Privacy Policy
This Privacy Policy explains how Club Eindhoven B.V., trading as MANA® Social Performance Club (“MANA”, “we”, “our”, “us”), collects, uses, stores and protects personal data when you visit our club, use our services, or interact with us via our website and supporting digital tools (including any member app).
MANA is a physical fitness and performance club. Our website and digital tools function as supporting channels for membership administration, bookings, communication and purchases. We process personal data in accordance with the General Data Protection Regulation (EU) (“GDPR”) and applicable Dutch and EU privacy laws.
Controller (data controller):
Club Eindhoven B.V.
Nieuwe Emmasingel 12–14
5611 AM Eindhoven, The Netherlands
Chamber of Commerce (KVK): 98428004
General questions or requests: clubs@join-mana.com
Privacy requests (GDPR rights): clubs@join-mana.com
This Privacy Policy applies to the processing of personal data relating to:
- Membership registrations, contracts and payments
- Access to and use of the Club and its facilities
- Class bookings and reservations (including via supporting digital tools)
- Communication via email, chat, forms and app notifications
- Marketing communications (where permitted and/or based on consent)
- Website use, webshop purchases and customer service
- Security, safety and incident prevention (including CCTV)
This Policy does not apply to third-party websites, platforms or services accessed via links from our website or communications. Those parties operate under their own privacy policies.
- First and last name
- Date of birth, gender
- Address and postcode
- Email address and phone number
- Member photo (optional, for access control)
- Membership type and contract information
- Start and renewal dates, billing cycle information
- Payment method (e.g., IBAN or card details processed via a secure payment provider)
- Invoices and payment history
- Attendance, check-in and access records (e.g., entry logs)
- Injuries, preferences or goals that you voluntarily provide
- Participation in classes or programs
This data is processed only to provide appropriate training guidance, safety support and member service. We request that you do not provide more health information than necessary.
- IP address, device type, browser type, operating system
- App usage data and website analytics
- Cookie identifiers and similar tracking technologies
- Login credentials and security tokens (where accounts are used)
- Emails, chats, contact forms and support requests
- Feedback, surveys and testimonials (when voluntarily submitted)
- Photos or videos taken during events or within the club (see Section 9)
We use personal data to operate, improve, and secure our services.
- Registering and maintaining your membership
- Processing payments and renewals
- Providing access to the Club and facilities
- Handling member services, administration and support
- Managing bookings for classes, sessions and personal training
- Enabling account functions (e.g., booking, access administration, schedule visibility)
- Supporting progress, engagement and operational features where offered
- Sending confirmations, reminders and notifications
- Informing you about changes (e.g., opening hours, policies, operational updates)
- Responding to questions, complaints and feedback
- Newsletters, offers, promotions and event invitations
- Relevant updates about MANA services
You may withdraw consent at any time (see Section 10).
- Meeting legal, tax and accounting obligations
- Fraud prevention and enforcement of club rules
- Ensuring safety of members, visitors and staff
- CCTV monitoring for security and incident prevention
We process personal data under one or more of the following GDPR legal bases:
- Performance of a contract (Article 6(1)(b) GDPR): to provide membership services, bookings, access, billing and support
- Legal obligation (Article 6(1)(c) GDPR): to comply with tax, accounting and administrative obligations
- Legitimate interests (Article 6(1)(f) GDPR): for club operations, safety, fraud prevention, service improvement and security (balanced against your rights)
- Consent (Article 6(1)(a) GDPR): for marketing communications (where required), optional preferences, and optional media use where explicit consent is required
You may withdraw consent at any time by emailing clubs@join-mana.com. Withdrawal does not affect processing already carried out before withdrawal.
We do not sell or rent your personal data. We only share data when necessary to operate the Club and supporting services, or where legally required.
We may share data with carefully selected third parties that act as processors on our behalf under GDPR-compliant Data Processing Agreements (DPAs), such as:
- Payment providers (e.g., Mollie, Stripe or equivalents)
- Booking and membership systems (e.g., Gymly or equivalent)
- Email and communication tools
- IT hosting, infrastructure and security providers
- Analytics providers
These parties may only process data according to our instructions and for the purposes described in this Policy.
