Skip to content

Privacy policy

Version of 21 October 2026

This website has no accounts and no login. Bookings and payments happen in the eFitness system. Data reaches us through two forms (the Friends with Benefits guest form and the CrossFit TEENs parental consent) and through the messages you send us. Below we explain what happens with your data in each case. The Polish text is the legal original.

1. Who is responsible for your data

The controller of your personal data is „NO REP” Łukasz Wysocki, who runs CrossFit Wilanów, registered at Aleja Rzeczypospolitej 18/272, 02-972 Warsaw, Poland, tax ID (NIP) 5782927422. The club operates at Aleja Rzeczypospolitej 12 lok. U1, 02-972 Warsaw (the Controller).

Contact on personal data matters:

We have not appointed a Data Protection Officer because we are not required to (Art. 37 GDPR). Write to us directly.

2. What we collect, why and on what basis

GDPR is Regulation (EU) 2016/679. For every situation in which data can reach us, we give the purpose, the legal basis and the recipients.

2.1. Statistics without cookies (Plausible)

We count visits with Plausible Analytics. It is always on, even if you reject cookies, because it stores nothing on your device: no cookies and no data in browser storage.

  • What data: the address of the page you visit, the page you came from, browser and system type, screen size, language, approximate location (country or region), and the names of clicks on key links (for example phone, WhatsApp, email, going to eFitness). Plausible does not store raw IP addresses.
  • Purpose: to know which pages work and where people drop off. The statistics are aggregate; we do not build a profile of a specific person.
  • Basis: the Controller’s legitimate interest (Art. 6(1)(f) GDPR), which is improving the site on the basis of aggregate data.
  • Provider: Plausible Insights OÜ, Estonia (an EU company).
  • Objection: you have the right to object to this processing; write to us (section 8).

The tools below load only after you click “Accept all” or switch on a type of consent in the settings. Before you consent, this site sends no request to Google or Meta.

Consent Tool Purpose
Analytics Google Analytics 4, provider Google Which pages you read, where you come from, which clicks you make. Statistics to improve the site.
Marketing Google Ads, provider Google Measuring whether an ad led to an action on the site, and remarketing.
Marketing Meta Pixel, provider Meta Measuring how well ads on Facebook and Instagram work, and matching ads.
  • What data: identifiers from cookies (section 4), IP address, device and browser data, pages visited, names of clicks. This data can identify your browser, so we treat it as personal data.
  • Basis: your consent (Art. 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law of 12 July 2024 for storing information on your device).
  • Providers: Google Ireland Limited together with Google LLC, and Meta Platforms Ireland Limited together with Meta Platforms, Inc.
  • Withdrawing consent: at any time, without giving a reason (section 3). Withdrawal does not affect the lawfulness of processing before it.

To connect visits to our site with a purchase in the eFitness shop, GA4 uses cross-domain linking (crossfitwilanow.pl and cf12u1-warszawa.cms.efitness.com.pl). This applies only to people who agreed to analytics cookies.

  • When you click “Reject” or do not answer, the Google and Meta scripts do not load at all. Only Plausible from section 2.1 stays on.
  • By default all four Google consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) are set to “denied”. After your decision we pass them the current state: analytics consent switches on analytics_storage, marketing consent switches on the other three.
  • If you agree to only one type, the other stays off.
  • When you withdraw consent, we switch off the matching tags and delete the cookies the site set in your browser for that purpose. A script already loaded on an open page stops working after you refresh it.

2.4. Videos and fonts

We host the videos on the site ourselves and load fonts from our own server. We do not embed YouTube players or Google Fonts, so simply viewing the site does not send your data to YouTube or Google. Links to our profiles (Facebook, Instagram, YouTube) and to the map open as ordinary links: data reaches those services only when you click them, and from then on their own rules apply.

2.5. Google reviews

The site shows Google reviews: the author’s name and the text, as the author published it on Google. We fetch them from the Google Places API when the site is built, not in your browser, so viewing the reviews does not send your data to Google. The reviews are public. If you want your review removed from our site, delete it on Google or write to us.

2.6. Phone, WhatsApp, email

If you call, write on WhatsApp or send an email, we receive what you share yourself: your name, phone number or email address, and the content of your message.

