1. WHO WE ARE
This privacy notice (the “Privacy Notice”) describes how Factory 4 S.A. processes the personal data of visitors, prospects and clients who use our service and who visit our website: https://www.factory4.lu (the “Website”), in accordance with applicable laws and guidance from relevant data protection authorities.
Name: Factory 4 SA
Address : 4-6 RUE FRANÇOIS HOGENBERG 1735 LUXEMBOURG
Luxembourg Business Register number (RCS) : B177177
Telephone number: +352 27 12 37
Email : info@factory4.lu
2. DATA CATEGORIES AND SOURCES
We currently collect and process the following information, depending on how you interact with us. We collect this data directly from you, or automatically when you use our website or app:
1. SUBSCRIPTION (MEMBERSHIP) AND EARLY TERMINATION
When you sign up for our services, at the club or online via our Website, we collect and process personal data such as: your first name, surname, date of birth, nationality, postal address, gender, e-mail address, telephone number and payment (bank) information..
When you ask to end your contract early for health-related reasons, we process the medical certificate you provide, solely to assess and justify your cancellation. Such certificates usually contains health data, which we process only where necessary to handle your request and, where applicable, to establish or defend a legal claim. We do not ask for any health information to sign you up.
2. CONTACT FORMS
When you use our contact form, we collect and process personal data such as: your first and last name, telephone number, email address, postal address, the subject and content of your message.
We use this data to identify you and handle your request. Your message is sent to our contact address and stored in our database for a period of three years.
This retention period may be extended to comply with legal obligations or if you are or become an active member/client. For evidentiary purposes, the data may also be archived for an additional period of five years.
To request access to, correction or deletion of your personal data, please write to the contact address shown on our website (info@factory4.lu).
3. COOKIES
A cookie is a very small file stored on your computer that contains a few lines of text. This text file contains information about your visit that helps provide you with a better browsing experience. The use of cookies on our Website is further explained in our Cookie Policy.
3. PURPOSES OF THE PROCESSING OF YOUR PERSONAL DATA
We collect and process your personal data for specific purposes only, and each time we do so we rely on a defined legal basis.
Our purposes are set out below, grouped by the legal basis on which we rely.
1. Processing necessary to perform our contract with you (Article 6(1)(b) GDPR)
Providing our services: To give you access to our services and to stay in touch with you, we process your identification, contact and payment data. We use this data to manage your membership, control access to our clubs and collect payments, including recurring payments.
Customer service: When you contact our customer service team, we keep a record of your request. This includes your membership details, the date and time of contact, any notes taken by our staff during a call, the e-mails you send us and the information you give us during the call or in your message.
Digital platforms and mobile applications:
To provide you with access to our digital services, mobile applications and online platforms, we process your account, identification and login data. These tools may allow you to manage your membership, access personalised content, book activities, track your interactions with our services and enhance your overall fitness experience.
Group classes and bookings:
We process your data to manage bookings, waiting lists, attendance records and participation in group classes, including Pilates, personal training and other activities offered by the club.
2. Processing based on our legitimate interests (Article 6(1)(f) GDPR)
Marketing: If you are a member, we use your contact details to send you newsletters, offers, promotions and news about our own services, by post, SMS or e-mail. If you cancel your membership, we may continue to send you this direct marketing for the retention period described in section 5. You can object to marketing at any time and free of charge, by using the unsubscribe link in each message or by contacting us (see section 9).
Improving our services: We work continuously to improve our services, and we use your personal data to help us do so, for example to understand how our services are used and where they can be enhanced.
Managing and improving our website: We process visitors’ data to operate, secure and improve our website and to analyse how it is used. This allows us to produce statistics about our activity, measure the website’s performance, and tailor our content and communications to our audience. To do this, we also work with third parties such as hosting and network providers, website and app developers, and online marketing specialists and consultants.
Preventing fraud: We process membership data to detect, prevent and combat fraud. Where necessary, we also share data with the competent administrative authorities, judicial bodies or other public authorities.
Video surveillance and security:
We use CCTV systems in certain areas of our facilities to ensure the safety of our members, employees and visitors, to prevent theft, damage and unauthorised access, and to protect our property. Video recordings are processed only for security purposes and are retained for a limited period. A specific notice is available in our clubs.
Access control and facility management:
We process your membership and access data to manage entry to our clubs, verify membership validity, ensure the security of our facilities and monitor the proper use of our services.
Personalised services and member experience:
We may process information relating to your use of our facilities, attendance history and training preferences to improve your experience, provide relevant recommendations and better adapt our services to members’ needs.
3. Processing based on your consent (Article 6(1)(a) GDPR and, for health data, Article 9(2)(a) GDPR)
Fitness profile: Where you choose to use our fitness-profiling features, we process additional data such as your height, weight, BMI, fitness goals and interests. As part of this data concerns your health, we process it only with your explicit consent, and solely to create your fitness profile, provide you with personalised content and support you throughout your fitness journey. You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before you did so.
Health and fitness information (optional):
If you voluntarily provide information about your fitness level, health objectives, training preferences or limitations, we process this data only with your explicit consent in order to provide you with a more personalised training experience and recommendations. You may withdraw your consent at any time.
