Privacy Policy

CrossFit Limmatstadt · Healthy & Fit GmbH · Version: October 2026. In case of discrepancies, the German version prevails.

1. Controller

The controller responsible for processing your personal data is:

Healthy & Fit GmbH, Albisstrasse 28, 8038 Zurich (registered office)

Box: CrossFit Limmatstadt, Binzstrasse 9, 8045 Zurich

E-mail: cfl@crossfitlimmatstadt.ch

This privacy policy applies to our website www.crossfitlimmatstadt.ch, memberships and all services of CrossFit Limmatstadt. The Swiss Federal Act on Data Protection (FADP) applies. Where applicable, we also take the EU General Data Protection Regulation (GDPR) into account.

2. Data We Process

Master and contact data: name, address, e-mail, phone number, date of birth, profile picture in the member account.
Contract data: subscription, term, renewal, suspensions, signed Terms and declarations.
Payment data: invoices, payments received, payment method. Card data is processed by the payment providers and not stored by us.
Booking and usage data: class bookings, check-ins, attendance, training results in the member account.
Health information: information on injuries or limitations you provide voluntarily, medical certificates for suspensions, and results and videos of the Functional Movement Screen (FMS).
Photos and videos from training sessions, classes and events.
Video surveillance recordings in the box.
Communication data: content of e-mails, WhatsApp messages and enquiries.
Website data: technical data such as IP address, browser, date and time, and cookies.

3. Purposes

We process your data in order to:

administer memberships, subscriptions, renewals, suspensions and payments,
run bookings, classes, personal training and FMS and keep your training safe,
communicate with you and send you our newsletter,
operate and promote our box, website and social media channels,
ensure the safety of people and property,
comply with legal obligations, e.g. retention of accounting records.

4. Service Providers and Recipients

We work with the following service providers, who process data on our behalf or under their own responsibility:

Boxbase (Luminous Falcon GmbH, Dornbirn, Austria): member administration, member account, bookings, online payments and newsletter. Data is stored in the EU (data centre in Amsterdam). Boxbase uses further providers, including Stripe for online payments and Cloudflare for infrastructure.
Wix (Wix.com Ltd., Israel): website builder, including website statistics and technically necessary cookies.
Infomaniak (Infomaniak Network SA, Switzerland): hosting.
Microsoft (Outlook): e-mail.
SumUp: card payments on site.
TWINT (TWINT AG, Switzerland): TWINT payments.
Our bank: payments by bank transfer.
Meta (Instagram, Facebook, WhatsApp): social media and WhatsApp community.
YouTube (Google): embedded videos on the website.

Beyond this, we only disclose data where necessary to perform the contract (e.g. to emergency services), where required by law, or where necessary to enforce our claims (e.g. to debt collection agencies, insurers, authorities or courts). We do not sell data.

5. Transfers Abroad

Your data is mainly processed in Switzerland and the EU. Some providers (e.g. Wix in Israel; Microsoft, Meta, Google, Stripe and Cloudflare in the USA) may also process data in other countries. According to the Swiss Federal Council, the EU and Israel provide an adequate level of data protection. For transfers to the USA, we rely on the providers' certification under the Swiss-U.S. Data Privacy Framework or on standard contractual clauses.

6. Newsletter

Members receive our newsletter via Boxbase. You can unsubscribe at any time via the link in the newsletter or by e-mail.

7. WhatsApp Community

Joining our WhatsApp community is voluntary. You join yourself and can leave at any time. Within the community, your name, phone number and profile picture are visible to other participants. Meta's privacy policy also applies to WhatsApp.

8. Photos and Videos

We take photos and videos of training sessions, classes and events and publish them on our website, Instagram and Facebook, in the newsletter and in advertising (see section 13 of the Terms). On request, you will not be named or tagged.

9. Video Surveillance

To protect people and property, the box is under video surveillance, indicated by signs on site. Only the management has access to the recordings. Recordings are only reviewed in case of incidents and are automatically deleted after 3 weeks at the latest. In case of incidents, they may be kept longer and passed on to law enforcement authorities.

10. Health Information and FMS

We only process health information if you provide it or consent to it, e.g. for the FMS, and only to keep your training safe, to handle suspensions and for coaching. Only the responsible coaches and the management have access. FMS videos are not published without your explicit consent.

11. Website and Cookies

When you visit our website, technical data (e.g. IP address, browser, date and time) is collected automatically to operate the website securely. The website uses cookies, in particular technically necessary cookies and cookies for anonymous visitor statistics by Wix. You can delete or block cookies in your browser settings at any time. Embedded YouTube videos and links to Instagram and Facebook may transfer data to the respective providers when used.

12. Retention

We keep personal data for as long as necessary for the purposes stated. Contract and accounting records are kept for up to 10 years in accordance with legal obligations. Other member data is generally deleted 5 years after the membership ends.

13. Data Security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss and misuse.

14. Your Rights

You have the right to request information about your data and to request its correction, deletion or handover. You may object to processing and withdraw consent, unless legal obligations or contractual reasons prevent this. Please send requests to cfl@crossfitlimmatstadt.ch. You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

15. Changes

We may amend this privacy policy at any time. The version published at www.crossfitlimmatstadt.ch/datenschutz applies.