Privacy Policy
Version valid as of 1 June 2022
General information
We treat personal data protection at Benefit Systems S.A. ("Benefit Systems", "we") very seriously.
We exercise due diligence to ensure that your personal data are processed in accordance with the applicable provisions of both
Polish and European Union law, including the Regulation (EU) of the European Parliament and of the Council of 27 April 2016 on the
protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (“GDPR”).
Below you will find information on how we process your data, in particular the legal basis for processing, methods of collecting and
using your personal data and your rights in connection with the processing of your personal data.
Who is the Controller of your personal data and what does it mean?
The Controller of your personal data is Benefit Systems (Benefit Systems S.A. with its registered office in Warsaw, at
Plac Europejski 2, 00-844 Warszawa).
This means that Benefit Systems makes decisions about the purposes and methods of processing your personal data, i.e. the manner in
which they will be used.
How to contact us?
You can contact us in any of the following ways:
We have designated a personal data officer, who can be contacted in any matters concerning the processing of your personal data. You can do this by e-mail to: iod@benefitsystems.pl Benefit Systems S.A. Pl. Europejski 2, 00-844 Warszawa, in an envelope marked “IOD”.
- Using the contact form
- Via e-mail to: daneosobowe@benefitsystems.pl
- Via the e-mail address dedicated to customers of our fitness clubs: daneosobowe@fitness.benefitsystems.pl
- By post to: Benefit Systems S.A. Pl. Europejski 2, 00-844 Warszawa, in an envelope marked “Personal data”.
We have designated a personal data officer, who can be contacted in any matters concerning the processing of your personal data. You can do this by e-mail to: iod@benefitsystems.pl Benefit Systems S.A. Pl. Europejski 2, 00-844 Warszawa, in an envelope marked “IOD”.
What personal data do we process? How do we collect personal data?
To be able to do our business, we need to process personal data. Personal data are any information relating to an identified
or identifiable natural person (e.g. first name and surname, e-mail address, MultiSport card number, IP address).
As a rule, you provide us with your data on your own, e.g. when contacting us or using our services.The types of personal data we process depend on your relationship with us (whether you are a customer, website user, MultiSport card user, or partner).
When you use our websites or applications, we process the data that you have provided in the registration form and in the account, data about your activity on the website or application (e.g. interaction with content, etc.) and data about your device (i.e. IP address, data collected by means of cookies or other similar technologies, browser data, IDs). To find out more about cookies, go to our “Cookies Policy”.
When you join the MultiSport Programme or the MultiLife Programme, use our Cafeteria, sign a Fitness Club subscription or use our other services (such as BenefitLunch, MultiBilet, or MultiTeatr), we process your data, such as identification data, contact details and data relating to your use of our services (including the services of our affiliated entities and providers of additional services offered in connection with the MultiSport Programme, MultiLife, our Cafeteria, a membership card of our Fitness Club or our other services). We receive the data directly from you, e.g. through the registration form or when signing the contract at the Fitness Club of your choice or on the Club's website. We may also receive your data from the entity that has enabled you to use the MultiSport Programme, MultiLife Programme, Cafeteria or our other services, and from providers of additional services and benefits.
When we have a business relationship with you, we process your data, such as your identification data, contact data, data relating to your function, data on the cooperation, orders and settlements. If you are a party to a contract with us, we have received the data directly from you. If you are a representative or a contact person of an entity that is a party to a contract signed with Benefit Systems, we have received the data from the entity that is a party to the contract. We could also receive data from an intermediary that helped us establish the cooperation with you or an entity for which you are a representative or contact person.
As a rule, you provide us with your data on your own, e.g. when contacting us or using our services.The types of personal data we process depend on your relationship with us (whether you are a customer, website user, MultiSport card user, or partner).
When you use our websites or applications, we process the data that you have provided in the registration form and in the account, data about your activity on the website or application (e.g. interaction with content, etc.) and data about your device (i.e. IP address, data collected by means of cookies or other similar technologies, browser data, IDs). To find out more about cookies, go to our “Cookies Policy”.
