B2C Privacy Policy
Table of Contents
Effective as of: 18.06.2026
Preamble
This B2C Privacy Policy describes Eversports practices and your rights in connection with information, including personal data, we collect, use or disclose through:
- the Eversports app for Android and iOS, our consumer-facing mobile application;
- Eversports websites, including: eversports.at, eversports.be, eversports.ch, eversports.com, eversports.de, eversports.es, eversports.fr eversports.it, eversports.nl and other.
The text of this Privacy Policy is in English. Localised versions of this Privacy Policy in other languages may be available for informational purposes, but the English version shall be the only binding and authoritative version in case of a dispute.
1. Who We Are
1.1. Eversport GmbH, with its business address at Jakov,Lind,Strasse 13 / Tür 6 / 5. Stock, 1020 Vienna, Austria, is the primary data controller. This entity is also referred to as “Eversports”, "We", "Us", and "Our" in this Privacy Policy.
1.2. In this document you will find all the necessary information in accordance with Articles 13 and 14 of the General Data Protection Regulation. This Privacy Policy applies to all persons who visit our websites, use our app and receive our newsletters or other marketing updates.
1.3. We have appointed a data protection officer. You can contact him as follows:
Mr. Thorsten Brendel
ViCoTec IT,Sicherheit & Datenschutz GmbH & Co. KG
Im Technologiepark 12,
26129 Oldenburg, Germany
Email: dataprivacy@eversports.com
1.4. For all privacy related questions, requests, or complaints, please contact us at help@eversports.com. We aim to acknowledge your request within 5 (five) business days and respond within one calendar month from the date of the receipt of your request if no other statutory deadlines apply.
2. What Personal Data We Collect and Why
2.1. The data we collect and process depends on the nature of the interaction between you and Eversports. Eversports processes only the data necessary for the defined purposes, following the principle of data minimization.
2.2. We organised the sections below by the type of audience to give you an overview of the data processed, its purpose and legal basis, how long we retain the data and who are the recipients for this data. Type of audiences are: a) Website & App Visitors, b) Registered Users, c) Recipients of Newsletters & Other Marketing Updates.
Website visitors
If you are visiting one of our websites, we collect and process data to ensure a functional, secure, and user-friendly experience.
When visiting the website without logging in
When you are visiting one of our websites, the following data is collected and processed.
| Data Processed | Purpose | Legal Basis | Retention | Recipients |
|---|---|---|---|---|
| Server logs: IP address date/time name of requested page successful request status browser/OS/& device info data volume country of origin | Operation of the website Information security Optimizing online offering | GDPR Art. 6 (1) (f), Legitimate Interest | 30 days | Eversports; Eversports data processor (hosting, IT services); |
| Necessary cookies | Operation of the website; Personalizing content (e.g., language); Information security | GDPR Art. 6 (1) (f), Legitimate Interest | Stored on your device; can be deleted in browser settings | Eversports, Eversports data processor (hosting, IT services) |
| Analytics cookies | Optimization of services; Understanding interaction patterns | GDPR Art. 6 (1) (a), Consent | Stored on your device; Various retention periods apply. Deleted when your consent expires or you actively withdraw your consent. | Eversports data processor (advertising partners) |
| Advertising cookies: pages visited products viewed | Personalization of advertising for our own products on third,party websites | GDPR Art. 6 (1) (a), Consent | Stored on your device; Various retention periods apply. Deleted when your consent expires or you actively withdraw your consent. | Eversports data processor (advertising partners) |
| Error & crash reports: IP address Request date / time Requested URL Web browser / OS Error message, error codes, stack trace | Optimization of online offering by detecting and resolving technical issues | GDPR Art. 6 (1) (f), Legitimate Interest | 90 days | Product and development department |
Our websites use Necessary, Analytics and Advertising cookies as described above. You can find more information about cookies and other tools we use here. As the website visitor, you are not obliged to consent to analytics and advertising cookies. If you have done so, you can withdraw your consent at any time by reopening the consent options and unchecking the boxes. You will find a link to these options at the bottom of each page. Withdrawal of your consent will not affect the lawfulness of processing based on your consent before its withdrawal.
