Privacy policy

Responsible

Manhatten Fitnessanlagen GmbH
Wildpretstraße 11
1110 Wien
Austria

Phone: +43 1 368 73 11-0
E-mail: [email protected]

Data Protection Officer

We have appointed a data protection officer for our company:
DPO Consult GmbH
Karl Pusch
Joanneumring 18
8010 Graz
Austria

Phone: AT: ++43 800 224 488 DE: +49 800 22 44 880
E-Mail: [email protected]
Register Court: Graz

Responsible Data Protection Agency

The data protection authority is the regulatory agency for data protection established under the General Data Protection Regulation (GDPR) and the Data Protection Directive for the law enforcement sector in Austria.
Austrian Data Protection Authority:
Barichgasse 40-42
1030 Wien

Phone: +43 1 521 52-25 69
E‑Mail: [email protected]

Objection to advertising E-Mails

The use of contact data published within the framework of the imprint obligation for the purpose of sending advertising and information material not expressly requested is hereby prohibited. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, such as spam e-mails.

Data Processing

We process personal data for the following purposes, resulting from the list of processing activities, Art. 30 EU-DSGVO:

Provision of the website
Presentation of our offers and courses on the website
Processing of interested parties and customer inquiries (contact form)
Applicant management (contact form)
Processing of service requests
E-mail newsletter
Manhattan App
Social media presence on Facebook and Instagram

Legal Bases of Data Processing

We process personal data on the basis of the following legal grounds:

Art. 6, para. 1 lit. a. EU-DSGVO
The data subject has given consent to the processing of personal data concerning him or her for one or more specific purposes

Art. 6, para. 1 lit. b. EU-DSGVO
The processing is necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the data subject’s request

Art. 6, para. 1 lit. c. EU-DSGVO
Processing is necessary for compliance with a legal obligation to which the controller is subject

Art. 49, para. 1 lit. a EU-DSGVO
The data subject has given his or her explicit consent to the proposed data transfer after having been informed of the potential risks to him or her of such data transfers without the existence of an adequacy decision and without appropriate safeguards

Storage Periods

Unless a more specific storage period has been specified within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be deleted once these reasons no longer apply.

Website and Online Apperance

a. Nature and purpose of the processing
Your data will only be used to send you the newsletter you have subscribed to by e-mail. Your name is provided in order to be able to address you personally in the newsletter and, if necessary, to identify you if you wish to exercise your rights as a data subject. To receive the newsletter, it is sufficient to provide your e-mail address. When registering to receive our newsletter, the data you provide will be used exclusively for this purpose. Subscribers may also be informed by e-mail about circumstances relevant to the service or registration (e.g. changes to the newsletter offer or technical circumstances). For an effective registration, we require a valid e-mail address. In order to verify that a registration is actually made by the owner of an e-mail address, we use the “double-opt-in” procedure. For this purpose, we log the order for the newsletter, the sending of a confirmation e-mail and the receipt of the response requested herewith. No further data is collected. The data is used exclusively for sending the newsletter and is not passed on to third parties.

b. Legal basis of the processing
On the basis of your express consent (Art. 6 para. 1 lit. a GDPR, Art. 7 GDPR in conjunction with § 107 para. 2 TKG), we will regularly send you our newsletter or comparable information by e-mail to your specified e-mail address.

c. Data categories

E-mail address
Last name
First name

d. Recipient

Employees of the IT and marketing department
Service provider for sending the newsletter

e. Storage periods
In this context, the data will only be processed as long as the corresponding consent is given. Afterwards they will be deleted.

f. Legal / contractual requirement
The provision of your personal data is voluntary, based solely on your consent. Unfortunately, we cannot send you our newsletter without your consent.

g. Third country transfer
The processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

h. Revocation of consent
You can revoke your consent to the storage of your personal data and its use for sending the newsletter at any time with effect for the future. You will find a link to this effect in every newsletter. In addition, you can also unsubscribe directly on this website at any time or inform us of your revocation using the contact option provided at the end of this data protection notice.

i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.

