Privacy policy

Who is responsible for your data?

RettGym (WEBB OLSEN COACHING, org. no. 924 419 180) is the data controller for the personal data described here.

Contact us about privacy at kontakt@rettgym.no. For now this is our shared contact point for both general enquiries and privacy questions.

Using RettGym without an account

Purpose

So the service remembers your answers and works the way you ask.

At RettGym

No processing – the data stays on your device.

You can search, compare and save gyms without logging in. To remember what you've done, your browser stores the following locally on your device:

• your answers in the guide (training interests, travel, budget and requirements)
• the place you chose – and, if you choose “use my location”, the coordinates from your device
• gyms you've saved as favourites
• your language choice

The comparison runs in your browser against public information about gyms. As the service works today, your location and answers are not sent to us. You can delete everything at any time by clearing site data in your browser.

Technical data and security logs

Purpose

To deliver, secure and troubleshoot the website.

Basis

Legitimate interest (GDPR Art. 6(1)(f)).

When you visit the site, our providers process technical data needed to deliver and protect the service – for example IP address, time, which page was opened, and browser and device type. This applies to the hosting service (Vercel) and the database service (Supabase).

RettGym has not built its own visitor log, profiling or statistics about individuals. Providers may keep technical logs in line with their own terms.

Maps and address links

Purpose

To show where a gym is located.

Basis

Legitimate interest (Art. 6(1)(f)). OpenStreetMap is responsible for its own processing.

On gym pages we may show a small map from OpenStreetMap. Your browser then contacts OpenStreetMap's servers directly, and they receive, among other things, your IP address and which map area is shown. See OpenStreetMap's own privacy policy for how they handle this.

The address link on a gym page opens Google Maps only when you click it yourself. Google's terms and privacy policy then apply.

Error reports and suggestions for missing gyms

Purpose

To correct errors and add gyms that are missing.

Basis

Legitimate interest in good data quality (Art. 6(1)(f)).

You can report incorrect information (category, message and optionally a link to the source) and suggest gyms that are missing (name, area, and optionally address, website, Instagram, type and note). We don't ask for your name or e-mail address, and the report is not linked to an account.

Please don't write personal data about yourself or others in reports. Reports are stored in the database and can be read by RettGym administrators. A report never changes gym information by itself – an administrator reviews it first.

Claiming a gym

Purpose

To confirm you can represent the gym, to contact you, and to prevent misuse.

Basis

Legitimate interest in preventing misinformation and misuse (Art. 6(1)(f)). For approved owners also performance of the access agreement (point (b)).

If you claim a gym, or submit a gym that isn't listed, we ask for:

• full name, e-mail address and phone number
• your role at the gym (for example owner or general manager)
• a message, and a description of how you can document your connection
• optionally an uploaded file as documentation (PDF, JPG, PNG or WebP, max 5 MB)
• for an unlisted gym: information about the gym

Claims are handled manually by RettGym's superadministrator, and no claim is approved automatically. Uploaded files are stored in a private storage folder and opened by an administrator through short, time-limited links. We may contact you by e-mail or phone to ask for more information.

Don't upload more than necessary. For example, remove national ID numbers and bank account numbers from documents before sending them.

Accounts for gyms and administrators

Purpose

Login and access control, so approved representatives can keep the gym's information up to date.

Basis

Access agreement (Art. 6(1)(b)) and legitimate interest in security and access control (point (f)).

When a claim is approved, we create a login for you using your e-mail address. You receive an e-mail with a link to activate the account and choose a password. Later you log in with e-mail and password, and can request an e-mail to reset your password.

We store, among other things, e-mail address, name (from the claim), account identifier, which gyms you have access to, role, when access was approved and when it expires, and time of last login. Access is time-limited and may require re-verification.

Login and account data are handled through established authentication and security services (Supabase Authentication). RettGym does not intentionally store user passwords in plain text.

Administrator accounts for RettGym's own work are handled in the same way. Regular visitors cannot create an account today.

Change history

Purpose

To document who changed gym information, keep data correct and resolve disagreements.

Basis

Legitimate interest (Art. 6(1)(f)).

