Privacy and Cookies Policy – App & Site Fit Net

1. Introduction and Purpose

1.1. Introduction

As part of its business activities, which consist of the design, development and operation of gyms, fitness centres and wellness facilities, as well as the sale of products and provision of services across the fitness and wellbeing sectors, and any other related or complementary activities, JUMATIC, S.A., a public limited company with registered office at The Tower, Rua do Silval, 37, Sala 1.4, 2780-373 Oeiras, Portugal, company and registration number 518082229 (hereinafter, "Fit Net"), processes personal data in connection with the provision and use of the FIT NET App.

1.2. Purpose of this Policy

This Policy aims to provide information to data subjects (hereinafter "Users" or "data subjects") regarding the processing of their personal data by Fit Net, ensuring compliance with applicable legal requirements.

Fit Net is committed to guaranteeing the confidentiality of all information provided by the User, ensuring their privacy.

2. General Principles Applicable to the Processing of the User's Personal Data

With regard to the general principles relating to the processing of personal data, Fit Net undertakes to ensure that the User's data processed by it is:

• Processed lawfully, fairly and transparently in relation to the User;
• Collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes;
• Adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
• Accurate and kept up to date where necessary, with all reasonable steps taken to ensure that inaccurate data is erased or rectified without delay, having regard to the purposes for which it is processed;
• Kept in a form which permits identification of the User for no longer than is necessary for the purposes for which the data is processed;
• Processed in a manner that ensures its security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

3. General Provisions

3.1. Data Controller

Fit Net is the entity responsible for drawing up this Privacy and Cookies Policy.

As part of its activity, Fit Net collects and processes information that allows the User to be identified. This Privacy and Cookies Policy aims to provide information on how Fit Net, as data controller, collects and processes personal data as part of its activity.

3.2. Purposes of Personal Data Processing

In general terms, the data collected and processed by Fit Net is intended for the following purposes:

• Customer management and the respective contractual relationship;
• Registration and management of the User's account on the App;
• Management of contacts with the User;
• Billing and collection from the User;
• Access control for Users at the gyms operated by Fit Net;
• Analysis of consumption profiles (profiling);
• Marketing and commercial communications, through any means of communication;
• Compliance with legal obligations to which Fit Net is subject;
• Video surveillance.

The legal basis underlying the processing of data depends on the purpose for which Fit Net collects it. This processing may be based on the need to perform a contract to which the User is party, or to take pre-contractual steps at the User's request. It may also be based on compliance with a legal obligation to which Fit Net is subject, or be necessary for the purposes of legitimate interests pursued by Fit Net or by third parties. In certain cases, the legal basis for processing is the User's consent.

3.3. Underage Users

Where the User of the App is under 18 years of age, FIT NET processes the personal data associated with the minor's account and, where applicable, the data of their legal representative necessary for the management and verification of the authorisation required for enrolment.

3.4. Data Retention Period

The retention period for personal data varies according to the purpose of processing. In general terms, Fit Net applies the following personal data retention periods:

• Customer management and the respective contractual relationship: 10 years after termination of the contractual relationship;
• Registration and management of the User's account on the App/Site: 2 years after termination of the contractual relationship;
• Management of contacts with the User: 2 years after termination of the contractual relationship;
• Billing and collection from the User: 10 years after termination of the contractual relationship;
• Access control for Users at the gyms operated by Fit Net: 2 years after termination of the contractual relationship;
• Analysis of consumption profiles (profiling): 2 years after termination of the contractual relationship;
• Marketing and commercial communications: from the User's consent until it is withdrawn;
• Compliance with legal obligations: 10 years after termination of the contractual relationship;
• Video surveillance: 30 days after the images are captured.

Once the periods indicated above have elapsed, personal data will be deleted, without prejudice to its retention for a longer period in the event of pending judicial proceedings or where legislation or regulations applicable to Fit Net require a longer retention period, depending on the nature of the data.

Deletion of the App account does not result in the erasure of personal data whose retention is necessary for compliance with legal obligations or for the management of outstanding amounts, complaints, disputes or the defence of rights. Such data will be retained only for the applicable periods and will not be used for purposes incompatible with those that justify its retention.

3.5. Cookies

Fit Net uses cookies. Cookies (or connection tokens) and other tracking technologies are small text files containing relevant information that is sent by websites and stored on access devices (computer, mobile phone/smartphone or tablet), via the internet browser, when a website is visited by the User's device.

Fit Net uses cookies on its site and applications for the following purposes:

• Recording data on Users' devices, setting configurations and preventing any attempted unauthorised access;
• Ensuring Users' privacy in the private area;
• Collecting statistical information to analyse the relevance of pages to Users and improve site efficiency;
• Analysing the effectiveness of advertising and promotional campaigns;
• Marketing information and User preferences to improve the browsing experience.

