Privacy policy

Who the controller is

Crossgym Satu Mare is the trading name of ASOCIAȚIA SPORTIVĂ CROSS GYM SATU-MARE, fiscal registration number 37397059, registered office at str. Fântânele bl. CF 14, ap. 8, Satu Mare, Romania, represented by Mr Vlad Verdeș, President. The gym itself is at Bulevardul Vasile Lucaciu 3, Satu Mare.

For any question about your data, call 0742116610 or write to contact@crossgymsatumare.ro.

What this website collects

The contact form: your name, email address, optionally your phone number, and your message. The form contains one hidden, empty field that spam robots fill in and people never see; whatever lands in it is discarded, never stored. Beyond that we add nothing to what you type.

Your preferences: the language you chose and your cookie choice. These stay in your browser, not on our servers.

We do not use Google Analytics. We use Vercel Web Analytics and Vercel Speed Insights, which count visits and measure how quickly pages load, without cookies and without identifying you: it builds no profile, does not follow you to other sites and sells nothing. We have no tracking pixels, we do not profile you and we make no automated decisions about you.

Legal basis

Messages sent through the form are processed on the basis of your consent (Art. 6(1)(a) GDPR), given by ticking the box next to the button. Without the tick, the form sends nothing.

Strictly necessary cookies rest on the legitimate interest of making the site work (Art. 6(1)(f)). Anything else requires separate consent.

How long we keep things

We keep your member account for as long as you are a member and for two years after your last membership ends; then we close the account and delete your personal data. An account set up for you that was never used and never had a membership may be closed sooner, after we tell you by email. Payments and their accounting records are kept for as long as the gym’s accounting and tax obligations require.

Messages received through the form are kept for at most 12 months after the last exchange, then deleted. If you become a member, membership data is handled separately, in the gym’s own system.

Your cookie choice is remembered for 12 months, after which we ask again.

Who else sees the data

Messages reach the coaches and whoever is on reception. We do not sell data and we do not share it for marketing.

Our hosting provider processes data technically on our behalf under a processing agreement. If you choose to load the map, Google receives your IP address — which is why the map stays off until you ask for it.

When something on the site breaks, on the server or in your browser, an error report goes, through our own server, to Sentry (Functional Software, Inc., USA), only so that we can find and fix the fault. A report holds the error message, the place in the code, the page address, the browser type and technical details of the request that failed, so it can include data from that request, such as an email address. Screen recording is switched off, and reports are stored in the European Union (Frankfurt). The basis is legitimate interest (Art. 6(1)(f) GDPR).

Member accounts

If you have a member account we keep: your name, email address, optionally your phone number, an encrypted form of your password (never the password itself), your memberships and their dates, sessions used, class bookings, and any training results you choose to log.

The legal basis is performance of the contract between you and the gym (Art. 6(1)(b) GDPR) — without this data we cannot track your membership or your bookings. Training results are optional: you log them only if you want to.

What other members see: in the booking calendar, every signed-in member sees your name in the attendee list of the classes you have booked, and under the workout of the day they see the results and comments you post. None of this is visible to visitors who are not signed in.

The TV in the gym: like the whiteboard, the screen in the gym shows you, beside the class’s workout, in the list of the class you have booked, from before it starts: your first name (e.g. “Andrei”; with the initial of your last name, “Andrei P.”, only if someone else on the same list has the same first name), then, once you log it, your score, your place in the class ranking and a PR mark when it is a personal record. If you would rather not appear, tick “Hide me from the gym’s TV” on the Progress page: you then do not appear on the screen at all, neither your name nor your score, and your name leaves the screen within a minute. The results appear only when the screen’s page is open in a browser signed in to a Crossgym account; anyone else who opens that address sees the workout alone. The legal basis is the association’s legitimate interest in showing, in the gym and like the whiteboard, who is training in the class and its results (Art. 6(1)(f) GDPR). You can object at any time with the tick above.

Signing in uses a strictly necessary session cookie, described in the cookie policy. It contains no password and is not used for tracking.

Paying online (drop-in, membership renewal and the Fundamentals course)

When you pay online for a single class, a membership renewal or a place on the Fundamentals course we keep: your name, email address, phone number and billing address (street, city, postcode, country), the class, membership or course you chose, the amount, the date of payment, the transaction reference the bank gives us and, for a single class, your answer to whether you have done CrossFit before (your own declaration, which we do not verify). We never see or store your card details: you enter them on the bank’s secure page.

A single class or a place on the Fundamentals course can be paid for without an account. In that case we create a minimal record for you — your name and email address, with no password and no way to sign in — only so that we can keep your payment and your place. For Fundamentals, if you already have an account with that email address, the payment is attached to your account, and we change nothing in it.

When you renew your membership online, the phone number and billing address from your last online payment are already filled in on the form, so you do not have to type them again. You can change them before you pay.

Payment is processed by Banca Transilvania S.A. Your name, phone, email and billing address are sent to it with the payment, and the bank passes them, through Visa or Mastercard, to the bank that issued your card, to verify the payment (3-D Secure). Banca Transilvania requires them for every card payment; without them the payment cannot be made. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

We keep this data for as long as the gym’s accounting and tax obligations require for a sale. We do not use it for advertising and do not add you to any list.

