Version 1.0 · Effective October 18, 2026 · Last updated October 18, 2026
NidoFit respects the privacy of users who access our website, mobile applications, business directory, gym management software, marketplace, fitness community, and related services.
This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use NidoFit.
NidoFit provides services internationally. We process personal information in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) where it applies.
Depending on the services you use, we may collect the following categories of information.
Where a gym uses NidoFit's management tools, we may process information relating to members, staff, attendance, memberships, class schedules, billing, and gym operations on behalf of that gym or for other disclosed purposes.
The gym is responsible for determining the appropriate legal basis for information it controls and for providing required notices to its members and staff.
We may process trainer profiles, workout records, challenges, posts, photographs, videos, reviews, ratings, and other content submitted through the Platform.
Some fitness information may qualify as health data under applicable law, depending on what it reveals about an identifiable individual. Where special-category data rules apply, additional legal conditions and safeguards may be required.
We may process subscription details, order records, billing information, refund records, and transaction identifiers.
Payment card information may be handled by third-party payment providers. NidoFit will describe the relevant arrangements in the applicable payment and privacy disclosures.
We may collect information such as IP addresses, device information, log records, security events, cookie identifiers, and Platform usage information, subject to applicable law and our cookie settings.
We may use personal information to:
We will not use personal information for materially incompatible purposes without an appropriate legal basis and any additional notice or consent required by law.
Where the GDPR applies, NidoFit will identify an appropriate lawful basis for each relevant processing activity.
Depending on the circumstances, these may include:
Performance of a contract: Processing necessary to provide a service or take steps requested before entering into a contract.
Legal obligation: Processing required to comply with applicable laws.
Legitimate interests: Processing necessary for a legitimate interest, after assessing whether the interests and fundamental rights of the individual require stronger protection.
Consent: Processing based on valid consent, where consent is the appropriate legal basis.
Vital interests or public interest: Processing where the applicable legal conditions for these bases are satisfied.
Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
NidoFit may display business information submitted by businesses, authorized representatives, users, or other sources that we are legally permitted to use.
A business may appear in the directory before its owner has claimed or verified the profile.
The presence of an unclaimed profile does not establish that the business has registered with, endorsed, or partnered with NidoFit.
Where directory information contains personal data, NidoFit will process it under an appropriate legal basis and provide required information about its source and use.
Business owners and affected individuals may request correction, restriction, deletion, or other appropriate action where they have a valid legal basis.
Requests will be assessed under applicable law, including relevant rights and any lawful grounds for retaining or continuing to display information.
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal obligations and other lawful retention grounds.
Retention periods may depend on:
When personal information is no longer required, we will delete it, anonymize it, or otherwise handle it in accordance with applicable law.
Specific retention periods or the criteria used to determine them will be provided where required.
NidoFit may use service providers or infrastructure located in different countries.
Where the GDPR applies and personal information is transferred outside the European Economic Area, we will use an appropriate transfer mechanism where required, such as an applicable adequacy decision or approved Standard Contractual Clauses, and implement additional safeguards where necessary.
Information about relevant transfers and safeguards may be requested through our privacy contact, subject to applicable law.
NidoFit will implement technical and organizational measures appropriate to the risks of processing personal information.
These measures may include access controls, authentication, encryption where appropriate, security monitoring, staff access restrictions, vendor assessments, backups, and incident-response procedures.
No electronic system can be guaranteed completely secure. However, this does not reduce our obligation to take appropriate security measures and comply with applicable breach-notification requirements.
Where the GDPR applies, you may have the right to:
These rights are subject to the conditions and exceptions provided by applicable law.
To submit a privacy request, contact:
Email: [Insert Privacy Email Address]
Please describe your request and provide sufficient information for us to identify the relevant account or data.
We may request reasonable additional information to verify your identity before disclosing or changing personal information.
Where the GDPR applies, we will generally respond without undue delay and within one month. The period may be extended by up to two additional months where legally permitted for complex or multiple requests, with notice of the extension and its reasons.
Where a request cannot be fulfilled, we will provide an explanation and information about applicable complaint or remedy options as required by law.
We may send service-related communications necessary for account administration, transactions, security, and Platform operation.
Marketing communications will be sent in accordance with applicable consent and marketing laws.
You may unsubscribe from marketing emails using the provided link or other available method. Unsubscribing from marketing will not prevent essential service or legal communications.
NidoFit will apply age restrictions and parental consent requirements where required by applicable law.
Where the GDPR's special rules for children's consent apply to an online service offered directly to a child, the applicable national age threshold and parental authorization requirements will be respected.
We will take appropriate measures to protect children's personal information and will not knowingly process it unlawfully.
NidoFit maintains procedures for assessing and responding to personal data breaches.
Where required by the GDPR, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.
Where a breach is likely to result in a high risk to individuals, we will communicate with affected individuals when required by law.
NidoFit may use automated tools for security, fraud prevention, recommendations, ranking, and Platform operations.
Where a decision falls within the GDPR rules governing solely automated decisions that produce legal or similarly significant effects, we will comply with the applicable requirements and provide the relevant rights and safeguards.
Additional information about relevant automated processing will be provided where required.
For privacy questions or requests, contact:
Privacy Contact: [Insert Name or Department]
Email: [Insert Privacy Email Address]
Address: [Insert Business Address]
Where required by the GDPR, NidoFit will designate an EU representative and publish the representative's contact details.
Where required by law, NidoFit will also designate a Data Protection Officer and publish the relevant contact details.
We may update this Policy to reflect changes in our services, technology, business practices, or applicable law.
We will publish the revised Policy and update the "Last Updated" date. Where required, we will provide additional notice or obtain consent.
If you have concerns about how NidoFit handles your personal information, contact our privacy team using the details above.
Where the GDPR applies, you may also lodge a complaint with the competent data protection supervisory authority, including in the EU country of your habitual residence, place of work, or alleged infringement, where applicable.
This Policy does not remove any rights or remedies available under applicable data protection law.