This policy explains what personal data we process, why, how long we keep it, who we share it with and what your rights are. It applies to the DARC Fitness gym, the website darcfitness.com and the DARC app (iOS, Android and web).
The governing text is the Romanian version; if translations differ, the Romanian version prevails.
We have tried to write it simply. If anything is unclear, write to us and we will answer.
In short:
- we take only the data needed for your membership, entry and training; everything else (photo, health, club messages, filming) only with your separate consent;
- data is stored in the EU (Germany, Netherlands); we do not sell it or use it for advertising;
- we keep it while you are a member and for 3 years after, then anonymise it;
- you can see, download, correct or delete your data and withdraw any consent at any time;
- questions: info@darcfitness.com, +373 67 933 336.
1. Who we are
The data controller is MAMONOV GROUP SRL (trading as DARC Fitness), IDNO 1026023042389, registered office: bd. Iurii Gagarin 1, ap. 39, Chișinău, Republic of Moldova; gym: Vatra, str. Ștefan Vodă 60, 2nd floor, Chișinău, Republic of Moldova.
For any data question: info@darcfitness.com or WhatsApp +373 67 933 336. Data protection is handled by the club manager, Ivan Mamonov.
We process data under Law of the Republic of Moldova No. 195/2024 on personal data protection.
2. What data we process
We collect only what we need. You give us most of it; some is created when you use the gym or the app.
| Category | What exactly | Source |
|---|---|---|
| Contact and identity | first name, last name, phone, email, date of birth, preferred language | you (form, gym, app) |
| App account | email for sign-in, one-time sign-in codes sent by email (temporary), role in the app | you, at sign-up |
| Membership and services | membership type, start and end dates, freezes (dates and, if you wish, the reason: travel, personal reasons, other — no medical details), sessions left, class and personal-training bookings | created when you buy and use services |
| Your gym record | your goal (e.g. "lose weight"), working tags (e.g. "morning class"), bonus points | you and the trainer |
| Visits and access | date and time of entry and exit, method (QR code, manual, turnstile), entrance device, whether entry was allowed and why not | created at the entrance |
| Payments | what you bought, amount, date, method (cash, card, bank transfer), debts and instalments | created when you pay. We never receive your card details: card payments go through the bank's terminal. There is no online payment yet; we will update this policy before it launches |
| How you found us | source (website, Instagram, referral, etc.), who referred you, UTM tags of the link | you, or the link you came from |
| Health and measurements | whether you have restrictions, your note about them, whether you have a doctor's clearance; body measurements (weight, body fat %, circumferences) | only if you tell us or take measurements with the trainer and give separate consent |
| Profile photo | one photo | only with your consent |
| Training data | training programme, trainer's notes, "before/after" body photos | the trainer and you; body photos only with separate consent |
| Communications | messages we send you (channel, text, status), in-app notifications | created when we contact you |
| Consents | which consent you gave or withdrew, text version, date, method (app, website, paper, verbal) | created when you choose |
| Website and message enquiries | first name, phone, email or Instagram handle, interest, comment, language, page and source, whether sent from a phone, a cryptographic hash of your IP address; enquiry history: calls, messages, stage, first-session date, reason for declining | you, your browser and the club management |
| Technical data | security log: who changed what in the system and when; IP address and device type in the sign-in logs of our provider (Supabase); device identifier for push notifications (only if you turn them on) | automatically |
If you were a member before the app launched, your data (name, phone, membership, debt) was transferred from our previous records.
What we do not collect: the app has no ads, we do not track you across other apps or websites, we use no third-party analytics, and we do not ask for access to your contacts or location. The QR code in the app changes every 30 seconds and is not stored. We do not use biometrics (fingerprint, face recognition).