Registering for Winter Race 2026

When you register an adult team for Winter Race 2026 we keep: the team’s name, its category, the names of the two athletes, each one’s age on race day (18 or over, 17 or 16 — not the date of birth) and T-shirt size, which of them pays and, for the one who pays, their email address, phone number and billing address. When you register a teenager we keep: the teenager’s name and age on race day (not the date of birth), the name and email address of the parent or legal representative, the moment the consent box was ticked and which version of the consent text it was. We also keep when the registration was made, the fee, how it is paid and whether it has been paid.

We use it to organise the competition: the list of teams and participants, the T-shirts, collecting the entry fee and letting you know if anything changes. The legal basis is performance of the contract to take part (Art. 6(1)(b) GDPR).

A minor is registered by a parent or legal representative, who confirms online, by ticking the box, that they consent to the minor taking part in the competition. We keep the wording of that consent, the parent’s name and the moment of the tick, and the parent receives a copy by email. When the parent pays the fee at reception, the consent is confirmed there as well. For a teenager we ask for no phone number and no address.

An athlete aged 16 or 17 may race as an adult only with the consent of a parent or legal representative. For them we keep the parent’s name and email address, the moment the consent was ticked and which version of the text it was; the parent receives a copy by email, and the consent is confirmed at reception, where we also note who confirmed it and when.

An adult team’s fee is paid online by card, like the site’s other online payments: the payment is processed by Banca Transilvania S.A., which receives the payer’s name, phone, email and billing address; we never see or store card details. If the payer has no account, we create a minimal record for them — name and email address, with no password and no way to sign in — only so that we can keep the payment; if they already have an account with that email address, the payment is attached to it, and we change nothing in it. A teenager’s fee is paid in cash at reception.

If a registration is cancelled or a participant is replaced by someone else, we keep when it happened, who at reception did it and what changed, including the details from before, until the registration data is deleted. In the same way we keep when a fee was paid or handed back at reception and who recorded it.

Only the organisers and the gym’s reception see the registrations: on the admin pages and in the notes sent to the gym’s email address. On race day the ranking is public, on the site and on the screen in the hall: it shows the team names and the times (for teens, the first name and the initial of the surname), and nothing else. A registration’s confirmation page is seen only by whoever has its link, and the email address appears there masked.

Volunteers who sign up on the site give us their name, phone, email, what they would help with and when they can come, so we can contact them about volunteering (basis: their consent, which they can withdraw at any time by writing to us). Only the organisers see the list, on the admin pages; we delete it together with the registrations.

We delete registration data three months after the competition, by 12.03.27 at the latest. Card payments and their accounting records are kept for as long as the gym’s accounting and tax obligations require.

The health declaration

When you pay online for a single class (drop-in) or sign up for the Fundamentals course, you tick a health declaration. We keep: the declaration’s wording (as you saw it, and in the language you read it in), the name and email address typed in the form, and the moment of the tick; you receive a copy by email. Your answer to the question about injuries or conditions is neither kept nor sent anywhere: it only tells you, there and then, to let the coach know.

The same goes for registering for Winter Race: the declaration is ticked by whoever registers the team, for both athletes, or by a teenager’s parent or legal representative, and the answer to the question only tells them to let the organisers know.

We keep these details so that we can show what was declared, should there ever be a dispute about an injury. The legal basis is our legitimate interest in being able to defend our rights (Art. 6(1)(f) GDPR). We delete them after three years, the time within which such a claim can be made.

Technical logs

Like any website, the server records the requests it receives: IP address, time, the page requested and the browser type. These logs exist to run and protect the site — for example to limit repeated sign-in attempts. The basis is the legitimate interest of keeping the service secure (Art. 6(1)(f)).

The counter that limits sign-in attempts briefly remembers the IP address and the email address used, only in the server memory and only for one minute.

Where the data is hosted

The website is hosted by Vercel Inc. and the database by Neon Inc. Both run on servers in Frankfurt, Germany, so the data sits inside the European Union.

The emails the site sends — password links, membership notices, payment and registration confirmations — go out from the gym’s own mailbox, no-reply@crossgymsatumare.ro, hosted by the gym’s web hosting company, Soluții Web (solutiiweb.ro), on servers in Germany. Soluții Web passes them on to the recipient through the delivery service MailChannels Corporation (Canada), which has servers in North America and Europe.

Both companies are, however, registered in the United States, and administration or technical support may involve access from outside the European Economic Area. Such transfers take place under the Standard Contractual Clauses approved by the European Commission, set out in the processing agreements signed with each provider.

Your rights

You have the right to ask for access to your data, to have it corrected or erased, to restrict processing, to portability, and to object to processing. You can withdraw consent at any time, as easily as you gave it.

If you have a complaint, you can lodge it with the Romanian data protection authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest.

Security

The site is served over HTTPS, sends security headers (including a content security policy) and loads no scripts from other domains. The form is rate-limited against automated abuse.