Privacy Policy

1. Introduction

This policy explains what personal data we process through the Salo Pass platform (salopass.com), for what purposes, on what legal bases and what rights you have. The platform operator is identified in the box above. The policy applies to website visitors, to the representatives of fitness gyms holding an account (“Customers”) and, within the limits described below, to gym members.

2. Our roles: controller and processor

For the data of website visitors and Customer accounts (name, e-mail, billing data), Salo Pass is the data controller. For the member data a gym enters into the platform (names, contact details, subscriptions, attendance, possibly photos), the gym is the data controller and Salo Pass acts as processor within the meaning of Art. 28 GDPR — we process that data only on the gym's instructions. If you are a gym member and want to exercise your rights over your data, please contact your gym first.

3. What data we process

• Account data: first and last name, e-mail, password (stored encrypted), role, preferred language.
• Gym data: name, address/city, schedule, logo, public page.
• Member data (on the gym's behalf): name, contact details, subscriptions, payments recorded at the front desk, check-ins, consents, optionally a photo.
• Payment data for the Salo Pass subscription: invoiced amounts and payment status; card data is processed exclusively by NETOPIA Payments and never reaches us.
• Technical data: access logs, IP address, device type — for security and diagnostics; aggregated usage statistics, without tracking cookies.

4. Purposes and legal bases

• Providing the service and managing the account — performance of a contract (Art. 6(1)(b) GDPR).
• Invoicing and accounting records — legal obligation (Art. 6(1)(c)).
• Platform security, abuse prevention, aggregated statistics — legitimate interest (Art. 6(1)(f)).
• Optional commercial communications — consent (Art. 6(1)(a)), which can be withdrawn at any time.

5. Who we share data with

We do not sell personal data. We use providers that process data on our behalf under contract: Supabase (database hosting, data centre in Frankfurt, EU), Vercel (application hosting and aggregated statistics), Brevo (transactional e-mail delivery), NETOPIA Payments (card payment processing). Data may be disclosed to authorities only where the law requires it.

6. Transfers outside the EU

The platform's data is hosted in the European Union. To the extent a provider processes certain data outside the European Economic Area, the transfer takes place under the safeguards provided by the GDPR (adequacy decisions or standard contractual clauses).

7. How long we keep data

Account data is kept for the duration of the contract. After termination, the gym's data is exported on request and deleted or anonymised within 30 days, except for documents we are legally required to keep (for example financial-accounting records, for the statutory periods). Technical logs are kept for short periods necessary for security.

8. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw consent where processing is based on it. To exercise them, write to our contact address. You also have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP, dataprotection.ro).

9. Security

We apply appropriate technical and organisational measures: database-level isolation of each gym's data (row-level security policies), encryption of data in transit, role-based access control and audit logging of sensitive actions.

10. Changes and contact

We may update this policy; the current version and its last-updated date are published on this page, and significant changes will be notified. For any question about personal data, use the e-mail address in the operator identification box.