3. Why, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answer your enquiry and book your first session | website or message enquiry | steps before a contract, at your request |
| Conclude and perform the contract: membership, entry, bookings, freezes, instalments, refunds | contact, membership, visits, payments | performance of the contract |
| App account and its security | account, sign-in log | performance of the contract; our legitimate interest in protecting the account |
| Service messages: enquiry reply, booking, membership ending, debt | contact, membership, payments | performance of the contract |
| Accounting and tax records | payments, sales | legal obligation |
| Personal training: programme, notes | training data | performance of the contract (trainer service) |
| Safe training that takes your health into account; tracking measurements | health data and measurements | your explicit consent |
| Recognise you at the entrance by photo | profile photo | your consent |
| Track progress with "before/after" photos | body photos | your separate consent |
| Messages about the club: news, new classes, invitations, birthday greetings | contact | your consent (separate tick box, off by default) |
| Photos and video in the gym for social media | your image | your separate consent, per shoot or for a period |
| "Bring a friend" — give the referrer their gift | who referred whom; the fact that the friend bought a membership of at least 3 months (no amount or other details) | for the referrer — the public offer agreement; for the friend — our legitimate interest; the friend is informed and can refuse |
| Protect the website form from spam and the QR pass from being shared | IP hash, counters, access events | our legitimate interest in protecting the service |
| Security log, backups | all system data | our legitimate interest in not losing data and knowing who changed what |
| Debt collection and defence of legal claims | contact, contract, payments | our legitimate interest |
| Video surveillance on the stairs, at reception, in the cardio area and in the strength area: safety of people and belongings, investigating incidents | video recording (your image), no sound | our legitimate interest in ensuring safety; there are no cameras in changing rooms, showers or toilets |
We do not make solely automated decisions that significantly affect you. The system automatically blocks entry if a membership has expired, is frozen, or a payment is overdue beyond the grace period — this is a contract rule; if you think it is a mistake, contact us and we will check manually.
If you do not give us data: we cannot conclude a contract without your name and phone number. The photo, health data, body photos and club messages are optional — everything works without them.
4. Your consent and how to withdraw it
Each consent is separate, never pre-ticked, and never a condition of buying a membership. You can withdraw it at any time, just as easily:
- in the app: Profile → Privacy (a switch for each consent);
- for club messages — reply STOP;
- at the gym or by message to +373 67 933 336.
On withdrawal, your profile photo and body photos are deleted from the system immediately, and from backups automatically within 30 days; health data and measurements are deleted; club messages stop. Withdrawal does not affect what was lawfully done before. We only keep the record that you gave and withdrew consent, as proof.
5. Where data is stored
- Database, accounts and files — Supabase, in a data centre in the European Union (Frankfurt, Germany).
- Backups — (1) Supabase daily backups in the same EU region, kept 7 days; (2) an independent copy, encrypted (AES-256) before upload, stored with Backblaze in the European Union (Amsterdam, Netherlands) and deleted automatically after 30 days. If we ever restore data from a backup, we re-apply all deletions and consent withdrawals made after the backup date.
- Creating the Backblaze copy — every night on GitHub Actions servers: the copy exists there for a few minutes, is encrypted before upload and then erased. GitHub servers may be outside the EU (usually in the USA).
- Video recordings — on the video recorder at the gym; only the administrator has access; recordings are overwritten automatically within 30 days. We hand them over only on a lawful request (for example, to the police), and to you — a clip in which you appear, without other recognisable people.
- On your phone — your sign-in session, encrypted in the Keychain (iOS) or Keystore (Android).
Photos are kept in private storage and opened only through temporary links (1 hour for the profile photo, 10 minutes for body photos).
6. Who we share data with
We do not sell your data or give it to anyone for their own advertising. We share it only with the recipients below, and only as much as needed:
| Who | Why | Where |
|---|---|---|
| Supabase Inc. | database hosting, sign-in, file storage | EU (Frankfurt); US company |
| Backblaze Inc. | storage of encrypted backups | EU (Amsterdam) |
| GitHub Inc. | creating and encrypting the nightly backup | usually USA, a few minutes |
| 650 Industries Inc. (Expo), Apple, Google | delivering push notifications to your phone | USA |
| Cloudflare Inc. | checking that the website form is filled in by a human, not a bot | worldwide |
| Netlify Inc. | hosting the website and the web version of the app | worldwide |
| the old booking form on the website (Google Sheet), the gift certificate sheet, website fonts | worldwide | |
| WhatsApp, Viber, Telegram | when you message us or we message you there | under their own rules |
| Accountant | bookkeeping — name only, no phone number | Republic of Moldova |
| Bank (card terminal) | card payments at the gym | Republic of Moldova |
| Public authorities | only when the law requires it | Republic of Moldova |
Providers process data only on our instructions. When data leaves Moldova and the EU (for example to the USA), we rely on the safeguards provided by law (for example, the provider's standard contractual clauses). You can ask for a copy of these safeguards at info@darcfitness.com.
