At Star Gym 24/7, we take your privacy seriously. This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and what rights you have under the Law on Personal Data Protection of the Republic of North Macedonia (Official Gazette no. 42/20 and 294/21, “DP Law”) — which is largely harmonised with the EU General Data Protection Regulation (GDPR).
1. Data Controller
The data controller responsible for your personal data is:
📍 Star Gym LLC Skopje
Company Registration No.: 7273720 · Tax ID (EDB): 4038018513244
Registered address: Bosna i Hercegovina 14-2/15, Butel, Skopje
Business location: Tale Hristov 2, Skopje 1000, North Macedonia
Phone: +389 75 240 430 · Email: info@stargym.mk
As the data controller, Star Gym 24/7 determines the purposes and means of processing your personal data. For questions about this policy or to exercise your rights, contact us at the details above.
2. What Data We Collect
Account Data
- Full name
- Email address
- Hashed password (never stored in plain text)
- Preferred language (used for the emails we send you)
- Account creation date and login activity
Membership Data
- Active membership plan (Monthly / 6-Month / 12-Month)
- Membership start and end dates
- Membership status (active, expired, cancelled)
- Remaining access time
- Date your gym access card was issued
Trainer Assignment Data
- Assigned personal trainer's name and email address
- Training schedule, programme notes, diet notes and other notes entered by your trainer (for example, fitness goals you share)
Payment Data
- Billing history (payment dates, amounts in MKD, plan type)
- Payment status (successful, pending, failed)
- Order number, and the bank's transaction ID and authorisation code
- Masked card number (first 6 and last 4 digits only), as returned by the bank
💳 Star Gym 24/7 does NOT store your full card number, CVV, or bank account details. Card data is entered on, and handled exclusively by, our acquiring bank's PCI DSS-compliant virtual POS (3-D Secure / Visa Secure / Mastercard ID Check).
Usage & Technical Data
- Email address entered, IP address and browser type on each sign-in attempt
- Error reports (technical error details, page address, browser type and, if you are signed in, your user ID)
3. Legal Basis for Processing
We process your personal data on the following legal bases under the DP Law:
- Performance of a contract — to activate your membership, manage billing, and provide dashboard access
- Legitimate interests — to maintain platform security, prevent fraud, and improve our services
- Consent — only where we specifically ask you for it, which you may withdraw at any time
- Legal obligation — to comply with financial, tax, and data protection regulations applicable in North Macedonia
4. How We Use Your Data
- Activate and manage your gym membership
- Provide access to your personal member dashboard
- Process membership payments and send billing receipts
- Connect you with your assigned personal trainer
- Allow your trainer to track your progress and sessions
- Send transactional emails (account creation, payment confirmations, membership expiry notices)
- Detect and prevent unauthorised access or fraudulent activity
- Respond to your support requests or complaints
- Comply with our legal obligations under North Macedonian law
5. Third-Party Data Processors
We share your data with the following trusted sub-processors. Each is bound by contractual obligations to protect your data:
Hosting, Database and Email Providers
We use Supabase Inc. (USA) for authentication and our database, Vercel Inc. (USA) to host the website, and Resend Inc. (USA) to send account emails, payment receipts and membership reminders. Your account credentials, membership data and dashboard information are stored on Supabase's secure servers. Where the provider is located outside North Macedonia, data is transferred under Standard Contractual Clauses (SCCs), in compliance with DP Law cross-border transfer requirements.
Acquiring Bank (Card Payment Processing) — Halkbank AD Skopje
Our acquiring bank processes membership card payments through its secure virtual POS using 3-D Secure (Visa Secure / Mastercard ID Check). Your card details are entered directly on the bank's PCI DSS-compliant payment page; we never receive or store your full card number, expiry, or CVV. The bank receives the transaction details necessary to authorise and settle your payment.
⚠️ We do not sell your personal data to any third party. We do not use your data for advertising purposes or share it with marketing platforms.
6. Data Retention
- Account data (name, email, gym card history, health-data consent) — kept while you have an account. If you ask us to delete your account, we delete it within 30 days of your request
- Membership records — kept for 5 years from the end of the year in which the membership ended, to comply with North Macedonian accounting and tax laws. If you delete your account, they are kept without your name
- Payment records — kept for 5 years from the end of the year of payment, as required by law. If you delete your account, they are kept without your name or card digits. Card checkouts that were never paid are deleted after 90 days
- Trainer session notes — retained for 2 years after the client-trainer relationship ends
- Sign-in records (email address entered, IP address, browser type) — 90 days
- Security audit logs — 180 days
- Error reports (technical details, page address, browser type, your user ID if you were signed in) — 90 days
7. Your Rights Under the DP Law
Under the Law on Personal Data Protection, you have the following rights:
Right of Access (Art. 15)
You may request a copy of all personal data we hold about you. Email us from the address on your account and we will send it to that address.
