Effective: 12 September 2026. Version 1.0. This is a translation of the Hungarian notice. In case of any difference, the Hungarian version prevails.
Crossfit Glasshouse Korlátolt Felelősségű Társaság (Crossfit Glasshouse Kft.), Nándorfejérvári út 40., 1116 Budapest, Hungary. Company registration number: 01-09-331344. Tax number: 26545831-2-43. Email: info@crossfitglasshouse.com. Phone: +36 30 590 4081. Represented by Levente Lakner, managing director.
We are not required to appoint a data protection officer. For any data protection question, write to info@crossfitglasshouse.com.
| What | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Enquiries and discovery calls | name, email, phone, language preference, goals, message | contacting you, arranging the call, recommending a membership | Art. 6(1)(b) – steps before a contract, at your request | 12 months from last contact if no membership follows |
| Membership and training | name, billing name and address, email, phone, membership plan, agreement and signature data (time, device, IP), bookings and attendance, pause and cancellation requests, training data you log | performing the membership contract | Art. 6(1)(b) – contract | 5 years after membership ends (general limitation period) |
| Invoicing and accounting | name, billing address, email, service and amount | issuing invoices, sending them to you by email, accounting, tax. Invoices are issued in Számlazz.hu and reported to the tax authority's online system as the law requires | Art. 6(1)(c) – legal obligation (Act C of 2000, s.169) | 8 years |
| Payments | we never see or store your card details; card payments are handled by Stripe through the member app | performing the contract | Art. 6(1)(b) | per the provider |
| Health declaration and training-relevant health information | health declaration, injuries, pregnancy, medical limitations you tell us or your coach records | safe training and scaling of workouts | Art. 9(2)(a) – your explicit consent | until you withdraw consent, max 1 year after membership ends |
| CCTV | footage from one camera at the entrance, stored on a memory card in the camera | protecting property, controlling entry | Art. 6(1)(f) – legitimate interest | at most 6 days, loop overwrite (see CCTV Notice) |
| Newsletters and SMS | name, email, phone, opens and clicks | marketing messages | Art. 6(1)(a) – consent | until you withdraw |
| Photos and videos | images of you in the gym and at events | showing the club online | Art. 6(1)(a) – consent | until you withdraw |
| Website, cookies, chat | see the Cookie Notice | running and improving the site | consent / legitimate interest | see the Cookie Notice |
| Complaints | your complaint and our reply | handling consumer complaints | legal obligation (Act CLV of 1997, s.17/A) | 3 years |
Operational messages about your membership (class changes, billing, opening hours) are not marketing and are sent as part of the contract.
Photo and video consent is voluntary, is not a condition of membership, and can be withdrawn at any time by writing to info@crossfitglasshouse.com. After withdrawal we stop using that material and remove it from our own channels where it can reasonably be done.
Our staff and coaches, as far as their work requires. In addition we use the following processors: PushPress, Inc. (member system, bookings, app, agreements, card payments, website, USA), PushPress Grow / LeadConnector (website forms, chat, booking, email and SMS, USA), Webflow, Inc. (technical hosting, USA), Google Ireland Limited (Workspace, Analytics), Meta Platforms Ireland Limited (Facebook, Instagram, Messenger, WhatsApp), Stripe (Stripe Payments Europe, Limited: card payments, Ireland and USA), KBOSS.hu Kft. (Számlázz.hu: issuing and emailing invoices, Hungary), Green Professional Kft. (bookkeeping, Hungary), Xiaomi (remote access to the camera through the manufacturer's app; footage itself is stored on a memory card in the camera, not in the manufacturer's cloud), Namecheap, Inc. (domain registration, USA), and BugHerd (website change requests and bug reports, Australia and USA). We may also disclose data to authorities where the law requires it.
Some of the providers above process data in the USA, under the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. [To be confirmed per provider.]
Access, rectification, erasure, restriction, objection to processing based on legitimate interest (including the camera), data portability, and withdrawal of consent at any time. Billing records cannot be deleted during the statutory retention period. Write to info@crossfitglasshouse.com; we reply within one month, extendable by two months for complex requests.
Please contact us first. You may also complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), Falk Miksa utca 9-11., 1055 Budapest, ugyfelszolgalat@naih.hu, +36 1 391 1400, or bring a court claim before the tribunal of your residence or of our seat.
Under-14s may only take part in the CrossFit Kids program, and members under 18 train with parental or guardian consent, on the basis of which we process their data.
We do not make automated decisions or carry out profiling that produces legal effects for you.