Filling in a contact form or contacting us by email
When you contact us by filling in a contact form on our website or by email, the following data will be processed.
| Data Category | Purpose | Legal Basis | Retention | Recipients |
|---|---|---|---|---|
| Email Communication Data Sender email Name, Timestamp message content | Managing and responding to your specific questions or requests. | GDPR Art. 6 (1) (f), Legitimate Interest | 12 months | Relevant Eversports employees; Eversports data processors (email provider). |
| Pre-contractual Data Inquiries regarding new services or partnerships | Handling business inquiries | GDPR Art. 6(1)(b), Pre-contractual measures or Contract performance. | 12 months, unless it leads to conclusion of a contract | Relevant Eversports sales/business development employees; Eversports data processors (email provider). |
| Commercial Correspondence Messages relating to commercial activities and classified as business letters | Statutory Record Keeping, Compliance with Austrian commercial and tax law. | GDPR Art. 6(1)(c), Legal Obligation | 7 years following the end of the calendar year of receipt. | Internal administration; Legal or tax advisors (if necessary). |
Registered users
If you are a registered User of Eversports Platform, we collect and process your data to provide our services as the market place and application, help you manage your bookings and payments, and enable core User Account and social features. Please note that our services are not intended for minors under 16 years old.
User Account Creation & Login
The following data is processed when you create an account or log in to the Eversports Platform:
| Data Category | Purpose | Legal Basis | Retention | Recipients |
|---|---|---|---|---|
| Account Data email, first and last name, optional phone number, hashed password | Creation and management of your user account; enabling login and access to the platform | GDPR Art. 6(1)(b), Contract performance | For the duration of the account; deletion upon request unless different legal retention period applies | Relevant Eversports employees; Eversports data processors (hosting, IT services) |
| SSO Login Data Google, Facebook, Apple identifiers; Metadata (date and time of account creation, last login, email verification status) | Authentication via third-party providers | GDPR Art. 6(1)(b), Contract performance | Only stored as necessary for authentication; account duration | Relevant Eversports employees, SSO providers (independent controllers); Eversports processors (third party providing the identifiers) |
Profile & Activity
The following data is processed to manage your profile and display your activity and entitlements within your account.
| Data Category | Purpose | Legal Basis | Retention | Recipients |
|---|---|---|---|---|
| Profile Data name, contact details | Managing your profile and enabling platform use | GDPR Art. 6(1)(b), Contract performance | Account duration | Eversports; Eversports processors |
| Activity Data bookings, history, credits, memberships | Displaying and managing your bookings, passes, and usage | GDPR Art. 6(1)(b), Contract performance | Account duration | Eversports; Eversports processors; sport providers (where relevant) |
| Reviews & User Content written review, date and time, profile data | Enabling feedback and reviews for sport providers, | GDPR Art. 6(1)(b), Contract performance | Account duration or until deletion | Eversports; Sport providers; other users*; Eversports processors |
| Stored Payment Methods (tokenized) | Facilitating faster checkout for future bookings | GDPR Art. 6(1)(b), Contract performance | Until removal by user or account deletion | Payment providers; processors |
| Voluntary information**: profile picture, sports experience, short bio, favorite sports facilities, friend contacts | Creation of detailed profile; visibility to other users | GDPR Art. 6(1)(b), Contract performance Where applicable** GDPR Art. 6 (1) (a), Consent | Until removal or deactivation of features by user or account deletion | Eversports; Sport providers; other users; Eversports processors |
| Rating data | calculating average rating for a sports provider | GDPR Art. 6 (1) (a), Consent | Account duration or until you actively withdraw your consent. | Eversports; Sport providers; other users; Eversports processors |
* This means that the data is effectively transferred to anyone who visits our website, including parties in non-EU/ECR countries. Whether personal data is actually published, i.e. whether you can be identified by someone visiting our website, depends heavily on two factors: who reads your review and what information you have provided. We (Eversports) can always attribute the review to you personally. Others only see the rating data, which may be anonymous. However, someone who already knows you could, for example, identify you from your profile picture alone or from the content of your written review.
** You can provide further voluntary information (sports experience, short bio, favorite sports facilities, upcoming activities). These serve as the basis for creating the detailed profile. If you share this voluntary information, this information will be visible to others as part of your public profile on Eversports Platform by default.
The profile data is grouped into so-called "profile sections" (personal details, sports experiences, upcoming activities, favorite sports facilities).
Additional profile information helps you to be found by other users who share your interests and with whom you can network. However, it is your decision whether you enter personal data in your profile and make it public. You should not add any personal data to your profile that you do not want to be publicly available.
In addition, so-called "profile views" can be set up, the visibility of which can be restricted to certain user groups (public, private, for friends). For each of these profile views, you can specify which profile sections you want to share.
