tools and tracking technologies used

Below you can find information about the individual tools used by us and by third parties in our app for the aforementioned purposes:

• Session token

The session token enables you to access your EGYM user account.

• Branch.io:

This service makes it easier for the user to interact with the app via different user devices, channels and platforms.

• Validic:

If you choose to connect the app to your fitness equipment and wearables in order to use the corresponding functionalities in the app, we use the Validic service here, which enables you to synchronise fitness data from your connected devices and wearables and display it in the app. Such data include your fitness routine and training sessions. A user ID without any personal data is used for this purpose.

• Crashlytics:

This service helps improve the app, as well as troubleshooting any issues with it, by collecting reasons for the app crashing. Instance IDs are used here to measure the number of users affected by a specific crash.

Where this processing concerns identifiable usage data, it takes place only with your consent as described above.

• Firebase analytics/Crashlytics:

These services collect data such as user ID, data about the user's interaction with the application (e.g. opening the screen and tapping buttons), user features (e.g. your home club), device features, device advertising ID, app name and app version. We analyse the data to learn about how the app is used by the user with a view to improving the user experience in the app. When using Firebase, we also use the Firebase Performance Monitoring function for speed analysis.

The analysis of identifiable usage data for improving the app takes place only with your consent as described above.

• Segment:

We use the segment service in the app to collect data about user interaction with virtual classes, such as which video was viewed or how long the video watched for. The information is analysed by us to make the classes more relevant, personalised and appealing to users. Each user is assigned a user ID for this purpose.

The analysis of identifiable interaction data for virtual classes takes place only with your consent as described above.

10.2.c) Withdrawal of consent

If you no longer want us to use tools and tracking technologies in the app for the aforementioned purposes where consent is required, you can withdraw your consent at any time in the privacy settings of the Branded Member App with effect for the future.

11. Rights of the data subject / Right of appeal to a supervisory authority

You have the following rights in relation to the personal data concerning you:

• Right of access (Art. 15 GDPR or Art. 25 DSG),
• Right of rectification (Art. 16 GDPR or Art. 32 DSG),
• Right of cancellation (Art. 17 GDPR; "right to be forgotten" or Art. 30 para. 2 lit. b DSG),
• Right to restrict processing (Art. 18 GDPR or Art. 30 para. 2 lit. b DSG),
• Right to object to processing (Art. 21 GDPR or Art. 30 para. 2 lit. b DSG),
• Right to data transferability (Art. 20 GDPR or Art. 28 DSG).

You also have the right to complain to a EU/EEA Data Protection Supervisory Authority in the EU/EEA member state where you reside, your place of work or place of the alleged breach, about the processing of your personal data by us if you consider that the processing of personal data concerning you is unlawful. If your place of residence, your place of work or the place of the alleged breach is in Switzerland, the Federal Data Protection and Information Commissioner is the competent authority.

If you have given us your consent to the processing of your data over the course of using our services and applications, you may revoke this consent at any time with effect for the future. The legality of the processing of your data up until revocation remains unaffected.

For the assertion of your rights or in the case of other data protection concerns, you can contact us at any time via the contact channels mentioned in section 1 above and/or those listed in our legal notice.

12. Additional information regarding your right of objection

In addition, we would like to point out that if your personal data are processed on the basis of legitimate interest as part of the balancing of interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR and/or your personal data is processed for direct marketing purposes, you have the right to object to the processing of your personal data at any time.

Privacy information on data processing in connection with our presences on social media platforms

We maintain presences and communication channels on the social networks, services and platforms (hereinafter "social networks") Facebook (https://www.facebook.com/egymglobal/), Instagram (https://www.instagram.com/egymdach/), YouTube (https://www.youtube.com/user/egymfitness), LinkedIn (https://www.linkedin.com/company/egym-gmbh/), TikTok (https://www.tiktok.com/@egymglobal) and WhatsApp (https://www.whatsapp.com/channel/0029VaeIIEGBlHpXoxSDlf3m), in order to provide you with information about our company and our services within social networks, to communicate with you, to publish content (for example videos) and to draw attention to career opportunities. We also use the platforms to serve advertisements. Below we inform you about the data that we, or the respective social network, process about you in connection with accessing and using our presences on social media channels.

a) Controller and contact details of the data protection officer

The controller pursuant to Art. 4 No. 7 of the European General Data Protection Regulation (GDPR) is EGYM SE, Einsteinstraße 172, 81677 Munich, Germany (hereinafter EGYM). You can contact our data protection officer at any time by email at datenschutz@egym.de or by post to the above address marked "Datenschutzbeauftragter" with any data protection-related concerns.

b) Your rights

You have the following rights in relation to the personal data concerning you (for personal data processed by the social networks, please see the information under d) below): - Right of access (Art. 15 GDPR), - Right to rectification (Art. 16 GDPR), - Right to erasure (Art. 17 GDPR; "right to be forgotten"), - Right to restriction of processing (Art. 18 GDPR), - Right to object to processing (Art. 21 GDPR), - Right to data portability (Art. 20 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority in the member state of your place of residence, your place of work or the place of the alleged breach about the processing of your personal data by us, if you consider that the processing of the personal data concerning you is unlawful. Where you have given us consent to the processing of your data, you can withdraw it at any time with effect for the future. The lawfulness of the processing of your data up to the withdrawal remains unaffected. To assert your rights or in the case of any other data protection concerns, you can contact us at any time using the contact channels stated in section a) above and/or those set out in our legal notice.

