Privacy Policy and Data Protection

1. Who we are and our role

BarmajTek operates in the Hashemite Kingdom of Jordan. Gym Tek is its product for managing memberships, attendance, classes and training in gyms.

• When you visit the website, create an account or subscribe to Gym Tek, we are the "data controller" and decide the purposes and means of processing.
• When a gym uses Gym Tek to manage its members and staff, the gym is the "controller", and we process that data on its behalf and only on its instructions as a "processor".

2. Data we collect

• Account data: name, email address, phone number, gym name, city and role, with the password stored hashed.
• Gym Tek subscription data: the chosen plan, the trial period and subscription payment records by CliQ or bank transfer. We do not store bank card numbers.
• Usage and security data: IP address, browser and device type, sign-in times, sessions and security logs.
• Cookies: only those needed for sign-in, form protection and remembering your language (section 4).
• Communications: your messages to us by email or WhatsApp.
• Gym member and staff data: what the gym enters in the platform (section 11), which we process only as a processor.

3. Purposes and legal basis

• Providing the service: creating accounts, running the platform and delivering features, based on performing our contract with you.
• Billing and subscription collection: issuing invoices and tax compliance, based on contract and legal obligation.
• Support and operational communication: answering your requests and sending important account messages such as email confirmation and password recovery, based on contract and legitimate interest.
• Security and abuse prevention: protecting accounts, security logs and limiting repeated attempts, based on legitimate interest.
• Marketing: sending product news if you agreed to it at signup; you can withdraw that consent at any time.

4. Cookies

We use necessary cookies only: a session cookie that keeps you signed in, a cookie that protects forms against forged requests, and your display language. We use no advertising cookies and no third-party tracking tools on the Gym Tek website.

5. Data sharing and third parties

We do not sell personal data. We share it with trusted service providers only as far as needed to run Gym Tek:

• Hosting and cloud infrastructure that store and run the platform.
• Email providers that send account messages.
• WhatsApp: only when a gym enables messaging and connects its account, the member's phone number and the message text go to the WhatsApp provider.
• CliQ and banks: members or gyms pay from their own banking app, and we never see their bank account details.
• The national invoicing system (JoFotara) and the Income and Sales Tax Department for tax compliance.
• Public authorities where a legal obligation or court order requires it.

These providers are contractually bound to protect the data and use it only for the stated purpose.

6. International transfers

Some data may be stored or processed on servers outside Jordan by cloud service providers. In that case we apply appropriate safeguards in line with the Personal Data Protection Law No. (24) of 2023.

7. Data retention

We keep data for the length of the subscription and as long as needed for the purposes of processing or for legal compliance, such as accounting and tax records. The gym decides how long its members' data is kept. When the relationship ends, we delete or return the gym's data on its request, unless the law requires otherwise.

8. Data security

• Encryption in transit (TLS) and hashed password storage.
• Each gym's data is isolated at database level, so no gym can see another gym's data.
• Permissions by role (owner, branch manager, reception, trainer) and by branch.
• Optional extra code check at owner sign-in, and a session list where sessions can be ended.

Despite these measures, no transmission over the internet can be guaranteed fully secure.

9. Your legal rights

Under Jordanian law, you have the right to:

• Access your personal data and receive a copy of it.
• Correct inaccurate or incomplete data.
• Delete your data within the limits the law allows.
• Object to or restrict a specific processing.
• Withdraw your consent at any time for processing based on consent.
• Lodge a complaint with the competent supervisory authority in Jordan.

To exercise your rights, email info@barmajtek.com. If you are a member of a gym, contact your gym first, as it controls your data, and we will help it answer your request.

10. Minors' data

Our services are intended for gyms and adults. If a gym registers members under the legal age, the gym is responsible for obtaining their guardians' consent.

11. Gym member and staff data

A gym enters its members' and staff data in Gym Tek, and we process it only on the gym's instructions. It includes:

• Member details: name, phone number, email address if given and gender where needed, plus memberships, invoices and payments.
• Attendance: check-in time, branch and device, and the result of the entry decision.
• Classes and training: bookings, workout plans, logged sessions, weights and progress, and any measurements the gym records.
• Women-only gyms: with "women only" mode on, members' photos are hidden, only first names appear on the check-in screen, and measurements are visible to authorised staff only.
• Staff: name, email address, role, branch and sign-in history.

This relationship is governed by the Terms and Conditions, including our commitment to notify the gym without undue delay of any breach affecting its data, and to delete or return its data on its request.

12. Changes to this policy

We may update this policy from time to time. We publish the updated version with a new date and notify you of material changes by email or in the platform.

13. How to contact us

• Legal name: BarmajTek
• Email: info@barmajtek.com
• Support: support@barmajtek.com
• Website: barmajtek.com
• Address: Hashemite Kingdom of Jordan