of the AMREP FITNESS online store
Who we are and how to contact us
1. Data controller
The controller of your personal data is:
Fit - B, s.r.o.
E. M. Šoltésovej 3109/1
052 01 Spišská Nová Ves
Slovak Republic
Company ID (IČO): 47 582 995
Registered in the Commercial Register of the Municipal Court Košice, Section Sro, File No. 34677/V.
E-mail: info@amrepfitness.eu
Phone: +421 908 024 911
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Slovak Act No. 18/2018 Coll. on Personal Data Protection. We have not appointed a Data Protection Officer (DPO), as we are not legally required to do so - please direct all questions about personal data to the contacts above.
What data we process and why
2. Processing your order
Data: name and surname, billing and delivery address, e-mail, phone, ordered goods, payment details (not your card number - that is processed by the payment gateway), and for business purchases the company ID, tax ID and VAT ID.
Purpose: conclusion and performance of the purchase contract - order confirmation, delivery, payment, communication about the order.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Retention period: for the duration of processing the order and the periods arising from liability for defects; tax and accounting documents for 10 years under the applicable accounting legislation (Art. 6(1)(c) GDPR).
Providing the data necessary to conclude and perform the contract is a contractual requirement; without it we cannot accept or fulfil your order. Providing the data needed for tax and accounting documents is required by law. Optional data, creating a customer account and marketing consent are voluntary.
3. Customer account
Data: login details, order history, saved addresses.
Purpose: maintaining your account and more convenient shopping.
Legal basis: performance of the account contract. You can cancel your account at any time - data from orders already placed is retained further to the extent and for the periods set out in point 2.
4. Complaints and withdrawal from the contract
Data: identification and contact details, order and product details, description of the defect, photographs or video, bank account number for refunds.
Purpose: handling a complaint or withdrawal from the contract.
Legal basis: performance of the contract and legal obligations; subsequently our legitimate interest in establishing, exercising and defending legal claims.
Retention period: for the duration of the process and subsequently for the duration of the limitation periods.
5. Enquiries, contact form and B2B projects
Data: name, e-mail, phone, city, content of the message, and for projects details about the space and the plan.
Purpose: responding to the enquiry, preparing a quotation, communication about the project.
Legal basis: if you contact us on your own behalf with an interest in concluding a contract, this is taking steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR). For general enquiries and communication with contact persons of business customers who are not the contracting party, the basis is our legitimate interest in handling the enquiry and in business communication (Art. 6(1)(f) GDPR); we use the same basis when communicating with such persons about orders. If the contact details of such a person are provided to us by their employer or client, we obtained them from that source and this policy also serves as information under Art. 14 GDPR.
Retention period: 2 years from the last communication, if no contract is concluded.
6. Newsletter and stock alerts
Data: e-mail address, records of the granting and withdrawal of consent.
Purpose: sending news and promotions (newsletter), a one-off notification of product availability (the "Let me know when it's back in stock" function).
Legal basis: consent (Art. 6(1)(a) GDPR). Consent is not a condition of purchase and can be withdrawn at any time - an unsubscribe link is included in every e-mail. For stock alerts, we do not use your e-mail for this purpose again after the notification has been sent; a one-off alert does not subscribe you to the newsletter.
Retention period: for the newsletter, we use your data until you withdraw your consent or until we stop sending the newsletter, whichever comes first. After consent is withdrawn, we end the marketing processing and demonstrably confirm the withdrawal within 30 days at the latest. We keep the record of the granting of consent and the confirmation of its withdrawal separately for at least four years after withdrawal to fulfil our obligation under Section 116(5) and (6) of Slovak Act No. 452/2021 Coll.; any further retention must be justified by a specific legal claim or proceedings.
The newsletter dispatch and the records of consents and unsubscriptions (time and manner of granting or withdrawal) are handled by our processor Ecomail.cz, s.r.o., Prague, Czech Republic; the data is processed in the European Union.
7. Reviews
If we publish or facilitate reviews after a purchase, we make sure they come from genuine customers - we match each review with an actual order. For reviews directly on the e-shop, we process the name, e-mail and content of the review for the purpose of publishing the product review, based on our legitimate interest in trustworthy reviews; we retain the review for as long as it is published. We do not currently use an external review service - details of any future involvement of a third party (e.g. a price comparison site with a verified reviews programme) will be added for the specific service.
Cookies
8. Cookies and similar technologies
When you visit our website, we use cookies and similar technologies in the following categories:
- Necessary - shopping cart, login, language and currency, storing your consent choice. The website does not work without them; we use them on the basis of the exemption for technically necessary storage under the applicable electronic communications legislation.
- Analytics - measuring traffic with Google Analytics 4 from Google Ireland Limited (page views, viewed products, cart, checkout and orders) and evaluating which source orders come from (WooCommerce order attribution). Only with your consent.
- Marketing - measuring advertising performance and remarketing through Google Ads (Google Ireland Limited) and the Meta Pixel and Conversions API (Meta Platforms Ireland Limited), and third-party content, for example the Google map. Only with your consent.
We load the analytics and marketing tools only after you have given the relevant consent; nothing is loaded or sent before that. We use Google Consent Mode v2, in which everything is denied by default. Staff accounts are excluded from advertising measurement. The legal basis is your consent (Art. 6(1)(a) GDPR and the consent requirement under the applicable electronic communications legislation); your consent is valid for 12 months.
Overview of the cookies and technologies currently in use:
- amrep-cookies (necessary) - stores your consent choice; our domain; valid for 12 months. We also store the same value in your browser's localStorage.
- wp-wpml_current_language (necessary) - remembers your language version; our domain; until the end of the browser session.
