Privacy Policy

It does not cover the privacy practices of our partner or studio partners on their own premises or on their own websites and apps. Once you visit a partner facility, the partner is the data controller for any data they collect directly.

3.1 Information you give us

• Identity: name, surname, date of birth, gender (optional)
• Contact: email address, phone number
• Account: password (encrypted), preferences, language
• Profile: profile picture (optional)
• Payment information: processed by our payment provider Stripe; we do not store full card numbers

3.2 Information generated when you use the app

• Activity: which partners, classes or services you book and visit, dates and times of check-ins, credits used
• Technical: device type, operating system, app version, IP address, app identifiers, crash logs
• Location: only if you grant permission, used to show you nearby partners
• Communication: emails, in-app messages, support tickets
• Behavioural: preferences such as favourite partners, search history, screens viewed

3.3 Information from third parties

• Login providers: If you sign in with Apple or Google, we receive basic profile information from them.
• Your employer: If your access to wayfit co. is provided through your employer, the corporate client confirms that you are eligible to use the service. We do not receive other personal data from your employer.

3.4 Health and fitness data (planned future feature)

In future versions of the app, we may offer optional features that allow you to log fitness goals, body metrics, workout history or to connect data from third-party sources such as Apple Health or Google Fit. Some of this would qualify as health data - a special category of personal data under the GDPR.

Where this applies:

• we will only collect such data if you explicitly opt in
• we will rely on your explicit consent (Article 9(2)(a) GDPR) as the legal basis
• we will never share this data with your employer or with partners without your specific instruction
• you can withdraw consent and delete this data at any time from the app

Until these features are launched and you opt in, no special category data is collected.

Partner and studio partners

To enable check-in and service delivery, partners receive only what they need: your name, profile picture (if any), the booking details and a confirmation that you are entitled to access. Partners are independent controllers for any further data they collect directly from you on their premises.

Sponsors and promotional partners (employers, insurers, banks, partners offering promotional access)

Some Members access wayfit co. through a third party that sponsors, subsidises or otherwise enables their subscription. We call this third party a "Sponsor". Sponsors include, for example: an employer that pays for a member benefit, an insurer that includes wayfit co. in a policy, a bank that offers wayfit co. as a cardholder benefit, or a partner that runs a promotional campaign giving discounted access.

Where a Sponsor is involved, the Sponsor needs basic information to manage the arrangement they are paying for or sponsoring. We share only what is necessary, and only the following:

If you object to a Sponsor receiving your active/inactive status, the sponsored subscription cannot continue, because this basic information is integral to the sponsored arrangement. In that case, your sponsored subscription will be cancelled and the Sponsor will be free to reallocate the seat or benefit. You may sign up independently as a self-paying Member at any time, in which case no usage data is shared with any Sponsor. To object, contact team@wayfitco.com.

• Aggregated insights: with all Sponsors, we share aggregated and anonymous statistics about how their cohort uses the platform (for example, percentage of users booking yoga, pilates, strength training, total bookings, engagement trends). These insights do not identify any individual Member.
• Activity status: with Sponsors that pay for or subsidise your subscription, we share whether you are active or inactive on the platform - meaning whether you have used your subscription within a defined period. This is identifiable to you, because the Sponsor already knows you are an enrolled user. We do this so the Sponsor can manage costs, renewals and the value of the benefit. Legal basis: our and the Sponsor's legitimate interests (Article 6(1)(f) GDPR).
• What we never share with Sponsors: we do not share which specific partners or studios you visit, which classes you take, when you visit, your booking history, your fitness goals, body metrics, communications with support, payment data, or any other detailed or sensitive usage data with any Sponsor.

Service providers (sub-processors)

We use trusted third parties to run our service. They process data only on our instructions, under written agreements that meet GDPR Article 28 requirements. Categories include:

• payment processing (Stripe and any payout provider, e.g. Wise, Trolley, Airwallex)
• cloud hosting and infrastructure
• transactional email and customer support tools
• analytics and crash reporting
• identity verification and fraud prevention (where applicable)

[A current list of sub-processors will be maintained at wayfitco.com/legal/sub-processors and updated when changes occur.]

