Privacy Protection

Conditions for the Processing of Personal Data

These conditions for the processing of personal data (hereinafter: Conditions) describe the manner in which the company GymBeam s.r.o. – Branch Office Zagreb, with its registered office at Josipa Marohnića 1/1, 10 000 Zagreb, Croatia, VAT ID: 84596141185 (hereinafter: Company or Us) processes your personal data for the purpose of providing our services, which consist of the sale and distribution of dietary supplements, sports clothing, and equipment for exercising through our online store (hereinafter: Services) on the website www.gymbeam.ba (hereinafter: Website), as well as through the GymBeam application (hereinafter: App), and through other means of distance communication.

The Company is responsible for the processing of personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“GDPR”) and in accordance with the Data Protection Implementation Act (NN 42/2018) and other applicable regulations of the Republic of Croatia.

The Company has taken all appropriate technical and organisational measures to ensure the protection of personal data.

“Personal data”: data relating to an identified natural person or a natural person who can be identified directly or indirectly, in particular by reference to a universally applicable identifier or other identifier, such as name, surname, identification number, location data or an online identifier, or by one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

“Processing of personal data”: any operation or set of operations which is performed upon personal data or upon a set of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, transmission by onward transfer, dissemination or any other form of making available, alignment or combination, restriction, erasure, or destruction, regardless of whether it is performed by automated means or not.

 

WHAT INFORMATION DO WE COLLECT? AND FOR WHAT PURPOSE?

Depending on how and to what extent you use our Website, App and/or Services, we collect the following personal data about you (hereinafter: Personal Data):

1. Data necessary for registration and access to the Website and App

For the purpose of registering on our Website and in the App, and for subsequent logging in to our Website and App and accessing our personalised services on the Website and in the App, we process the following personal data: (i) your first name, (ii) your surname, and (iii) your email address.

The processing of this data is necessary for the performance of the contract of which you and we are parties. The legal basis for processing this data is Article 6(1)(b) of the GDPR.

1. Data necessary for the provision of the Services

For the purpose of providing our Services (i.e. [delivery of ordered goods / provision of purchased services]), we process the following personal data: (i) your first name, (ii) your surname, (iii) your address, (iv) your email address, (v) your telephone number, and (vi) your payment card details (in particular card number, expiry date and CVV code).

The processing of this data is necessary for the performance of the contract of which you and we are parties. The legal basis for processing this data is Article 6(1)(b) of the GDPR.

1. Data collected for marketing purposes

For the purpose of receiving our news and/or flyers, information about discounts, updates, improvements and offers, as well as other marketing material in the form of emails, SMS messages or postal mail and/or notifications, we process your: (i) first name, (ii) surname, (iii) email address, (iv) telephone number, and (v) address.

We process these personal data on the basis of your explicit consent. The legal basis for processing this data is Article 6(1)(a) of the GDPR.

 If you decide that you no longer want to receive such messages, you have the right to withdraw your consent by clicking the hyperlink directly in the email communication and/or available here: https://gymbeam.ba/newsletter/manage/. Withdrawal of consent may result in your no longer receiving notifications about discounts, updates, improvements and offers. It is not possible to withdraw consent for receiving emails that contain notifications related to the provision of the Services.

1. Data collected using our Website and App

For the purpose of continuous improvement of our Services, and for developing your user experience when using our Website and/or App, we process data relating to: (i) your computer and/or mobile device, (ii) your visits or use of our Website, App and/or our Services (including your IP address, geographical location, type and version of your browser/operating system, referral sources, length of visits to viewed pages and navigation on our Website and/or in the App, or any similar information that the Company may obtain directly or indirectly from third-party providers), (iii) data generated during your use of our Website and/or App and/or Services or generated during your use of our Services (including the schedule, frequency and usage patterns of the Website and/or App).

We process these personal data on the basis of your explicit consent. The legal basis for processing this data is Article 6(1)(a) of the GDPR.

1. Data collected by leaving your comment/review

For the purpose of leaving a review or posting a comment on our Website or in the App, we will process the personal data you provide together with the review/comment on our Website and/or in the App, namely: (i) your first name, (ii) your surname, (iii) the nickname you choose to leave the comment/review, and (iv) any other data you decide to include in the review/comment.

We process these personal data on the basis of your explicit consent. The legal basis for processing this data is Article 6(1)(a) of the GDPR.

