FITNESS24SEVEN COLOMBIA S.A.S.
CALLE 71 no 6-21 Oficina 501, Edif. La Ceiba, Bogotá D.C ,Colombia
FITNESS24SEVEN COLOMBIA S.A.S. (“F24S”), an entity domiciled in CALLE 71 no 6-21 Oficina 501, Edif. La Ceiba, Bogotá D.C ,Colombia, whose data protection officer’s with telephone number and e-mail address are +46(0)722-53 99 75 and firstname.lastname@example.org, is committed with ensuring the safeguarding and preserving of any personal data collected or received from our members. In strict compliance with the Colombian Constitution, Law No. 1581 of 2012 and Decree No. 1377 of 2013 and other amending or adding norms, (the “Governing Law”), to ensure the Habeas Data right that all individuals have to know, update and rectify the information compiled on them in the databases and files of F24S, it is required to adopt policies for the collection, processing, exchange, transfer and transmission of personal data in relation to which processing, F24S is regarded as the data controller, hereinafter the “Personal Data Processing Policy” or the “Policy”.
F24S in its condition of party Accountable and Responsible for the processing of personal data compiled, stored, updated, conveyed or deleted from its members, is committed to the correct use thereof, and the processing that will be given to it shall be to comply with its functions, giving in any case a special and reserved processing to sensitive data of the members, hereinafter the “Data Subjects”.
1. Scope of Application
This Policy shall apply to the processing by F24S of any information related to or which can be associated to one or several determined or determinable individuals (namely, Data Subjects) residing in the Republic of Colombia (hereinafter “Personal Data”).
F24S may collect the following categories of Personal Data directly from Data Subjects who are Members:
- Master Data: Name and family name, home address and home telephone number, date and place of birth, citizenship, gender, national tax and/or social insurance number, information required for tax reporting, health insurance information, photograph or image (where permitted by applicable law); fingerprint and bank account details.
- Personal Contact Details: Name and family name, personal address, phone numbers, fax numbers, and email address;
- Emergency Contact Information: Name and family name, and contact information (if provided by you) of a family member to be contacted in an emergency;
- Health Information: Medical history; details and evolution of any medical treatments that may be considered for the training program; details of medications you have used or are using; health insurance information; corporal profile. This information is necessary for the trainers and F24S staff to determine what type of training is more appropriate for you regarding your corporal profile.
2. Purpose specification of the processing of personal data
In order to carry out our relationship with you and our business operations, we may, to the extent required, use and process Personal Data for the following purposes:
- For Treatment. F24S may use your Personal Data to provide you with training recommendations or to assist in the coordination, continuation or management of your training services. This includes the coordination or management of your training with F24S staff, such as trainers, who may be able to provide information or insight in the development and coordination of your plan of trainee.
- For Payment. F24S may use your Personal Data for purposes of obtaining payment for services that you receive. For example, we will need to set up a recurring payment plan via credit card (encrypted card number).
- For communications. F24S may use your information to provide appointment reminders. We may, from time to time, contact you to provide information about training alternatives or other F24S related benefits and services that may be of interest to you. In order to better serve you, we may communicate with you about plan renewal reminders and alternative products. We may also provide you with informational materials including information about F24S and its subsidiaries. We may also, at times, send you informational materials about a particular product or service that may be helpful for your training. Material may come from a third party.
- F24S will not process Personal Data for any other purpose incompatible with the purposes outlined in this section, unless it is required or authorized by law, or as authorized by you. For some activities, processing of certain Personal Data continues after members have ceased to receive services from F24S. However, F24S will not keep Personal Data longer than required or appropriate in accordance with the law. If F24S is unable to collect, process or use your Personal Data, some of which is considered sensitive under Colombian laws, you have the right to refrain from granting your consent or revoke it.
- F24S will only transmit and/or transfer the Personal Data to its parent company, affiliates, subsidiaries, service providers and business partners, inside or outside the Colombian territory, when said circulation of data is necessary to fulfill the purposes specified above. Any domestic or cross-border circulation of Personal Data will be conducted in compliance with the Governing Law.
- F24S may collect the image, fingerprint and other basic identification Personal Data of Data Subjects who visit or access the premises of F24S for the purposes of supervising the appropriate behavior within said premises and as a tool to preserve the security of Data Subjects, the premises and the assets of F24S.
- Personal Data can be processed by F24S through all existing media, including but not limiting to physical or electronic documents, voice messages, mobile and electronic devices and computers, online platforms and any other type of media.
3. Rights of Data Subjects
In accordance with article 8 of Law 1581 of 2012, Data Subjects have the following legal rights in relation to the processing of their Personal Data by F24S:
- Know, update and correct their Personal Data with F24S. This right may be exercised, among others, in relation to partial, inaccurate, incomplete, split, deceptive data or whose processing is prohibited or not authorized.
