Privacy

Version: 2026-10-11 · Effective from: 11 October 2026

1. Controller

The controller of personal data is GE-KO, Maja Dolžan s.p., Cesta Toneta Tomšiča 71, 4270 Jesenice, Slovenia, registration number 8732043000, e-mail info@fitblizu.com. We have not appointed a data protection officer, as our processing is not large-scale or systematic within the meaning of Article 37 GDPR. Please send privacy questions to info@fitblizu.com.

2. Visiting the website (without an account)

• Technical data with every request (IP address, browser and device type, time, page requested) in the web server logs — for operation and security (abuse prevention). Basis: legitimate interest. Server logs are managed by our hosting provider; application logs (technical errors) are deleted after 30 days.
• Our own cookie-free statistics: the page visited, language, device and browser type, the domain you arrived from, campaign tags (utm) and whether the page was opened as an app. We do not store the IP address; visits are counted using a one-way digest that changes every day, so visits cannot be linked across days. If your browser sends Do Not Track or Global Privacy Control, we do not link visits even within the same day. We record clicks on the contact details of gyms and sports venues (phone, website, directions), filters used and searches with no results in the same way (to help complete the database). Detailed rows are deleted after 6 months; only daily totals without personal data remain. Basis: legitimate interest (measuring the usefulness of the service).
• Google Analytics 4 (only with your consent): if you choose "Accept" in the cookie banner, your browser loads Google Analytics (Google Ireland Limited). It sets the _ga and _ga_* cookies and sends Google the pages visited, on-page events, device and browser type, approximate location (country, city) and the domain you arrived from. Google does not store the IP address. We use it only for aggregate visit statistics; Google Signals and advertising features are switched off. Basis: your consent (Article 6(1)(a) GDPR and the cookie rules of the electronic communications act). Until you choose "Accept", or if your browser sends Global Privacy Control, Google Analytics is not loaded. You can withdraw consent at any time via "Cookie settings" in the menu or the page footer.
• Country from your IP address: when the map opens, our server determines from your IP address whether you are in Slovenia or Croatia (DB-IP IP to Country Lite database, CC BY 4.0) so the map starts with your country. Neither the IP address nor the country is stored or sent to anyone.
• Location: "Near me" uses your device location only when you allow this in your browser. Coordinates are sent only as a search area to display gyms and sports venues and are not stored.
• Browser storage (localStorage): saved gyms, recent searches, the selected theme and similar settings stay only on your device; we cannot see them. You can delete them by clearing the site data in your browser.
• External resources: to show the map, your browser downloads map tiles from OpenFreeMap (tiles.openfreemap.org), which receives your IP address and browser data; it sets no cookies. All other files (including software libraries) are hosted by us.

3. Crowd reports

When you report how busy a gym is, we store the gym, the crowd level, the time and an anonymous daily digest (without an IP address) that prevents repeated or malicious reporting. Reports are shown publicly only as an aggregate rating (e.g. "Quiet · 12 min ago") and as an hourly average. Basis: legitimate interest. Retention: 90 days.

4. Suggested corrections and new places

The content of a suggestion about a gym or sports venue (e.g. a corrected schedule or address, a new gym), optionally your e-mail address for a reply, and an anonymous daily digest to prevent abuse. Suggestions are reviewed by an editor. Basis: legitimate interest (data accuracy) or your request. Retention: 24 months after the decision.

5. Claiming a profile (owners and managers of gyms and sports venues, trainers)

For a claim of a gym, sports venue or trainer profile we process your first name, last name, e-mail address, phone number (if you provide one), your role at the place, and your message. After verification, we send a link to edit the profile without a password to that e-mail address; the link is valid for 30 days and we store only its hashed value. Profile changes are recorded in an audit trail (who, what, when). Basis: contract, or steps taken at your request. Retention: a confirmed claim, for as long as the profile remains claimed; rejected requests, 24 months after the decision; expired or cancelled links, 90 days.

6. Data about gyms, sports venues and trainers

Profiles of gyms, sports venues (courts, pools, climbing gyms, studios) and personal trainers contain publicly available business data: name, address, location, public contact details (phone, business e-mail address, website, social media), opening hours, prices, equipment and sports. We compile this data from official websites, public directories and maps, and from owners and visitors; for each item of data we keep the source and verification date. We do not publish personal e-mail addresses (firstname.lastname@…) or data only accessible in registers. For personal trainers working as sole traders, the name and business contact may also be personal data; we publish them only as the trainer publishes them for their own business. Basis: legitimate interest (helping visitors find a gym, sports venue or trainer nearby, Article 6(1)(f) GDPR). You may object at any time (Article 21 GDPR) by writing to info@fitblizu.com; we will then correct or remove the data.