1. Data collected when communicating with us

For the purpose of communicating with us for any reason (e.g. support when using the Website and/or App, using the Services, complaints, resolving any issues, etc.), we will process the following personal data: (i) your first name, (ii) your surname, (iii) your address, (iv) your email address, (v) your telephone number, (vi) the content of the communication, (vii) metadata related to the communication, and (viii) any other necessary data you decide to provide in the communication.

The processing of this data is necessary for the performance of the contract of which you and we are parties. The legal basis for processing this data is Article 6(1)(b) of the GDPR.

1. Data collected during the complaint handling process

During the complaint handling process, based on your complaint regarding the goods or service that we provided to you, we will process personal data primarily within the following scope: (i) first name, (ii) surname, (iii) email address, (iv) telephone number, (v) address and (vi) IBAN.

The processing of these personal data is necessary in order to fulfil our legal obligations, in particular under the Consumer Protection Act (NN 19/22, 126/21) and the applicable provisions of the Obligations Act (NN 35/05, 41/08, 125/11, 78/15, 29/18). The legal basis for processing this data is Article 6(1)(c) of the GDPR.

 

ON WHAT LEGAL BASIS CAN WE PROCESS YOUR PERSONAL DATA?

In addition to what is stated above, we have the right to process your Personal Data for the purpose of fulfilling our legal obligations (Article 6(1)(c) of the GDPR) or for protecting our legitimate interests (Article 6(1)(f) of the GDPR), for example for the purpose of fraud prevention, network and information security, and direct marketing.

We will process your Personal Data in accordance with the applicable legal regulations of the Republic of Croatia and protect them against misuse and/or unlawful disclosure.

 

HOW DO WE SHARE YOUR PERSONAL DATA?

To enable access to our Website, App and/or Services (and if appropriate given the circumstances), we have the right to transfer your Personal Data (and you agree to such transfer) in accordance with the principle of data minimisation to a limited circle of persons only, namely to our employees, subcontractors, officials, advisors, commercial representatives, suppliers or affiliated persons of the Company and service providers, to the extent that is reasonably and necessary to achieve the purpose set out in these Conditions, especially to the following persons:

(i) Global Payments s.r.o., organisational unit, with its registered office at Vajnorská 100/B, 831 04 Bratislava, Company ID (IČO): 50 010 301

(ii) HP d.d., Poštanska ulica 9, 10410, Velika Gorica, Croatia,

(iv) Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02X525, Ireland

(v) Google Ireland Limited (registration number: 368047), with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland

(vi) nabava.net, Aplos d.o.o., Modruška 9, 10000 Zagreb, Croatia

(vii) Glami, Inspigroup s.r.o., Újezd 450/40, 118 00 Praha 1 – Malá Strana, Czech Republic

(viii) Dognet, Lead Media, s.r.o. Karpatská 6, 81105 Bratislava, Slovakia

(ix) Adyen N. V., PO Box 10095, 1001 EB Amsterdam, the Netherlands

(x) idealno.ba, sMind d.o.o., Ulica grada Vukovara 269 D, 10000 Zagreb, Croatia 

Furthermore, we may provide your personal data:

(i) to the extent required by applicable regulations,

(ii) in relation to any ongoing or future legal proceedings, or

(iii) for the purpose of establishing, exercising or defending our legal rights (including providing your Personal Data to third parties for the purpose of preventing fraud and reducing payment risk).

Data based on which you are not identified: We have the right to provide your Personal Data based on which it is not possible to identify you (including anonymised data about your use of our Website and/or Services, entry/exit pages and URL addresses, platform types, number of clicks, etc.) to third parties that are interested in such information in order to understand the ways in which certain services are used.

We do not share your Personal Data, based on which your identification or location may be possible, with third parties for the purpose of direct marketing.

We may allow some third parties to display advertisements and marketing information on our Website. Such third parties use technology that sends directly to your browser offers or links to offers, which are then displayed as part of the webpage you are viewing. In such cases, they automatically receive information about your IP address. They may also use other technologies (e.g. cookies, JavaScript or web beacons) in order to measure the effectiveness of their advertisements and personalise the ad content shown to you. We do not allow such third parties access to information that would enable them to personalise in this way the data collected. Please note that if an advertiser asks us to display an advertisement to a specific group of customers, and you respond to that advertisement, that advertiser or ad server may infer that you belong to the target group. The purpose of these Conditions is not to regulate your relationship with any third party that uses the above-mentioned technologies. For more information, please read the personal data processing conditions of such advertisers.

