This translation is provided for convenience. The Russian version is the legally binding one.

This Policy describes what personal data the PROFORM DINAMO club processes, on what grounds, how long we retain it and what rights you have. The Policy has been drawn up in accordance with the Law of the Republic of Uzbekistan "On Personal Data" № ЗРУ-547 dated 02.07.2019, as currently in force.

1. Who processes your data

The personal data operator:

ООО «PROFORM NUTRITION»
ИНН 302 636 915
Республика Узбекистан, г. Ташкент, Мирзо-Улугбекский район, массив Буз-1, дом 8А

Enquiries concerning the processing of personal data are accepted by phone on +998 94 045 54 48, on Telegram (@PROFORM_uzbot), in person at the club reception desk, and by letter to the address given above.

2. Scope of the Policy

The Policy applies equally to all channels through which you interact with the club:

the club's website;
the mini application in Telegram;
the mobile application;
the club's Telegram bots;
the reception desk, the cash desk and the internal records system;
the access control and video surveillance systems on the club's premises.

3. What data we process and on what grounds

We process data solely for the specific purposes listed below. We do not collect data without which the purpose cannot be achieved.

3.1. Data for the performance of the contract

Ground: the contract concluded with you.

surname, first name, patronymic — identification of the club member, execution of the contract;
date of birth — verification of age;
mobile phone number — logging into the application by code, communication regarding the services;
e-mail address, if provided — sending of documents;
contract number and status, type of membership, terms — membership records;
visit history by QR code — access control and recording of the remaining visits;
history of class bookings — provision of the services;
history of payments and receipts — settlements, accounting and tax records.

Bank card data. We neither receive nor store the full card number. Payments are processed by Payme and Click on their side. Where a card is saved for repeat payment, we store only the token issued by the payment system, the card type, the last four digits and the expiry date.

3.2. Photograph

Ground: separate consent. The photograph is used for two different purposes, and separate consent is given for each of them:

Identification upon entry to the club. The photograph is displayed to the reception staff member when the card or QR code is presented. Such use renders the photograph biometric personal data, and it is therefore stored exclusively within the territory of the Republic of Uzbekistan and is not transferred outside it.
Publication in the club's advertising materials. Consent is voluntary, does not affect the terms of service and may be withdrawn at any time.

3.3. Data on health and physical condition

Ground: separate written consent. This is a special category of data.

information from the health questionnaire: contraindications, past illnesses and operations, pregnancy, medication taken;
indicators which you enter yourself: weight, measurements, notes on how you feel;
information on injuries sustained at the club, if any have occurred.

Access to this data is available only to those employees who require it for their work: the trainer with whom you train and the authorised manager. This data is not accessible to reception administrators or bar staff.

3.4. Location data

Ground: separate consent given in the device's system dialogue.

Precise location is processed only in the "Capture" game mode and in map mode, if you have enabled it yourself. The mode is disabled by default. We store only the last location point, not the movement history. The permission may be withdrawn in the device settings at any time; the other functions will continue to operate. The game mode is not intended for persons under 18 years of age.

3.5. Data arising from use of the application

Telegram identifier, if you have logged in via Telegram;
the device push token for the delivery of notifications;
posts, comments and reactions in the club feed;
private messages between members: stored until the account is deleted; access by employees is possible only in the course of handling a complaint;
points, coins, rewards and achievements earned and spent;
technical login logs required for security purposes.

3.6. Video surveillance

Ground: legitimate interest in ensuring the security of property and visitors. The club's premises are equipped with a video surveillance system. No cameras are installed in changing rooms, showers or lavatories. Recordings are stored for a limited time, after which the system overwrites them automatically, and are accessible to a limited number of authorised employees. Signs at the entrance give notice of the presence of video surveillance.

4. Retention periods

contract, payment and receipt data — for the period established by the legislation on accounting and tax records;
health questionnaire — until termination of membership and for one year thereafter;
photograph for identification — until termination of membership;
photograph in advertising materials — until consent is withdrawn;
posts and messages — until deleted by you or until the account is deleted;
location data — only the last location point, until the mode is disabled;
video surveillance recordings — a limited period, after which the system overwrites them automatically.

Upon expiry of the retention period, the data is destroyed or anonymised.

5. To whom we transfer data

We do not sell personal data and do not transfer it to third parties for their own purposes. A limited volume of data is processed on our instructions by:

Payme, Click — processing of payments;
the fiscal data operator and the tax authority — generation and transmission of fiscal receipts, as required by law;
the SMS provider — delivery of the confirmation code;
Telegram — operation of the mini application and the bots;
Google, Apple — delivery of push notifications to the device.

Data is disclosed to state authorities only in the cases expressly provided for by the legislation of the Republic of Uzbekistan and to the extent required by the request.

6. Transfer of data outside the Republic of Uzbekistan

The club's principal database is hosted on a server within the territory of the Republic of Uzbekistan. Biometric data does not leave the territory of the Republic of Uzbekistan.

Certain functions operate on foreign services, and we state this expressly:

the "AI trainer" function processes your question on a foreign language model service. We transfer there only the text of the question and anonymised training indicators. Your first name, surname, phone number and health questionnaire data are not transferred there;
push notifications are delivered through the infrastructure of Google and Apple, which processes only the technical device identifier.

Use of these functions is voluntary.

7. Your rights

You have the right to:

obtain information as to what data of yours we process and from where we obtained it;
demand the rectification of inaccurate or incomplete data;
demand the blocking or destruction of data if it is processed in breach of the law or is no longer necessary for the purpose for which it was collected;
withdraw any consent;
delete your account together with the data associated with it;
object to the processing of data for marketing purposes;
lodge a complaint with the authorised state body for the protection of personal data of the Republic of Uzbekistan or with a court.

How to exercise your rights. Apply at the club reception desk, call +998 94 045 54 48 or write to us on Telegram. You will receive a reply within no more than fifteen days. We are entitled to ask you to verify your identity so as not to disclose your data to an unauthorised person.

What happens upon withdrawal of consent. Withdrawal of consent to marketing, to the use of a photograph for advertising or to geolocation does not affect the service. Withdrawal of consent to the processing of health data means that we will no longer be able to admit you to personal training sessions, since without such information the safety of the sessions cannot be ensured. Data which we are required by law to retain shall be kept after the withdrawal of consent for the period established by law.

8. Marketing communications

Advertising messages by SMS, in Telegram and via push notifications are sent only to those who have given separate consent thereto. Consent is recorded with the date and time and is stored in the club's system.

Advertising messages are not sent between 18:00 and 09:00.

You may opt out at any time: by a command in the bot, by the toggle in the application profile or by applying at the reception desk. Opting out of advertising does not disable service notifications concerning your bookings, purchases and membership validity period, which form part of the service.

9. Minors

For persons under eighteen years of age, the contract is concluded with the consent of the legal representative, who also gives consent to the processing of personal data. The game mode with geolocation and the club feed functions are not activated for minors.

If you become aware that a child has provided us with data without the knowledge of the legal representative, notify us and we will delete it.

10. How we protect data

the transmission of data between the applications and the server is encrypted using the TLS protocol;
employee access is segregated by role, each seeing only what is necessary for their work;
operations with data in the records system are recorded in an audit log;
passwords and access keys are stored in protected form and are changed regularly;
backup copies are created regularly and are hosted within the territory of the Republic of Uzbekistan.

11. Cookies

The use of cookies on the website is described in a separate Cookie Policy.

12. Amendments to the Policy

We may update the Policy. Each new version is assigned a new number and date. We give notice of material changes in the application and on the website at least ten days before they come into force. All previous versions are retained and provided upon request.

13. Contacts