Privacy Policy
This personal data protection policy establishes the basis on which METROPOLITAN processes your personal data. The protection of personal data is of vital importance to us, which is why we believe that proper processing of such data, based on transparency with our clients and members, builds trust and peace of mind.
Remember that every time you browse, purchase our services or products, or use the services and functionalities of the website and are asked for personal data or it is necessary for us to access it, this Privacy Policy will apply. Therefore, you should read it and ensure you agree with it. Please review it periodically to confirm if any changes have been made, as the date of the latest version will always be displayed.
Among the values we identify with is transparency, which is why we want you to know from the start that the privacy of your data is very important to us. This privacy statement explains what personal data we collect from our users and how we use it. We invite you to read these terms carefully before providing your personal data on this website.
We have strived to create a safe and trustworthy space, and for that reason, we want to share our principles regarding your privacy:

• We never request personal information unless it is strictly necessary to provide you with the services you require.
• We never share our users’ personal information with anyone, except to comply with the law or if we have your express authorization.
• We will never use your personal data for a purpose other than those expressed in this privacy policy.

This will be applicable if users decide to fill out any of the contact forms where personal data is collected.
These rules have been drafted in accordance with the application of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, GDPR), Organic Law 3/2018, of December 5, on Data Protection and Guarantee of Digital Rights, as well as Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSICE or LSSI).

Data Controller:
METROPOLITAN SPAIN, SL, hereinafter METROPOLITAN, with CIF B-62936737 and registered office at Av. Mare de Déu de Bellvitge, 3, 3-B, 08907 L’Hospitalet de Llobregat (Barcelona).
If you have any questions, requests, or concerns about our processing of your personal data, please contact our Data Protection Officer at [email protected].

Principles
In the processing of your personal data, we will apply the following principles which comply with the requirements of the new GDPR:

• Principle of lawfulness, fairness, and transparency: We will always require your consent for the processing of your personal data for one or more specific purposes, which we will inform you about in advance with absolute transparency.
• Principle of data minimization: We will only request data that is strictly necessary for the purposes for which we require it. The minimum possible.
• Principle of storage limitation: Data will be kept only for the time necessary for the purposes of the processing. Depending on the purpose, we will inform you of the corresponding retention period. In the case of subscriptions, we will periodically review our lists and delete those records that have been inactive for a considerable time.
• Principle of integrity and confidentiality: Your data will be processed in such a way as to ensure adequate security of personal data and guarantee confidentiality. You should know that we take all necessary precautions to prevent unauthorized access or misuse of our users’ data by third parties.

Types of personal data obtained
When we state that we will process your personal data, we refer to any information or data that can identify you, either directly (e.g., your name and surname) or indirectly (e.g., your phone number).
The personal data we collect through the Website may be obtained directly through forms, applications, devices, or social media pages, and includes data such as: name and surname, email, phone number, address, ID number, date of birth, gender, banking details (for online sign-ups), whether you are a member or not, the goal sought when contracting certain services (maintenance, recovery, cardio, muscle building…), time availability, or username; and also data that we collect indirectly such as: personal preferences and shopping habits, information on how you use the Website obtained through cookies, unique numerical identifiers like your computer’s IP address, or user-generated content.

Purposes of processing
The data collected or received may be processed for the following purposes:

• User support: to respond to inquiries, information requests, complaints, and suggestions you may make through the Website, which may be related to any of our services, products, prices, promotions, new openings, among others.
• Execution and management of the contractual relationship: this includes managing online client registration, online booking of a spot, downloading an invitation, or signing up for activities, courses, or events; contacting you to finalize the online registration when you have started the process in order to assist you with any information you may need; sending the corresponding documentation; processing and following up on the registration until you visit the center to complete the procedures (e.g., to receive the access wristband); attending to your inquiries and managing any operations related to payments or transactions; administering the payment for online registration; managing the member-client loyalty program; allowing your participation in contests, publishing comments and content on our blog and social media, as well as showing you the schedules of group activities of the selected club or the club you are a member of. It also includes allowing your registration on the website, whether you are a client of any METROPOLITAN Club or not, and enabling the actions provided in the private area of the Website (https://clubmetropolitan.com/socios/login?referer=%2Fsocios%2Fperfil%2F) such as signing up for activities, events, and courses; booking times or spots in our sessions, buying tickets, or purchasing gift packs, among others.
• Access control: your personal data may be processed to allow you access to the facilities, as well as, where applicable, to keep a record of the sessions provided and of reservations and/or access to group activities.
• Restaurant reservations: your personal data may be processed to manage your reservation at the requested Club’s restaurant through The Fork platform, for which you will have to provide your contact details (name, surname, email, and phone) to the said platform to manage the table reservation. METROPOLITAN will have access to this information.
• Commercial, promotional, and marketing activities: we may contact you for commercial follow-up and to promote our services and products, as well as our clubs. Contact for these purposes may be made through any existing communication channel, although it will mainly be via email, phone calls, messaging services (including SMS and push notifications in apps), social media, and postal mail. These commercial actions include being able to contact you by phone during the online registration process as well as showing you ads and content online and on social media.