** With the combination of the “Spot booking” and “Friends” functions, you can additionally see which spots your friend contacts have booked for sports activities, and they can also view the spots you have booked. This function allows you to specifically book spots next to your friends. The function is deactivated by default and requires your explicit consent pursuant to Art. 6 (1) (a) GDPR. The display of your booked spots will only take place if both you and the person wishing to view your spot have consented to this function. You may activate or deactivate it at any time in the privacy settings of your profile.
Bookings & Payments to the Studio
The following data is processed when you book services and complete payments via the platform.
| Data Category | Purpose | Legal Basis | Retention | Recipients |
|---|---|---|---|---|
| Booking Data sports provider, type of sport, product, date and time, location, (optional: number of participants, first time booking) | Managing reservations and enabling participation in sports services | GDPR Art. 6(1)(b), Contract performance | Account duration; legal retention where applicable | Sport providers (independent controllers); Eversports processors |
| Payment & Transaction Data payment details, payment method (anonymised), payment confirmation, transaction IDs, invoices | Processing payments and documenting transactions | GDPR Art. 6(1)(b); Art. 6(1)(c), Legal obligation (accounting) | 7 years (statutory retention) | Payment providers (independent controllers); sport providers; tax/legal advisors (if required) |
| Booking Overview | Display of all bookings within your account | GDPR Art. 6(1)(b), Contract performance | Account duration | Internal processing only |
Please note: For certain services offered by studios based in Italy, it is legally required to provide a valid medical certificate (“Certificato medico non agonistico”). In this context, only the fact that such a certificate has been provided and its period of validity (expiry date) are processed. The processing is carried out solely for this purpose and on the basis of the applicable Italian legal provisions. Depending on the booking and studio configuration, sport providers may also receive profile and contact information required to manage your participation and customer relationship.
Family Account Members
The following data is processed when you add and manage additional participants (including minors) within your account. When adding a minor under 16 years old, you must be a parent or legal guardian. Otherwise, you must obtain the consent of the person you are adding and have shown them this Privacy Policy.
| Data Category | Purpose | Legal Basis | Retention | Recipients |
|---|---|---|---|---|
| Family Member Data name, booking, related data; may include minors | Managing bookings for additional participants linked to your account | GDPR Art. 6(1)(b); Art. 6(1)(f), Legitimate interest in account functionality | Account duration | Sport providers; processors |
Note: We do not proactively request or require the date of birth of family members.
Using Friends Feature
The following data is processed when you use social features such as connecting with friends or sharing activities.
| Data Category | Purpose | Legal Basis | Retention | Recipients |
|---|---|---|---|---|
| Friend Connection Data profile references, shared activities | Enabling social features such as connecting, inviting, and viewing shared activities | GDPR Art. 6(1)(b), Contract performance | Account duration | Other users; processors |
Recipients of Newsletters & Other Marketing Updates
The following data is processed when you subscribe to and receive newsletters and other marketing communications. You can unsubscribe from marketing communications at any time via the privacy settings in your profile. Also at the bottom of each of the marketing communication emails you will find a link to unsubscribe from these messages.
| Data Category | Purpose | Legal Basis | Retention | Recipients |
|---|---|---|---|---|
| Marketing Communication Data email address, subscription status, interaction data | Sending newsletters and marketing updates; measuring and improving communication performance | GDPR Art. 6(1)(a), Consent; Art. 6(1)(f), Legitimate interest (direct marketing, where applicable) | Until withdrawal of consent or objection; thereafter limited storage for proof of consent | Eversports (marketing department); Eversports data processors (email/marketing tools) |
3. How We Handle Your Data
3.1. We share your personal data only where necessary to operate our website and the Eversports Platform, to provide requested services, and to fulfil contractual or legal obligations. Where possible, we limit data sharing to what is strictly necessary (data minimisation).
3.2. Your data may be shared within the Eversports Group for internal administrative and operational purposes.
3.3. We engage service providers (processors) who process personal data on our behalf and under our instructions. These processors are contractually bound in accordance with Art. 28 GDPR.
Processors support us in particular in the following areas:
- Hosting and infrastructure
- IT operations, security, and system monitoring
- Customer support and communication
- Analytics and performance measurement
- Marketing communication
Processors may only process your data in accordance with our documented instructions and are subject to appropriate confidentiality and security obligations.