Professional advisers and authorities

Where required, we share data with our accountants, auditors, lawyers and tax authorities, and with public authorities or courts where compelled by law.

Corporate transactions

If wayfit co. is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred to the relevant counterparty under appropriate confidentiality protections. We will notify you of any change in controllership.

You can request a copy of the relevant safeguards by emailing team@wayfitco.com.

8.1 What we personalise

• Discovery and ranking: which partners, studios or services appear higher in your feed, based on factors such as proximity, availability, your past bookings and ratings, and overall quality signals.
• Reminders and nudges: if you allow notifications, we may send timely prompts - for example a reminder to book if you have not visited in a while, a nudge when your credits are about to reset, or a suggestion to try something new.
• Recommendations: we may surface classes or partners that match your interests, sports preferences or booking patterns.
• Habit and engagement features: we may show your activity streaks, monthly summaries, or progress visuals.

8.2 What it is, and what it is not

These features are personalisation and product improvement tools. They help us show you more relevant content and remind you to use the service you are paying for. They do not produce legal effects on you, do not affect your access to the service, do not affect your subscription, and are not shared with your employer or with insurers.

We do not make automated decisions that significantly affect you within the meaning of Article 22 GDPR.

8.3 Legal basis

We rely on our legitimate interests (Article 6(1)(f) GDPR) in operating and improving the platform and providing a useful experience. Where notifications or marketing communications are involved, we rely on your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

8.4 Your controls

• Notification preferences: turn push notifications, emails and reminders on or off in your account settings or device settings
• Personalisation toggle: we will offer settings to reduce or disable behavioural nudges and personalised recommendations as these features roll out
• Right to object: you can object to processing based on legitimate interests by contacting team@wayfitco.com (see section 17)

8.5 Health-data integrations (when launched)

If, in future, you choose to connect Apple Health, Google Fit or similar sources to wayfit co., we will only use that data with your explicit consent and only for the personalisation and habit features described in this section. See also section 3.4 (Health and fitness data) and section 13 (Research and aggregated insights).

9.1 Data we process about the people you sponsor

When your organisation sponsors wayfit co. access for individuals (members, policyholders, cardholders, programme participants), we act as the controller for the personal data of those individuals as described in this policy. You provide us with the contact details needed to invite or enrol them (typically email) and confirm their eligibility.

Your organisation must have a lawful basis to share these contact details with us, must inform the individuals concerned that their data is being shared, and must ensure this is documented in your own privacy notice.

9.2 Data we process about your administrators

We process the names, business contact details and roles of HR, programme or admin users who manage the Sponsor dashboard. Legal basis: legitimate interests (Article 6(1)(f) GDPR) in administering the contract with your organisation.

9.3 What you see in the Sponsor dashboard

Your dashboard shows:

You will not see which partners or studios individuals visit, which classes they book, when they visit, their booking history, fitness goals, body metrics, communications with our support team, payment data, or any other detailed or sensitive information about their personal use of the platform.

You must use the information shown to you only for the legitimate purpose of administering the wayfit co. arrangement, and you must inform the individuals you sponsor that this basic active/inactive status is shared with you.

Where an individual objects to active/inactive status being shared with you, their sponsored subscription will be cancelled and the seat will be released back to your organisation for reallocation. The individual may sign up independently as a self-paying Member at any time.

• aggregated activity statistics about your sponsored cohort (e.g. percentage of users booking yoga, pilates, strength, etc., total bookings, engagement trends). These do not identify individuals.
• for individuals whose subscription you pay for or subsidise, their active/inactive status - so that you can manage cost, renewals and the value of the benefit you are funding.

9.4 Joint responsibilities

Your organisation and wayfit co. each have independent obligations under the GDPR. We provide a Data Processing Agreement separately as part of our contractual arrangements where required, and we are happy to support you in completing your own privacy notices and DPIAs.

