Privacy and GDPR

Fitnesspoint Group AS processes personal data about you in accordance with the following fundamental principles:

• Fitnesspoint Group AS must be open and clear about how we process personal data about you.
• Personal data about you must only be processed for lawful purposes and will be deleted or anonymised when we no longer have a basis for processing it.
• You must receive information about your privacy rights and be given help to exercise your rights.
• Fitnesspoint Group AS must ensure that personal data about you is adequately protected, regardless of where in the world it is processed.
• Fitnesspoint Group AS must build good privacy into our services when the services are designed and developed.

Fitnesspoint Group AS processes personal data about you when:

• It is necessary to deliver agreed goods/services to you,
• It is necessary to improve our customer care in order to give you better user experiences,
• It is necessary to safeguard information security
• It is necessary to develop and market our services,
• You have given your consent to the processing of data about you
• It is necessary for us to comply with legal requirements.

Which data is processed depends on which services you have entered into an agreement to receive or that you actually use. The following data may be processed:

• Your name, telephone number, e-mail address, postal address, date of birth and gender in connection with you registering as a customer or user of our services.
• Username and password for access to our services.
• Payment information such as your creditworthiness and other relevant bank and account information.
• Information about your customer account and our communication with you.
• Invoice information.

Fitnesspoint does not store credit card details. All credit card details are stored by our payment service provider. Here the information is stored securely, and all communication with the payment service provider is encrypted.

For use in access control, we store only parts of the credit card number, not all of it. This too is stored encrypted.

In addition, we encrypt all communication with an SSL certificate (https) on all our sites.

The data above will typically need to be processed to fulfil the following purposes:

• Identify you as a customer, user and/or payer,
• Deliver the agreed goods/services,
• Improve and develop the services,
• Administer your customer account
• Provide and improve our customer service
• Carry out credit checks
• Communicate with you,
• Invoice and collect outstanding amounts
• Complaints handling
• Research
• Create a customer/usage profile in order to offer personalised content, products and services,
• Give you information about products and services based on your preferences and interests,

5.1. External sources may be:

• Companies or organisations that supply payment and shipping services, advertising/ad networks, analytics companies
• The National Population Register.

5.2 Data that we receive may be:

• Credit information and credit assessments and decisions,
• Data that we need to authenticate you
• Other information, such as demographic information and information to provide you with specially tailored services.

Data about you may be shared with third parties such as, for example:

• Acquirers of payment services, debt collection companies and credit information
• Companies we have entered into an agreement with that carry out assignments on our behalf.
• Others to whom you have given your consent for us to share information, e.g. an accountant/accounting firm.
• Potential partners in the event of a sale, purchase, merger or other reorganisation of the company.
• Public authorities

Sometimes others who receive data about you may process the data for their own purposes. In such cases, the person concerned will be responsible for ensuring that the information is processed in accordance with the agreement entered into with Fitnesspoint Group AS. The processing by public authorities of data that Fitnesspoint Group AS is required to disclose is outside the control of Fitnesspoint Group AS.

We use Norwegian and foreign partners and ensure that data is only transferred if the recipients have committed to ensuring satisfactory privacy, security and confidentiality mechanisms or methods when processing the data. When transferring data to, and having it processed by, processors who carry out assignments on our behalf, we enter into a data processing agreement. When transferring data outside the EU/EEA area, we enter into the EU standard data processing agreement.

In cases where the processing of personal data takes place either

• outside the EU/EEA area, or
• in countries other than those pre-approved by the European Commission, the processing must be in accordance with the applicable EU rules on the transfer of personal data to countries outside the EU or the EEA area.

The data is secured through physical, technical and administrative methods and mechanisms, including protection of the infrastructure and office buildings, technical facilities and requirements placed on our personnel. Examples of security mechanisms include:

When you log in to your account with your telephone number or username and password, all the data will be encrypted using an encryption protocol such as “Transport Layer Security (TLS)” and “Secure Socket Layer (SSL)”. We use these protocols on all websites where we process data about you. If you make purchases via our websites, you must use a browser adapted for TLS or SSL, such as Internet Explorer, Safari, Firefox or Chrome. This ensures that data about you remains confidential and is protected when it is transferred over the Internet.

When using processors, we ensure that equivalent or stronger security mechanisms are used.

In the development of our services and products, we build in privacy and protection of data about you. • We carry out privacy impact assessments to identify and limit any consequences of the processing of data relating to you.

We process the data about you for as long as is necessary to achieve the purpose of the processing. The data is then deleted, unless we are required by law to continue to retain it.

Information: Information about the processing of data about you must be clear and easily accessible so that you can gain a good understanding of how we process this data.

Access: You can get an overview of the data we process about you by logging in to “My Page”. Here you can also correct your data.

Erasure: You can ask us to delete information about you:

• When you no longer have a customer relationship with Fitnesspoint Group AS or
• When you withdraw a consent and there is then no longer a lawful basis for continued processing of the data.

Restriction: You can request that we do not delete data if you need the data to establish, exercise or defend legal claims.

Under Norwegian law, children are persons under the age of 18. A child can give their consent if they are over 15, provided that the data being processed is not sensitive. Fitnesspoint has an age limit of 16 and therefore does not store information about persons under 15. Members under 18 can thus give consent themselves, depending on the activity and the privacy risk associated with it.

The notice will be reviewed annually to ensure that necessary updates and changes are incorporated.

Our app collects and processes health-related information such as workout activity, exercise logs, heart rate, and other fitness metrics. This data is collected only with your explicit consent and is used exclusively to deliver core app features, including fitness tracking, progress insights, and cross-device synchronization.We do not share your health data with any third parties, and we do not use this data for advertising or marketing purposes. All health information is stored securely and access is limited to authorized personnel only. We adhere to industry best practices to ensure data protection.If you choose to delete your account, all associated personal and health-related data will be permanently deleted from our systems.

To request the deletion of your personal information from our database, you can submit a request through our in-app settings or contact form available on our platform. For such requests, please write "delete my account" in the subject line, and include your first and last name and e-mail address in the body of the message. We will use commercially reasonable efforts to honor your request. We may retain an archived copy of your records as required by law or for administrative purposes. Please note that we will store communications you may send through the Service, as well as any comments you may post, and they may not be subject to modification or deletion. You may also control the information that we collect through the settings in your browser or mobile device. You may configure your browser to reject cookies from our app and may adjust the settings of your mobile device to prevent the Platform from obtaining location information. However, please note that the Service may rely on cookies and location information to function properly and some parts of the Service may not be available if you disable cookies.