When you join the MultiSport Programme or the MultiLife Programme, use our Cafeteria, sign a Fitness Club subscription or use our other services (such as BenefitLunch, MultiBilet, or MultiTeatr), we process your data, such as identification data, contact details and data relating to your use of our services (including the services of our affiliated entities and providers of additional services offered in connection with the MultiSport Programme, MultiLife, our Cafeteria, a membership card of our Fitness Club or our other services). We receive the data directly from you, e.g. through the registration form or when signing the contract at the Fitness Club of your choice or on the Club's website. We may also receive your data from the entity that has enabled you to use the MultiSport Programme, MultiLife Programme, Cafeteria or our other services, and from providers of additional services and benefits.
When we have a business relationship with you, we process your data, such as your identification data, contact data, data relating to your function, data on the cooperation, orders and settlements. If you are a party to a contract with us, we have received the data directly from you. If you are a representative or a contact person of an entity that is a party to a contract signed with Benefit Systems, we have received the data from the entity that is a party to the contract. We could also receive data from an intermediary that helped us establish the cooperation with you or an entity for which you are a representative or contact person.
How do we process your personal data?
The manner in which your personal data are processed depends on the relationship you have with Benefit Systems.
Below you will find information on the purposes for which we usually process personal data.
If you cannot find below any description that would fit our relationship, and you would like to get additional information about how we process your data, please contact us. You can find contact details above in section How to contact us? powyżej.
It may happen that due to the specific nature of your use of our services, we might process your personal data in a manner other than that indicated below. In that case, we will inform you of such processing before it starts.
If you cannot find below any description that would fit our relationship, and you would like to get additional information about how we process your data, please contact us. You can find contact details above in section How to contact us? powyżej.
It may happen that due to the specific nature of your use of our services, we might process your personal data in a manner other than that indicated below. In that case, we will inform you of such processing before it starts.
| Purposes of the processing: | Legal basis: |
|---|---|
| Provision of services as part of our websites or mobile applications | Performance of a contract for provision of services by electronic means in accordance with a terms of service (Article 6(1)(b) of the GDPR); |
| Administering the infrastructure and ensuring security of the infrastructure and the services provided | Our legitimate interest connected with administering and ensuring security of infrastructure and services (Article 6(1)(f) of the GDPR); |
| Facilitating the use, keeping statistics, as well as improving and developing our services, including websites and applications | Our legitimate interest connected with adaptation, improvement and development of our services (Article 6(1)(f) of the GDPR); |
| Providing services or tailored marketing content that uses special categories of data (e.g. health data) | Your explicit consent (Article 9(2)(a) of the GDPR); |
| Showing you, in the search engine or in the application, facilities that are closest to your location | Our legitimate interest connected with helping you find a facility, subject to your consent for our access to location data (Article 6(1)(f) of the GDPR); |
| Conducting a competition or lottery, including selecting a winner, handing over prizes, publishing the winner's personal data | Our legitimate interest connected with organisation of the competition or lottery (Article 6(1)(f) of the GDPR); |
| Running our websites in social media | Our legitimate interest connected with promoting our products and services (including those prepared together with counterparties), as well as products and services of third parties, including companies from the Benefit Systems Group, and keeping statistics on the use of our websites (Article 6(1)(f) of the GDPR); |
| Provision of services related to the participation in the MultiSport or MultiLife Programme | Your consent (Article 6(1)(a) of the GDPR); |
| Provision of services related to the use of the Cafeteria and other services (such as BenefitLunch, MultiBilet, MultiTeatr) | Performance of the contract between you and Benefit Systems (Article 6(1)(b) of the GDPR); Our legitimate interest connected with the provision and settlement of services (Article 6(1)(f) of the GDPR); |
| Provision of services related to your use of our Fitness Club or other services when you enter into a contract with us | Performing the contract between you and Benefit Systems, e.g. the contract for the provision of services by our Club (Article 6(1)(b) of the GDPR); Your consent relating to the processing of your image or fingerprint to identify you when entering our Club (Article 6(1)(a), Article 9(2)(a) of the GDPR); |
