Privacy Policy

Last updated: 19.10.2026

This Privacy Policy describes how ИВП ВЕНЧЪРС ЕООД, UIC 204104685 ("Story Gym", the "Controller", "we"), processes the personal data of users of the client area at my.story-gym.org, in accordance with Regulation (EU) 2016/679 (GDPR).

1. Data controller

ИВП ВЕНЧЪРС ЕООД, UIC 204104685, registered address: България, гр. София (1379), р-н Възраждане, жк. Сердика, бл. 12А, ет. 11, ап. 33. Venue: Story Gym, ул. Панайот Волов №31, гр. Пазарджик. Contact: support@story-gym.org.

2. Data we collect

• Account data: name, email address, hashed password.
• Purchase data: type of access bought, date/time, gym entry history.
• Payment data: handled entirely by DSK Bank's virtual POS. We do not collect or store bank card data. If automatic renewal is selected, we keep only a secure reference (token) to the card issued by the bank — not the number or security code.
• Invoicing data: if an invoice is requested — company or personal details (name/company, UIC/personal number, VAT No., address, responsible person), kept for accounting and tax purposes.
• Device data: a technical identifier of the bound device, used to protect against access being shared between multiple people.
• Technical data: IP address, session/language/theme cookies; Cloudflare Turnstile for abuse protection.
• Documents you upload: parental consent (for minors), proof of registration with a sports club (for the athlete discount) and screenshots of a review or post (for a coupon). They are kept so we can verify your entitlement and are erased when the account is deleted.
• Conversations with the automated assistant: questions and answers in the chat are stored to improve the service and may be reviewed by us.
• Record of a spent free workout: if your free workout has been used and you then delete your account, we keep only first name, surname and date of birth so that it is not granted twice. This record holds no e-mail, phone or history and is erased on request to support@story-gym.org.

3. Purposes and legal basis

• Creating and maintaining an account and providing the service — performance of a contract (Art. 6(1)(b));
• Processing payments and issuing documents — contract and legal obligation (b, c);
• Security and fraud prevention, including the one-off nature of free and promotional entitlements — legitimate interest (f);
• Verifying entitlement to a discount (club registration, review/post) — contract and legitimate interest (b, f);
• Database backups, stored encrypted and erased automatically after 90 days — legitimate interest in service continuity (f);
• Accounting and tax purposes — legal obligation (c).

4. Recipients

Data is shared with processors only as necessary: DSK Bank (card payment processing), Cloudflare, Inc. (hosting, protection and Turnstile). We do not sell personal data.

5. Retention

Account data is kept until the account is deleted. Accounting records are kept for statutory periods. Technical logs are kept for a limited period for security.

6. Payments

Card payments are processed via DSK Bank's virtual POS, using the Mastercard Identity Check and Visa Secure programs. Card details are entered on the bank's secure page and never reach us.

7. Your rights

You have the right to access, rectification, erasure, restriction, portability and objection. Contact us at support@story-gym.org.

8. Supervisory authority

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), Sofia, Bulgaria, kzld.bg.

9. Cookies

We use only necessary cookies — for session (login), language and theme. Cloudflare Turnstile may set its own technical cookies for bot protection.

10. Contact

ИВП ВЕНЧЪРС ЕООД, UIC 204104685, България, гр. София (1379), р-н Възраждане, жк. Сердика, бл. 12А, ет. 11, ап. 33, support@story-gym.org.