The sending of commercial communications regarding products and services already purchased, use of the facilities as a guest on some occasion, pre-registered in one of the Clubs, or as a former member, in which case the processing is based on our legitimate interest based on Article 21.2 of the LSSI.
You can unsubscribe at any time from receiving this type of communication by clicking on the “unsubscribe” link that you can find in the promotional emails.

• Creation of a commercial profile: we may collect and analyze your personal data to evaluate certain personal aspects, in particular to analyze or predict aspects related to your personal preferences, interests, behavior, location, or relationships with other users, and based on this analysis, we will send or show you adapted advertising communications or content. This processing is also known as profiling, and ultimately consists of categorizing a person based on their own characteristics through the automated processing of your personal data. It is commonly used in marketing actions and is practical for identifying the consumer profile or defining the target (target customer) of an advertising campaign.

However, we remind you that you have the right to object to your data being used for profiling, as informed in the section regarding your rights.
Under no circumstances will we use this profile to make decisions that are based solely on the automated processing of your data and that have legal effects on you or significantly affect you in a similar way (e.g., denying you online contracting).

• Analysis and improvement of services and products: to better understand the needs and expectations of users and in order to improve our customer service, our services, and products, we may send you satisfaction and quality surveys, as well as conduct statistics (these will allow us to know, for example, the reaction of users to our advertising campaigns).

Likewise, in order to allow for the proper functioning of the website/applications and to improve the user experience (e.g., allowing for proper display of its content; remembering your login or language preference), technical and functional cookies are used. These cookies collect data related to the use of the Website/applications, about the web page, registration details, pages, videos or ads you have visited, products viewed, duration of the visit, location, and technical information (IP address, browser information, device identifier with which you are browsing, …).

• Analysis of job candidates: in the event that you send us your CV through the section provided for this purpose (https://clubmetropolitan.com/quieres-trabajar-con-nosotros/), we inform you that the personal data provided will be processed for the purpose of analyzing your application and profile to assess your participation in current or future selection processes for your employment by any of the existing Clubs in the METROPOLITAN Group.
• Compliance with legal obligations: there may be regulations that require the processing and retention of personal data for the fulfillment of certain legal obligations or to address liabilities. For example, the General Data Protection Regulation allows for the blocking of personal data of individuals who have exercised their right to erasure for the period during which liabilities may arise, in order to be able to formulate, exercise, or defend against claims. Your data may also be kept in order to prevent us from sending you commercial communications if you have requested not to receive them.

Similarly, your data may be kept duly blocked to prevent possible fraud in matters of contracting and sign-ups (new member benefits).

Data retention period
The personal data provided will be kept for the time necessary for the purpose for which we process your data, to meet your requests or needs, as well as to comply with our legal and regulatory obligations and the defense of our interests (e.g., for our defense in court) or for statistical or historical purposes.
The criteria for determining the retention period of your personal data are as follows:

• Personal data obtained when contracting our services online: for the duration of our contractual relationship;
• Personal data obtained when contacting us for an inquiry: for the time necessary to address your inquiry;
• Personal data obtained when creating an online account (online management): for the duration of our contractual relationship if you are a client, or in the case of non-subscribers, until you ask us to delete them or after a period of inactivity (with no active interaction with us) we may delete them automatically;
• Personal data obtained by giving your consent for sending commercial communications: until you unsubscribe, demand that we delete them, or after a period of inactivity (with no active interaction with us);
• Personal data of candidates: for the duration of the selection process and for a maximum period of two years. After this period, if you wish to continue participating in selection processes, you must send your updated CV again.
• Cookies that are installed on your computer: we keep them for the time necessary to achieve their purposes (for example, during a session for session identification cookies).
• Personal data obtained through video surveillance systems (images): we keep them for a period of 30 calendar days, provided there is no third-party complaint or inspection for this purpose by state security forces.

