Privacy Policy – fitness nation I united (Single Sign-On)
1. Note on the general data protection regulations of Fitness Nation
Fitness Nation I United is the central login service (Single Sign-On, "SSO") of Fitness Nation GmbH . This service allows you to register and authenticate once, and then use the same login credentials to access Fitness Nation's digital services and connected studio/location systems.
For all other processing of personal data in connection with the use of the Fitness Nation website/app/platform (e.g., website visits, cookies/consent manager, contact, appointment scheduling, portal/shop functions, widgets/modules, direct marketing, payment and shipping processing, health and fitness data, BeneFits, live chat, accounting, fonts, storage periods, data subject rights, child protection guidelines), the general data protection regulations of Fitness Nation GmbH , which are provided below, apply .
This privacy policy describes exclusively the data processing in connection with fitness nation I united .
2. Controller and Data Protection Officer
2.1 Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Fitness Nation GmbH
Bergstr. 18, 59394 Nordkirchen, Germany
Tel.: 025969372486
Email: [email protected]
2.2 Data Protection Officer
The data controller has appointed a data protection officer. They can be contacted as follows:
Mr. Jürgen Recha
c/o interev GmbH
Robert-Koch-Straße 55
30853 Langenhagen
(Email: [add if available])
3. Subject and Functioning of Fitness Nation I United
Fitness Nation United is a single sign-on service. Single sign-on means that after registering and authenticating with Fitness Nation once, you can use your login credentials to access multiple affiliated services without having to go through a separate registration process for each one.
Where technically supported, fitness nation I united can also allow you to remain logged in within a session and use connected services without having to log in again (see section 8).
4. What personal data do we process?
4.1 Account details / Registration details
We process data that is necessary for setting up and managing your united account, in particular:
- Email Address
- Password or authentication factor (technically secured, not in plain text)
- internal user identification (e.g. FN-ID)
- Verification status (e.g., email confirmation)
- Account status (e.g., active/locked)
4.2 Authentication, log and security data
For the purpose of processing the registration, ensuring functionality, and for IT security, we process in particular:
- Time(s) of login/logout
- Session information (e.g., session ID, token/similar technical identifiers)
- Technical device and application information (e.g., app/browser version, operating system)
- IP address and server-side log data (e.g., failed attempts, security-relevant events)
4.3 Linking and authorization data for connected services
Insofar as you register (or a connection is established) with affiliated studios/status locations/providers, we process in particular:
- Information that an account is linked to an affiliated offer.
- Technical assignment identifiers for connection/authorization
- Authorization status (e.g., "authenticated/authorized")
5. Purpose of processing
We process the data for the following purposes:
- Registration and management of your account for fitness nation I united
- Performing authentication (login) and providing the SSO service
- Provision of login to connected studio/status location systems
- Session management ("stay logged in") and convenient use of connected services
- Ensuring system security, preventing abuse and fraud, analyzing errors and defending against attacks
- Communication regarding account-related processes (e.g. verification, security alerts, password reset)
6. Legal basis for processing
Your data is processed – depending on the processing purpose – on the following legal bases:
- Article 6(1) b GDPR (contract/pre-contractual measures): Provision and use of the united account, registration/authentication, session management, technical account and access management
- Article 6(1)(f) GDPR (legitimate interests): IT security, abuse/attack detection, stability and error analysis, prevention of unauthorized access
- Article 6(1) c GDPR (legal obligation): insofar as we are subject to legal obligations (e.g., obligations to provide evidence/documentation in individual cases)
7. Sharing of data with affiliated studios/status locations/providers
7.1 Principle of data minimization in SSO
When you register via fitness nation I united at a connected studio/location/provider or its studio system, the respective provider generally only receives:
- Confirmation that you have been successfully authenticated, as well as
- a technical identifier (e.g. FN-ID or a derived mapping ID) that is required to map your account in the provider's system.
No further transmission of personal data occurs solely through the SSO login.
7.2 Further data flows / links
Further data transfers only occur if this is necessary for the use of a specific connected offer and a corresponding link has been established or – where legally required – consent has been obtained.
7.3 Data protection responsibilities of the affiliated providers
Each affiliated provider processes data for its own services (e.g., membership, check-in, course bookings, access, studio-specific services) under its own data protection responsibility . Information on this can be found in the respective provider's privacy policy.
8. "Stay logged in" / Session usage
The SSO service allows you to remain logged in within a session after successful login and to use connected services without logging in again.
This is subject to any additional declarations or steps required to use a specific affiliated offer (e.g., agreement to status location terms and conditions, booking confirmations, or proof of identity/membership).
9. Recipients / Categories of Recipients
To provide fitness nation I united, we may use technical service providers (e.g., hosting, maintenance, IT operations, support). These providers process personal data exclusively on the basis of data processing agreements (Art. 28 GDPR) and according to our instructions.
10. Third Country Transfer
Data is only transferred to countries outside the EU/EEA ("third countries") within the framework of Fitness Nation I United if this is necessary in individual cases and the legal requirements are met (e.g., adequacy decision or EU standard contractual clauses and supplementary safeguards). Where third-country transfers occur through individual services within the Fitness Nation platform, this is governed by the general data protection provisions (below).
11. Storage period / Deletion
We only store personal data for as long as is necessary for the purposes stated in this privacy policy or as required by law.
- Account data : for the duration of the use of the united account; after deletion/termination, the data will be deleted unless there are legal obligations to retain it.
- Security and log data : only as long as necessary to ensure operation, for error analysis and for investigating misuse/attacks; subsequently deleted or anonymized.
12. Data security
We implement appropriate technical and organizational measures (TOM) to protect your data against loss, manipulation, unauthorized access or unauthorized disclosure (e.g. access controls, encryption, logging of security-relevant events, regular security updates).
13. Rights of the data subject, in particular the right to object
You have the following rights vis-à-vis the data controller, provided the legal requirements are met:
- Right to information (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on Art. 6(1) f GDPR (Art. 21 GDPR)
- Revocation of granted consent (Art. 7 para. 3 GDPR), provided that consent is obtained in individual cases.
You can contact us at any time to exercise your rights (see section 2.1 for contact details). To protect your data, we may require suitable proof of identity.
Right to object:
If we process your personal data based on our legitimate interest (Art. 6(1) f GDPR), you have the right to object at any time, on grounds relating to your particular situation, with effect for the future. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.
14. Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.
15. Changes to this Privacy Policy
We reserve the right to update this privacy policy if necessary due to technical changes, further developments of Fitness Nation I United, or legal requirements. The current version will be available within the Fitness Nation platform.