  • Purpose: to answer you and deal with your matter.
  • Basis: steps before entering into a contract, if you ask about classes or a membership (Art. 6(1)(b) GDPR); in other matters our legitimate interest, which is handling correspondence (Art. 6(1)(f) GDPR).
  • Recipients: OVH (email). WhatsApp is a service of Meta Platforms Ireland Limited, under its own privacy policy.
  • Retention: until the matter is closed, and then as long as the law or our legitimate interest requires (for example defence against claims).

2.7. Work at CrossFit Wilanów

You send applications by email from the “Jobs” page. The site itself does not store any form.

  • What data: whatever you put in the message or attachment, usually name, phone, email, a description of your experience, a CV.
  • Purpose: recruitment and contacting you about it.
  • Basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). Data that employment law does not require from a candidate but that you send on your own initiative is processed on the basis of your consent (Art. 6(1)(a) GDPR), given by sending the application. Please do not send sensitive data (for example about health) or document numbers.
  • Future recruitments: if you want us to keep your application for later, add your consent to the email (you will find the sentence on the “Jobs” page). We then process the data on the basis of your consent (Art. 6(1)(a) GDPR).
  • Retention: we keep CVs and other recruitment documents until the recruitment ends, and for 3 months at most after that. If you agree to take part in future recruitments, we keep them for 12 months. You can withdraw your consent at any time by writing to info@crossfitwilanow.pl.
  • Withdrawing consent or deleting your application: write to info@crossfitwilanow.pl and we will delete it sooner.

2.8. Guest registration (Friends with Benefits)

We take guest registrations through our own form on the Friends with Benefits page. Our server on Cloudflare sends it by email, through OVH mail, to info@crossfitwilanow.pl. We do not store the registration in any external spreadsheet or form.

  • What data: name, phone number, email address, the date you chose, the name of the club member who invites you, and a tick showing whether this is your first visit to the club.
  • Purpose: arranging the guest’s FWB Thursday visit and contacting the guest about it.
  • Basis: steps taken at the request of the person the data concerns, before entering into a contract (Art. 6(1)(b) GDPR).
  • Recipients: Cloudflare (hosting) and OVH (email), acting on our behalf.
  • Retention: up to 12 months, then we delete it.

For a person aged 11-12, the contract is concluded by a parent or legal guardian, and a person aged 13-17 concludes it with a parent’s consent (§ 2 of the Terms). Before the first CrossFit TEENs class the parent emails the consent to info@crossfitwilanow.pl (the button on the CrossFit TEENs page opens a ready message).

  • What data: the parent’s name and phone number, the child’s name and date of birth, and, if the parent provides it, health information about the child (for example medication, asthma, injuries).
  • Purpose: arranging the child’s participation in classes, contacting the parent, and safety during training.
  • Basis: Art. 6(1)(b) GDPR (the contract for taking part in classes). Health information is special category data. We process it on the parent’s explicit consent (Art. 9(2)(a) GDPR), given by sending it to us. Providing it is voluntary. You can withdraw consent at any time by writing to us.
  • Who sees it: only the coach leading the class and the front desk see health information.
  • Recipients: OVH (email) and Cloudflare (site hosting), acting on our behalf.
  • Retention: for as long as the child takes part in classes, and we delete it within 30 days after that.

2.10. Bookings and payments in eFitness

The schedule, class bookings, membership purchases, and payments all run in the eFitness system, outside this site. The site only links to eFitness. Once you go there, you give your data in eFitness and the eFitness privacy policy and the club’s terms apply.

Google Tag Manager runs in the eFitness shop. That tool is on the eFitness side, not on this site, and follows the rules set in that system.

2.11. Hosting and security (Cloudflare)

Cloudflare serves the site. On every visit Cloudflare servers process technical connection data (including IP address, time, the address of the requested resource, browser data) to deliver the site, keep it secure and fend off abuse.

  • Basis: the Controller’s legitimate interest, which is running and securing the site (Art. 6(1)(f) GDPR).
  • Provider: Cloudflare, Inc.
  • We do not intend to identify individuals from these logs.

2.12. CCTV in the club

The club has a camera covering the training floor and the reception. It does not cover the changing rooms, toilets or showers. The camera does not record sound. The club entrance carries a notice about the monitoring.