3.4. In certain cases, your data is processed by third parties acting as independent controllers. This applies in particular to:
- Sport providers (Operators), when you attend their classes and interact with the Operators directly
- Payment service providers, when processing transactions
- SSO providers (e.g. Google, Facebook, Apple), when you use third,party login
These controllers process your data under their own responsibility and in accordance with their own privacy policies.
3.5. When you book a class or service with a sports provider (Operator), Eversports often acts as a processor on behalf of that Operator. In these instances, the Operator is the "Controller" (the decision-maker) under the GDPR, and we handle your data strictly according to their instructions. Essentially, we provide the digital tools (Eversports Manager) for the Operator to run their venue and manage their relationship with you. Because the Operator is responsible for how your data is handled in this context, we recommend also reviewing the specific privacy policy of the sports provider you are booking with.
3.6. For certain activities on the Eversports Platform we and the sports provider (Operator) collaborate to provide services. In these instances Eversports and Operator are responsible for the lawful handling of your data together. In the meantime, Eversports remains the sole controller for your User account on Eversports Platform, while the Operator becomes the sole controller once your data is managed within their internal Eversports Manager system for their own business operations.
3.7. Our website may include or link to third-party services (such as embedded content, social media icons or links to external websites). When you interact with such third party services, your data may be processed by these third parties under their own responsibility. If by clicking on such services you are being redirected outside of Eversports interface, please note that Eversports is not responsible for the privacy practices of external providers, and we recommend reviewing their respective privacy policies.
3.8. The Eversports websites and its Platform are hosted on servers in Germany. Our email servers are located within the EU. Where personal data is transferred outside the European Economic Area (EEA), such transfers are carried out in compliance with applicable data protection laws. Appropriate safeguards (e.g. standard contractual clauses) are implemented to ensure an adequate level of data protection. Eversports ensures adequate level of protection as follows:
(a) for transfers to countries covered by a European Commission adequacy decision under Article 45 GDPR, the adequacy decision;
(b) for transfers to recipients in the United States certified under the EU-US Data Privacy Framework, the Framework;
(c) for all other transfers, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 2 or Module 3 as applicable), supplemented where necessary by additional safeguards including encryption in transit and at rest, access controls, and contractual restrictions on government access requests, the SCC.
3.9 We implement a robust security framework to protect your personal data from unauthorized access, loss, or misuse. We also continuously evolve our security framework to meet the European standards, including compliance with the NIS2 Directive to ensure the resilience and availability of our digital services. Our Technical and Organizational Measures (TOMs) are reviewed regularly for effectiveness and include:
- Secure infrastructure: Our platform is hosted on secure infrastructure in geographically distributed, high-security data centers within Germany to ensure resilience and availability.
- Encryption: All data transmitted to us is protected using TLS/SSL and 256-bit encryption. Sensitive login credentials (passwords) are never stored in plain text but are secured using advanced cryptographic hashing (bcrypt).
- Strict access controls: We follow the "need-to-know" principle. Access to your data is restricted to authorized employees who require it for specific tasks, secured by Multi-Factor Authentication (MFA) and stringent password policies.
- Proactive monitoring: Our systems use automated monitoring and logging to detect and prevent security incidents (such as unauthorized access attempts or denial-of-service attacks).
- Data minimization & confidentiality: We process only the data necessary to provide our services and ensure that all employees and external partners are bound by formal confidentiality agreements.
4. Your Rights & How to Use Them
4.1. You have the right to access, rectify, erase, restrict the processing of your personal data, as well as the right to data portability and to object to processing. To exercise any of these rights, please contact Eversports via email to help@eversports.com.
4.2. You have the right to request confirmation as to whether personal data concerning you is being processed, access to that data, and to have inaccurate or incomplete data corrected. You may also request the erasure of your data, subject to applicable legal retention obligations.
4.3. You may request the restriction of the processing of your personal data where the conditions under applicable law are met. Additionally, you have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, and to transmit those data to another controller where technically feasible.
4.4. Where processing is based on our legitimate interests, you have the right to object, on grounds relating to your particular situation, at any time. If your data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.
4.5. Where processing is based on your consent, you have the right to withdraw this consent at any time with effect for the future. This can be done either by contacting Eversports directly or by using the mechanisms provided for each specific processing activity (e.g. unsubscribing via a link in marketing emails). Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
4.6. Under the GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. The Eversports Group does not carry out such decision-making.
4.7. If you believe that the processing of your personal data violates data protection laws, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. In Austria, this is the Data Protection Authority (www.dsb.at). You may also contact Eversports at help@eversports.com, and we will make every effort to address your concerns.