Use of CloudFlare

a. Nature and purpose of processing
Our website uses CloudFlare. CloudFlare is a CDN (content delivery network). CloudFlare distributes the content of our website to the CloudFlare server worldwide so that our website is delivered in an accelerated manner. In addition, it serves as DDOS protection and another firewall is placed in front of our website.

b. Legal basis of the processing
The use of “CloudFlare” is carried out with legitimate interest according to Art. 6 para. 1 lit. f) DSGVO in the availability and stability of our online offer.

c. Data categories

IP address
Information about the system configuration
Name of the website
Date and time of the request
Name and URL of the retrieved file
Amount of data transferred
Status information
Operating system
Referrer URL
Requesting provider
Device type
Time of server request

d. Recipient

Employee of the Marketing and IT department of Manhatten Fitnessanlagen GmbH
CloudFlare

e. Storage periods
After the end of the purpose and the end of the use of Cloudflare by us, the data collected in this context will be deleted.

f. Legal / contractual requirement
The provision of your personal data is voluntary, based solely on your consent. Without the provision of your personal data, we cannot grant you access to our offered content and services.

g. Third Party Transfer
CloudFlare processes your data in the USA.

i. Automatic decision-making and profiling
As a responsible company, we do not use automatic decision-making or profiling for this data processing.

Use of Usercentrics

a. Nature and purpose of the processing
This website uses Usercentrics, a consent management service provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Münschen, Germany. The use of Usercentrics enables us to obtain and manage a website user’s consent to data processing.

b. Legal basis of the processing
Processing of data is necessary to comply with Art. 7 (1) DSGVO, a legal obligation to which we are subject pursuant to Art. 6 (1) p. 1 lit. c DSGVO. The following categories of data are processed:

c. Data categories

IP address
URL of the visited page
Opt-in and opt-out data
Date and time of consent
Browser information
Device information
Location
Banner language

d. Recipient

Employees of the Marketing and IT Department of Manhatten Fitnessanlagen GmbH
Usercentrics GmbH

e. Storage periods
Data will only be processed in this context as long as the corresponding consent has been given. Afterwards, they will be deleted, provided that there are no legal retention obligations to the contrary. To contact us in this context, please use the contact details provided at the beginning of this privacy policy.

f. Legal / contractual requirement
The provision of your personal data is voluntary, based solely on your consent. If you prevent access, this may result in functional restrictions on the website.

g. Third country transfer
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

h. Revocation of consent
You can revoke your consent to the storage of your personal data at any time with effect for the future. You can notify us of your revocation at any time using the contact option provided at the beginning of this privacy notice.
You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.

Use of Google Analytics

a. Nature and purpose of the processing
This website uses Google Analytics, a web analytics service provided by Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland. Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of the website will be transmitted to and stored by Google on servers in the United States. However, due to the activation of IP anonymisation on these websites, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. The purpose of the data processing is to evaluate the use of the website and to compile reports on website activities. Further associated services are then to be provided on the basis of the use of the website and the internet.

b. Legal basis of the processing
The processing of the entered data is based on the user’s consent (Art. 6 para. 1 lit. a GDPR).

c. Data categories

IP address (shortened/anonymised)

d. Recipients

Employees of the IT and marketing department
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

g. Third country transfer
Processing will not take place outside the European Union (EU) or the European Economic Area (EEA).

h. Withdrawal of consent
You can revoke your consent to the storage of your personal data at any time with effect for the future. You can notify us of your revocation at any time using the contact option provided at the beginning of this privacy notice.
You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. In addition, you can prevent the collection of the data generated by the cookie and related to your use of the website (incl. your IP address) to Google as well as the processing of this data by Google by downloading and installing the browser plugin available under the following link: “Browser Add On to deactivate Google Analytics”.

i. Automatic decision-making and profiling
With the help of the tracking tool Google Analytics, the behaviour of visitors to the website can be evaluated and interests analysed. For this purpose, we create a pseudonymous user profile.

Use of Google Tag Manager

a. Nature and purpose of the processing
Use of Google Tag Manager: Google Tag Manager is a solution that allows marketers to manage website tags through one interface. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, this remains in place for all tracking tags implemented with Google Tag Manager: http://www.google.de/tagmanager/use-policy.html

b. Legal basis of the processing
The processing of the entered data is based on the user’s consent (Art. 6 para. 1 lit. a GDPR).

c. Data categories
Google Tag Manager itself does not store any personal data. The personal data is collected by the tags of the respective web analytics tool used.

d. Recipients
Recipients of the data are internal employees of the marketing and IT department and Google as a processor. For this purpose, we have concluded the corresponding order processing agreement with Google.

e. Storage periods
Data will only be processed in this context as long as the corresponding consent is given. Afterwards, they will be deleted, provided that there are no legal storage obligations to the contrary. To contact us in this context, please use the contact details provided at the beginning of this privacy policy.

g. Third country transfer
Processing will not take place outside the European Union (EU) or the European Economic Area (EEA).

i. Profiling
The Google Tag Manager tool can be used to evaluate the behaviour of visitors to the website and analyse their interests.