10.1 What personal data we process about you

When you sign up to and operate on the wayfit co. platform, we collect the following categories of personal data relating to you, your business and your representatives:

• Identity and contact data: business name, legal form, registration number, owner and representative names, job titles, work email, work phone and business address
• Financial and tax data: bank account or payout details, tax registration numbers, VAT status, invoicing information
• Facility data: location, address, opening hours, services offered, capacity, equipment, photographs, descriptions and any other listing content you provide
• Operational data: bookings accepted, visits confirmed, no-show records, capacity utilisation
• Performance and quality data: Member ratings and reviews, complaints, incidents, response times
• Payment data: amounts owed, paid and pending, history of payouts, dispute records
• Communications: support tickets, emails, in-platform messages and any other correspondence with us
• Account and technical data: login credentials (encrypted), IP address, device information and audit logs of partner-portal activity
• Verification documents: where applicable, identification documents, business licences, insurance certificates and any other evidence required for onboarding or compliance

10.2 Why we process your personal data and our legal bases

We process your personal data for the purposes set out below, relying on the legal bases described:

• Onboarding and listing: to evaluate your application, set up your account, list you on the platform and present your services to Members. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR) and steps prior to entering into that contract
• Operating the platform: to enable bookings, check-ins, communications with Members, customer support and to calculate amounts due to you. Legal basis: performance of our contract with you
• Payments: to pay you for Confirmed Visits, manage invoicing and resolve payment disputes. Legal basis: performance of our contract with you and legal obligation (Article 6(1)(c) GDPR)
• Quality and safety: to investigate complaints and incidents, monitor service quality and maintain platform standards. Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in running a reliable network and protecting Members
• Security and fraud prevention: to detect and prevent fraud, abuse and manipulation of visits, and to secure the platform. Legal basis: our legitimate interests
• Improving the platform and the network: to understand usage patterns, optimise the partner experience and develop new features. Legal basis: our legitimate interests
• Marketing to you (about wayfit co. itself): occasional updates about new features, training opportunities and partner programmes. Legal basis: our legitimate interests for transactional and partner-specific updates; your consent for any commercial marketing. You can unsubscribe at any time
• Tax, accounting and legal compliance: issuing invoices, keeping accounting records, responding to tax authorities and meeting other legal obligations. Legal basis: legal obligation (Article 6(1)(c) GDPR)

10.3 Who we share your personal data with

We share your personal data only when needed and with appropriate safeguards. The main categories of recipient are:

We do not sell your personal data, and we do not share it for the marketing purposes of third parties.

• Members: limited information about your facility (name, location, photos, services, hours) is shown to Members through the platform. Personal contact details of you or your staff are not shared unless required for a specific booking or communication
• Payment and payout providers: such as Stripe (payment processing) and our payout provider (e.g. Wise, Trolley or Airwallex). They receive the information needed to make payments to you and prevent fraud
• Professional advisers: accountants, auditors, lawyers and similar advisers under confidentiality obligations
• Tax authorities and regulators: where we are legally required to report or to respond to lawful requests
• IT, hosting and analytics providers: who process data on our behalf as sub-processors, under written agreements that meet GDPR Article 28 requirements
• Corporate transactions: in the event of a merger, acquisition, financing or sale of assets, your data may be transferred to the counterparty under appropriate confidentiality protections

10.4 International data transfers

Most of your data is stored within the European Economic Area. Some service providers may process data outside the EEA. Where this happens, we rely on the safeguards described in section 6 of this policy (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework).

10.5 How long we keep your personal data

• Active partner data: for as long as you are a partner on the platform
• After termination: we delete or anonymise your operational data within 12 months of termination, unless a longer retention is required by law
• Financial, tax and invoice records: retained for 7 years to comply with Cyprus and Greek tax and accounting law
• Compliance and dispute records: retained while a dispute, investigation or regulatory matter is open, plus a reasonable archive period thereafter
• Verification documents: retained for the duration of the relationship and a short period thereafter, in line with anti-fraud and regulatory expectations

10.6 Your rights

As a data subject, you have the GDPR rights set out in section 12 of this policy, including the right of access, rectification, erasure, restriction, portability and objection. You can exercise these rights by contacting team@wayfitco.com. You can also lodge a complaint with the Cyprus or Greek data protection authority (details in section 12).

