Privacy policy
Review version · 09/10/2026
1. Controller
EFXA TOTAL GYM, S.L. · NIF B26846469. C/ Rocacorba, 34, 1r, local, 17190 Salt (Girona), España. info@xpaifitness.com. Centre: Carrer Quilali, 1, 17190 Salt (Girona).
2. Data and purposes
The enquiry form collects name, email, optional phone, enquiry type and message to answer requests and take requested pre-contractual steps. Technical data is used for operation and security. The membership enquiry collects no identity numbers, banking, card or health data and does not create a contract.
3. Legal bases
Enquiries are handled on consent and, where appropriate, requested pre-contractual measures. Membership management relies on the contract and legal duties. Marketing requires separate voluntary, revocable consent. Image-use authorization is also separate.
4. Retention
Data is kept for as long as needed for the enquiry or relationship and applicable statutory periods. Marketing consent can be withdrawn at any time; marketing retention then ends, subject to records needed to document the withdrawal.
5. Providers and recipients
Brevo (Sendinblue) handles the enquiry form and contacts. Google reCAPTCHA helps prevent fraudulent submissions when you open the form. Google Maps only loads with your authorization. Google Analytics requires analytics consent. Virtuagym manages memberships and the app; when enabled, its checkout will display its data processing and terms. Data may also go to authorities where required and necessary administration and payment providers. We do not sell personal data.
6. International transfers
Some providers may process data outside the European Economic Area. Applicable safeguards such as adequacy decisions or standard contractual clauses are required where appropriate. Further information is available from the controller.
7. Your rights
You may request access, rectification, erasure, restriction, objection or portability where applicable at info@xpaifitness.com. Consent may be withdrawn without affecting prior processing, and you can unsubscribe from marketing. Complaints can be made to Spain’s data protection authority (aepd.es).
8. Minors and security
Legal representative authorization is required where applicable to the age or service. Minor signups are reviewed by the club. Appropriate technical and organizational safeguards apply. Do not send banking information, identity documents or health information through the enquiry form.