| Marketing | Our legitimate interest (Article 6(1)(f) of the GDPR) connected with promoting our products and services, as well as products and services of third parties, including companies from the Benefit Systems Group |
| Displaying advertisements or offers to you that may be tailored to your interests, activity on websites and applications, or your location | Our legitimate interest (Article 6(1)(f) of the GDPR) consisting in presenting you with advertisements and offers (tailored or not) in relation to the contract between us and our cooperation and with your consent for the use of cookies and similar technologies or information about your location for marketing purposes |
| Providing you with marketing content (tailored or not), using the communication channel of your choice (e.g. e-mail, SMS/MMS, telephone) concerning our own products and services, as well as products and services prepared together with counterparties of Benefit Systems, which are offered to our users and customers as additional benefits (e.g. dietary, coaching, educational and development services) or products and services of third parties, including companies from the Benefit Systems Group. You can find a list of third parties here. . | Our legitimate interest (Article 6(1)(f) of the GDPR) connected with presenting you with marketing content, including content tailored to you on the basis of profiling, in connection with your consent to the use for this purpose of the communication channel of your choice. |
| Providing you with marketing content as part of a business relationship concerning our own products and services, as well as products and services prepared together with counterparties of Benefit Systems, which are offered to you as additional benefits (e.g. dietary, coaching, educational and development services) or products and services of third parties, including companies from the Benefit Systems Group. You can find a list of third parties here. . | Your consent (Article 6(1)(a) of the GDPR) our legitimate interest (Article 6(1)(f) of the GDPR) connected with presenting you with marketing content, including content tailored to you on the basis of profiling, in connection with your consent to the use for this purpose of the communication channel of your choice (depending on the information provided at the consent gathering stage) |
| Conducting analytics, marketing statistics and surveys of service satisfaction and profiling, i.e. using data about your interests in order to provide you with tailored offers and content | Our legitimate interest (Article 6(1)(f) of the GDPR) connected with evaluating the efficiency of marketing activities, improving the quality of our user service, and improving our products and services. Your explicit consent relating to special categories of personal data (Article 9(2)(a) of the GDPR); |
| Performing a contract and conducting cooperation with counterparties, customers and partners |
When you are a party to a contract with Benefit Systems, we process your data as this is necessary for the performance of the
contract (Article 6(1)(b) of GDPR);
When you are a representative or a contact person of our counterparty, we act on the basis of our legitimate interest consisting in the ability to correctly enter into and perform the contract and cooperate with our counterparty (Article 6(1)(f) of the GDPR); |
| Handling a matter you have raised, including answering a question you have asked or examining a complaint you have submitted. |
Our legitimate interest (Article 6(1)(f) of the GDPR) connected with handling inquiries or complaints addressed to us and ensuring
the highest quality of service;
Fulfilment of the legal obligation (Article 6(1)(c) of the GDPR) imposed on us by law (e.g. where the matter you have referred to us constitutes a request to exercise your rights under the GDPR); |
| Implementation of legal obligations, particularly those arising from tax and accounting laws | Applicable law (Article 6(1)(c) of the GDPR); |
| Exercising, establishing or defending legal claims | Our legitimate interest consisting in the ability to establish or defend a legal claim (Article 6(1)(f) GDPR); |
How long will your personal data be stored?
We store your data for a period necessary to achieve the processing purposes outlined above in the section
How do we process your personal data?. We will delete the data when they are no longer needed for the
above purposes. We store your data in particular:
- To perform the contract and provide services until the contract has been performed or the service provision has ended, and subsequently for a period necessary for effective investigation or defence against claims, which is usually 3 or 6 years, but may be shorter or longer in certain situations provided for by law;
- When law imposes certain obligations on us, in particular tax and accounting obligations, we will process the data necessary for the performance of those obligations for the period required by law;
- When we process data on the basis of your consent, we will process them no longer than until you withdraw your consent;
- When we process data on the basis of a legitimate interest, we will process them no longer than until the objection is effectively raised, unless the data are no longer necessary for the performance of our legitimate interests.