Fit Net uses the following types of cookies:

• Essential (mandatory) cookies: Cookies essential to the proper functioning of the site and applications and, as such, cannot be disabled. These cookies do not store information that allows a person to be identified.
• Performance and statistics cookies: Cookies intended to analyse the use of the site and application and collect statistical browsing information so that Fit Net can tailor its offers and available content.
• Marketing cookies: Cookies that enable the integration of third-party content on the Fit Net site or that are used to advertise Fit Net's products and services on third-party sites.
• Personalisation cookies: Cookies that allow the User's display preferences and site usage to be saved, in order to provide a personalised browsing experience.

3.6. Technical, Organisational and Security Measures Implemented

Fit Net has implemented various technical and organisational measures to ensure an appropriate level of security for personal data, which are reviewed and updated periodically as needed. In terms of general measures, Fit Net adopts the following:

• Regular audits to assess the effectiveness of the technical and organisational measures implemented;
• Awareness-raising and training of staff involved in data processing operations;
• Pseudonymisation and encryption of personal data;
• Mechanisms capable of ensuring the ongoing confidentiality, availability and resilience of information systems;
• Mechanisms that ensure the timely restoration of information systems and access to personal data in the event of a physical or technical incident;
• Restricted access to facilities through access controls.

3.7. Subcontracted Entities

As part of the personal data processing it carries out, Fit Net uses, or may use, subcontractors who, on its behalf and in accordance with its instructions, process personal data in strict compliance with the law and this Privacy and Cookies Policy.

These subcontracted entities may not transmit the User's personal data to other entities without Fit Net's prior written authorisation. Fit Net undertakes to only subcontract entities that provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures.

If you would like information about the subcontracted entities, please contact Fit Net.

3.8. Disclosure of Data to Third Parties

Fit Net will not transmit or disclose personal data to third parties, except in the following cases:

1. Where the User consents, or where the transmission or disclosure is necessary for the performance of a contract between the User and Fit Net;
2. As part of pre-contractual steps taken at the User's request;
3. Where necessary for compliance with a legal obligation to which Fit Net is subject;
4. Where necessary for the purposes of pursuing legitimate interests of Fit Net or a third party.

3.9. Transfer of Data Outside the European Union

For certain types of processing, personal data collected by Fit Net may be made available to third parties, which may involve its transfer outside the European Union. In such cases, Fit Net undertakes to ensure that the transfer complies with applicable legal provisions.

If you would like information about the possibility of data transfers outside the European Union, please contact Fit Net.

4. User Rights

Under the law, Users have the following rights:

• Right of access: The User has the right to obtain confirmation from Fit Net as to whether or not personal data concerning them is being processed and, where applicable, the right to access that personal data.
• Right to rectification: The User has the right to obtain, at any time, the rectification of inaccurate personal data concerning them.
• Right to erasure ("right to be forgotten"): The User has the right to obtain the erasure of their personal data where it is no longer necessary, where consent is withdrawn, or where other legal grounds apply.
• Right to restriction of processing: The User has the right to obtain restriction of the processing of their personal data in certain circumstances provided for by law.
• Right to data portability: The User has the right, where applicable, to receive the personal data concerning them in a structured, commonly used and machine-readable format.
• Right to object: The User has the right to object, at any time, to the processing of personal data concerning them, in particular for direct marketing purposes.
• Right to lodge a complaint with a competent authority: The User has the right to lodge complaints with the Portuguese National Data Protection Authority (CNPD). Contact details: Av. D. Carlos I, 134 - 1.º, 1200-651 Lisbon, Phone: +351 213.928.400, Email: geral@cnpd.pt
• Right to withdraw consent: Where processing is based on consent, the User may withdraw it at any time, without affecting the lawfulness of processing carried out on the basis of consent previously given.

The rights referred to above may be exercised by the User by contacting Fit Net, through the App, or by e-mail at: dpo@dataprivacy.pt

Fit Net will respond to the User's request without undue delay and within one month of receipt. This period may be extended where necessary, taking into account the complexity and number of requests, in accordance with legal requirements.

5. Final Provisions

5.1. Amendments to the Privacy and Cookies Policy

Fit Net reserves the right to amend this Privacy and Cookies Policy at any time. In the event of an amendment, the date of the last update is indicated on the final page.

5.2. Data Protection and Complaints Contacts

For questions relating to the protection of personal data or to exercise your rights, the User may contact the Data Protection Officer (DPO) at dpo@dataprivacy.pt.

Without prejudice to other administrative or judicial remedies, the User also has the right to lodge a complaint with the Portuguese National Data Protection Authority (CNPD), using the contact details indicated in section 4 of this Policy.

5.3. Governing Law and Jurisdiction

This Privacy and Cookies Policy, as well as the collection, processing or transmission of the User's personal data, is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the legislation and regulations applicable in Portugal.

Any disputes arising from the validity, interpretation or performance of this Privacy and Cookies Policy shall be submitted to the jurisdiction of the judicial courts of the Lisbon district.

Last updated: September 2026