Privacy policy
Last updated: 16 August 2026
This policy explains what personal data Gym Privé collects when you book a slot or contact us, why we collect it, how long we keep it and what rights you can exercise. It applies to gymprive.fr and its sub-pages. Gym Privé is established in France, so French law and the GDPR apply.
1. Who is the data controller
The data controller is Gym Privé, avenue Niel, 75017 Paris, France.
The company is currently being registered. Full identification details are published at the bottom of this page, section 12.
For any question about your data, or to exercise your rights: info@gymprive.fr.
We have not appointed a Data Protection Officer: our activity does not fall within any of the cases listed in article 37 of the GDPR.
2. What data we collect
We apply data minimisation: we only ask for what is needed to reserve your slot and send you the door code.
- Mandatory fields in the booking form: your name (or first name) and your e-mail address.
- Booking data: the date and time of the slot, the format (Solo, Duo, Trio or Coach) and your booking history.
- Correspondence: the content of messages you send us by e-mail, through the chat on this website (which asks for your e-mail address before the first message, so that we are able to reply) or through the chat available after booking.
- Independent coaches: in addition to the above, the valid professional liability insurance certificate we ask for at registration.
- Technical and browsing data: only if you consent, through the audience-measurement and advertising cookies described in our cookie policy.
We do not collect any payment card data. No payment is taken on this site: booking is limited to sending us your name and e-mail address. We also do not collect special categories of data (health, opinions, sexual orientation and so on), and we ask you not to include such information in your messages.
3. Purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Managing your booking and sending you the confirmation and door code | Name, e-mail, slot, format | Performance of a contract or pre-contractual steps — art. 6(1)(b) GDPR | 3 years from your last booking or last contact |
| Answering your questions and supporting you (e-mail, website chat, in-app chat) | Name, e-mail, message content | Performance of a contract — art. 6(1)(b); otherwise our legitimate interest in replying — art. 6(1)(f) | 3 years from the last exchange |
| Checking the insurance cover of independent coaches | Name, e-mail, professional liability certificate | Performance of a contract — art. 6(1)(b); legitimate interest in operating safely — art. 6(1)(f) | Duration of the relationship, then 5 years (general limitation period, art. 2224 French Civil Code) |
| Securing access to an unstaffed gym (one-time door codes) | Slot, generated code, time of use | Our legitimate interest in protecting the premises and equipment — art. 6(1)(f) | 90 days |
| Understanding how the site is used and spotting friction in the booking flow (session replay and click maps) | Visit identifier, pages visited, clicks and mouse movements, device type | Your consent — art. 6(1)(a) GDPR and art. 82 of the French Data Protection Act | Session recordings: 30 days |
| Measuring site audience and assessing our advertising campaigns | Cookie identifiers, pages viewed, traffic source, IP address | Your consent — art. 6(1)(a) GDPR and art. 82 of the French Data Protection Act | Cookies: 13 months maximum. Associated data: 25 months maximum |
We do not take automated decisions producing legal effects concerning you, and we do not carry out profiling.
We do not send marketing e-mails without your prior agreement. If we introduce a newsletter, sign-up will use a separate, non-pre-ticked box and every message will include an unsubscribe link.
4. Who has access to your data
Your data is never sold, rented or passed on to third parties for commercial purposes. It is accessible to the Gym Privé team and to the following providers, acting as processors within the meaning of article 28 of the GDPR:
| Provider | Role | Data concerned | Location |
|---|---|---|---|
| Bookla | Online booking engine (calendar, slots, confirmations) | Name, e-mail, slot, format | European Union |
| Crisp IM SAS | Live-chat support messaging (website chat and in-app chat) | E-mail, message content, the page you are writing from | France |
| Website host | Hosting of the pages and technical server logs | IP address, access logs | France |
| Google Ireland Limited | Audience measurement (Google Analytics) and advertising (Google Ads), through Google Tag Manager | Cookie identifiers, browsing data | Ireland, with transfers to the United States — see section 5 |
| PostHog | Usage analysis, click maps and session replay | Visit identifier, pages visited, clicks and mouse movements | European Union (EU Cloud region, Germany). Parent company established in the United States — see section 5 |
We may also disclose data where the law requires it, in particular at the request of a competent judicial or administrative authority.
5. Transfers outside the European Union
Data relating to your bookings is hosted in the European Union.
Data collected by PostHog is stored in that service’s European region. As its parent company is established in the United States, access from that country cannot be entirely ruled out; it is framed by a data processing agreement incorporating the European Commission’s standard contractual clauses.
Google’s audience-measurement and advertising tools may involve transfers to the United States. Those transfers rely on the European Commission’s adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, to which Google LLC is certified, and additionally on the European Commission’s standard contractual clauses. These transfers only occur if you have accepted the relevant cookies: if you decline, no Google tag is loaded at all.
6. Cookies
No audience-measurement or advertising cookie is set before you agree. The full list of cookies, their lifetime and how to change your mind at any time are set out in our cookie policy.
7. Security
The site is served over HTTPS. Access to booking data is limited to the people who need it to run the service, and our providers are contractually bound by confidentiality and security obligations. Should a data breach be likely to result in a high risk to your rights, we will inform you in accordance with article 34 of the GDPR.
8. Your rights
Under the GDPR and French Act no. 78-17 of 6 January 1978 as amended, you have the following rights:
- Access — obtain a copy of the data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — ask us to delete your data, subject to our legal retention duties.
- Restriction — ask us to temporarily freeze a processing operation.
- Portability — receive the data you provided in a structured, machine-readable format.
- Objection — object to processing based on our legitimate interest.
- Withdrawal of consent — at any time, for processing that relies on it, without affecting the lawfulness of processing carried out beforehand. For cookies, use the “Manage cookies” link at the bottom of every page.
- Post-mortem directives — set instructions on what happens to your data after your death, under article 85 of the French Data Protection Act.
To exercise these rights, write to info@gymprive.fr. We reply within one month, extendable by two months for complex requests. We may ask for proof of identity if we have reasonable doubt about who is making the request.
9. Complaint to the CNIL
If, after contacting us, you consider that your rights are not respected, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr. You may also complain to the supervisory authority of your country of residence.
10. Minors
The gym is for adults only: booking and training are available from the age of 18. This site is not aimed at minors and we do not knowingly collect their data.
11. Changes
We may update this policy, in particular if we add a service or change provider. The date of the last update appears at the top of this page. We will inform you by appropriate means in the event of a substantial change.
12. Legal notice
Site publisher: Gym Privé — Paris 17th arrondissement. The project is being set up and the company is currently being registered. Once registration is complete, the full identification details — company name and legal form, share capital, SIREN/SIRET number, RCS city, intra-EU VAT number and the name of the publication manager — will be published in this section.
Address: avenue Niel, 75017 Paris, France.
Payment: no payment is taken on this site at this stage. Booking a slot is limited to sending us your name and e-mail address: there is no online payment, and no card details are entered or stored.
Hosting: the site is hosted in France. The host’s full details will be published together with the identification details above.
Contact: for any question — bookings, gym access, personal data or anything related to this site — info@gymprive.fr. We answer at this address.