Use of Facebook Pixel

a. Nature and purpose of the processing
The Facebook Pixel is a JavaScript code implemented on our website to link people’s behaviour on the website to Facebook user profiles. It collects data that helps track conversions, optimise ads and create audiences.

b. Legal basis of the processing
The processing is carried out pursuant to Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in the functionality of our website.

c. Data categories
Please refer to Facebook’s privacy policy to find out which specific data is collected and how it is used:
Facebook: http://www.facebook.com/policy.php

d. Recipients

Employees of the IT department of our company
Facebook

e. Storage periods
The data collected directly by us via the pixel will be deleted from our systems as soon as the purpose for storing it no longer applies, you request us to delete it, revoke your consent to store it or the purpose for storing the data no longer applies. Stored cookies remain on your end device until you delete them. Mandatory legal provisions – in particular retention periods – remain unaffected.
We have no influence on the storage period of your data that is stored by Facebook for its own purposes. For details, please contact Facebook directly (e.g. in their privacy policy, see above).

f. Legal / contractual requirement
The provision of your personal data is voluntary. Without the provision of your personal data, we cannot grant you access to our offered content and services.

g. Third country transfer
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.

Use of ImageKit

a. Nature and purpose of the processing
Imagekit enables us to customize and optimize images on our website. ImageKit’s provider is ImageKit Private Limited, 1201, Lords CGHS, Plot -7 Sector-19B, Dwarka, New Delhi, 110075, INDIA.

b. Legal basis of the processing
The processing of the entered data is based on the user’s consent, moreover we have a legitimate interest to present our website in an optimal way (Art. 6 para. 1 lit. a DSGVO).

c. Data categories

IP address
Date and time of the request
Information on the browser and operating system used

d. Recipient
Recipients of the data are internal employees of the IT and marketing department and ImageKit.

g. Third country transfer
The processing of your data takes place in India.

Use of Preeco

We use an external service for the ongoing updating of the data protection declaration. No personal data is collected when calling up the information obligations according to Art. 13ff, the so-called data protection declaration.
For data protection management and the protection of data subject rights according to Art. 15ff EU-DSGVO, data collection is necessary for secure communication.

Use of Social Media Plugins

a. Type and purpose of processing
Social plugins from the providers listed below are used on our websites. You can recognise the plugins by the fact that they are marked with the corresponding logo.
Information, which may include personal data, may be sent to the service provider via these plugins and may be used by the service provider. We prevent the unconscious and unintentional collection and transmission of data to the service provider through a so-called Shariff solution. Only by clicking on the plugin is the collection of information and its transmission to the service provider triggered. We do not collect any personal data ourselves by means of the social plugins or through their use.

We have no influence on what data an activated plugin collects and how it is used by the provider. At present, it must be assumed that a direct connection to the provider’s services is established and that at least the IP address and device-related information is collected and used. There is also the possibility that the service providers try to save cookies on the computer used.

b. Legal basis of the processing
The processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in the functionality of our website.

c. Data categories
Please refer to the data protection information of the respective service provider to find out which specific data is collected and how it is used:
Facebook: www.facebook.com/policy.php
Instagram: help.instagram.com/155833707900388

d. Recipient

Employees of the IT department of their own company
Meta Platforms Inc (Facebook and Instagram)

e. Storage periods
The data collected directly by us via the social media plugins will be deleted from our systems as soon as the purpose for storing it no longer applies, you request us to delete it, revoke your consent to store it or the purpose for storing the data no longer applies. Stored cookies remain on your end device until you delete them. Mandatory legal provisions – in particular retention periods – remain unaffected.
We have no influence on the storage period of your data, which is stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policy, see above).

f. Legal / contractual requirement
The provision of your personal data is voluntary. Without the provision of your personal data, we cannot grant you access to our offered content and services.

g. Third country transfer
Processing takes place in the USA.

i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.