Legal basis for processing your data
The legal basis for processing your personal data may be:

• Your consent (e.g., access control, sending commercial communications or quality surveys, profiling).
• Our legitimate interest, which may be:
  Performing statistics: to help us better understand your needs and expectations and, therefore, improve our services, websites/applications/devices, products, and brands.
• Enabling the functioning of our website/applications through technical and functional cookies: keeping our tools (websites/applications/devices) safe and secure and ensuring they function correctly.
• Offering you our user support service.
  In relation to products and services already purchased, based on Article 21.2 of the LSSI.
• The performance of a contract: to provide the services you request;
  Compliance with legal obligations that involve personal data processing (e.g., invoicing, among others).

Recipients of your data
METROPOLITAN does not sell, rent, or transfer personal data that can identify the user, nor will it do so in the future, to third parties without prior consent. However, in some cases, collaborations with other professionals may be carried out, in which case, consent will be previously required from users, informing them of the identity of the collaborator and the purpose of the collaboration. This will always be done with the strictest security and confidentiality standards.
METROPOLITAN may share personal data with the following recipients only under the conditions of this document and/or the applicable contract. METROPOLITAN may share personal data with third parties that provide services:

• On behalf of METROPOLITAN, as part of the performance of the contract with the client/member (data hosting, software provider platforms, subcontracting, etc.) and in accordance with its terms;
• To companies of the METROPOLITAN business group, for administrative, client management, commercial management, and candidate selection purposes, given that there is a global corporate tool for managing the user database, accessible by those companies that manage the Clubs.
• To the competent authorities for compliance with legal obligations (e.g., courts and tribunals, public administrations with competence in the matter).
• To third-party service providers to METROPOLITAN; this communication is necessary only to the extent that it allows METROPOLITAN to fulfill the purposes of the processing, and they cannot use them for any other purpose (e.g., IT systems service providers).
• To help METROPOLITAN comply with the financial and administrative conditions of the contract (debt collection, billing, etc.)
• To send marketing communications on behalf of METROPOLITAN.

Your data will not be communicated to third parties with whom the METROPOLITAN Group has not signed some type of collaboration agreement to send you commercial information; rather, in any case, the third party’s information will be incorporated into the communications that METROPOLITAN already sends you (e.g., by including a banner in the newsletter).
Your personal data may be processed or stored in countries other than those of the European Economic Area (EEA), depending on where our service providers are located. Data is only transferred outside the EEA if comparable guarantees are offered. Service providers located outside the EEA, such as Facebook, Inc. or Google, LLC, may access your personal data. These service providers are part of the “Data Privacy Framework DPF” or the EU-U.S. Data Privacy Framework adequacy decision of July 2023, therefore, they are obliged to protect your personal data in accordance with a series of well-defined protection rules and safeguards by the European Union.

Use of the MyWellness platform
As a result of our services, you may benefit from the use of certain applications, specifically MyWellness.
MyWellness: is an application that allows the user to set training, fitness, and healthy living goals and monitor their physical activity in order to meet the previously set objectives. METROPOLITAN has a contract as a data processor with the owner of this application. However, its use is voluntary, as is how the user interacts with said application and the METROPOLITAN Clubs (since, for example, if they so wish, their results can be displayed on our “routines” screens to verify their achievements and progress).
In relation to MyWellness, the data subject should be aware that TECHNOGYM, S.p.A. is the owner of this application.
The data that these applications know about the user are: name and surname, email and phone, date of birth, age, sex, and physical characteristics, as well as health data and biometric data that the user has entered into the app. All this data is collected by TECHNOGYM, S.p.A. with the user’s consent when they download the application on their smartphone, register, and use it.
As a general rule, METROPOLITAN does not process the data that the user enters into these applications, except when providing services where authorized professionals must access them as authorized by the data subject (for example, physiotherapy or personal training services).
No international data transfers are foreseen.
The data contained in this application will be kept as long as you are registered in them and subsequently, will only be retained if necessary to deal with any potential liabilities arising from the use of these applications by users.
To unsubscribe from this platform if the user has ceased to be a METROPOLITAN client, they must do so directly on that platform and according to its guidelines and Privacy Policy, with METROPOLITAN not being responsible at any time for the actions or commercial activities of TECHNOGYM, S.p.A.