  • What data: images of people on the training floor and at the reception, with the date and time of recording.
  • Purpose: the safety of people and property in the club, and investigating incidents such as accidents or theft.
  • Basis: the Controller’s legitimate interest (Art. 6(1)(f) GDPR), which is keeping the club safe.
  • Who has access: the Controller and persons authorised by the Controller. We do not publish recordings.
  • Recipients: the provider of the camera system, which stores recordings on our behalf, and, where needed, authorised public bodies (e.g. the police) if a recording is evidence in a case.
  • Retention: recordings are deleted automatically after 7 days. If a recording is evidence in proceedings, or we know it may become evidence, we keep it until the proceedings end.
  • Your rights: you can ask whether you appear in a recording and object to the processing (section 8).

On your first visit we show a window with three equal buttons: “Accept all”, “Reject” and “Settings”. In the settings you switch analytics and marketing consent on separately. The only necessary file is the one that remembers your choice.

  • We store your choice in your browser storage (localStorage, key cfw-consent), with the date and two values: analytics consent and marketing consent. It does not leave your browser.
  • Consent is valid for 12 months. Then we ask again. We also ask again if we change the purposes of processing or add a new provider.
  • You can change or withdraw your decision at any time with the “Cookie settings” button in the site footer. Withdrawing consent is as easy as giving it.
  • You can also delete or block cookies in your browser settings. If you delete the stored choice, we ask you again.
  • The consent window needs JavaScript. Without it the Google and Meta scripts do not load.

We give the names in general terms. The exact names and lifetimes are set by the providers and may change.

Name Provider Consent What it is for
_ga, _ga_* Google Analytics analytics tells visitors apart, counts sessions
_gcl_* Google Ads marketing remembers which ad you came from, to measure conversions
_fbp Meta marketing identifies the browser for measurement and ad matching

Google and Meta may also set other cookies and identifiers (for example on their own domains). Their rules are in the Google and Meta privacy policies. We delete the first-party cookies of these tools when you withdraw consent. Plausible sets no cookies.

5. Recipients of data

Recipient What for When
Camera system provider storing CCTV recordings from the club whenever you are on the training floor or at the reception (section 2.12)
Cloudflare site hosting, security, sending forms whenever you open the site or send a form
OVH the club’s email when you send a form or an email to us
Plausible Insights OÜ (Estonia) statistics without cookies whenever you open the site
Google (Analytics, Ads) statistics, measurement and remarketing only with your consent
Meta (Pixel, WhatsApp) ad measurement and matching; messenger pixel only with consent; WhatsApp when you write to us
eFitness bookings, memberships, payments when you click the link and go to the system (a separate relationship, section 2.10)

We may also disclose data to public authorities if the law requires it. We do not sell personal data.

6. Transfers outside the European Economic Area

Some providers (Google, Meta, Cloudflare) have offices or servers in the USA or in other countries outside the EEA. Data goes there only as described above, and for Google and Meta only with your consent. The basis for the transfer is usually a European Commission decision on adequate protection for companies taking part in the EU-US Data Privacy Framework, or standard contractual clauses. Plausible statistics are processed in the EU, so there is no transfer outside the EEA in that case.

7. How long we keep data

Data Period
Your choice in the consent window 12 months, then we ask again
Google and Meta cookies per section 4, deleted when you withdraw consent
Guest registration (Friends with Benefits) up to 12 months
Parental consent and the child’s data (CrossFit TEENs) until the child stops taking part in classes, deleted within 30 days after that
CVs and recruitment documents until the recruitment ends, 3 months at most after that; 12 months if you agree to future recruitments
CCTV recordings in the club 7 days, longer only if a recording is evidence in proceedings
Messages (phone, WhatsApp, email) until the matter is closed, then as the law or our legitimate interest requires

Data that we must keep longer under the law (for example tax law) or to defend against claims, we keep for as long as needed.

8. Your rights

You have the right to:

  • access your data and receive a copy of it,
  • rectify your data,
  • erase your data (“right to be forgotten”),
  • restrict processing,
  • data portability,
  • object to processing based on our legitimate interest, on grounds relating to your particular situation,
  • withdraw consent at any time,
  • lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

To use your rights, write to info@crossfitwilanow.pl. We will reply within one month. Giving your data is voluntary, but without it we cannot answer your message or handle your request. We do not make decisions about you based solely on automated processing that would have legal effects or similarly significantly affect you.

9. Changes to this policy

When we change tools, purposes or providers, we update this page and the version date at its top. If the purposes change significantly, we ask for consent again in the cookie window. The version published on this page applies.

First class(opens in a new tab)