Use of Plugins to download our App

a. Nature and purpose of the processing
Plugins from the providers listed below are used on our websites to enable you to download our app. You can recognize the plugins by the fact that they are marked with the corresponding logo.
Via these plugins, information, which may include personal data, may be sent to and possibly used by the service provider. We prevent the unconscious and unintentional collection and transmission of data to the service provider through a so-called Shariff solution. Only by clicking on the plugin, the collection of information and its transmission to the service provider is also triggered. We do not collect any personal data ourselves by means of the social plugins or about their use.
We have no influence on what data an activated plugin collects and how it is used by the provider. Currently, it must be assumed that a direct connection to the provider’s services is established and that at least the IP address and device-related information is collected and used. Likewise, there is the possibility that the service providers attempt to store cookies on the computer used.

b. Legal basis of the processing
The processing is carried out in accordance with Art. 6 (1) lit. f DSGVO on the basis of our legitimate interest in the functionality of our website.

c. Data categories
Please refer to the data protection notices of the respective service provider to find out which specific data is collected in this context and how it is used:
Google Play: policies.google.com/privacy
App Store: www.apple.com/legal/privacy

d. Recipient

Employees of the IT department of our own company
Google
Apple

e. Storage periods
The data collected directly by us via the social media plugins will be deleted from our systems as soon as the purpose for storing them no longer applies, you request us to delete them, revoke your consent to store them or the purpose for storing the data no longer applies. Stored cookies remain on your terminal device until you delete them. Mandatory legal provisions – in particular retention periods – remain unaffected.
We have no influence on the storage period of your data, which is stored by the operators of social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policy, see above).

f. Legal / contractual requirement
The provision of your personal data is voluntary. Without the provision of your personal data, we cannot grant you access to our offered content and services.

g. Third country transfer
Processing takes place in the USA (Apple) and within the EU/EEA (Google).

i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.

Online Appearance on Facebook

a. Nature and purpose of the processing
We appreciate your interest in our presence on FACEBOOK. We would like to give you an overview of what data is collected, used and stored by us there.
Social networks can usually comprehensively analyse your user behaviour when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media presence on Facebook triggers numerous processing operations relevant to data protection. In detail:
If you are logged into your Facebook account and visit our social media presence, Facebook can assign this visit to your user account. However, your personal data may also be collected under certain circumstances if you are not logged in or do not have an account on Facebook. In this case, this data collection takes place, for example, via cookies that are stored on your end device or by recording your IP address. With the help of the data collected in this way, Facebook can create user profiles in which your preferences and interests are stored. In this way, you can be shown interest-based advertising inside and outside Facebook. If you have an account on Facebook, the interest-based advertising can be displayed on all devices on which you are logged in or have been logged in. Please also note that we cannot track all processing on Facebook. Therefore, additional processing operations may be carried out by Facebook. For details, please refer to Facebook’s terms of use and privacy policy.

b. Legal basis of the processing
The processing is carried out in accordance with Art. 6 para. 1 lit. f. GDPR on the basis of our legitimate interest of contacting our customers. The analysis processes initiated by Facebook may be based on different legal bases, which are to be specified by Facebook (e.g. consent within the meaning of Art. 6 (1) lit. a GDPR).

c. Data categories
Please refer to Facebook’s data protection information to find out which specific data is collected and how it is used:
Facebook: http://www.facebook.com/policy.php

d. Recipients

Employees of the IT department of our own company
Facebook

e. Storage periods
After the end of the purpose and the end of the use of Facebook by us, the data collected in this context will be deleted.

f. Legal / contractual requirement
The provision of your personal data is voluntary. Without the provision of your personal data, we cannot grant you access to our offered content and services.

g. Third country transfer
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.

Online Appearance on Instagram

a. Nature and purpose of the processing
Thank you for your interest in our presence on INSTAGRAM. We would like to give you an overview of what data is collected, used and stored by us there.
Social networks can usually comprehensively analyse your user behaviour when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). By visiting our social media presence on Instagram, numerous data protection-relevant processing operations are triggered. In detail:
If you are logged into your Instagram account and visit our social media presence, Instagram can assign this visit to your user account. However, your personal data may also be collected under certain circumstances if you are not logged in or do not have an account on Instagram. In this case, this data collection takes place, for example, via cookies that are stored on your end device or by recording your IP address. With the help of the data collected in this way, Instagram can create user profiles in which your preferences and interests are stored. In this way, you can be shown interest-based advertising inside and outside Instagram. If you have an account on Instagram, the interest-based advertising can be displayed on all devices on which you are logged in or have been logged in. Please also note that we cannot track all processing on Instagram. Further processing operations may therefore be carried out by Instagram. For details, please refer to Instagram’s terms of use and privacy policy.