When gym information is changed by an owner or administrator, we store what changed (before and after), the time, and the account that made the change. The history is only visible to RettGym administrators, not public.

Contacting us

Purpose

To reply to you.

Basis

Legitimate interest in answering enquiries, or doing what you ask (Art. 6(1)(f) and (b)).

If you write to kontakt@rettgym.no, we use your e-mail address and the content of your message to reply. Please don't send sensitive information by regular e-mail.

Cookies and similar technologies

Today RettGym uses no analytics, tracking or marketing cookies, and we have no third-party tools for statistics or advertising. For that reason we don't show a consent banner.

• In the public service: local storage in your browser (see above) to remember your answers and favourites.
• In logged-in areas (gyms and administrators): necessary login cookies from the authentication service so you stay logged in, and a language setting (rg_owner_lang or rg_admin_lang) stored for up to one year if you switch language.
• On the forgotten-password page: a small local value (a timestamp) that shows how long you must wait before requesting another e-mail.

If we later introduce analytics tools or other non-essential cookies, we will update this policy and ask for consent before they are used.

Who has access, and which providers we use

We don't sell personal data and don't use it for advertising. The following have access today:

• RettGym administrators: can see reports and change history. Only the superadministrator sees claims and documentation.
• Supabase (provider and data processor): database, authentication, file storage and sending e-mail for login and password reset.
• Vercel (provider and data processor): hosting and delivery of the website.
• OpenStreetMap (own responsibility): map view on gym pages, see above.

Gyms don't receive information about visitors today, and RettGym doesn't forward enquiries from users to gyms. Approved owners only see their own gyms. We may disclose information to public authorities if we are legally required to.

Transfers outside the EEA

Our providers are international companies and, depending on how the services are configured, may process data in countries outside the EEA. If personal data is transferred out of the EEA, it must happen on a valid transfer basis, for example the EU Standard Contractual Clauses (SCCs) in the providers' data processing agreements, or an adequacy decision. Ask us if you want to know more.

How long we keep data

We don't keep data longer than we need it for the purpose. We don't have fixed automatic deletion periods for everything today; during the beta we clean up manually. In practice:

• Local storage in your browser: until you delete it yourself.
• Reports and suggestions: until they have been handled, and after that as long as needed to document what we did.
• Claims and documentation: while the claim is being handled and access is active. Uploaded documents are deleted when they are no longer needed to confirm access.
• Owner and administrator accounts: while access is active. Access is time-limited and can be revoked.
• Change history: as long as needed to document changes to gym information. The link to a deleted account is removed or made unidentifiable where possible.
• Technical logs at our providers: according to their own routines.

Privacy and security

We limit what information we collect and who can access it. Access to claims, documents and change history is limited to administrators, and owners can only edit the gyms they are approved for.

Login and account data are handled through established authentication and security services. RettGym does not intentionally store user passwords in plain text. No solution is completely secure, and we can't promise that unauthorised access will never happen. If we discover a personal data breach, we follow the requirements of data protection law, including on notification.

Your rights

You have the right to:

• access the information we hold about you
• have incorrect information corrected
• have information deleted, when the conditions in the law are met
• restrict processing, or object to processing based on legitimate interest
• receive the information you have given us in a common format, where processing is based on an agreement (data portability)

Send your request to kontakt@rettgym.no from the e-mail address you've used with us, so we can check it's you. We normally reply within one month. Accounts for gyms and administrators are not deleted automatically – ask by e-mail. Some information, for example change history, we may have reason to keep; we will then explain why.

Because regular visitors don't have an account with us, we usually hold no information about you to give access to or delete if you have only used the service. What you've saved is in your own browser.

If you disagree with how we process personal data, you can complain to Datatilsynet, the Norwegian data protection authority.

Children

RettGym is not aimed at children, and we don't ask children to provide personal data. Gym accounts are for people who represent a gym. If you believe a child has sent us personal data, contact us and we will delete it.

Changes to this policy

We update the policy when the service or the processing changes – for example if we introduce user accounts, notifications or analytics. The date of the last update is shown at the top. For material changes we notify on the website, and directly if we have your contact details and the change concerns you.

Questions? Write to kontakt@rettgym.no. See also the terms of use.