International Data Transfers
METROPOLITAN does not process personal data outside the European Union. For the purposes of the above, METROPOLITAN does not carry out any type of international transfers. Should it carry out international data transfers at any time, it would subscribe to the corresponding standard contractual clauses of the European Commission.
To provide services strictly necessary for the development of the activity, it shares data with the following providers under their corresponding privacy conditions:
Google Analytics: a web analytics service provided by Google, Inc., a Delaware company whose main office is at 1600 Amphitheatre Parkway, Mountain View (California), CA 94043, United States (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help Metropolitan analyze how users use the website. The information generated by the cookie about your use of Metropolitan (including your IP address) will be directly transmitted to and stored by Google on servers in the United States.

Rights regarding the processing of your data
Data protection regulations recognize certain rights so that you have control over your data, which you can exercise at any time by contacting METROPOLITAN by email at [email protected] or in writing to METROPOLITAN SPAIN, SL at Av. Mare de Déu de Bellvitge, 3, 3-B, 08907 L’Hospitalet de Llobregat (Barcelona) to the attention of Data Protection. To process your request, we may ask you to prove your identity.

Right to Information
You have the right to obtain clear, transparent, and easy-to-understand information about how we use your personal data and about your rights. We provide this information in this Policy.
Right of access
You have the right to know whether or not your personal data is being processed and, if so, to know the purposes for which it is processed, the category of data, recipients, retention period, and the rights that concern you, among others.
Right to rectification
You have the right to have your personal data rectified when it is inaccurate or no longer valid, or to have it completed when it is incomplete.
Right to erasure (right to be forgotten)
In certain cases, you have the right to have your personal data erased or deleted. It should be noted that this is not an absolute right, as we may have legal or legitimate reasons to retain it.
Right to restriction of processing
You have the right to request the restriction of the processing of your data (we can store it but cannot continue to use or process it) in certain circumstances provided for in GDPR 2016/679 (EU):

• that the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;
• that the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• that the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims;
• that the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Right to data portability
You have the right to move, copy, or transfer data from our database to a different one. It is only possible to exercise this right with respect to data you have provided, when the processing is based on the performance of a contract or on your consent and the processing is carried out by automated means.
Right to object to processing
You have the right to object to us processing your data when the processing is based on the satisfaction of legitimate interests, including profiling and direct marketing.
Right to withdraw consent
You have the right to withdraw the consent you have previously given for processing. Consent can only be withdrawn for processing based on this consent. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with the Spanish Data Protection Agency if you consider that your rights regarding the protection of personal data have been violated (www.agpd.es).
Social Media
METROPOLITAN has a presence on social media such as Instagram, Youtube, and Facebook and may process personal data of individuals who become followers of METROPOLITAN on social media or perform any connection action through them.
You should be aware that any information you post through the social media profiles managed by METROPOLITAN will become public information and will be available to visitors of the same and the general public. This means that any user located in any country in the world, universally, can access your information. In this regard, you should be particularly careful and diligent when disclosing personal information on these Sites. Also, keep in mind that the privacy policy of the corresponding social network will apply.
Your personal data provided on the social networks managed by METROPOLITAN will be processed by it for the following purposes: (i) to allow access and navigation to the content and services offered through said social networks; (ii) to allow and manage participation in contests, promotions, raffles, or any other initiatives carried out by METROPOLITAN and to manage the promotion of winners, as well as the delivery of possible prizes; (iii) to allow the sending of information or commercial communications related to our services and activities or with the companies of the METROPOLITAN Group; (iv) to contact you regarding any statement, complaint, or claim about our services and to manage complaints received from third parties for abuse; (v) to moderate the uses, if any, you make on METROPOLITAN’s social networks.
Processing of MINORS’ data
The data collection forms contained on this website are not directed at children under 16 years of age.
The holders of parental authority or guardianship of the minor must authorize the processing of the child’s data.
If you are under 16 years of age, you should not provide your personal data on this website. Ask your parents or guardians to help you read this information and to clarify anything you do not understand.
METROPOLITAN will make reasonable efforts to verify that consent has been given by the holder of parental authority or guardianship over the minor, taking into account the available technology. For these purposes, a contact address may be requested to which we can direct ourselves.
METROPOLITAN may contact you at any time to verify that you are indeed the age you have reported in the corresponding registration form.
METROPOLITAN may request a copy of your ID, giving you a period of time to send it to us. Failure to meet the deadline or failure to provide any evidence required by METROPOLITAN will allow us to block your account until you prove you are over 16 years of age.
Updates to this policy
We may change this privacy policy. The “Effective Date” legend at the bottom of this policy indicates when it was last revised. The changes will take effect once the Privacy Policy is published.

Last updated: October 2024