Events, competitions and photos:
With your consent, we may use photographs or videos taken during events, challenges or activities organised by the club for communication and promotional purposes on our website, social media channels or marketing materials.
4. DATA RECIPIENT AND PROCESSORS
We share your personal data only where necessary, and always in line with the purposes set out in this Privacy Notice.
1. Our staff
Our employees can access your personal data only to the extent they need it to carry out their duties and tasks. In any event, your personal data will only be processed for the purposes described in this Privacy Notice.
2. Our processors
We rely on third parties to support our operations, for example providers that handle online payments, a company that sends our direct marketing on our behalf, and companies that carry out market research for us. These providers act as our processors: they process your data only on our instructions and only for the purposes we define, under a data processing agreement that meets the requirements of Article 28 GDPR. They may not use your data for their own purposes.
3. App provider
When you use the app Technogym, our service provider, also processes your personal data.
Its own privacy notice applies to that processing and is available here.
4. Other recipients acting as independent controllers
Some recipients decide themselves how and why they use your data, and therefore act as independent controllers rather than as our processors. These include law firms, debt collection agencies, insurers and banks. When they process your data as controllers, their own privacy terms apply.
5. Competent authorities
We may be required to share your personal data with the competent authorities. We do so only in response to a legitimate request, and we review each request before disclosing any data.
5. TRANSFER OF YOUR PERSONAL DATA OUTSIDE THE EEA (European Economic Area)
Unless otherwise indicated, we do not transfer your personal data outside the European Economic Area. Should such personal data transfer take place, we would only transfer it to a country providing an equivalent level of data protection in comparison with the European Union (for more information, see the following link: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en)
6. DATA RETENTION PERIODS
Your personal data is kept for as long as is necessary to achieve the purpose for which it was collected. We keep your data for a maximum of 10 years after the end of our contractual relationship. This retention period may be extended to comply with legal obligations.
If you leave a comment, the comment and its metadata are retained indefinitely. This allows us to automatically recognise and approve follow-up comments instead of holding them in moderation.
For users who register on our website (if applicable), we also store the personal data provided in their user profile. All users can see, edit, or delete their personal information at any time (except their username). Website administrators can also see and edit this information.
For evidentiary purposes, data may also be archived for a period of five years following the end of the contractual relationship before final deletion.
7. YOUR RIGHTS OVER YOUR DATA
Under data protection legislation and subject to our own rights and obligations, you have the following rights:
Right of access (article 15 GDPR): you have the right to request access to your personal data from us, free of charge, and to obtain a copy in an accessible format.
Right of rectification (article 16 GDPR): you have the right to ask us to rectify personal data that you consider to be inaccurate. You also have the right to ask us to complete your information.
Right of erasure (article 17 GDPR): you have the right to ask us to delete your personal data in certain circumstances.
Right to processing restriction (article 18 GDPR): you have the right to ask us to restrict the processing of your personal data in certain circumstances.
Right to data portability (article 20 GDPR): you have the right to ask us to return your data to you in an easily transferable format or, if technology permits, to transfer it directly to another service provider.
Right to object to the processing (article 21 GDPR): you have the right to object to the processing of your personal data in certain circumstances.
To exercise these rights, simply send us a letter and/or an email by using our contact details as indicated below.
We may ask you to provide proof of identity; we will only request information reasonably necessary for this purpose.
We will respond to your request as soon as possible and within one (1) month of receipt. In complex or high-volume cases, we may extend this period by a further two months, in which case we will inform you within one month of receiving your request.
8. COMPLAINT TO THE SUPERVISORY AUTHORITY
If you remain unsatisfied with our response, you may file a complaint with the Data Protection Authority, whose contact details are as follows:
Commission Nationale pour la Protection des données (CNPD)
Address: 15 Boulevard du Jazz, avenue du Rock’n’Roll, L-4370 Belvaux
Phone number : (+352) 26 10 60 -1
Website: https://cnpd.public.lu/fr.html
9. CONTACT INFORMATION
If you wish to exercise your right to access, modify, or delete your personal data, please contact us by email at: info@factory4.lu
10. ADDITIONAL INFORMATION
1. HOW WE PROTECT YOUR DATA
To ensure that the personal data we collect are not lost, misused, accessed, altered, or disclosed by unauthorized third parties, we have implemented strict and recognized data security measures and policies.
2. AUTOMATED MARKETING OR PROFILING OPERATIONS
No automated marketing or profiling operations are carried out.
3. Minors
Our services, website and app are intended for people aged 15 or over. We do not knowingly collect personal data from persons under 15. If you believe that a minor has provided us with personal data without the required authorisation, please contact us and we will delete it.
11. CHANGES TO THE PRIVACY NOTICE
We are constantly developing and improving our services so that we can continue to offer you the best possible service at all times. For this reason, we will regularly adapt this Privacy Notice so that it always correctly sets out how we process your personal data. Although we make every effort to notify you of any changes, we still recommend that you consult our Privacy Notice regularly.
French 
English