How Kaayu Gym Management meets its obligations under the EU General Data Protection Regulation for gym operators, staff, and members across Europe.
The General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") came into force on 25 May 2018 and applies to any organisation that processes the personal data of individuals located in the European Union or European Economic Area (EEA), regardless of where the organisation itself is based.
Kaayu Gym Management serves gym operators across Europe. As a result, we process personal data of EU/EEA residents — including gym members, staff, and operator contacts — and are subject to GDPR obligations. This page explains how we meet those obligations, what rights EU residents have, and how to exercise them.
This GDPR Compliance Statement should be read alongside our full Privacy Policy, which provides broader detail on the personal data we collect, how we use it, and the sub-processors we engage.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Full text available at gdpr-info.eu.
GDPR distinguishes between a Data Controller (who determines the purposes and means of processing) and a Data Processor (who processes data on behalf of the Controller). Kaayu operates in both capacities depending on the context.
When gym operators use Kaayu to manage their members' data — names, contact details, health information, membership records, access logs — the gym operator is the Data Controller and Kaayu acts as their Data Processor. We process that data strictly under the operator's instructions and do not use it for our own purposes.
EU gym operators who require a Data Processing Agreement (DPA) in compliance with GDPR Article 28 should contact legal@kaayu.online. We provide a standard DPA at no additional cost.
Kaayu acts as a Data Controller for personal data it collects for its own business purposes, including operator account contacts (name, email, billing address), marketing opt-in records, platform usage analytics, and support communications. For this data, Kaayu is solely responsible for GDPR compliance.
A GDPR-compliant DPA is available to all EU operator clients. Email legal@kaayu.online with subject line "DPA Request" and we will respond within 3 business days.
Under GDPR Article 6, every processing activity must have a lawful basis. Where Kaayu acts as a Data Controller (for its own operational data), the following lawful bases apply:
| Processing Activity | Lawful Basis | GDPR Article |
|---|---|---|
| Operator account management and platform access | Contract necessity — processing required to deliver the SaaS service | Art. 6(1)(b) |
| Billing and invoicing | Contract necessity and legal obligation (VAT records) | Art. 6(1)(b) & (c) |
| Platform security, fraud prevention, abuse detection | Legitimate interests — protecting the platform and its users | Art. 6(1)(f) |
| Aggregate, anonymised product analytics | Legitimate interests — improving the product | Art. 6(1)(f) |
| Marketing emails and product updates | Consent — opt-in at signup or via preferences | Art. 6(1)(a) |
| Optional analytics cookies | Consent — via cookie banner on first visit | Art. 6(1)(a) |
| Tax record retention | Legal obligation — EU VAT Directive and member-state tax law | Art. 6(1)(c) |
Where Kaayu acts as a Data Processor (processing gym member data on behalf of an operator), the lawful basis is the operator's own determination. Gym operators are responsible for identifying and documenting their lawful basis for processing member data.
GDPR grants EU/EEA residents a comprehensive set of rights over their personal data. The following rights apply to data for which Kaayu acts as Data Controller. For gym member data (where the gym operator is the Controller), members should contact their gym directly — operators can then coordinate with Kaayu as needed.
To exercise any of the above rights, email privacy@kaayu.online with the subject line "GDPR Rights Request" and describe your request. We will respond within 30 days and may need to verify your identity before processing the request. In complex cases we may extend by up to two further months, with notice.
If you are a gym member whose data is managed by a gym that uses Kaayu, your gym is the Data Controller for your membership data. Please contact your gym operator first. They can engage us directly to fulfil your request.
Kaayu's primary infrastructure is hosted on servers with data centre options in the EU (Frankfurt) and Singapore. EU gym operators can request EU data residency to ensure that member data does not leave the EEA — contact legal@kaayu.online to configure this option.
Where personal data is transferred outside the EEA (for example, to sub-processors headquartered in the Philippines or the United States), Kaayu relies on the following transfer mechanisms:
A full list of our sub-processors, including their locations and the transfer mechanism applied to each, is maintained in our Privacy Policy. EU operators may request a copy of the relevant SCCs by emailing legal@kaayu.online.
Kaayu retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Our retention schedule is as follows:
Gym operators (as Data Controllers) are responsible for setting appropriate retention policies within Kaayu for their members' data. Kaayu provides data deletion tools within the platform and will action deletion requests on behalf of operators.
Kaayu implements appropriate technical and organisational measures under GDPR Article 32 to ensure a level of security appropriate to the risk:
Kaayu has an incident response process aligned with GDPR Articles 33 and 34:
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, Kaayu will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (where Kaayu acts as Controller). Where Kaayu acts as Processor, we will notify the affected gym operator without undue delay so they can meet their own notification obligations to their supervisory authority.
Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, Kaayu (or the gym operator as Controller) will notify those individuals directly without undue delay, in clear and plain language describing the nature of the breach and the measures taken.
If you believe you have discovered a security vulnerability or data breach, please contact us immediately at security@kaayu.online. We will acknowledge all reports within 24 hours.
Kaayu implements the principles of Privacy by Design and Privacy by Default as required by GDPR Article 25. This means data protection is built into our systems and processes from the ground up, not added as an afterthought.
Kaayu has appointed a Data Protection Officer (DPO) to oversee our GDPR compliance programme, advise on data protection obligations, and act as the primary point of contact for data subjects and supervisory authorities on matters relating to the processing of personal data.
Data Protection Officer
Kaayu Technology Inc.
Email: dpo@kaayu.online
Phone: +63 947 984 1430
Manila, Philippines
The DPO can be contacted for any GDPR-related queries, to exercise your data subject rights, to request a copy of our DPA, or to raise concerns about our data processing activities. We aim to respond to all DPO inquiries within 5 business days.
If you believe that Kaayu has not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the supervisory authority in your EU member state without prejudice to any other administrative or judicial remedy.
The European Data Protection Board (EDPB) maintains a directory of national Data Protection Authorities at edpb.europa.eu. Common DPAs include:
We encourage you to contact us first at dpo@kaayu.online — most concerns can be resolved quickly and informally, and we are committed to addressing every inquiry seriously and promptly.
Our DPO is happy to walk you through how Kaayu handles EU personal data — plain language, no jargon.