Recruitment
Information on our processing of personal data of job applicants is available at:
https://corp.benefitsystems.pl/o-nas/kariera/obowiazek-informacyjny-dla-kandydata
https://corp.benefitsystems.pl/o-nas/kariera/obowiazek-informacyjny-dla-kandydata
Marketing
General information
The way in which we process personal data for marketing purposes depends on the type of relationship between us (e.g. whether you have signed up on our website or mobile application, whether you are our customer or counterparty) and the consents you have given us.
Our marketing activities may include displaying advertisements to you on websites or applications, presenting offers or advertisements via a communication channel such as e-mail or telephone (if you have authorised us to deliver marketing content to you via the communication channel of your choice, e.g. e-mail, SMS/MMS, telephone, push notifications), traditional marketing mailings, conducting analyses and statistics for marketing purposes and conducting service satisfaction surveys, including by contacting you by means of the communication channel of your choice. We can also perform profiling for marketing purposes.
Tailored marketing
We may process your personal data for marketing purposes, including for profiling, in the following cases:
We can also present you with unprofiled advertisements and offers.
What is profiling for marketing purposes?
Our processing of your personal data for direct marketing purposes involves profiling.
Profiling is the use of automatic processing of your data to draw conclusions about your potential interests and preferences. By profiling, we can match products, offers and advertisements to you in the best way possible. As part of profiling, we can also combine information that you leave us when using our different products and services, such as information that you leave when visiting our website or application, using the MultiSport or MultiLife Programme, the Cafeteria, or the services of our Fitness Club.
For profiling, we use tools provided by specialised third parties. See our “Cookies Policy” for more information about our partners and the possibility of adjusting your advertising preferences. We seek to ensure that profiling brings you clear benefits: offers, promotions and advertisements that you may find interesting. In this way, we want to ensure we do not present you with content that might be inappropriate or unattractive for you. Example: if we determine that you are a woman and as part of the MultiSport Programme you regularly attend dance classes in a particular location, this will give us a signal that you may be interested in new dance classes in your favourite location, but you are probably not interested in martial art classes in another, distant city.
Our legitimate interest and your interests, rights and freedoms
We process your personal data for marketing purposes, including profiling, based on our legitimate interest. For this reason, we have assessed whether your interests, rights and freedoms (e.g. the right to privacy) outweigh our interests. This assessment has shown that we can process your personal data in the indicated manner, because:
The way in which we process personal data for marketing purposes depends on the type of relationship between us (e.g. whether you have signed up on our website or mobile application, whether you are our customer or counterparty) and the consents you have given us.
Our marketing activities may include displaying advertisements to you on websites or applications, presenting offers or advertisements via a communication channel such as e-mail or telephone (if you have authorised us to deliver marketing content to you via the communication channel of your choice, e.g. e-mail, SMS/MMS, telephone, push notifications), traditional marketing mailings, conducting analyses and statistics for marketing purposes and conducting service satisfaction surveys, including by contacting you by means of the communication channel of your choice. We can also perform profiling for marketing purposes.
Tailored marketing
We may process your personal data for marketing purposes, including for profiling, in the following cases:
- If you consent to the storage of cookies or similar technologies on your device, we may use the information collected by means of those technologies to provide you with advertisements or offers tailored to your potential interests identified on the basis of the content you view and your activity. For example, if you browse pages related to MultiSport packages, we will be able to display you an advertisement for MultiSport or our other services on other websites and in applications;
- If you are a registered user of our website or application and you log in to your account, we will be able to associate information on the content you viewed with you, and use it for profiling purposes to better adjust our marketing communication and offer for you;
- If you have authorised us to deliver marketing content to you via the communication channel of your choice
- If we concluded a contract or cooperate
- if you agree to our use of information about the location of your device (e.g. smartphone), we will be able to display to you advertisements or offers relevant to your location. For example, we will be able to show you an invitation to an event held to celebrate the opening of our new fitness club nearby;
- To conduct analyses and statistics for our marketing needs and to test your satisfaction with the services we offer by contacting you via the communication channel of your choice.
We can also present you with unprofiled advertisements and offers.
What is profiling for marketing purposes?
Our processing of your personal data for direct marketing purposes involves profiling.
