Privacy Policy
Effective from April 1, 2026
In accordance with EU Regulation 2016/679 (GDPR) and Act No. 18/2018 Coll. This policy covers purchases in the nowfitness.eu e-shop. Data processing in the NOW mobile app and web analytics are governed by the separate policy at nowfitness.eu/privacy.
1. Data Controller
The controller has not appointed a Data Protection Officer (DPO), as the scope of personal data processing does not give rise to this obligation.
2. What Data We Process and Why
Order fulfillment
Name, address, email, phone, payment data.
Legal basis: performance of contract (Art. 6(1)(b) GDPR). Retention: 5 years after contract end.
Legal obligations
Billing data, accounting records.
Legal basis: legal obligation (Art. 6(1)(c) GDPR). Retention: 10 years under accounting law.
Technical cookies
IP address, cookies essential for site operation.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: session or max. 12 months.
Analytical & marketing cookies
On-site behaviour and traffic source — PostHog (EU servers) and Metricool. Activated only after consent is given in the cookie banner.
Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time.
3. Who We Share Data With
We never sell or rent personal data. Data is shared only with these recipients: Shopify — e-shop platform and order processing; Stripe / Shopify Payments — payment processing; delivery carriers — name, address, phone for delivery; Vercel — website hosting; Resend — email delivery (confirmations, support); Sentry — technical error monitoring (EU servers); PostHog and Metricool — analytics, only with consent; public authorities — only where required by law. All processors are contractually bound to protect data in line with GDPR.
4. Transfers to Third Countries
Personal data is processed primarily within the European Economic Area (EEA). Some processors (Vercel, Resend, Stripe) are US-based companies and may process data outside the EEA — such transfers are safeguarded by the EU-U.S. Data Privacy Framework adequacy decision or Standard Contractual Clauses under Art. 46 GDPR.
5. Your Rights
As a data subject, you have the following rights (submit requests to admin@nowfitness.eu): Right of access — find out what data we hold about you; Right to rectification — correct inaccurate or incomplete data; Right to erasure — request deletion (where not needed for legal obligations); Right to restriction — limit processing in cases provided by law; Right to portability — receive data in a structured format; Right to object — object to processing based on legitimate interest; Right to withdraw consent — at any time, without affecting prior lawful processing. We will respond to requests within 30 days. In justified cases we may extend by a further 2 months (with notification of reasons).
6. Data Security
We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. Access to data is restricted to authorised persons bound by confidentiality.
7. Complaints
If you believe your rights are being violated, you have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava — dataprotection.gov.sk