10.7 Roles and controllership

• For personal data that we collect about you and your business, wayfit co. is the data controller.
• For personal data that we share with you about Members (such as Member name and booking details), wayfit co. is the controller and you act as a recipient and processor in respect of that data. You may use it only for the purposes set out in the Partner Agreement, and you must apply the data-protection obligations set out in that Agreement, including the 24-hour breach notification requirement.
• When a Member visits your facility and you collect additional personal data from them directly (for example, a waiver, an induction form, biometric access or in-house loyalty data), you act as an independent controller for that data and your own privacy notice applies.

10.8 Security

We apply the technical and organisational security measures described in section 14 of this policy. This includes encryption in transit, hashed credentials, role-based access controls and audit logging. We will notify you of any personal data breach affecting your data without undue delay and, where required, within the time limits set by the GDPR.

Legal bases: legitimate interests for essential site operation and security; consent for analytics, marketing and non-essential cookies.

We use cookies and similar technologies in line with our Cookie Policy [link]. You can manage your preferences at any time through the cookie banner or your browser settings.

To exercise any right, email team@wayfitco.com. We will respond within 30 days. We may need to verify your identity before acting on a request.

If you are not satisfied with how we have handled your data, you have the right to lodge a complaint with a supervisory authority. The competent authorities are:

• Cyprus: Office of the Commissioner for Personal Data Protection, dataprotection.gov.cy
• Greece: Hellenic Data Protection Authority (HDPA / Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), dpa.gr
• Other EEA countries: you may also complain to the supervisory authority in your country of residence.

13.1 Aggregated and anonymous insights

We produce aggregated and anonymous statistics about how the wayfit co. network is used - for example, total bookings by category, regional engagement trends, average activity frequency, popularity of different sports, or seasonal patterns. These insights do not identify any individual Member.

We may share such aggregated insights with corporate clients (see section 9), partner and studio partners, research partners, insurers, public bodies, or the public (for example, in research reports or press releases). Because the data is aggregated and anonymous, it is no longer personal data and the GDPR does not restrict this use.

Legal basis: not applicable once the data is fully anonymised. Until anonymisation is complete, we rely on our legitimate interests (Article 6(1)(f) GDPR) in producing research and improving public knowledge of physical activity and wellbeing.

13.2 Pseudonymised research datasets

In some cases we may produce pseudonymised datasets - datasets where direct identifiers (such as your name and email) are removed and replaced with a code, so that you cannot be identified directly from the dataset itself. Pseudonymised data is still personal data under the GDPR.

We may use such datasets internally for research and product development (e.g. studying how booking patterns relate to retention) on the basis of our legitimate interests (Article 6(1)(f) GDPR), with appropriate safeguards including access controls, contractual restrictions, and a strict prohibition on attempts to re-identify individuals.

We will not share pseudonymised datasets with insurers or other commercial third parties without your specific, informed and freely given consent.

13.3 Sharing individual-level data with insurers or research partners

From time to time we may explore partnerships with insurance companies, academic institutions, public health bodies or research organisations that would involve sharing individual-level activity or health data. Where this happens, we apply the following rules:

Until you give explicit, opt-in consent for a specific partnership, no individual-level data is shared with insurers or commercial research partners. Today, no such sharing is taking place.

• Explicit consent: we ask for your explicit, opt-in consent for each such use, separately from your acceptance of these terms (Article 6(1)(a) and, where health data is involved, Article 9(2)(a) GDPR)
• Specific information: we tell you who will receive the data, what data will be shared, what they will do with it, and for how long
• Withdrawal: you can withdraw consent at any time without affecting your access to the wayfit co. service
• DPIA: we conduct a Data Protection Impact Assessment (DPIA) before launching any such use, in line with Article 35 GDPR
• No silent profiling: we will not use shared data to make automated decisions that significantly affect you (such as setting an insurance premium for you personally) unless we tell you so explicitly and you separately agree

13.4 What we will never do

• sell your personal data
• share individual-level data with insurers, employers or marketers without your explicit, informed consent
• use your data to take actions that disadvantage you (such as denying you access to insurance products) without telling you and giving you a meaningful choice

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals where required by law.

We aim to resolve concerns directly and informally wherever possible. You always retain the right to contact your supervisory authority as set out in section 12.