GDPR compliance

1. Our commitment

Gymy is operated by Examin SRL, Oradea, Romania. Gymy processes access and biometric data for teams in the EU and beyond, so the General Data Protection Regulation (GDPR) is central to how the product is designed and run. This page summarises how we support your GDPR obligations and complements the Privacy Policy and the Terms and Conditions.

2. Roles: controller and processor

When your company uses Gymy for its members, your company is the data controller and Examin SRL acts as the processor under Article 28 GDPR. We process member data only on your documented instructions. For data we collect directly, such as website visits and administrator accounts, Examin SRL is the controller.

3. Data Processing Agreement (DPA)

We provide a Data Processing Agreement (DPA) covering the requirements of Article 28 GDPR: confidentiality commitments, security measures, sub-processor rules and audit support. Write to us at contact@examin.ai to receive and sign the DPA.

4. Legal bases and biometric data

Biometric data used to identify a person is a special category of data under Article 9 GDPR. As the controller, you must establish a valid basis before enrolling members, usually explicit consent under Article 9(2)(a) or a provision rooted in tax and contractual obligations. Gymy supports this through informed, consent-based enrollment and the ability to remove or re-enroll a member at any time.

5. Data subject rights

We help controllers respond to requests under Articles 15 to 21: access, rectification, erasure, restriction, portability and objection. Access data can be exported in machine readable formats, and a member's biometric template can be deleted at any time. Members should address requests to their gym first; we help promptly.

6. Data protection by design

Gymy follows Article 25 by default: faces are stored as encrypted mathematical templates rather than photographs, matching happens on the device at the entrance, retention periods are configurable, and reports contain only the data the gym genuinely needs.

7. Security

In line with Article 32, we use encryption in transit and at rest, role-based access controls, logging and regular security reviews. Biometric templates receive the highest level of protection.

8. Sub-processors

We use a small number of vetted sub-processors, such as cloud hosting providers, bound by contracts that impose equivalent data protection obligations. The current list is available on request, and we give notice before adding or replacing a sub-processor.

9. International transfers

Examin SRL is based in Romania, in the European Union. If personal data is nevertheless transferred outside the EEA, we rely on appropriate safeguards under Article 46, in particular the European Commission's standard contractual clauses.

10. Breach notification

If a data breach affects your data, we notify you without undue delay and give you the information you need to meet your obligations under Articles 33 and 34.

11. Retention and deletion

We keep personal data only as long as your retention settings and instructions require. On termination, data remains available for export for 30 days, then it is deleted or anonymised, unless the law requires otherwise.

12. Questions and complaints

For GDPR questions, write to us at contact@examin.ai or call +40 750 270 818. You can also lodge a complaint with your local supervisory authority; for Romania that is ANSPDCP (dataprotection.ro).