7. Invitations to gyms, sports venues and trainers

We send an invitation to claim the profile for free to the publicly listed business e-mail address of the gym, sports venue or trainer and, if there is no response, at most one reminder. Legal basis: legitimate interest (accuracy of data about a business). The invitation contains a personal link for editing the profile (valid for 90 days); when you use it we record the time of use, and the first save counts as claiming the profile. Every message contains an "Unsubscribe" link (and one-click unsubscribe in your mail client); it takes effect immediately and applies to all gyms and sports venues with that address. Messages contain no tracking pixels and we do not measure opens. Replies, automatic replies and non-delivery notices that arrive at info@fitblizu.com are automatically linked to the gym or sports venue; addresses that cannot be reached or ask to unsubscribe are unsubscribed. Retention: records of sent messages and received responses 24 months; unsubscribed addresses are kept as long as needed to respect the unsubscribe permanently.

8. Correspondence

If you write to us at info@fitblizu.com, we process your e-mail address, name and the content of your message in order to reply. Basis: legitimate interest or your request. Retention: 24 months.

9. Cookies

• Strictly necessary cookie fb_lang: it remembers the language (si, hr or en) you last used, so that fitblizu.com and the app open in the same language. It contains no identifier and is valid for one year. For the private admin area (editors only) we use a session cookie and a form-protection cookie.
• Analytics cookies _ga and _ga_* (Google Analytics, point 2) are set only if you choose "Accept" in the banner; they last at most 13 months.

We keep your choice in your browser (localStorage, fitblizu.consent) for 12 months and then ask again. You can change it at any time via "Cookie settings" in the menu or the page footer; when you withdraw consent we delete the _ga cookie. We do not use advertising cookies.

10. Who we share data with

• Our hosting provider (server, database, backups, sending e-mail): G-SERVER d.o.o., Slovenia; server in a data centre in Slovenia — a processor that processes data on our instructions.
• OpenFreeMap — only the IP address and browser data when the map loads (point 2).
• Google Ireland Limited (Google Analytics) — only with your consent (point 2); Google processes the data as our processor.
• The public — data about gyms, sports venues and trainers (point 6) and aggregate crowd ratings (point 3).
• Government authorities — when required by law.

We do not sell data or use it for advertising or profiling.

11. Transfers outside the EU/EEA

The server, database and backups are located in Slovenia. OpenFreeMap may serve map tiles from a server outside the EU/EEA; in doing so it receives only the IP address and browser data. Google Analytics may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework, so the transfer relies on the European Commission's adequacy decision.

12. How long we keep data

• Crowd reports: 90 days.
• Google Analytics: event data at most 14 months, _ga cookies at most 13 months.
• Detailed visit and event statistics: 6 months (thereafter only daily totals without personal data).
• Suggested corrections and new places: 24 months after the decision.
• Claim requests: confirmed, for as long as the profile remains claimed; rejected, 24 months.
• Profile edit links: 90 days after expiry or cancellation.
• Records of invitations sent: 24 months; opt-outs, permanently.
• Edit audit trail: 24 months.
• Correspondence: 24 months.
• Application logs: 30 days.

These deadlines are enforced by an automated task that runs every day.

13. Your rights

You have the right to access, rectification, erasure, restriction of processing, objection (where processing is based on legitimate interest) and data portability. Send your request to info@fitblizu.com; we will respond within one month at the latest (for complex requests we may extend this period, and we will notify you if so). Since we have no accounts, we verify identity proportionately, usually via the e-mail address you wrote to us from. You may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.

14. Children

The service is not intended for children under 16 and we do not knowingly collect their data.

15. Automated decision-making

We do not carry out automated decision-making with legal or similarly significant effects and we do not profile users.

16. Security

Connections are encrypted (HTTPS), edit and unsubscribe links are signed or stored only as hashed values, access to editing is role-restricted and audited, and backups are intended for recovery after a technical or security incident. We apply appropriate technical and organisational measures, but no system can guarantee complete protection. Personal data breaches are handled in accordance with the applicable regulations, and where required we notify the supervisory authority or the affected individuals.

17. Changes

We update the policy when new features or processors are introduced, or when regulations change. The version and date are shown at the top; previous versions are sent on request.

Service provider details

GE-KO, Maja Dolžan s.p.
Cesta Toneta Tomšiča 71, 4270 Jesenice, Slovenia
Registration: Business Register of Slovenia (AJPES)
Registration number: 8732043000
VAT ID: SI 33880263
E-mail: info@fitblizu.com
Website: www.ge-ko.si

Updated: 11 October 2026