privacy policy rush
This privacy statement describes how we handle your personal data. We do everything we can to safeguard your privacy and therefore handle personal data with care.
About RUSH
RUSH Studio (“RUSH”) is a Dutch gym that offers group classes in Amsterdam. RUSH Studio is part of Urban Gym Group B.V.
To provide our services, we process personal data. In this privacy statement, you can read which personal data we process and how we do so. Naturally, we comply with the data‑processing and privacy regulations applicable in the Netherlands. For more information on these regulations, please consult the website of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Urban Gym Group B.V., located at Silodam 402, 1013 AW Amsterdam, is responsible for processing the personal data of members with a membership, punch cards (“credits”) and other individuals interested in RUSH.
What is personal data?
Personal data refers to any information relating to an identified or identifiable natural person. It concerns information through which you can be recognized. Examples include your name, (email) address, telephone number, date of birth, photo, and/or bank account number.
Processing of personal data of members and individuals booking credits via RUSH
Below you will find the data we request from you, receive from you, or which you may choose to provide yourself if desired:
· First and last name, email address, date of birth and (optional) telephone number: We use this information to perform the agreement (such as memberships and packages) and for related communications. These data are also used for administrative purposes, such as enabling lesson bookings when credits have been purchased, offering a free trial as part of promotional activities (for example when opening a new location), and creating an account with Eversports (the booking system). In addition, these personal data are processed for contact moments with RUSH – for example via social media channels or other communication methods.
· Bank account number (IBAN): When a payment is made via the website, we automatically receive your payment details. We also process your IBAN for automatic (periodic) direct debit for memberships only.
· Email preferences: You can indicate whether you are interested in receiving emails with the latest offers, events, or news-related emails.
Processing of personal data of interested individuals
Below you will find the data we request from you, receive from you, or which you may choose to provide yourself if desired:
· First and last name and email address: We process these data to keep individuals who show interest in RUSH informed about relevant offers and updates. Interested individuals may also contact us for informational purposes.
This processing is based on your consent or our legitimate interest. You give consent when you choose to receive information, newsletters, or promotional materials from us. In addition, RUSH has a legitimate (commercial) interest in responding to information requests. This applies, for example, when an interested person fills out the contact form on our website or submits a digital request for contact through social media platforms such as LinkedIn, Facebook, or Instagram. RUSH also has a legitimate (commercial) interest in providing targeted information to individuals who have booked a trial — if such a trial has been offered — in order to encourage them to sign up for a paid membership or package. Note that free trials are exceptional and offered only in limited circumstances.
For more information, please refer to the paragraph “Newsletter” below.
Legal basis for processing personal data
RUSH relies on the legal bases described in Article 6 of the GDPR.
One of the legal bases we rely on is the necessity to use your data to enter into and perform an agreement with you. This applies when you take out a membership or purchase (single) credits (including associated possibilities such as club access, booking classes and making payments) and for the registration and renewal of memberships or packages.
We may also process your personal data when we have a legitimate interest. For example, we analyze your data to improve our services. We also have a legitimate commercial interest in informing you when you request more information about RUSH or when you (exceptionally) booked a free trial to persuade you to become a paying member. Additionally, based on our commercial interest, we will send newsletters to members, package holders and/or users who purchased packages. You have the right to object at any time to such processing for marketing purposes, and every email contains an “opt-out” link. We may also send service-related emails (e.g., about renewal/modification/terms of a subscription or credits) based on our legitimate information interest and for execution of the agreement, via email or SMS.
Another legal basis is consent. For example, you consent to the use of cookies. With the help of these cookies, we can show or send you information, offers, and advertisements that suit your preferences. You can read more about what cookies are and how we use them in our cookie statement. There you can also adjust your cookie preferences. Additionally, you can give your consent to receive newsletters and/or (membership) offers if you have already entered into a membership with us.
We generally do not process the personal data of minors (under 16 years old). Exceptions apply when a minor independently contacts us for more information and/or a (free) trial. In these cases, we do not process sensitive or special categories of personal data.
Newsletter
Our newsletter contains a variety of information and offers. We send this newsletter via email. Based on your visits and profile, we aim to tailor the content as much as possible to your interests and to inspire you for a future visit.
To send the newsletter, we use your first and last name and your email address. We send the newsletter based on our legitimate (commercial) interest.
If you no longer wish to receive the RUSH newsletter, you can unsubscribe at any time free of charge via the unsubscribe link at the bottom of the newsletter – the so-called "opt-out."
Retention period
We retain your data for as long as you are a member, purchase credits or are subscribed to our newsletter. When your membership ends and is not renewed, or when you unsubscribe from the newsletter, your data will automatically be deleted within two years.
The retention period for the data of prospects and/or interested parties is the period during which you are considered a prospect by us. This is ninety (90) days.
Exceptions apply to data we are required to retain for a longer period due to legal obligations or our legitimate interest. For example, tax legislation requires us to retain certain financial data for 7 years. Information related to the handling of inquiries or complaints is retained for a maximum of 2 years after the matter has been resolved.
Sharing with third parties
We will not share your personal data with third parties without your explicit consent, unless required by law. There are a few exceptions.
Several parties involved in delivering RUSH services act as processors. These processors handle certain parts of our services and assist us in fulfilling our obligations toward you. We have processor agreements in place where necessary, specifying which personal data they may process and for what purposes. RUSH remains the primary point of contact for questions or concerns about data processing.
These processing activities include:
· Systems for booking group classes
· Management of financial administration
· Ensuring GDPR compliance for our online environment
· Sending newsletters and event invitations
We do not share data with other parties unless legally required or permitted—for example, when the police request personal data as part of an investigation. In such a case, we are required to cooperate.