- woocommerce_items_in_cart, woocommerce_cart_hash, wp_woocommerce_session_* (necessary) - cart contents and shopping session; our domain; until the end of the session, at most 48 hours.
- sbjs_current, sbjs_current_add, sbjs_first, sbjs_first_add, sbjs_udata, sbjs_migrations, sbjs_session (analytics) - the source of your visit for order attribution (WooCommerce); our domain; until the end of the browser session, sbjs_session 30 minutes. They are created only with your consent and are removed when you withdraw it.
- _ga, _ga_* (analytics) - Google Analytics 4 from Google Ireland Limited; our domain; valid for up to 2 years. The tool measures page views, viewed products, cart, checkout and orders (order number, items, order value excluding VAT and shipping). It also measures enquiries submitted via a form. If a purchase cannot be measured in the browser (for example because you closed the browser after payment), we may send it to Google Analytics from our server - tied only to the randomly generated Google Analytics identifier from the _ga cookie, and only if you gave analytics consent before placing the order.
- _gcl_au, _gcl_aw (marketing) - Google Ads from Google Ireland Limited: conversion measurement and remarketing; our domain; valid for 90 days. Google also uses its own advertising cookies on Google domains for this purpose. As part of the enhanced conversions feature, after a completed order we pass the e-mail, phone, name and address from the order to Google in hashed form (SHA-256) so that the order can be matched to an ad click.
- _fbp, _fbc (marketing) - Meta Pixel and Conversions API from Meta Platforms Ireland Limited; our domain; valid for 90 days. We record the following events: product viewed, added to cart, checkout started, purchase and enquiry submitted. For purchases we also send to Meta from our server the hashed (SHA-256) e-mail, phone, name, city, postal code and country, as well as the IP address, browser identifier (user agent), order value and items.
- Google Map (marketing) - after you give consent, the map loads from the google.com domain, which may store Google's own cookies (Google Ireland Limited) according to its policies.
You give and can change your consent at any time in the website's cookie bar - the "Cookie settings" link is in the footer of every page. After you withdraw consent, we stop loading the relevant tools, switch the Google consent signals to denied and delete the cookies _ga, _ga_*, _gcl_*, _fbp and _fbc that were set on our domain. Not giving consent does not limit your ability to shop.
Who we share data with
9. Recipients of data
We share data only to the extent necessary for the given purpose with the following categories of recipients:
- Carriers - delivery of your order (e.g. GLS - General Logistics Systems, the Packeta group, pallet carriers): name, address, phone, e-mail and, where applicable, the cash-on-delivery amount.
- Payment gateway - processing online payments (Comgate, a.s., Czech Republic; payment data is processed by the gateway operator as an independent controller, your card number never reaches us).
- Hosting and technical infrastructure provider - operation of the website and e-mail.
- Accounting and invoicing services - processing tax documents.
- E-mailing platform - newsletter dispatch and consent records (Ecomail.cz, s.r.o.), only where consent has been given.
- Google analytics and advertising tools - traffic measurement (Google Analytics) and advertising measurement (Google Ads): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; only where the relevant consent has been given.
- Meta advertising tools - advertising measurement (Meta Pixel and Conversions API): Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; only where marketing consent has been given.
- Public authorities - where required by law (e.g. tax administration, supervisory authorities).
We have data processing agreements under Art. 28 GDPR in place with our processors.
10. Transfers to third countries
We process data primarily in the European Union. Our key suppliers (the Comgate payment gateway, the Ecomail e-mailing platform, carriers, hosting, invoicing services) process data in the EU. A transfer to a third country may realistically occur when the Google and Meta tools are used after the relevant consent is given - for Google Analytics, Google Ads and the display of the Google map (Google Ireland Limited, with a possible transfer to Google LLC, USA) and for the Meta Pixel and Conversions API (Meta Platforms Ireland Limited, with a possible transfer to Meta Platforms, Inc., USA) - on the basis of the European Commission's adequacy decision (the EU-US Data Privacy Framework) and standard contractual clauses. If we deploy another tool involving a third-country transfer in the future, we will add it to this policy. You can obtain information about the safeguards used and a copy of them at info@amrepfitness.eu.
Your rights
11. What rights you have
In connection with the processing of your personal data, you have the right to:
- access your data and information about its processing,
- rectification of inaccurate or incomplete data,
- erasure of data that is no longer needed, unless a legal obligation prevents it,
- restriction of processing,
- data portability - receiving the data you provided to us in a machine-readable format,
- object to processing based on legitimate interest, including direct marketing,
- withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal,
- not to be subject to a decision based solely on automated decision-making with legal effects - we do not carry out such decision-making. Remarketing through Google Ads and Meta (point 8) takes place only with your marketing consent, which you can withdraw at any time.
12. How to exercise your rights
Write to us at info@amrepfitness.eu or by post to our registered office. We will respond without undue delay, at the latest within one month; for complex requests, the period may be extended by a further two months, of which we will inform you. We may ask for additional information to verify your identity.
13. Complaint to a supervisory authority
If you believe that we process your data in breach of the law, you have the right to lodge a complaint with a supervisory authority. The lead authority for us as a Slovak controller is:
Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)
Galvaniho Business Centrum II
Galvaniho 7/B
821 04 Bratislava
Slovak Republic
www.dataprotection.gov.sk
You may also lodge a complaint with the supervisory authority of the EU member state of your habitual residence or place of work.
Final information
14. Security
We protect your data with appropriate technical and organisational measures - encrypted connections (HTTPS), access control, backups and system updates. Only persons who need the data to perform their work tasks have access to it.
15. Changes to this policy
We may update this policy, in particular when legislation or the tools we use change. The current version is always published on this page. The terms of purchase are governed by the separate Terms and Conditions; the returns and complaints procedure is summarised on the Returns and complaints page.