Click & Fit Privacy Policy

1. Who is responsible for the data

There are two roles on the Platform:

• We are the controller of the data for your account (registration and sign-in), the VIP subscription and payments to us, the notifications we send, the security and operation of the Platform, and the records of your consent.
• The gym, studio or instructor you book with (the "Organisation") is the controller of the data about your bookings with it: what and when you booked, attendance, no-shows, your date of birth and the messages the Organisation sends you. We process this data on behalf of the Organisation as a processor under Art. 28 GDPR, under a contract with it (Annex 1 to the Terms and Conditions).

For questions about personal data: info@lighthouse-software-solutions.com, tel. +359 885 507 650. You can also contact the Organisation directly about the data it holds. We will help. We have not appointed a data protection officer, as we are not required to.

2. What data we process

• Account: name, email, phone and password (we only keep a cryptographic hash, not the password itself). When you sign in with Google or Facebook, we receive your name, email and picture from that account.
• Optional: date of birth and gender.
• Bookings: activities and times, status (confirmed, declined, cancelled), attendance and no-shows, payment method at the Organisation, waiting list sign-ups.
• Notifications: your notification settings, a device identifier, a push notification key, the type of device and browser.
• Payments: for the VIP subscription — status, amount, date and the customer identifier at Stripe. We do not receive or store bank card data.
• Technical data: IP address, browser and device when an error occurs on the Platform and when you accept these terms.
• Consent records: when and which version of these terms you accepted, your confirmation that you are at least 14 years old, IP address and browser.
• Visit statistics through Google Analytics — only if you accept analytics cookies.

3. Purposes and legal bases

• Account, bookings, waiting list and notifications about them — performance of a contract (Art. 6(1)(b) GDPR).
• Date of birth and gender — your consent (Art. 6(1)(a)). The Organisations you book with can see your date of birth (for example, to wish you a happy birthday). You can delete this data from your account at any time.
• VIP subscription and accounting — performance of a contract and a legal obligation (Art. 6(1)(b) and (c)).
• Records of consent and of being at least 14 — a legal obligation to be able to prove consent (Art. 7(1) and Art. 8 GDPR, Art. 25c of the Bulgarian Personal Data Protection Act) (Art. 6(1)(c)).
• Error logs and security of the Platform — our legitimate interest in keeping the Platform working and protected (Art. 6(1)(f)).
• Visit statistics (Google Analytics) — your consent through the cookie banner (Art. 6(1)(a)).
• SMS and email messages from the Organisation (for example, a reminder if you have not trained for a while, and promotions) — with your separate consent (Art. 6(1)(a)), which you give at registration or in your account settings. For users registered before 03.10.2026 — on the basis of the Organisation's legitimate interest in contacting its own clients (Art. 6(1)(f)). You can opt out at any time in your account settings.

We do not make automated decisions that have legal effects on you and we do not profile you for advertising.

4. Children

The Platform is only for people aged 14 or over. When registering, you confirm that you are at least 14 years old. If we find out that an account belongs to a child under 14, we will delete it. A parent or guardian can book for a child in their own name.

5. Who we share data with

The Organisations you book with: they see your name, phone, email, bookings, attendance, no-shows and date of birth (if you entered it). The Organisation can download a list of its clients.

Providers that process data on our behalf:

• Contabo GmbH, Germany — servers and hosting.
• Stripe — payment processing.
• Google — Google Analytics (only with consent), Google sign-in, Google Maps and Firebase Cloud Messaging (push notifications).
• Google Gemini — the AI assistant in the Organizations' admin panel, only if the Organization's administrator uses it and has accepted its terms. The service receives the administrator's messages and summary information about the Organization (number of classes and reservations, plan status) — no names or contact details of clients or staff; phone numbers, emails and other numbers in messages are hidden automatically before sending. We use the free version of the service, under which Google may use the content to improve its products, including through human review, and keeps it according to its own terms.
• Meta Platforms Ireland — Facebook sign-in.
• SendPulse — sending emails.
• Mobica, Bulgaria — sending SMS.
• BunnyWay d.o.o. (Bunny.net), Slovenia — Organisations' video content (no personal data of yours).
• Lighthouse Errors — our own error logging system, on servers in the EU. Logs are kept for 30 days.

Public authorities — only when required by law.

We do not sell personal data.

6. Transfers outside the EU

Google, Meta, Stripe and SendPulse may also process data outside the European Union, for example in the USA. Such transfers are based on the European Commission's adequacy decision (the EU–US Data Privacy Framework) for certified companies, or on standard contractual clauses approved by the European Commission.

7. How long we keep data

• Account and bookings — for as long as the account exists. We delete them when you ask us to delete your account, unless the law requires us to keep them longer.
• Accounting documents — for as long as the law requires (up to 10 years).
• Consent records — for as long as the account exists and up to 5 years after its deletion, so that we can prove consent in case of a dispute.
• Error logs — 30 days.
• Push notification devices — removed devices are deleted automatically after 30 days.
• Google Analytics — according to the Google Analytics settings, up to 14 months.
• AI assistant conversations — on our side up to 90 days, then deleted automatically. At Google — according to Google's terms for Gemini; we cannot delete them there.

8. Your rights

You have the right of access to your data, to rectification, to erasure ("the right to be forgotten"), to restriction of processing, to data portability, to object to processing based on legitimate interest, and to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

You can correct some data yourself in your account settings. For anything else, including deleting your account or getting a copy of your data, write to info@lighthouse-software-solutions.com. We reply within one month.

When a request concerns data for which the Organisation is the controller, we will forward it to the Organisation and help it respond to you.

9. Security

The connection to the Platform is encrypted (HTTPS), passwords are stored only as a cryptographic hash, and access to data is limited to the people who need it. If a personal data breach occurs, we will notify the Bulgarian Commission for Personal Data Protection within 72 hours, and you without delay where there is a high risk to your rights.

10. Right to complain

If you believe we process your data unlawfully, you can lodge a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, https://www.cpdp.bg, or with the data protection authority in the EU country where you live.

11. Changes to this policy

We may change this policy. The current version is always on this page, with the date from which it applies. We will notify you of significant changes by email or on the Platform.