b. Legal basis of the processing
The processing is carried out pursuant to Art. 6 para. 1 lit. f. GDPR on the basis of our legitimate interest of contacting our customers. The analysis processes initiated by Instagram may be based on deviating legal bases to be indicated by Instagram (e.g. consent within the meaning of Art. 6 (1) lit. a GDPR).

c. Data categories
Please refer to Instagram’s privacy policy to find out which specific data is collected and how it is used:
Instagram: https://help.instagram.com/155833707900388

d. Recipients

Employees of the IT department of your own company
Facebook

e. Storage periods
After the end of the purpose and the end of the use of Instagram by us, the data collected in this context will be deleted.

f. Legal / contractual requirement
The provision of your personal data is voluntary. Without the provision of your personal data, we cannot grant you access to our offered content and services.

g. Third country transfer
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.

Data Security

The personal data of every individual who has a contractual, pre-contractual or other relationship with our company deserves special protection. We aim to maintain our level of data protection at a high standard. That is why we focus on the continuous development of our data protection and data security concepts. We are therefore committed to protecting your privacy and treating your personal data confidentially. In order to prevent manipulation, loss or misuse of your data stored with us, we take extensive technical and organisational security precautions which are regularly reviewed and adapted to technological progress. These include, among other things, the use of recognised encryption procedures (SSL or TLS).  However, we would like to point out that, due to the structure of the Internet, it is possible that the rules of data protection and the above-mentioned security measures are not observed by other persons or institutions not within our sphere of responsibility. In particular, data disclosed unencrypted – e.g. if this is done by e-mail – can be read by third parties. We have no technical influence on this. It is the user’s responsibility to protect the data he or she provides against misuse by encrypting it or in any other way.

Data Subject Rights

If personal data is processed by you as a user, you are considered a data subject in accordance with the GDPR. Data subjects have the following rights vis-à-vis the controller:

Right of access (Art. 15 GDPR)
Right to rectification or erasure of personal data (Art. 16, 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to communication in connection with the rectification or erasure of your personal data or the restriction of processing (Art. 19 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)
Right to revoke declarations of consent given. The lawfulness of the data processing carried out until the revocation remains unaffected due to the consent valid to date. (Art. 7 para. 3 GDPR)
Right to complain to the supervisory authority (Art. 77 GDPR)

Our Right to Change the Policy

Since changes in the law or changes in our internal company processes may make it necessary to adapt this data protection declaration, we ask you to read through this data protection declaration regularly. The data protection declaration can be accessed at any time. We therefore reserve the right to amend this policy at any time in compliance with data protection law.

Overview of the Processors

If, in the course of our processing, we disclose data to other persons and companies (order processors, jointly responsible persons or third parties), transmit it to them or otherwise grant them access to the data, this shall only be done on the basis of a legal permission (e.g. if a transmission of the data to third parties, such as to payment service providers, is necessary for the performance of the contract), users have consented, a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.). If we disclose or transfer data to other companies in our group of companies or otherwise grant them access, this is done in particular for administrative purposes as a legitimate interest and, in addition, on a basis that complies with legal requirements.
The following organizations, companies or persons have been commissioned by the operator of this website to process data:

Google Ireland Limited
Gordon House, Barrow Street,
Dublin 4,
Ireland
Phone: +353 1 543 1000
Email: [email protected]
Website: https://about.google

Usercentrics GmbH
Sendlinger Street 7,
80331 Munich,
Germany
Phone: + 49 89 21 54 01 20
Email: [email protected]
Website: https://usercentrics.com

Cloudflare GmbH
Rosental 7,
80331 Munich, Germany,
Germany
Phone: +49 89 2555 2276
Email: [email protected]
Website: https://www.cloudflare.com

ImageKit Private Limited
Caddie Commercial,
Tower5th floor, Aerocity,
New Delhi, Delhi 110037,
India
Email: [email protected]
Website: https://imagekit.io

Responsible

Data Protection Officer

Responsible Data Protection Agency

Objection to advertising E-Mails

Data Processing

Legal Bases of Data Processing

Storage Periods

Website and Online Apperance

Newsletter

Use of CloudFlare

Use of Usercentrics

Use of Google Analytics

Use of Google Tag Manager

Use of Facebook Pixel

Use of ImageKit

Use of Preeco

Use of Social Media Plugins

Use of Plugins to download our App

Online Appearance on Facebook

Online Appearance on Instagram

Data Security

Data Subject Rights

Our Right to Change the Policy

Overview of the Processors

List of Cookies and External Services