Privacy policy

Last updated: 15 November 2026

This page explains, in plain words, what personal data the MyoGen Fitness website collects, why, who else sees it and what your rights are. It covers the website myogen.gr in Greek and English. If the two versions ever differ, the Greek one applies.

It does not cover members' data that we handle at the gym itself (sign-ups, memberships) or the MyoGen app. The app has its own privacy policy:
https://www.privacypolicies.com/live/9f71d1b9-65ec-403a-ac6c-8c53252db024

1. Who we are

The controller is:

MyoGen Fitness
VAT no. (ΑΦΜ): 166019687, tax office: Lagkadas (ΔΟΥ Λαγκαδά)
Archelaou, Assiros 572 00, Thessaloniki, Greece
Email: myogenf@gmail.com
Phone: +30 697 429 8956

We are a small business and have not appointed a Data Protection Officer, because the law does not require one for what we do. For anything about your data, email myogenf@gmail.com.

2. What data we collect and where it comes from

a) When you send us a message through the contact form. We collect what you type:

• first name (required)
• email address (required)
• phone number (optional)
• the membership plan you're interested in (optional)
• your message (required)

Please don't include health details or other sensitive information in the message. If your training needs it, we'll talk about it in person at the gym.

b) When you email or call us directly. We receive your email address or number and whatever you tell us.

c) When you simply visit the website. Like any website, the server automatically receives technical details your browser sends: IP address, date and time, the page requested, your device and browser type (User-Agent) and your browser's language settings. We use them for two things:

• to show the site in your language (Greek or English);
• when you scan the app's QR code, to send you to the right app store (App Store on iPhone, Google Play on Android).

Our own code does not store these details. Our hosting provider, Cloudflare, keeps temporary logs to run and protect the site (see sections 4 and 6).

We do not use analytics (such as Google Analytics), advertising pixels, embedded maps, videos or social media buttons. Fonts are served from our own server, not from Google.

d) Customer reviews. We show excerpts of public Google reviews with their author's first name and the initial of their surname. If you wrote one of these reviews and want your name or the review removed, email us and we will remove it.

3. Why we use it and our legal basis

We don't ask for your consent for the form: you write to us because you want a reply, and processing your details is necessary for exactly that. Where we rely on legitimate interest, we have weighed it and found the processing small, expected and not overriding your rights. You can always object (see section 7).

Writing to us does not sign you up for marketing or newsletters. We make no automated decisions and do no profiling.

4. Who else sees the data

We don't sell your data or give it to anyone for their own purposes. We only use the following providers, which the site needs to work:

• Cloudflare, Inc. (USA): hosts the site and serves it through its network, protects it from attacks, and sends contact-form messages as an email to the gym. It acts as our processor under its Data Processing Addendum.
• Google (Gmail): hosts the gym's mailbox (myogenf@gmail.com), where form messages and your emails are stored.
• Gym staff who answer messages.

If the law requires it (for example, a prosecutor's order), we may have to give data to a public authority.

Links to other sites. The site has plain links to Google Maps, Instagram, Facebook, TikTok, the App Store and Google Play. Nothing from these services loads on our pages. If you click a link, you leave our site and that service's privacy policy applies.

5. Transfers outside the European Union

Cloudflare and Google are US companies and may process data outside the EU. Both are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Implementing Decision (EU) 2023/1795, Art. 45 GDPR). Both state that if their certification lapses they rely on the Commission's Standard Contractual Clauses (Art. 46 GDPR). Email us if you'd like more information about these safeguards.

6. How long we keep data

• Form messages and emails: up to 12 months after our last exchange, then deleted. If you become a member, anything about your membership moves to the gym's member records and is kept as long as the law requires for those.
• Cloudflare logs for the site's code (Workers Logs): deleted automatically within 7 days at most.
• Other Cloudflare technical logs (security, network): only as long as Cloudflare needs them to run and secure its service, under its own policy.
• If there is a legal dispute, we keep what relates to it until it is resolved.

7. Your rights

You can ask us for:

• access: to know whether we hold data about you and get a copy (Art. 15 GDPR);
• rectification of anything wrong (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• portability: the data you gave us, in a common electronic format (Art. 20).

Right to object (Art. 21 GDPR). Where we rely on legitimate interest, you can object at any time on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds or need the data for a legal claim.

How: email myogenf@gmail.com or ask at the gym. We reply free of charge within one month. For complex requests this can be extended by two more months, and we'll tell you if so (Art. 12 GDPR). We may ask for something to confirm it's really you.

8. Complaints to the Data Protection Authority

If you think we are breaching your rights, you can lodge a complaint (Art. 77 GDPR). Please write to us first so we can fix it; the Authority itself asks that you contact the controller first.

Hellenic Data Protection Authority (HDPA)
Kifissias Ave. 1-3, 115 23 Athens, Greece
Phone: +30 210 6475600
Email: contact@dpa.gr (complaints: complaints@dpa.gr)
Online complaints with Taxisnet login: https://eservices.dpa.gr
Guidance: https://www.dpa.gr/en

You can also complain to the authority in the EU country where you live or work.

9. Cookies and browser storage

This website does not use cookies. We use no analytics, advertising or tracking cookies, our own or anyone else's. That's why there is no cookie banner.

We store one item in your browser tab's memory (sessionStorage):

It is purely technical and serves the browsing you asked for, so it does not need consent (Art. 4(5) of Greek Law 3471/2006). You can clear it by closing the tab or clearing the site's data in your browser settings.

To protect the site from malicious bots, Cloudflare may set strictly necessary security cookies (e.g. __cf_bm, which expires after 30 minutes of inactivity, or cf_clearance if you are asked to complete a check). They are not used for analytics or advertising.

10. Children

The website is meant for adults. If you are under 15, please ask a parent or guardian to contact us for you. If we find that a child has messaged us without a parent knowing, we will delete the message.

11. Security

The site only runs over an encrypted connection (HTTPS). Form messages are not stored in a database: they go straight to the gym's email, which only the people who answer messages can access. The email account is protected with two-step verification.

12. Changes to this policy

If the way the site works changes (for example, if we add analytics or a map), we will update this page and the date at the top. If a change needs your consent, we will ask for it before it applies.

Last updated: 15 November 2026