Privacy Policy

Last updated: 21 August 2026
This Privacy Policy explains how personal data is collected and processed in connection with HTT - Hybrid Training Tallinn.

1. Data controller

The data controller is:
Complete Performance OÜ
Registry code: 17523831
Registered address: Pirni tn 12, 10617 Tallinn, Estonia
Email: hybridtrainingtallinn@gmail.com
Operating as HTT - Hybrid Training Tallinn.

2. Personal data we process

Depending on how you interact with HTT, we may process:
● name and contact information;
● date of birth where necessary;
● membership and account information;
● bookings and attendance;
● payment and transaction information;
● communications with HTT;
● electronic gym-entry/access records;
● CCTV recordings;
● website usage and device information;
● cookie and analytics information;
● emergency contact information where provided;
● limited health or injury information voluntarily provided where relevant to safe
participation; and
● other information voluntarily provided to HTT.
HTT does not generally receive or store complete payment-card information where payments are handled directly by an external payment provider.

3. Why we process your information

Personal data may be processed to:
● create and administer memberships;
● provide gym access;
● manage class bookings and attendance;
● process and administer payments;
● provide training and other purchased services;
● communicate with members;
● provide customer support;
● maintain security and investigate incidents;
● protect members, staff and HTT property;
● prevent misuse of memberships and access credentials;
● comply with accounting, tax and other legal requirements;
● establish, exercise or defend legal claims;
● maintain and improve HTT's website and services; and
● provide marketing communications where permitted.

4. Legal bases

Depending on the processing activity, HTT processes personal data on the basis of:
Contract - where processing is necessary to provide a membership, booking, gym access or other requested service.
Legal obligation - where HTT must process or retain information to comply with applicable law.
Legitimate interests - including maintaining security, preventing misuse, operating and improving the business and protecting HTT's legal interests, provided those interests do not override the individual's rights and freedoms.
Consent - where consent is required, including certain marketing, analytics/cookie and photography activities.

5. Health-related information

Information concerning health may constitute special-category personal data.
HTT does not require members to provide extensive medical histories.
Where a member voluntarily provides information concerning an injury, health condition or limitation for safe participation, HTT will limit the collection and use of that information to what is reasonably necessary and process it only where an appropriate legal basis exists.
Access will be restricted to people who reasonably need the information.

6. Electronic access control

HTT uses an electronic access-control system to provide members with access to the premises and to protect the security of the gym.
Access records may include information such as the member's identity, credential/account identifier and date and time of entry.
Access data may be used to:
● provide gym access;
● prevent unauthorised access;
● investigate security or safety incidents; and
● protect HTT, its members, staff and property.
Access logs are retained only for as long as reasonably necessary for these purposes and applicable legal obligations.

7. CCTV / video surveillance

HTT uses CCTV in selected areas of the premises for security and safety purposes, particularly because the gym may operate during unstaffed periods.
CCTV may be used to:
● protect members, staff and property;
● prevent and investigate theft, vandalism and unauthorised access;
● investigate accidents and security incidents; and
● support the safe operation of the premises.
The legal basis for CCTV processing is Complete Performance OÜ's legitimate interest in protecting people, premises and property and maintaining the security of the facility.
CCTV is not installed in toilets, showers or changing areas.
Recordings are normally retained for a maximum of 30 days and then automatically deleted or overwritten unless a particular recording needs to be preserved for longer in connection with an accident, security incident, legal claim or legal obligation.
Access to recordings is restricted to authorised persons.
Recordings may be provided to police, emergency services, insurers, legal advisers or other recipients where there is an appropriate lawful basis.
A CCTV notice will be displayed before entry into monitored areas.

8. Website and cookies

HTT's website is operated using Wix.
The website may use cookies and similar technologies necessary for its operation.
HTT also uses or may use Google Analytics to understand website usage and improve its website and services.
Where consent is legally required, analytics, advertising and other non-essential cookies will not be activated until the website visitor has provided the appropriate consent.
Visitors may change or withdraw their cookie choices through the website's
cookie-management tools where available.

9. Service providers

HTT uses external service providers to operate its business.
These currently include or may include:
Wix - website hosting and website functionality.
IronTrack - membership, booking and gym-management services.
Montonio - payment services.

Google Analytics - website analytics.
Electronic access-control provider - gym access and security.
CCTV provider/system - video surveillance and security.
HTT may also use providers for accounting, email, IT, legal and other necessary business services.
Personal data is shared only to the extent reasonably necessary for the relevant purpose.

10. International data transfers

Some technology providers may process personal data outside Estonia or the European Economic Area.
Where personal data is transferred outside the EEA, HTT will use an appropriate transfer mechanism or safeguard where required by GDPR.

11. Retention

HTT does not retain personal data indefinitely.
Data is retained for as long as reasonably necessary for the relevant purpose and to meet applicable legal obligations.
In particular:
● membership information is generally retained for the duration of the membership and afterwards where necessary for legal, accounting or dispute-resolution purposes;
● accounting information is retained for the period required by Estonian law;
● CCTV is normally retained for a maximum of 30 days, unless preservation of specific footage is necessary;
● access-control records are retained only as long as reasonably necessary for access/security purposes and applicable legal obligations;
● marketing data based on consent is processed until consent is withdrawn or the information is otherwise no longer required.

12. Marketing communications

HTT may send marketing communications where it has an appropriate legal basis.
Where consent is required, marketing will only be sent after consent has been obtained.
Recipients may unsubscribe from electronic marketing at any time.
Essential communications relating to membership, payments, bookings, safety or changes to HTT services are not considered marketing communications.

13. Photography and video for marketing

HTT may photograph or film classes, events or activities.
Where an identifiable person's image is used for marketing and consent is required, HTT will obtain an appropriate legal basis or consent.
Members may inform HTT if they do not wish to participate in marketing photography or filming.

14. Your data-protection rights

Subject to the requirements and limitations of GDPR, individuals may have the right to:
● access their personal data;
● correct inaccurate information;
● request deletion;
● request restriction of processing;
● object to certain processing;
● receive certain personal data in a portable format; and
● withdraw consent where processing is based on consent.
Withdrawal of consent does not affect processing lawfully carried out before withdrawal.
Individuals may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

15. Data security

HTT takes reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.
Access to personal data is limited to persons who require it for legitimate business purposes.

16. Changes to this Privacy Policy

HTT may update this Privacy Policy where its services, technology or legal obligations change.
The current version will be published on the HTT website.

17. Contact

Questions concerning privacy or requests relating to personal data can be sent to:
Complete Performance OÜ / HTT - Hybrid Training Tallinn
Email: hybridtrainingtallinn