 

VIRTUAL TRY-ON OF CLOTHING (“Virtual Try-On”)

By using the “Virtual Try-On” feature on the pages of our clothing products, users can upload a personal photo to generate a virtual image of how the selected garment could look on them. The uploaded image is processed through the Google Vertex AI system, which automatically analyses the photo to position the garment appropriately. Pursuant to Article 9 of the GDPR, this constitutes processing of biometric data. The processing is carried out exclusively on the basis of the user’s explicit consent in accordance with Article 6(1)(a) and Article 9(2)(a) of the GDPR, which is given by voluntarily uploading the image. We state that Google Vertex AI is a third-party tool used for this function. The photo is processed only temporarily during the virtual try-on and is automatically and permanently deleted immediately after the generated image is displayed to the end user. Neither GymBeam nor Google store or retain any voluntarily provided user data (in this case, images).

DO WE TRANSFER YOUR PERSONAL DATA TO THIRD COUNTRIES?

The personal data we collect may be stored or otherwise processed and transferred within countries where we carry out our business activities, all for the purpose of achieving the processing purpose established in these Conditions. For the same purpose, your data may be transferred between Member States of the European Union or the European Economic Area and countries for which the European Commission considers they provide an adequate level of protection for personal data, according to the list published from time to time by the European Commission and the Data Protection Agency (AZOP) on their websites.

 

HOW LONG WILL WE PROCESS YOUR PERSONAL DATA?

Unless otherwise prescribed by applicable legal regulations, we have the right to process your Personal Data in a form that allows your identification for as long as is necessary to achieve the purpose for which the Personal Data was provided (this may include the period during which you visit our Website and/or App or use our Services and/or the entire period during which the purpose of processing the Personal Data lasts), unless otherwise stated, within the following time limits:

1. Data necessary for registration and access to the Website and App

We will process the data necessary for registration and access to the Website and/or the App from the day of your registration on the Website and/or in the App until 30 days after the day you cancel your registration. During this period (i.e. 30 days from the cancellation of registration) we will process the data only for the purpose of concluding the contractual relationship between us and you that arose through your registration on the Website or in the App, resolving any potential disputes that may arise from this, and protecting any of our legitimate interests.

1. Data necessary for the provision of the Services

We will process the data necessary for the provision of the Services from the day you order the Service until its demonstrable delivery (i.e. until the day the goods are delivered to you and the price is paid).

1. Data collected for marketing purposes

We will process the data collected for marketing purposes from the day you give us your consent for such processing until the day (i) you withdraw your consent or (ii) you cancel your registration on the Website or in the App.

1. Data collected using our Website and/or App

We will process the data collected for marketing purposes from the day you give us your consent for such processing until the day (i) you withdraw your consent or (ii) you cancel your registration on the Website or in the App.

1. Data collected by leaving your comment / review

We will process the data collected for marketing purposes from the day you give us your consent for such processing until the day (i) you withdraw your consent or (ii) you cancel your registration on the Website or in the App.

1. Data collected when communicating with us

We will process the data collected when communicating with us from the day they are collected until the day the request arising from the email communication is resolved.

1. Data collected during the complaint handling process

We will process the data collected during the complaint handling process from the day you provide them to us, during the archiving period prescribed by special legal regulations and supervisory authorities, for example in accordance with the Consumer Protection Act (NN 19/22, 126/21) and the Obligations Act (NN 35/05, 41/08, 125/11, 78/15, 29/18).

We have the right to process your personal data longer than the period stated above if this is necessary (i) to fulfil our legal obligations, (ii) for the purpose of establishing, exercising or defending our legal rights (including providing information to third parties to prevent fraud and reduce payment risk).

 

CONSEQUENCES OF NOT PROVIDING PERSONAL DATA

Providing certain personal data (such as name, address, contact details, and payment information) is necessary for concluding the contract and for the provision of services by GymBeam s.r.o. – Branch Office Zagreb. Failure to provide this data may lead to the inability to conclude the contract, deliver the ordered goods, provide access to the app, or provide personalised services. Providing data that is not marked as mandatory is voluntary, and its absence will not affect the fulfilment of the contract.

 

VOLUNTARY AND MANDATORY NATURE OF DATA

In cases where personal data is necessary to fulfil a legal or contractual obligation, failure to provide it may lead to the inability to fulfil the contract or provide the service.

 

HOW CAN YOU WITHDRAW YOUR CONSENT?

You may withdraw your consent at any time based on your own decision via email or by phone contact, which you can find here: [email protected], +387 70 33 00 640. Withdrawal of consent does not affect the lawfulness of the processing of personal data based on consent before its withdrawal.

 

HOW CAN YOU DELETE YOUR ACCOUNT IN THE APP?

You can delete and cancel your account in the App at any time based on your own decision, directly in the App in the “Need help?” section, or you can contact our customer support via email [email protected] or by phone at +387 70 33 00 640. Withdrawal of consent does not affect the lawfulness of the processing of personal data that was carried out based on consent before its withdrawal.

 

WHAT ARE YOUR RIGHTS AND OBLIGATIONS?

You have the right:

To access your Personal Data

In particular, to request information about:

• the purposes of processing your Personal Data,
• the categories of Personal Data being processed,
• the recipients to whom the Personal Data are provided, and
• the period for which your Personal Data will be stored,
• the right for us to request rectification of your Personal Data concerning you, their erasure or restriction of their processing, or the right to object to the processing of your Personal Data,
• the right to lodge a request to initiate proceedings before the Data Protection Agency (AZOP),
• the source of Personal Data, if the Personal Data were not obtained from you.

The Company will provide you with your personal data that it processes without undue delay, in the manner in accordance with your requests. For repeated provision of personal data you request, we may charge a reasonable fee corresponding to administrative costs. 

Rectification of Personal Data

If you find that we process your Personal Data incorrectly, please inform us and we will correct such incorrect Personal Data without undue delay. You also have the right to request supplementation of incomplete Personal Data.

Erasure of Personal Data (Right to be forgotten)

We will erase your Personal Data if: (i) the Personal Data are no longer necessary for the purpose for which they were collected, (ii) you withdraw your consent to the processing of Personal Data under the conditions set out in these Conditions, (iii) you object to the processing of Personal Data, (iv) we have obtained your Personal Data unlawfully, (v) we have a legal obligation to erase your Personal Data or (vi) the Personal Data were collected in connection with an offer of information society services.

In the event of erasure of personal data at your request, we will at the same time take reasonable security measures to inform other data controllers who process your personal data about that request, so that they also erase links to those personal data and their copies or duplicates.

Restriction of the processing of Personal Data

You have the right to restrict the processing of your Personal Data if: (i) you contest the accuracy of the Personal Data, for a period that enables us to verify their accuracy, (ii) the processing of your Personal Data is unlawful, and you request restriction of their use instead of erasure, (iii) we no longer need your Personal Data for the purposes of processing, but they are needed by you for the establishment, exercise or defence of a legal claim, or (iv) you object to the processing of Personal Data, until it is determined whether our legitimate grounds override your legitimate interests.

If the processing of personal data is restricted, except for storage, we process the personal data only with your explicit consent or for the establishment, exercise or defence of a legal claim, for the protection of persons or for reasons of public interest.

Data portability

You have the right to receive from us the Personal Data concerning you that we process, in a structured, commonly used and machine-readable format, for the purpose of transmitting those Personal Data to another data controller.

To object to the processing of Personal Data

You have the right to object to the processing of Personal Data for purposes of direct marketing, including profiling to the extent that it is related to direct marketing.

To initiate proceedings before the supervisory authority

If you suspect that your rights related to the protection of your Personal Data have been violated, you have the right to lodge a request to initiate proceedings before the Data Protection Agency (AZOP) in accordance with the relevant provisions of the Data Protection Implementation Act (NN 42/2018).

 

DO WE USE AUTOMATED DECISION-MAKING AND PROFILING?

When providing our Services, we do not carry out automated decision-making, including profiling, within the meaning of Article 22 of the GDPR (i.e. decision-making that produces legal effects for you or similarly significantly affects you and is carried out exclusively by automated means without human intervention).

We do carry out profiling within the meaning of Article 4 of the GDPR (i.e. we process your Personal Data and analyse your behaviour on our Website and in our App in order to adapt our services to your needs, analyse your interests or preferences). However, such profiling does not lead to decision-making that produces legal effects for you or similarly significantly affects you.

 

AUTOMATED DECISION-MAKING CARRIED OUT BY THE PAYMENT SERVICE PROVIDER

When processing payments, we cooperate with service providers, and these providers may carry out automated decision-making, including profiling, based on their own internal rules and risk assessments (e.g. approving purchases or rejecting transactions).

Your personal data is provided to those entities solely for the purpose of processing payments and assessing transaction security. All such processing is governed by the personal data protection rules of those service providers. Our company does not make decisions about approving or rejecting those transactions.

 

DO WE PROCESS PERSONAL DATA OF CHILDREN?

We consider the protection of the privacy of your children particularly important. For this purpose, we consciously do not collect any personal data of persons under 16 years of age. If you are under 16, please do not send us any personal data about yourself, including your name, residential address, telephone number or email address. No one under the age of 16 is authorised to enter their personal data on the Website. If we determine that any Personal Data we process relates to a person under the age of 16 and whose legal representative has not given consent to us, we will erase such Personal Data without undue delay. If you suspect that we might process data from or about persons under 16 years of age, please contact us at +387 70 33 00 640.

  

HOW DO WE PROCESS FINANCIAL TRANSACTIONS?

All financial operations and transactions carried out electronically on our Website or in the App or in connection with our Services will be processed through the online payment service provider Global Payments s.r.o., organisational unit, Tomášikova 48, 831 04 Bratislava. You can find the personal data processing conditions of these service providers here: https://www.globalpaymentsinc.com/sk-sk/gdpr. We provide your Personal Data to the above-mentioned online payment service providers only to the extent necessary to process the payments you carry out via our Website or App, to process refunds of such payments, and to resolve complaints and inquiries relating to such payments and refunds.

 

HOW DO WE COOPERATE WITH THIRD-PARTY WEBSITES?

On our Website there are hyperlinks and details about third-party websites.

We have no control over the terms and procedures of third parties regarding personal data processing, nor do we take responsibility for them.

 

DO YOU HAVE ANY OTHER QUESTIONS?

If you wish to contact us regarding the processing of personal data, including cases where you want to exercise one of the rights set out in these Conditions, please send us an email to: [email protected] or call us at +387 70 33 00 640.

 

HOW DO WE UPDATE OUR PERSONAL DATA PROCESSING CONDITIONS?

We reserve the right to amend these Conditions. In the event that we modify the Conditions or procedures, we will publish those changes on the Website or in the App so that you always have an overview of what information we collect, how we use it, and under what circumstances we can provide it to third parties. It is important that you regularly review these Conditions to ensure that you are informed about any changes.

 

WHAT COOKIES DO WE USE?

A cookie is a file containing an identifier (a string of letters and numbers) that is sent from the web server to the web browser and stored in the browser on your mobile device or computer for your identification (most often based on anonymous identifiers). This identifier is then sent back to the server every time the browser requests the display of a page, for the purpose of identifying your visit to a particular page, the list of advertisements you responded to, the type of browser you use, and for remembering the data you entered into our Website or App.

We use cookies to personalise the content and advertisements shown to you, to enable the use of social media features, and for analysing visits. We provide information about your use of our Website to our partners in the field of social media, advertising and analytics, who can combine it with other data you have provided or that they have collected due to your use of their services.

We use cookies to adapt to your needs, to distinguish you from other users, to prevent the display of advertisements in your browser that are not interesting to you, and so that you do not have to log in to our Website repeatedly.

We use either “persistent” or “temporary” cookies: persistent cookies will be stored in your web browser until the date specified as their expiry, if you do not remove them earlier; temporary cookies, on the other hand, expire as soon as you close the web browser.

We also use third-party cookies: Third-party cookies are cookies that are set by a different website rather than our Website or App. For example, “Like” social network buttons placed on their website. Such a button may download cookies which can then be read by the operators of those social networks. The purpose of these third-party cookies is usually to collect certain data for behaviour research, demographics, and ultimately for targeting for marketing purposes.

Cookies usually do not contain data on the basis of which you could be identified, but your Personal Data that we store may be linked to data collected and stored in cookies.

Technical cookies: so that our online store functions correctly (e.g. so that you can create a user account, log in to it and so that you can purchase goods and services), we use technical cookies. Without them, our online store would not function at all.

Functional cookies: to prevent you from having to log in again and again and so that you do not always have to set your preferences again (e.g. language settings for how our online store is shown to you), functional cookies help you. In this case, your password is always saved. Use of these cookies is not necessary, but it greatly facilitates and makes your visit to our online store via the Website or purchase via the App easier and more pleasant.

Analytical cookies: analytical cookies help us improve our Website and App, which ultimately benefits you as well. Analytical cookies on our website and in the App are collected by scripts of Google Inc., which then anonymise that data. After anonymisation, it is no longer personal data, since anonymised cookies cannot be linked to a specific user, i.e. a specific person. We use cookies only in anonymised form. Therefore, from them we cannot determine how a particular user behaved on our website or in the app (which pages they visited, which product they viewed, etc.).

We also use insights from these cookies for advertising purposes, where, based on these data, we can display advertisements on other websites that we believe will be relevant to you.

Please note that blocking and/or deleting cookies can negatively affect your ability to use the Website, App and/or our Services.

Last updated: 11.11.2025.