In some cases, you may have given us permission to share your browsing behavior and preferences with third parties so that we can show you targeted information or offers on external websites. In such cases, we only share your IP address, not other personal data.
We do not transfer personal data to parties outside the European Union.
Data processing within Urban Gym Group
Urban Gym Group is the parent company, which includes among others the brands TrainMore, Clubsportive, GYM BOX, RUSH, BTY CLB, TRIB3 and PILAT3S. For specific purposes, we may share your personal data within the Urban Gym Group corporate group. We are permitted to do so (and will only do so) for administrative purposes, service improvement, internal management (internal analyses), and/or for the performance of the contract.
Camera surveillance
At the request of Urban Gym Group, RUSH uses camera surveillance. The purposes and means described below are determined by Urban Gym Group (the controller), and RUSH acts according to its instructions in accordance with the processor agreement.
Camera surveillance (live where necessary) is used for the following purposes:
· Access control at RUSH clubs (and/or Rush Studios located inside TrainMore locations)
· Surveillance and protection of goods and individuals present in RUSH
· Prevention and documentation of disturbances, such as vandalism and violence against individuals.
No other personal data is processed apart from:
· Camera footage of the buildings and premises, and the persons and objects located therein and thereon, for which RUSH is responsible.
· Data relating to the time, date and location at which the footage was recorded.
No hidden cameras are used.
RUSH locations are transparent about the use of cameras. Where cameras are in use, this is clearly indicated by stickers, signs, etc.
No cameras are installed in locker rooms or restrooms at the clubs.
Execution of camera surveillance
· In practice, video surveillance is carried out by the control room and staff on-site at the relevant RUSH location. Occasionally, a third party may be engaged to record or monitor footage, such as external control rooms during surveillance of temporarily unstaffed clubs. Urban Gym Group and the RUSH control room always remain ultimately responsible for the execution of the video surveillance.
· Camera footage is retained for a maximum of 30 days, unless a longer retention period is necessary to handle a recorded incident.
· The control room has implemented adequate measures to prevent unauthorized access or misuse of stored footage.
· Individuals authorized to review footage are explicitly bound by confidentiality. Access to the footage is protected by a password.
Access, copies, deletion or blocking of camera images
· A specific request from a data subject for access to and copies of footage, including the date, time period, and location in question, can be submitted to Urban Gym Group (via privacy@urbangymgroup.com).
· A request for deletion or blocking of footage may be submitted if the footage is incomplete or irrelevant for the purposes of the processing, or if it is otherwise processed in violation of legal requirements.
· A request may be denied if granting access would infringe upon the privacy rights of others.
· Disclosure of footage: recorded camera footage will only be provided to an authorized government body when a lawful (generally written) order from the respective authority is received, or when other legal obligations require RUSH to do so.
Security
We have implemented appropriate technical and organizational measures to protect your personal data from unlawful processing. Examples include:
· All persons who can access your data on behalf of RUSH are bound by confidentiality
· We use a username and password policy for all systems
· We pseudonymize and encrypt personal data when appropriate
· We make backups to restore data in the event of physical or technical incidents
· We regularly test and evaluate our security measures
· Our employees are informed about the importance of data protection
RUSH website
We use cookies on our website. These cookies allow us to show or send information, offers and advertisements suited to your preferences. You can read more in our cookie policy, where you can also adjust your cookie settings.
Rights regarding your data
As a data subject, you have the following rights:
· The right to request information about the processing of your personal data;
· The right to data portability, allowing you to request the transfer of your personal data to another party;
· The right to rectification, enabling you to have your data corrected or updated;
· The right to withdraw your consent at any time, if the processing is based on your consent;
· The right to have your data deleted when it is no longer needed for the original purpose or when you withdraw your consent (note: this right does not apply in all cases due to possible exceptions);
· The right to request restriction of the processing of your personal data in certain situations.
Would you like to exercise one of these rights? Then please contact us at privacy@urbangymgroup.com. We may ask you to identify yourself before we process your request.
We will process requests related to these rights within one month but reserve the right to extend this period to two months. If we do so, we will inform you in time. Please be aware that a request may not always be granted. If we have a reason not to (or not fully) comply with your request, we will of course inform you accordingly.
You also have the right to object to the processing of your personal data.
For cookies, you can exercise this right by adjusting your preferences via the cookie settings on our website. For all other requests, you can contact us at privacy@urbangymgroup.com.
Complaints
If you have a complaint about the processing of your personal data, we kindly ask you to contact us directly at privacy@urbangymgroup.com. We will do our best to work with you to find a suitable solution.
If we are unable to resolve the matter together, you always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the supervisory authority for privacy protection in the Netherlands. You can find more information about this on the website of the Dutch Data Protection Authority.
Changes
We recommend that you check this privacy statement regularly, as we may update it from time to time. This way, you will always stay informed about the most current version regarding how we use and protect your personal data.
Data Protection Officer
To ensure compliance with the obligations set out in the General Data Protection Regulation and the policy of the Autoriteit Persoonsgegevens, Urban Gym Group B.V. has appointed an external Data Protection Officer: mr. Bente van den Beuken of De Vos & Partners Advocaten, Van Miereveldstraat 13, 1071 DW Amsterdam. Mrs. Van den Beuken can be contacted at: bvandenbeuken@devos.nl.
Questions
If you have any questions or comments regarding our Privacy Statement, please feel free to contact us!
Contact Details
Urban Gym Group B.V. (label RUSH)
T.a.v. de directie
Postbus 7035 2701 AA Zoetermeer