Profiling is the use of automatic processing of your data to draw conclusions about your potential interests and preferences. By profiling, we can match products, offers and advertisements to you in the best way possible. As part of profiling, we can also combine information that you leave us when using our different products and services, such as information that you leave when visiting our website or application, using the MultiSport or MultiLife Programme, the Cafeteria, or the services of our Fitness Club.
For profiling, we use tools provided by specialised third parties. See our “Cookies Policy” for more information about our partners and the possibility of adjusting your advertising preferences. We seek to ensure that profiling brings you clear benefits: offers, promotions and advertisements that you may find interesting. In this way, we want to ensure we do not present you with content that might be inappropriate or unattractive for you. Example: if we determine that you are a woman and as part of the MultiSport Programme you regularly attend dance classes in a particular location, this will give us a signal that you may be interested in new dance classes in your favourite location, but you are probably not interested in martial art classes in another, distant city.
Our legitimate interest and your interests, rights and freedoms
We process your personal data for marketing purposes, including profiling, based on our legitimate interest. For this reason, we have assessed whether your interests, rights and freedoms (e.g. the right to privacy) outweigh our interests. This assessment has shown that we can process your personal data in the indicated manner, because:
- We process your personal data for marketing purposes only when we find that you can reasonably expect that processing (e.g. you are a user of the MultiSport card or Fitness Club subscription, you sign up on our website or in our application, and consent to receiving marketing e-mails from us);
- We will send you marketing communications via e-mail, SMS/MMS or phone calls only with your consent;
- We will send you marketing communications about products or services of third parties not affiliated with Benefit Systems via e-mail, SMS/MMS or phone calls only if you separately consent to those communications;
- We enable you to easily object to the processing of your personal data for direct marketing purposes, and we inform you about this right;
- Our profiling for marketing purposes does not excessively interfere with your privacy. We focus on what products or services available on our offer you may find interesting. We do not want to provide you with content that you might find unattractive. Based on our profiling, we do not take any decisions against you with adverse legal effects (e.g. refusal to conclude a contract) or that might significantly affect you in a similar way.
- We use technical and organisational measures that adequately protect your personal data.
Is providing data compulsory?
As a rule, providing personal data is not compulsory, but may be necessary for you to use the services provided by Benefit
Systems, e.g. to enter into an agreement with us, to participate in our competitions or to have a matter your raise examined.
Therefore, your failure to provide your data may in some instances make it impossible for us to provide services or undertake other
actions. Our forms used to collect data clearly indicate the data the provision of which is necessary.
Who do we disclose your data to?
Your personal data may be disclosed to the following entities: entities from
Benefit Systems Group companies hosting and maintenance service providers for our websites and applications, ICT and IT support and
security service providers, data storage and destruction service providers, providers of services that are in addition to the services
we provide you with, our Partners (sports and recreation, entertainment, and cultural facilities, hotels, offices and tourist
intermediaries), entities that have enabled you to use the MultiSport Programme, MultiLife, Cafeteria or other services (usually your
employer or the employer of the person who reported you to the MultiSport or MultiLife Programme), card printers, social network
operators, payment operators, firms supporting us in debt collection, entities providing services related to serving our clients,
and to other stakeholders (e.g. couriers) and to those entities which support our marketing activities, as well as to legal advisors
and auditors.
Your data may also be disclosed to public authorities in cases provided for by law.
Your data may also be disclosed to public authorities in cases provided for by law.
Are your data transferred outside the European Economic Area?
As a rule, your personal data are not transferred outside the European Economic Area (EEA). Some of the parties to whom we may
provide data are established outside the EEA. We make every effort for the provision of data to be lawful and that all relevant safeguards
are in place. Such efforts include in particular application of standard contractual clauses approved by the European Commission.
You can contact us to obtain copies of the implemented safeguards. You can find contact details above in section
Jak się z nami skontaktować?
Rights of the data subject
You have the right to:
To exercise the above rights, please contact us or our data protection officer. You can find contact details above in section How to contact us?
