Academy Privacy Notice

Notice on the processing of personal data pursuant to Articles 13 and 14 of EU Regulation No. 679/2016 (“Regulation”)
and Legislative Decree No. 196/2003, as subsequently amended

Virgin Active Italia S.p.A., with registered office in Corsico (20094 - MI), via Privata Archimede no. 2, Tax Code and VAT no. 03641880962 (hereinafter: “VAI” or “Controller”), as Data Controller, provides information on its policies for processing the personal data you provide (in particular, to receive information regarding the activities and services relating to the VAI Academy or to become part of the “Virgin Active” world). The Controller's organization has appointed a data protection officer (Data Protection Officer or "DPO"), who is available for any information concerning the processing of your personal data at the e-mail address: dpo@virginactive.it.

   1. PERSONAL DATA SUBJECT TO PROCESSING

a) Data provided by you

The Controller will process the personal data you provide when interacting with the VAI Academy, by manual or electronic means. The processing will concern common data (including, by way of example and without limitation, personal details such as name, surname, date and place of birth, residential address, tax code, VAT number, e-mail address and mobile phone number, your image) and, in general, the personal data you enter in the forms requesting information about the VAI Academy.

Other processing of your image may occur because a camera system is installed inside the Club to protect property and people, and you too may be recorded by these cameras: the images collected are retained for only 24 hours; in fact, each day the images recorded by the cameras overwrite those from the previous day. A specific notice for this processing is displayed at the Clubs and specific signs indicate the presence of cameras (e.g. “Video-surveilled area”). For further clarification in this regard, you may write to the contact details indicated in Section 7 “Rights of the data subject”  of this notice.

b) Third-party data voluntarily provided by you

When using particular services, personal data of third parties that you communicate to Virgin Active may be processed (for example, name, surname, etc.). This could occur, for example, if you provide Virgin Active with personal data of the Virgin Active Trainer who recommended the Academy course to you. With regard to these cases, we inform you that you act as an independent data controller, assuming all related legal obligations and responsibilities. In this regard, you grant the broadest indemnity in respect of any dispute, claim, request for compensation for damage arising from the processing of personal data, etc. that may be brought against the Data Controller by third parties whose personal data have been processed through your use of the services in breach of applicable data protection laws. In any case, where you provide or otherwise process personal data of third parties, you guarantee from now on - assuming all related responsibility - that such third parties have been informed in advance that their personal data would be communicated to Virgin Active, which would process them as described in this notice, also drafted pursuant to Article 14 of the Regulation. The communication of the Trainer's data must be based on your prior acquisition of his/her consent to the processing of such data by Virgin Active.

Furthermore, if you publish on social networks or on any platforms used, images/videos taken inside our Clubs (in all publicly accessible areas) depicting other Members, our collaborators or visitors,  we inform you that Virgin Active in these cases does not carry out any processing of the personal data in question and that you act as an independent data controller, assuming all related legal obligations and responsibilities. In this regard, you grant the broadest indemnity in respect of any dispute, claim, request for compensation for damage arising from processing, etc. that may be brought against Virgin Active, which in this case is not the data controller. In any case, we invite you always to behave respectfully toward our Members, collaborators and visitors, always making sure that they do not object to being recorded by you and always informing them about how you will use the images depicting them. Above all, we recommend that you always request their consent before publishing images depicting them on social networks.

c)Data processed when interacting with social networks

Where possible, in addition to completing the appropriate service request forms, you may register, if you have a Google account, also simply by clicking the “Register with Google” button. In these cases Google will automatically send Virgin Active some of your personal data, specified in the appropriate disclaimer displayed when completing the form to enroll in Academy courses. In particular, Google will share with Virgin Active your username and, if available, your Google account photograph.

    2. PURPOSES OF PROCESSING OF PROCESSING

Your personal data will be processed, subject to your explicit consent where necessary, for:

a) providing the services requested from VAI from time to time and, by way of example, (i) satisfying your requests to be contacted regarding training activities by the VAI Academy, as well as (ii) responding to requests for information submitted by you through the contact forms (online and offline) made available from time to time by VAI in relation to the Academy world, (iii) publishing your image on social networks, since this is an integral part of the Academy service, which in this way gives visibility to its courses and participants, (iv) if necessary, using the medical-visit booking services made available at our Clubs and undergoing a medical check-up with Virgin Active's affiliated medical centers, in order to obtain a certificate of fitness for fitness&wellness,activities, which is necessary to train at our Clubs. In these cases Virgin Active processes your data only for the purpose of making the bookings, while the doctors act as independent data controllers, processing your personal data as indicated in their notices (“Provision of the Service”); 
b) sending you by e-mail offers on products or services similar to those you have purchased, unless you expressly refuse to receive such communications, which you may do at any time (“Soft Opt-in”);
c) sending you informational and promotional material relating to VAI services and products, such as, by way of example, training courses organized by the VAI Academy; commercial communications may be made by e-mail, postal mail, telephone, SMS and through the use of VAI's official pages on social media (“Marketing”);
d) fulfilling specific obligations arising from law, regulations or EU legislation, or satisfying requests from the authorities (“Compliance”).

   3. LEGAL BASIS OF PROCESSING

The processing of your personal data will be carried out using manual, IT and telematic tools that are in any case suitable for ensuring the security and confidentiality of the data.

Provision of the service: the processing of your personal data for this purpose (Sec. 2.a) has its legal basis in Art. 6.1.b of the Regulation ([…] processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract).The provision of personal data for this purpose is optional, but without it it will not be possible to provide you with the requested service.