Right to Rectification (Art. 16)
You may request correction of inaccurate or incomplete data.
Right to Erasure — Right to be Forgotten (Art. 17)
You may request deletion of your data where it is no longer necessary for the purpose it was collected, or where you withdraw consent. You can ask for it from Profile in your account. We then delete your name, email, coach notes, health-data consent, gym card history and sign-in records. Payment and membership records that accounting law requires us to keep are kept without your name until the end of the retention period (see Section 6). A running membership ends when the account is deleted.
Right to Restriction of Processing (Art. 18)
You may request that we limit how we use your data in certain circumstances.
Right to Data Portability (Art. 20)
You may request your personal data in a structured, machine-readable format (JSON) to transfer to another service. Ask us by email and we will send you the file.
Right to Object (Art. 21)
You may object to processing based on legitimate interests or for direct marketing purposes.
Right Not to Be Subject to Automated Decisions (Art. 22)
We do not currently use automated decision-making or profiling that produces legal or similarly significant effects on you.
📧 To get a copy of your data, or to exercise any other right, email us at info@stargym.mk from the address on your account; we send copies only to that address. You can also ask for your account to be deleted from Profile in your account (if your membership has ended, from the membership screen after you sign in). We will respond within 30 days, as required by the DP Law.
8. Cross-Border Data Transfers
Some of our infrastructure providers are located outside North Macedonia. Any such transfers of your personal data are carried out under Standard Contractual Clauses (SCCs) — the legally recognised safeguard under the DP Law for transfers to third countries that do not have an adequacy decision from the North Macedonian DPA (AZLP). Card payment processing is handled by our acquiring bank within North Macedonia.
We have notified AZLP of these transfers as required by the DP Law. If you wish to obtain a copy of the applicable SCCs, contact us at info@stargym.mk.
9. Security Measures
We take the security of your personal data seriously and implement appropriate technical and organisational measures, including:
- All data in transit encrypted via TLS/HTTPS
- Encryption of data at rest
- Passwords stored using strong, one-way hashing (never readable)
- Role-based access control (trainers can only see their own clients)
- Regular security reviews of our platform and infrastructure
- Logging of sign-in attempts, with a temporary lockout after repeated failed attempts
🚨 In the event of a personal data breach that poses a risk to your rights and freedoms, we are obliged to notify AZLP within 72 hours and, where required, notify affected individuals without undue delay.
10. Cookies & Analytics
Our platform uses only essential cookies: the sign-in session cookie (named “sb-…-auth-token”, sometimes split into several parts, set when you log in, sent only over a secure (HTTPS) connection, and kept for 30 days from your last visit unless you log out) and the language cookie “NEXT_LOCALE” (remembers the language version you opened and expires when you close your browser). We do not use analytics, advertising or other third-party cookies, and our pages do not load third-party tracking scripts.
You can control cookie settings in your browser, but disabling essential cookies may prevent you from logging in to your dashboard.
11. Children's Privacy
Online accounts are only for people aged 18 or older, and the sign-up form asks you to confirm this. Members under 18 are registered at our reception with the consent of a parent or guardian. If you believe someone under 18 has created an account online, please contact us and we will delete it promptly.
12. Sensitive Data
Fitness goals or health-related information you share with your trainer (for example an injury, a medical condition or medication) may constitute health data under the DP Law, a special category of personal data. Your trainer may only record such information with your explicit consent, which you give, and can withdraw at any time, on the My Coach page of your dashboard or by contacting us. When you withdraw it, your trainer is asked to remove that information. It is visible only to your assigned trainer and to Star Gym’s administrators; reception staff cannot see it. You may request its deletion at any time.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will update the “Last updated” date and notify registered users by email. We encourage you to review this policy periodically.
14. Contact the Data Controller
For any questions about this Privacy Policy, to exercise your rights, or to request your data:
📍 Star Gym 24/7 — Tale Hristov 2, Skopje 1000, North Macedonia
📞 +389 75 240 430
📧 info@stargym.mk
We will respond to all requests within 30 days.
15. Right to Lodge a Complaint with AZLP
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Personal Data Protection Agency of North Macedonia (AZLP):
🏛️ Personal Data Protection Agency (AZLP)
Boulevard Goce Delcev 18, 1000 Skopje, North Macedonia
Website: azlp.mk
We would appreciate the opportunity to address your concerns before you contact AZLP — please reach out to us first at info@stargym.mk.
See also: Terms of Service →