We may disclose personal data to competent authorities (e.g., police, tax authorities) if required by law, regulation, or a valid legal request.
Within MANA, access to personal data is limited to staff who need it for their role (e.g., reception, coaching, finance, management). Staff are bound by confidentiality obligations.
We retain personal data only as long as necessary for the purposes described and in accordance with legal requirements:
- Membership and billing data: 7 years (legal tax/accounting retention requirement)
- Access and attendance data: 12 months
- Health and training notes: deleted after membership ends, unless a longer retention is required by law or needed for an ongoing dispute
- Email and chat history: 12 months (unless required longer for dispute handling)
- CCTV footage (if used): 30 days, unless required longer due to an incident investigation
- Marketing data: until you withdraw consent or object (or until no longer necessary)
If data must be retained longer due to a legal claim, dispute, or legal obligation, we will retain it as needed and restrict access.
- Encrypted data transfer where applicable (e.g., TLS/HTTPS)
- Secure hosting environments and access controls
- Role-based access and confidentiality obligations for staff
- Monitoring and updates to protect systems
No system is fully immune to risks. If you use any supporting digital tools, you do so at your own discretion and you should protect your account credentials.
Photos and videos taken inside the Club may capture members in the background.
We will not publish images of a member for promotional purposes without explicit consent, unless another lawful basis applies under GDPR and Dutch law (e.g., where individuals are clearly incidental and not the focus, and publication is proportionate). If you are unintentionally captured in a photo or video and object to the use of imagery in which you are identifiable, you may request a review or removal by contacting clubs@join-mana.com. We will assess the request and take appropriate action where required.
If you do not wish to appear in content captured on-site, notify staff at the time. We will make reasonable efforts to accommodate this (e.g., positioning, exclusion, or blurring where feasible).
- Right of access (obtain confirmation and a copy of your data)
- Right to rectification (correct inaccurate or incomplete data)
- Right to erasure (deletion, where permitted by law)
- Right to restriction (limit processing in specific cases)
- Right to data portability (receive certain data in a structured format)
- Right to object (particularly to marketing and certain legitimate-interest processing)
- Right to withdraw consent (where processing is based on consent)
How to exercise rights: email your request to clubs@join-mana.com. We respond within 30 days, unless legally extended (we will inform you if so). We may ask you to verify your identity before fulfilling a request.
If you believe we are not processing your data lawfully, you may also lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens.
Our website (and where applicable supporting digital tools) may use cookies and similar technologies to:
- Enable core website functionality (e.g., sessions, preferences)
- Improve performance and user experience
- Measure website usage and effectiveness (analytics)
You can manage cookie preferences via your browser settings and, where implemented, via our cookie banner/settings. Disabling cookies may affect certain website features.
For the safety of guests, visitors and staff, CCTV may be in operation in public areas (e.g., reception and general access areas). Cameras are not intended for use in private areas where privacy is expected.
- CCTV footage is used exclusively for safety, security and incident prevention/investigation
- Footage may be shared with authorized authorities where necessary
- Retention is as stated in Section 7, unless an incident requires longer storage
If personal data is processed outside the European Economic Area (EEA) by one of our service providers, we ensure appropriate safeguards are in place, such as:
- EU Standard Contractual Clauses (SCCs)
- Adequacy decisions
- Other GDPR-compliant transfer mechanisms and contractual protections
We may update this Privacy Policy from time to time. The latest version will be available at www.join-mana.com/privacy. If changes are significant, we will communicate them via email and/or supporting digital tools where appropriate.
For privacy questions or requests: clubs@join-mana.com · dagmar@join-mana.com
For general inquiries: clubs@join-mana.com
Club Eindhoven B.V.
Nieuwe Emmasingel 12–14
5611 AM Eindhoven, The Netherlands
Every service. One roof.
One club for how you train, recover, think and connect.