Data relating to health status: the processing of your personal data relating to your health status is based on your consent, in accordance with Art. 9(2)(a) of the Regulation ([…] the data subject has given explicit consent to the processing of those personal data for one or more specified purposes). The provision of your consent is optional, but without it we will not be able to provide you with the requested service, for the protection of your training safety, since the medical certificate is an essential requirement to train in our Clubs and attend Academy courses.

Soft Opt-in: this processing (Sec. 2.b) is lawful pursuant to Art. 130, paragraph 4, of the Privacy Code, and does not require your consent, provided that the communications concern products or services similar to those you purchased and that you, having been adequately informed, do not refuse such use of your e-mail address, initially or upon receiving subsequent communications. This means that you may object to the processing of your personal data for this purpose both when requesting the available products and services (by expressly refusing consent to processing for Marketing purposes) and upon receiving subsequent commercial communications related to your purchase from the Controller, by writing to the contact details indicated in Section 7 of this notice.

Marketing: processing for this purpose (Sec. 2.c.) is instead based on your consent, in accordance with Art. 6.1.a of the Regulation([…] the data subject has given consent to the processing of his or her personal data for one or more specific purposes). Consent to processing for this purpose is optional and does not prejudice your use of the service and does not affect the lawfulness of processing carried out before your objection; without your consent VAI will not be able to send you generic promotional material about its services and products. You may withdraw the consent you previously gave by writing to the following e-mail address: academy@virginactive.it or by writing to the Controller's physical address as indicated in Section 7 of this notice.

Compliance: processing for this purpose (Sec. 2.d.) has its legal basis in Art. 6.1.c of the Regulation ([…] processing is necessary for compliance with a legal obligation to which the controller is subject). When you provide your personal data to the Controller, they must be processed in accordance with applicable law, which may involve their retention and communication to the Authorities for accounting, tax or other obligations.

   4. RECIPIENTS OF THE DATA

Your personal data may be shared, for the purposes referred to in Section 2 of this notice, with the subjects indicated below (the “Recipients”):

a) persons authorized by VAI to process personal data necessary to carry out activities strictly related to the provision of the services, who have undertaken confidentiality obligations or have an appropriate legal confidentiality obligation;

b) subjects who typically act as data processors, namely: i) persons, companies or professional firms that provide assistance and consultancy to VAI in accounting, administrative, legal, tax and financial matters; ii) subjects delegated to carry out technical maintenance activities; iii) credit institutions, insurance companies and brokers; iv) data processors such as Credly Inc., Virgin Active's supplier for the creation of the Open Badges certifying your participation in the Academy course;

c) parent, subsidiary and associated companies of VAI, limited to the pursuit of administrative-accounting purposes connected with the performance of organizational, administrative, financial and accounting activities;

d) subjects, bodies or authorities to whom it is mandatory to communicate your personal data by virtue of legal provisions or orders from the authorities;

e) medical practices affiliated with Virgin Active, in the event of a request to book medical visits at them for the purpose of issuing the medical certificate of fitness to engage in recreational-motor activities.

   5. TRANSFERS OF PERSONAL DATA

Some of your personal data are shared with Recipients that may be located outside the European Economic Area, e.g. Google, Inc., which provides the registration forms and has been deemed adequate by virtue of an adequacy decision of the European Commission. VAI ensures that the processing of your personal data by these Recipients takes place in compliance with the Regulation. Indeed, transfers may be based on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission. Further information is available by sending a written request to the Controller addressed to: Virgin Active Italia S.p.A., via Archimede no. 2, Corsico (MI), or to the following e-mail address: dpo@virginactive.it.

   6. RETENTION OF PERSONAL DATA

Personal data processed for the purpose of Provision of the Service will be retained by the Controller for the time strictly necessary for the above purpose. In any case, since such personal data are processed to provide you with services and satisfy your requests within the VAI Academy, the Controller may retain them for a longer period, in particular for as long as may be necessary to protect the Controller's interests against possible claims relating to the services. In particular, we will retain medical certificates for a period of 5 years from their expiry date. Once this period has been reached, we will delete them.

Personal data processed for the purposes of “Soft Spam” will be retained until you object to the processing by requesting that you no longer receive commercial communications.

Personal data processed for the purposes of Marketing will be retained by the controller until the moment you withdraw your consent. Once consent has been withdrawn, the Controller will no longer use your personal data for this purpose, but may nevertheless retain those strictly necessary to protect its interests against possible claims based on such processing.

Personal data processed for the purpose of Compliance will be retained by the Controller for the period required by specific legal obligations or applicable legislation.

Further information regarding the data retention period may be requested by writing to VAI at the following address: Virgin Active Italia S.p.A., via Archimede no. 2, Corsico (MI), or to the following e-mail address: dpo@virginactive.it.

   7. RIGHTS OF THE DATA SUBJECT

Pursuant to Articles 15 et seq. of the Regulation, you have the right to ask VAI, at any time, for access to your personal data, rectification or erasure of the same, or to object to their processing pursuant to Art. 21 of the Regulation. You also have the right to request restriction of processing in the cases provided for by Art. 18 of the Regulation, as well as to obtain the data concerning you in a structured, commonly used and machine-readable format, in the cases provided for by Art. 20 of the Regulation.

In any case, you always have the right to lodge a complaint with the competent supervisory authority (Garante per la Protezione dei Dati Personali), pursuant to Art. 77 of the Regulation, if you believe that the processing of your data is contrary to the legislation in force.           

Requests must be made in writing to the Controller's contact details, by writing via email to the following address:academy@virginactive.it or by writing to the Controller's physical address: Virgin Active Italia S.p.A., via Archimede no. 2, Corsico (MI).