c) Supplementary information on your right to object

We additionally point out that where your personal data is processed on the basis of legitimate interests within the balancing of interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR and/or your personal data is processed for direct marketing purposes, you have the right to object to the processing of your personal data at any time.

d) Data that we process about you

aa) Contact via messenger or direct message

If you wish to contact us by messenger or direct message via the respective social network, we generally process your name or the user name through which you contact us, and store any further data you provide (for example your name or address) insofar as this is necessary to handle or respond to your enquiry. The legal basis is Art. 6 para. 1 sentence 1 lit. f) GDPR (processing is necessary to safeguard the legitimate interests of the controller). We have a legitimate interest in offering persons interested in our company simple and convenient ways of getting in touch, including on our social media presences. Use of the messenger or direct message functions of the social networks is voluntary. Alternatively, you can reach us at any time via the contact channels stated in this privacy policy (for example email, post or contact form).

bb) (Statistical) usage data that we receive from the social networks

Via the Facebook Insights, Instagram Insights and LinkedIn Insights functionalities, we receive statistics relating to our social media presences that are provided automatically at regular intervals. The statistics include, among other things, the total number of page views, likes, information on page activity and post interactions, reach, video views, information on the proportion of men and women among our followers, and statistics and metrics on the reach and success of the advertisements we place on the social networks. The statistics made available to us are aggregated and do not allow us to draw any conclusions about individual identifiable persons. Where we use so-called insights, statistics or analytics functions of the social networks, the processing of the associated personal data takes place in part under joint controllership pursuant to Art. 26 GDPR with the respective platform operator. The joint controllership is limited in each case to the creation and provision of aggregated usage statistics.

cc) Participation in prize draws and promotions

Where you have a user account with the respective social network and wish, for example, to take part in a prize draw or similar promotion organised by us on Facebook or Instagram, we collect the data required from you in order to take part in and run the prize draw, including notification of the prize and its dispatch. This is generally the participant user name and, from the winners, following dispatch of the prize notification, their real name and address and, where applicable, their email address. The legal basis is Art. 6 para. 1 sentence 1 lit. b) GDPR (processing is necessary for the performance of a contract-like relationship with the data subject). We provide supplementary information on the respective processing in the terms and conditions of participation for the relevant prize draw.

dd) WhatsApp channel

We operate an information and communication channel via the messenger service WhatsApp. Use of this channel is voluntary. If you subscribe to our WhatsApp channel or communicate with us via WhatsApp, we process the personal data you transmit (for example telephone number, profile name and message content) in order to provide you with information or to handle your enquiry. The legal basis for this processing is your voluntary consent pursuant to Art. 6 para. 1 lit. a) GDPR, which you give by subscribing to the channel or by actively contacting us. You can withdraw your consent at any time with effect for the future by unsubscribing from the channel or ending the contact. WhatsApp also processes personal data as a separate controller for its own purposes. This may in particular involve transfers of personal data to third countries (for example the USA) over which we have no influence. Further information can be found in the WhatsApp privacy notice. Alternatively, you can contact us at any time using the contact channels stated in this privacy policy.

e) Which data the social networks process about you and your rights vis-a-vis the social networks

In order to view the content of our social media presences, you generally do not need to be a member of the respective social network, and no user account for the respective social network is required for that purpose. Please note, however, that when the respective social network is accessed, the social networks also collect and store data from website visitors without a user account (for example technical data in order to be able to display the website to you) and use cookies and similar technologies, over which we have no influence whatsoever. Details can be found in the privacy provisions of the respective social network (see the corresponding links at the end of this section). Where you wish to interact with the content on our social media presences, for example to comment on, share or like our posts, and/or to contact us via messenger functions, prior registration with the respective social network and the provision of personal data is required. We have no influence on the data processing carried out by the social networks in connection with your use. To the best of our knowledge, your data is stored and processed in particular in connection with the provision of the services of the respective social network, and further for the analysis of usage behaviour (using cookies, pixels or web beacons and similar technologies) on the basis of which advertising based on your interests is served both within and outside the respective social network, as well as for advertising and marketing purposes. It must further be assumed that personal data is also transferred by the platform operators to third countries, in particular the USA. Information on, among other things, the precise scope and purposes of the processing of your personal data, the storage period and deletion, and the policies on the use of cookies and similar technologies in connection with registration for and use of the social networks can be found in the privacy provisions and cookie policies of the social networks, where you will also find information about your rights and options to object. We recommend that you assert your data protection rights of access, rectification, erasure, restriction of processing, objection and data portability directly with the respective social network where the processing is carried out by the social networks:

Facebook: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; privacy information: https://www.facebook.com/privacy/explanation; cookie information: https://www.facebook.com/policies/cookies/. Please note that joint controllership exists between us and Facebook in respect of the Insights provided by Facebook; the corresponding agreement between us and Facebook is available here: https://www.facebook.com/legal/terms/pagecontrolleraddendum

Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; privacy information: https://privacycenter.instagram.com/policy; cookie information: https://www.instagram.com/privacy/cookie_settings/

LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; privacy information: https://www.linkedin.com/legal/privacy-policy; cookie information: https://www.linkedin.com/legal/cookie-policy

YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; privacy information: https://policies.google.com/privacy; cookie information: https://policies.google.com/technologies/cookies

WhatsApp: WhatsApp Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; privacy information: https://www.whatsapp.com/legal/

TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland; privacy information: https://www.tiktok.com/legal/page/eea/privacy-policy/en; cookie information: https://www.tiktok.com/legal/page/global/tiktok-website-cookies-policy/en

Status: August, 2026