Your request will be handled within one month of its receipt. When we need more time, we will inform you about the prolonged time for considering your request and about the reasons for the prolongation. If your request is manifestly unjustified or excessive, we may refuse to take the requested actions.
You also have the right lodge a complaint with a supervisory authority competent for data protection in the EU Member State of your habitual residence, place of work or place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office. To learn more about lodging complaints with the President of the Personal Data Protection Office, please visit the following page: https://uodo.gov.pl/pl/83/155
- Access to your personal data, obtain information from us about their processing, as well as receive a copy of your data from us;
- Update your personal data or request their rectification if they are incorrect;
- Withdraw your consent to personal data processing at any time. This will not affect the lawfulness of our processing on the basis of the consent prior to its withdrawal;
- Object to the processing of your data when the processing is based on a legitimate interest, and the objection is justified by your particular situation;
- Object to the processing of your personal data for direct marketing purposes, including profiling;
-
Request restriction of processing of your personal data if
(1) you question the accuracy of your data (for a period enabling us to verify the accuracy of the data);
(2) the processing is unlawful and you oppose the erasure of your personal data and request restriction of their use instead;
(3) we no longer need your personal data for our purposes, but these data are needed by you for the establishment, exercise or defence of legal claims, or
(4) you have objected to the processing of your data – until the objection is found effective; - Personal data portability – with respect to the processing of your data based on your consent or an agreement, you have the right to receive your personal data from us in a commonly used and machine-readable computer format. You can also request that we transfer your data to another data controller, but we will only do so if this transfer is technically feasible;
-
Request erasure of your personal data – you may request us to erase your data in the following cases:
(1) if your data are no longer necessary for the purposes for which they are processed;
(2) you have withdrawn the consent on which the processing is based, and there is no other basis for processing;
(3) you have effectively objected to the processing;
(4) your personal data have been unlawfully processed;
(5) your data must be erased because we are required to do so by law.
To exercise the above rights, please contact us or our data protection officer. You can find contact details above in section How to contact us?
Your request will be handled within one month of its receipt. When we need more time, we will inform you about the prolonged time for considering your request and about the reasons for the prolongation. If your request is manifestly unjustified or excessive, we may refuse to take the requested actions.
You also have the right lodge a complaint with a supervisory authority competent for data protection in the EU Member State of your habitual residence, place of work or place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office. To learn more about lodging complaints with the President of the Personal Data Protection Office, please visit the following page: https://uodo.gov.pl/pl/83/155
Amendments to the Privacy Policy
We will regularly review and update this Policy in connection with amendments to applicable laws and any new measures we may
take to improve the security of your personal data.
Social media
With regard to data processing for statistics purposes as part of our Facebook pages, we and Facebook Ireland act as joint controllers of your data. The joint controller arrangements can be found at facebook.com/legal/controller_addendum.
When we use Facebook products, we do so in accordance with Facebook's rules. To find out more about page statistics, go to: facebook.com/legal/terms/information_about_page_insights_data.
For more information on how Facebook Ireland processes personal data, the legal basis for processing and how to enforce the rights of data subjects against Facebook Ireland, see the "Data Policy" of Facebook Ireland at facebook.com/privacy/policy.
Social media plugins and codes
In addition, we place social media buttons and codes on our websites and in our applications. When you are redirected to a given social media portal by clicking one of those buttons, you can, for example, like or start following our website. Your activity and personal data are then also processed by the entity operating the portal and are used by that entity for its own purposes, e.g. for marketing. Your activity on pages containing codes and your personal data are collected by entities running social media portals, in particular for statistical purposes and to check whether you are a logged user of this portal, and to enable the provision of services (e.g. logging in by means of your social media account). The data are also further processed for other purposes specified by those entities. This applies to all users of our websites, regardless of whether they are registered users of those social media portals.
We process and enable social media portals to access specified data based on our legitimate interest (Article 6(1)(f) of the GDPR). This consists in enabling you to share your content of interest on social media, facilitating your logging in, and promoting our business, services and products. Detailed information on the processing of your personal data and the method of exercising your rights related to data processing by social medial portals are described in the privacy policies of respective portals. Please read them.