7. How long we keep data
| Data | Period |
|---|---|
| Website enquiry, if you did not become a member | no more than 12 months from submission, then anonymised |
| IP hash of the enquiry | 30 days |
| Member record, memberships, visits, bookings, trainer's notes, programmes | while you are a member and 3 years after your last activity (last membership, visit or payment), then anonymised |
| Health data, measurements, body photos | until you withdraw consent; otherwise 12 months after your last activity |
| Profile photo | until you withdraw consent or delete your account |
| Sales and payments | as long as accounting and tax law requires (usually 5 years after the end of the year); after anonymisation, not linked to you |
| Access events (each entry) | 12 months |
| Video recordings | no more than 30 days; if needed for an incident or dispute — until it is resolved |
| Messages sent | 12 months |
| In-app notifications | 90 days |
| Consent log | as long as we process the data plus 3 years |
| Security log | 3 years; when your data is deleted, personal data in the log is anonymised |
| Backups | 7 days (Supabase), 30 days (Backblaze) |
| Gift certificate sheet (Google) | 12 months after the certificate is used or expires |
| WhatsApp conversations with the club | 12 months |
| Paper consents (filming, children) | while we use the material plus 3 years |
Automatic deletion after these periods is being implemented in the system; until then we do it manually at least once a month.
8. Your rights
You have the right:
- to know what data we hold about you and get a copy;
- to correct inaccurate data;
- to ask for erasure;
- to ask for restriction of processing (for example, while we check a complaint);
- to receive your data in electronic form and pass it on (portability);
- to object to processing based on our legitimate interest;
- to withdraw consent at any time;
- to complain to the National Center for Personal Data Protection (NCPDP), datepersonale.md.
How:
- in the app: Profile → Privacy → Download my data (a file with all your data) and Delete account (if your version of the app does not have these features yet, write to us by email or WhatsApp — the same time limits apply);
- by email to info@darcfitness.com or message to +373 67 933 336;
- at the gym.
We reply within one month. If the request is complex or there are many requests, the period may be extended by up to two more months, but we will tell you within the first month and explain why. It is free. To avoid giving your data to someone else, we may ask you to confirm it is you (for example, from your app account or from the phone number we have on file).
9. Deleting your account
DARC app — developer MAMONOV GROUP SRL (DARC Fitness).
You can delete your account yourself: in the app go to Profile → Privacy → Delete account and confirm. You can also ask without the app: write to info@darcfitness.com or WhatsApp +373 67 933 336 from the phone number on your account.
What happens:
- your sign-in account is deleted immediately — you can no longer sign in;
- within 30 days we delete or anonymise your name, phone, email, date of birth, photos, health data, notes, measurements, programmes and messages;
- we keep, without your name, only sales and payments — accounting law requires them; if you have an unpaid debt or an open dispute, we keep the data needed for it until it is closed;
- the data disappears from backups by itself within 30 days;
- we confirm by message when deletion is complete.
Deleting your account does not automatically cancel an active membership or mean a refund — see the public offer agreement (refunds). If you want to keep your membership without the app, tell us and we will check you in manually.
10. Children
On their own, people can buy a membership and create an account from age 18. From 14 to 17 — only with the written consent of a parent or legal guardian; consents for data processing (health, photos, messages) are also given by the parent. We do not sell memberships to or create accounts for children under 14. Children who come to the gym with their parents are not registered in the system. We do not publish children's faces; if a child does appear in a photo, only with a parent's written consent.
11. Cookies and on-device storage
The website uses no advertising or analytics cookies. It only stores in your browser:
darc-lang— the language you chose;darc-bookings— bookings you made on the website, so you can see and cancel them.
These are needed for the site to work and never leave your device. We count daily visits without cookies and without identifying you.
External services on the website:
- Cloudflare Turnstile — in the enquiry form, checks that you are human; may use technical browser data;
- Google Fonts — website fonts; your browser sends your IP address to Google;
- embedded Instagram posts — load only after you agree; once loaded, Meta may use its own cookies.
The app uses no cookies; on your phone it stores the sign-in session (encrypted), language and theme. In the web version — the session, language and theme in browser storage (localStorage).
12. Security
Only the club management (currently the manager) can access the data, with two-step sign-in. If other trainers join, each will see only what they need for their own clients and classes. Each member sees only their own data in the app. Connections are encrypted (HTTPS), and so are backups. Health data is stored separately and every read is logged. If a personal data breach does happen, we notify the supervisory authority within 72 hours where the law requires it, and if the risk to you is high, we tell you too, without undue delay.
13. Changes
When we change this policy, we publish the new version here with its date. We tell you about important changes in the app or by message before they take effect. Previous versions are available on request.
14. Contact and complaints
MAMONOV GROUP SRL (DARC Fitness), Vatra, str. Ștefan Vodă 60, 2nd floor, Chișinău · info@darcfitness.com · +373 67 933 336.
If you are not satisfied with our answer, you can contact the National Center for Personal Data Protection: MD-2004, Chișinău, str. Serghei Lazo 48 · centru@datepersonale.md · +373 22 820 801 · datepersonale.md.