Privacy Policy

1. Who we are

Gymy is operated by Examin SRL, Oradea, Romania. This Privacy Policy explains what data we process when you use Gymy or visit our website, and what rights you have. For member data processed on behalf of a gym or sports center, that business is the data controller and Examin SRL acts as the processor.

2. What data we process

Depending on how you use the Service, we process:

• Account data: name, email, company, role.
• Access data: gym entries, memberships and payments.
• Biometric templates: encrypted mathematical representations of the face, used only for verification.
• Technical data: device information, system logs, access events.
• Communications: messages sent to our support team.

3. How we handle biometric data

Faces are converted into encrypted mathematical templates. We do not store photographs for matching, and templates cannot be turned back into images. Matching happens on the device at the entrance. Members are enrolled only after being informed and, where the law requires it, after explicit consent. Biometric templates are deleted when a member is removed, when the retention period expires, or on request.

4. Why we process data

We process data to provide and secure the Service, generate access, membership and revenue reports, provide support, bill you and meet our legal obligations. Under the GDPR, our legal bases are performance of the contract, legitimate interests, consent (for biometrics) and legal obligation.

5. Retention

Access records are kept for as long as your gym's retention policy requires, usually driven by billing and by tax and contractual obligations. Account data is kept while the contract is active and is deleted or anonymised within 90 days of termination, unless the law requires a longer period.

6. Who we share data with

We do not sell personal data. We share data only with sub-processors who help us operate the Service (for example cloud hosting providers), under contracts requiring equivalent protection, and with authorities where the law requires it.

7. Security

We use encryption in transit and at rest, strict access controls and regular security reviews. No system is perfect, but biometric data is handled at the highest standard of protection we have.

8. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, plus the right to lodge a complaint with a supervisory authority. California residents have equivalent rights under the CCPA. If you are a member of a gym that uses Gymy, address your requests to the gym first; we will support them in responding.

9. International transfers

When data is transferred outside the EEA, we use appropriate safeguards, such as the standard contractual clauses approved by the European Commission.

10. Children

Gymy is a tool for businesses and is not directed at children.

11. Changes to this policy

We may update this policy from time to time. New versions are published on this page, and we tell you directly about important changes.

12. Contact

For any question about your data: contact@examin.ai, +40 750 270 818, or in writing at the address above.