- Request proof of the consent granted to F24S to collect and process your Personal Data, have access to your Personal Data that is subject to processing by F24S and in general, be informed by F24S about the uses that Personal Data is been subject to.
- Revoke the authorization granted to F24S and/or request the elimination of the Personal Data when data Subjects consider that F24S is not respecting the principles, rights and constitutional and legal guarantees. In such cases, F24S will inform Data Subjects of the implications that revoking the authorization or the elimination of their Personal Data from the database may have.
- Access your Personal Data that F24S has collected and processed.
If Data Subjects do not agree with the manner in which F24S processes their Personal Data or have any complaint or claim, Data Subjects may submit a communication before the Data Protection Officer of F24S to the e-mail email@example.com.
- If the Data Protection Officer of F24S does not solve Data Subjects’ queries or does not attend their complaint within the legal term to do so, they may submit a complaint with the Superintendence of Industry and Commerce if Data Subjects consider that F24S has violated its rights to habeas data or the provisions of the Governing Law.
4. Person or area responsible to attend Data Subjects’ queries, requests or claims related to the processing of their Personal Data
Should Data Subjects have any queries, consultations or claims related to the processing of their Personal Data by F24S, they can contact the Data Protection Officer of F24S at firstname.lastname@example.org. Data Subjects may exercise their right to know, update, correct or eliminate their Personal Data and revoke the consent granted to F24S for the processing of their Personal Data before the Data Protection Officer.
5. Procedure for Data Subjects to exercise their rights
Any query or consultation in relation to Personal Data collected and processed by F24S, will be received by the Data Protection Officer of F24S, for which Data Subjects will have to send a written description of their consultation to email@example.com.
The Data Protection Officer of F24S will resolve the Data Subject’s query or consultation within the next ten (10) working days as of the date on which the query or consultation was received. Should it not be possible for the Data Protection Officer of F24S to respond to the claim within the mentioned period, the Data Protection Officer of F24S will let you know of the situation and will explain the reason of the delay. In any event, the Data Protection Officer of F24S will respond to the Data Subject within the next five (5) working days counted as of the expiration of the first ten (10) day initial deadline.
The consent granted by Data Subjects may be revoked at any time with prior, written and signed notice, addressed to the Data Protection Officer of F24S, to the previously mentioned email address, in the terms established by the Governing Law.
Should Data Subjects consider that the information contained in the database of F24S is subject to correction, update or suppression or if Data Subjects consider that F24S is not complying with its obligations under the Governing Law, Data Subjects must file a claim with F24S, addressed to the Data Protection Officer, which will be processed in accordance with article 15 of Law 1581 of 2012.
6. Conditions under which Information is Shared with Third Parties
F24S may share Personal Data to third parties for the Purposes described in Section 2 as follows:
- F24S Entities. Since training and conduct applies to all F24S companies including, but not limited to, Fitness24Seven AB, Fitness24Seven-Lund AB, Fitness24Seven AS, Fitness24Seven Oy & Fitness24Seven Sp. z o.o., F24S may transfer some Personal Data to, or otherwise allow access to such data to all of its companies, which may use, transfer, and process the data to complement the purposes specified in this Section 2.
- Regulators, authorities, and other third parties. As necessary for the purposes described in this Section 2, Personal Data may be shared with regulators, courts, and other authorities (e.g., tax and law enforcement authorities), independent external advisors (e.g., auditors), insurance carriers, including entities in the jurisdictions where F24S is located.
- Acquiring entities. If the F24S site in which you receive our services is sold or transferred in whole or in part (or such a sale or transfer is being contemplated), your Personal Data may be transferred to the buyer, subject to any rights provided by law, including jurisdictions where the buyer is located. Prior to completion of a sale or transfer, Personal Data shall only be shared in a manner that cannot be linked to individuals, except in limited circumstances.
- Other third parties. As necessary for the purposes described in Section 2, Personal Data may be shared with one or more parties, whether affiliated or unaffiliated, to process Personal Data under appropriate instructions (“Data Processors”). Such Data Processors may carry out instructions related to IT system support, database management, compliance, and other activities, and will be subject to contractual obligations to implement appropriate technical and organizational security measures to safeguard the Personal Data, and to process the Personal Data only as instructed.
In order to provide adequate protection for such sharing of Personal Data, to the extent required by applicable law, F24S will: (a) address any applicable requirement to assure an adequate level of data protection before transferring or transmitting Personal Data by assuring the execution of appropriate data transmission or transfer agreements or confirming other controls; and (b) establish that Personal Data will be made available to individuals within the recipient entities on a need-to-know basis only for the relevant purposes described in Section 2.
7. Entry into Force of this Policy and Expiry Date of the Database
This Policy is in force from 22/08/2017. Personal Data, which processing is governed by this Policy, shall remain in the database of F24S for as long as the purpose for which it was collected and is processed, remains current or once any legal retention period has expired.