Privacy Policy

The controller of personal data is:

This privacy policy is drafted in accordance with Law No. 124/2024 "On Personal Data Protection" of the Republic of Albania, in force since 31 January 2025, which is fully harmonized with the EU General Data Protection Regulation (GDPR).

The supervisory authority is the Commissioner for the Right to Information and Protection of Personal Data (IDP) — idp.al

Website forms:

• Free session form: first name, last name, phone, email, class type, preferred date and time
• Contact form: first name, phone, email, message

Gym membership:

• First name, last name, phone, email, birthday, gender, address, photo, card number

Technical data:

• Language preference (stored on your device via localStorage)
• IP address when visiting the website

• Consent — When you submit the free session or contact form, you give consent to data processing by accepting the Privacy Policy.
• Contractual necessity — Processing of member data is necessary for membership management.
• Legitimate interest — Communicating with you to respond to your inquiries.

• To respond to free session requests and contact messages
• To schedule and confirm sessions
• To manage your gym membership
• To record gym entrances
• For internal administration and service improvement

• Inquiry data (free sessions, contact): retained up to 2 years
• Member data: retained for duration of membership + 5 years (per commercial obligations)
• You may request deletion of your data at any time (see Section 8)

Under Law No. 124/2024, you have the following rights:

• Right of access — to know what data we hold about you
• Right to rectification — to correct inaccurate data
• Right to erasure — to request deletion of your data
• Right to restriction — to restrict data processing
• Right to portability — to receive your data in a structured format
• Right to object — to object to data processing

To exercise these rights, contact us at info@fitnessfirsttirana.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Commissioner for the Right to Information and Protection of Personal Data (IDP) at idp.al

We implement technical and organizational measures to protect your data, including:

• Encrypted communication (HTTPS/TLS)
• Secured database with restricted access
• Rate limiting to prevent abuse
• Token-based authentication for administrative panel

Google Maps may transfer data to Google's servers outside Albania (including the US). Google applies GDPR-compliant safeguards. For more information, visit privacy.google.com.

Our services are not intended for persons under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided personal data, please contact us.

We may update this policy from time to time. Changes will be posted on this page with the updated date. For material changes, we will provide notice through our website.

For any questions or requests regarding personal data protection: