Privacy Policy

1. Who We Are

The controller of your personal data is UAB “Treniruoklių gamyba”, company code 304446782, Beržiniškės g. 2A, Naisių k., Šiaulių r., LT-81474, Lithuania. This policy covers gfverified.com, which includes both the GFV gym platform and the Colossus Hall of Fame at gfverified.com/champions. The Hall of Fame was previously published at gfcolossus.com; that address now redirects here and is no longer operated as a separate service. For any question about your data, or to exercise the rights in section 9, contact contact@gfverified.com.

2. Data We Collect From You

We collect information you provide when registering, including name, email, and for gym owners, business registration details. When you sign up to our pre-launch list, we store the email address you provide, the timestamp of your consent, and your IP address. Event-recognition enquiries contain the contact and event details you submit.

3. Gym Data We Obtain From Other Sources

Part of the directory is built from OpenStreetMap, an open public map database. From it we import gym names, addresses, telephone numbers, websites and, where the source lists them, email addresses. We did not obtain this information from you directly. Where a listing identifies an individual — a sole trader’s name, a personal mobile number, or an email address containing a person’s name — it is personal data, and this section serves as your notice under Article 14 GDPR. We process it on the basis of our legitimate interest in maintaining a complete and useful gym directory. You may ask us to correct, hide, or delete any listing at contact@gfverified.com, and we will do so.

4. Champion Profiles

Colossus Hall of Fame profiles at gfverified.com/champions publish an athlete’s name, photographs, video, competition record, and biography. These pages are public and permanent by design — they are the destination of the QR code engraved on each Colossus trophy. We publish them only with the athlete’s consent, which may be withdrawn at any time by contacting us; withdrawal removes the public profile.

5. Certification Applications

When a club applies for GFV certification, the club’s owner fills in our online questionnaire and may add photos, PDF documents and links to it. The questionnaire asks for details of the club, its responsible person and its coaches. We use this information only to evaluate the application and decide on certification. We process it at the club’s request, before and for the purpose of certification (Article 6(1)(b) GDPR), and, for the people named in it, on our legitimate interest in evaluating the club properly (Article 6(1)(f) GDPR).

The application is stored on our own server in Lithuania, is never published, and can be opened only by the club’s owner and GFV staff. We record each time a member of staff opens a full-size photo or document. Photos are re-saved when they are uploaded, which removes the location and camera details they carry. PDF documents are stored exactly as sent, so anything inside a document stays in it. Links are stored as written and are not visited automatically. Videos are not uploaded to us: the club shares them from its own storage through a link in the form.

Documents such as coaches’ qualification certificates contain other people’s personal data. A club may submit them only after telling those people and, where the law requires it, with their consent. Material in which children can be recognised may be submitted only with the consents the form describes.

We keep an application, its answers and its material while the club’s certification is valid and for 90 days after it ends. If we do not certify the club, or ask it to change its application, the application goes back to the club so it can change it and send it again. An application that is not sent, or not sent again, is deleted 12 months after its last change. Any other application that ends without a certificate is deleted 90 days after our decision.

6. How We Use Data

Your data is used to provide platform services, communicate with you, review certification and event-recognition requests, and improve the user experience. Pre-launch signups receive a single launch announcement when the platform opens. We do not run analytics or marketing tracking.

7. Retention

Certification applications are covered in section 5. IP addresses attached to pre-launch signups and event enquiries are truncated to a coarse network range after 30 days. Event-recognition enquiries are deleted after 24 months. Rejected gym-claim evidence is deleted after 90 days, approved claim evidence is removed after the same period while the ownership record is retained, security activity logs are retained for 12 months, and idle sessions are removed after 30 days. Google Analytics data, collected only with your consent, is kept for 14 months and then deleted automatically. Database backups are replaced on a rolling schedule: nightly copies are kept for 14 days, weekly copies for 8 weeks, monthly copies for 12 months, and copies made while the site is being updated for 14 days. Data erased from the service therefore disappears from every backup within 12 months.

8. Data Sharing

We do not sell your personal data. Business information for listed gyms is displayed publicly on the platform. We use the following processors and recipients: Interneto vizija UAB (server and email hosting, Lithuania); Mapbox (maps on gfverified.com, United States, under Standard Contractual Clauses); CARTO (map tiles on gfverified.com gym pages and in the mobile app; the Hall of Fame has no map); YouTube, operated by Google (embedded video — when you play an embedded video, YouTube receives your IP address and may set cookies under its own privacy policy); and, only if you accept analytics cookies, Google Analytics, provided by Google Ireland Limited with processing by Google LLC in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses (which pages you visit, your device and browser type, and an approximate location derived from your IP address — never for advertising).

9. Your Rights (GDPR)

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and — where we rely on consent — to withdraw that consent at any time. Contact contact@gfverified.com to exercise these rights. Pre-launch subscribers can also unsubscribe instantly via the link in any email we send — clicking it permanently removes your record. If you believe we have handled your data improperly, you have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt).

10. Cookies

We use essential cookies for sign-in and session management. Only if you accept them, we also use Google Analytics cookies to measure how visitors use the website — never for advertising: Google signals and ad personalisation are switched off. You choose in the banner on your first visit; until you accept, Google Analytics is not loaded at all. You can change your choice at any time with “Cookie settings” at the foot of our pages or on our Cookie Policy page. Our lawful basis for analytics is your consent.