Terms and privacy

1. Who runs Gymmen

Gymmen is a gym at Øklandsvegen 32, 5580 Ølen, Norway, run by Nils Kvamen, org. no. 984 780 532 (tel. +47 900 39 648, email post@gymmen.net). Nils is responsible for your membership and is the data controller for your personal data.

2. Membership and payment

Membership runs from the day you pay for the period you choose (1, 6 or 12 months). Card payment is handled by Stripe and renews automatically at the end of each period until you cancel. You can also pay with Vipps, either as a recurring payment that renews automatically at the end of each period until you cancel, or for one period at a time without renewal. There is no lock-in period and no notice period. You can cancel at any time from My page ("Change card or cancel" for card, "Stop recurring payment" for Vipps) or in the Vipps app; your membership then runs to the end of the period you already paid for and nothing more is charged. Payments are not refunded except where the error is ours.

3. Access and fob

You get a key fob that opens the door while your membership is valid (plus a few days' grace). The fob is personal. Do not let others in or lend your fob. Misuse may end your membership without refund. Report a lost fob to Nils at once so he can block it.

4. Using the gym

You train at your own risk. Put equipment back, wipe down machines after use, lock the door when you leave and report any damage. Children under 14 must be accompanied by an adult.

5. Personal data

We store your name, email, phone number, language, membership period and which fob is linked to you. The legal basis is the membership contract (GDPR art. 6(1)(b)).

The door: The access system (Ubiquiti UniFi Access) logs every use of your fob with a timestamp. The log is deleted automatically after 90 days. The camera in the reader at the door records short video clips without sound when the door is opened and when someone rings the bell, and only shows the area right in front of the door. The clips are deleted automatically after 7 days. We do not use face recognition. The log and clips are used to check that only members enter and to resolve damage or theft. They are kept longer only for a specific incident that is being investigated or reported. The legal basis is Gymmen's legitimate interest in securing an unstaffed gym (GDPR art. 6(1)(f)). Only Nils Kvamen and the person who runs the access system for Gymmen have access, and recordings are only shared with the police. You may ask to see recordings of yourself.

PIN and «Open the door»: Once you have paid, you get a PIN code for the door. It is stored encrypted and deleted together with your account. If you tap «Open the door» on My page, your phone sends its location once to check that you are at the door. The location is not stored, only that the door was opened.

Payment: Your card number goes directly to Stripe and is never stored by us. Stripe is an independent controller for the payment, see stripe.com/privacy. If you pay with Vipps, Vipps MobilePay is an independent controller for the payment, see vippsmobilepay.com.

Email: Sign-in links and reminders are sent via Resend (EU server in Ireland). We do not send advertising.

Storage: Data is stored with Cloudflare (D1 database in the EU). We share it with no one except the providers above.

Your rights: You can view and edit your details on My page and delete your account yourself ("Delete my account"). Name, email, phone, membership history and fob link are then deleted immediately; the door log is anonymised. Accounting records at Stripe must be kept for 5 years under Norwegian bookkeeping law. You may complain to Datatilsynet (the Norwegian DPA) if you believe we handle your data incorrectly.

6. Changes

We may change prices and terms with one month's notice by email. If you keep your membership after that, you have accepted the changes.