1 Controllers

UniSport, University of Helsinki (Business ID 0313471-7)
P.O. Box 53 (Fabianinkatu 28)
FI-00014 University of Helsinki
Tel. +358 2941 22151

Technogym S.p.A.
Via Calcinaro 2861
47521 Cesena (FC), Italy

2 Contact persons in matters concerning the processing of personal data

UniSport

UniSport customer service
P.O. Box 53 (Fabianinkatu 28)
FI-00014 University of Helsinki
Tel. +358 2941 22151, unisport.asiakaspalvelu@helsinki.fi

Contact the University of Helsinki Data Protection Officer by e-mail: tietosuoja@helsinki.fi

Technogym

Data Protection Officer dpo@technogym.com

3 Description

UniSport provides its customers with online sports services (such as group exercise classes and workout videos) that customers use through the Mywellness application provided by Technogym. In order to access the UniSport online services, the customer must have their customer information in the UniSport customer register, Technogym's Mywellness account and, for some UniSport services, a product that entitles the customer to use them (such as a training card or an online training card).

The Mywellness application is a service offered by Technogym for supporting, guiding and monitoring exercise and for producing group exercise. In addition to exercising, the service enables the monitoring of the customer's exercising activity.

4 Purpose of processing of personal data and legal basis

UniSport

UniSport processes customers' personal data as described in the privacy statement for customer data. The data referred to in section 5 is collected from customers so that they can be granted the right to reserve and use UniSport's online services in the Mywellness application and, if necessary, be notified of a change or cancellation of the reserved service. The processing of personal data is based on the agreement between UniSport and the customer.

Technogym

The personal data collected in connection with the registration and provision of the Mywellness application will be used by Technogym to produce and develop the application.

Personal data is also used for marketing and market research concerning Technogym's products and/or services (including the sending of newsletters that can be cancelled at any time by selecting Unsubscribe).

Technogym has customised the Mywellness application to meet UniSport's needs. Technogym also provides similar services through the application in cooperation with other operators. These operators do not have access to the personal data of UniSport's customers without a permission given by the customer. The customer manages the permissions they have granted in their own information in the Mywellness service and application.

Technogym's full privacy policy statement is available at https://www.mywellness.com/cloud/Terms/Privacy

5 What personal data do we process

UniSport processes the following information in the Mywellness application:

• The customer's first name, surname, gender, e-mail address, telephone number, user ID in UniSport's system, information on access rights (such as a training card, an online training card, a course) and their validity (active or outdated), the date on which the access right or course starts or ends, the date when the Mywellness account was created.
• The customer's acceptance of terms of use, the customer's reservations, cancellations and participation information made in the Mywellness application
• A limited number of UniSport personnel who act as application administrators also have access to data collected through the application to enable customer support

Technogym processes the following information in the Mywellness application:

• Personal details (first name, surname, gender, e-mail address, password, date of birth)
• Weight (min. 30 kg) and height (min. 60 cm) indicated by the customer
• Acceptance of Technogym's privacy policy statement and terms and conditions
• Geo-localisation information if the customer gives a permission

More information in Technogym's privacy policy statement.

6 Regular sources of data

The name, gender, e-mail address, telephone number, date of birth, access rights and user ID are automatically transferred to the Mywellness application from Unisport's Enkora customer information system. The customer then registers in the application and enters their password, weight, height, language and country. The customer can edit the data transferred from UniSport's system in the application (such as e-mail address, telephone number, gender, name, date of birth).

Data related to the use of the service are collected in the Mywellness application when the customer uses services through the application.

7 Regular disclosures of data

UniSport

UniSport does not disclose data related to the use of the Mywellness application to third parties.

Technogym

According to its privacy policy statement, Technogym discloses personal data to the service providers who are used by the customer and authorised by them in the Your gyms section under Settings or to third parties authorised by the customer to communicate with them through the Mywellness application. These service providers and third parties process personal data in accordance with their privacy policy statements.

During an exercise or online group exercise class, the customer gives their consent to display their name (or a nickname of their choice) to other participants in their own information in the section My Details, Profile Preferences.

According to its privacy policy statement, Technogym may disclose personal data for legal reasons while adhering to the principle of proportionality and minimal processing requirements.

More information in Technogym's privacy policy statement.

8 How long will we process your personal data

UniSport

UniSport processes the personal data of its customers for the time specified in the privacy statement for customer data.

Technogym

As for the Mywellness application, data is stored in the application as long as the service is active for the customer. Personal data will be anonymised by Technogym when the customer deletes their account. When the Mywellness service has not been used for five years, Technogym will send two quarterly reminders and, if the customer does not react, their account will be anonymised.

9 Transmission of data outside the EU or EEA

The service provider for Mywellness, Technogym, uses subcontractors (such as Amazon Web Services and Google) who may disclose information outside the European Union. The data is transmitted using standard contractual clauses approved by the EU Commission.

10 What rights do you have?

To use your rights, you can edit and delete your data through the Mywellness service and application.

Right to access data

You have the right to be informed of what personal data we process and how they are processed. You can also request a copy of the personal data being processed. The user interface of the system is available on the Internet, where the customer can check their data and reservation information by means of personal identification.

Right to the rectification of data

If your personal data is inaccurate or incorrect, you have the right to request their rectification or supplementation. The customer can personally edit their information in the Mywellness application. Incorrect information can also be reported to UniSport's customer service where it will be rectified or where the customer is assisted in rectifying the information or in communicating the need for rectification to Technogym's Data Protection Officer.

Right to delete data

You can delete your personal data at any time by deleting your account from the Mywellness application.

In accordance with the General Data Protection Regulation, you have the right to request the deletion of your personal data in the following cases:

• personal data is no longer needed for the purposes for which they were collected
• you withdraw the consent on which the processing was based and there is no other legal basis for processing
• you object to the processing (the description of the right to object is below) and there is no justified reason for the processing
• unlawful processing of personal data

Right to the restriction of processing

You have the right to request that the processing of your personal data be restricted. This means that we will store your data, but we will not process it in any other way.

You have this right in the following cases:

• you dispute the accuracy of your personal data, in which case the processing is restricted during a period within which we can verify that they are correct
• The processing is illegal and you are opposed to the deletion of personal data and require that their use be restricted instead
• we no longer need such personal data for the purposes of processing, but you need it to establish, present or defend a legal claim

Right to transfer data from one system to another

You have the right to receive the personal data you provide to us in a structured, commonly used and machine-readable format and to transfer that data to another controller.

Right to object

You have the right to object to the processing of your personal data if the processing is based on a legitimate interest (such as marketing).

Right of appeal

If you have any questions regarding the processing of your personal data, you can always contact the contact persons mentioned in section 2. However, you also have the right to lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi) if you consider that the processing of your personal data has violated valid data protection legislation.

11 Changes to the privacy statement

We may make changes to this privacy statement. You can always find the latest version of the privacy statement in the Mywellness application and on UniSport's website.