Skip to content
← Split Gate

Personal Data Processing Notice

This is a translation for your convenience. The Slovak version is the original. Read the Slovak version

I. Preamble

  1. This notice on the processing of personal data is drawn up for the Split Gate application (“Split Gate” or the “Service”) operated on the website www.splitgate.app (the “Website”).
  2. This notice on the processing of personal data is drawn up in accordance with Art. XV of the Split Gate general terms and conditions available at: https://splitgate.app/terms (the “Terms”).
  3. This notice on the processing of personal data is drawn up in accordance with the applicable generally binding legislation, in particular but not only:
    1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the “GDPR”),
    2. Slovak Act No. 18/2018 Coll. on Personal Data Protection and on amendments to certain acts, as amended (the “Data Protection Act”),
    3. Slovak Act No. 452/2021 Coll. on Electronic Communications, as amended (the “Electronic Communications Act”).
  4. Personal data in Split Gate is processed in accordance with all the principles of personal data processing under Section 6 et seq. of the Data Protection Act and Art. 5 et seq. of the GDPR.
  5. The persons whose personal data the Service processes are the individual users of the Service (the “User” or, in the plural, the “Users”). Depending on the features of the Service, individual Users may act in different roles within the Service. For clarity, this notice therefore uses different names for Users according to their roles in the features of the Service, namely: “Registered users” (all Users with an account), “Athletes”, “Coaches”, “Clients” (Athletes who have accepted a Coach's invitation), “Gyms”, “Gym members”, “Gym admins”, “Class attendees”, “Event participants”, “Event organisers”, “Partners” (Athletes who turn partner discovery on), “Customers” (Users with a paid plan or a trial), “Reporters” (persons who report content) and “Visitors” (persons who use the Website without signing in). To a limited extent we also process personal data of persons who are not Users (for example athletes listed in the public results of HYROX events, or a partner whose name an Athlete enters for a Doubles race); in this notice they are called “other data subjects”. Unless this notice expressly states that personal data is provided to third parties outside the circle of Users, personal data is provided only within the relevant circle of Users.
  6. Where the User is a natural person, under the Terms it may only be a natural person who has reached the age of 16. Because we also process personal data of natural persons who have reached 16 but not yet 18, we have written this notice in the plainest language we could. If anything is unclear, we are ready to explain the matters set out in this notice at any time – please use the contact details in Article II.

II. Controller

  1. For the purposes of personal data processing in Split Gate, the controller is Delta Production IT s. r. o., with its registered office at Kukučínova 2043/4, 069 01 Snina, Slovakia, company ID (IČO): 55 881 645, registered in the Commercial Register of the District Court Prešov, section Sro, file no. 46919/P (the “Controller”).
  2. The Controller's contact details are:
    • E-mail: privacy@splitgate.app
    • Postal address: Delta Production IT s. r. o., Kukučínova 2043/4, 069 01 Snina, Slovakia

III. Personal data we process

  1. The Controller processes your personal data to the extent necessary for the purposes set out in this notice.
  2. The Controller processes personal data primarily by automated means, using devices and software solutions designed for that purpose with an adequate level of security and protection. The Controller declares that only persons expressly authorised to process personal data and duly instructed persons have access to the personal data.
  3. The Controller protects personal data against damage, destruction, loss, alteration, unauthorised interference and access, provision or disclosure, and against any other impermissible manner of processing. Appropriate technical, organisational and personnel measures corresponding to the manner of processing have been adopted for that protection.
  4. Where the legal basis for processing personal data is the contractual relationship between the Controller and you as a user: Providing your personal data is a contractual requirement. The data subject is obliged to provide the personal data; if it is not provided, the contractual relationship cannot be concluded or the relevant feature of the service cannot be properly provided. Unless this notice implies otherwise, the contractual relationship for the purposes of this notice means in particular the contractual relationships established between the Controller and the relevant User under the Terms.
  5. Where the legal basis for processing personal data is a law that obliges the Controller to process your personal data: Providing personal data is a statutory requirement. The data subject is obliged to provide the personal data; otherwise the Controller cannot properly fulfil its obligations under the applicable generally binding legislation.
  6. Where the legal basis for processing personal data is the Controller's legitimate interest: The legitimate interest is defined in the purposes of processing, which also state what kind of legitimate interest it is.
  7. Depending on which features of the Service you use, we process these categories of personal data:
    1. Account data - name, e-mail, password (stored only as a secure hash), profile photo, bio, public profile code and preferred language.
    2. Sport data - results and splits of HYROX-based races, division (which implies a sex and age category), home gym, ELO rating, league points, goals, target races and a partner's name for Doubles races.
    3. Training data - logged sessions, times, distances, sets, rate of perceived exertion (RPE), notes, training plans and AI insights.
    4. Partner discovery data - your note, intent, availability, target race and one contact (Instagram, WhatsApp or e-mail) that you choose.
    5. Coach and gym data - title, bio, specialties, contact and booking link on a coach card, schedule, bookings, classes and their results, and a coach's notes about a client.
    6. Payment and billing data - plan, subscription status, trial, billing name and address, and for businesses the business name, company ID, tax ID and VAT ID, invoices and their payments. Payment card details are processed solely by an external provider (Stripe) - we never see them.
    7. Communication with the Controller - messages in the Service's support, including the page of the application you wrote from.
    8. Technical data - IP address and e-mail on sign-in, registration and password reset attempts, error records, browser data for push notifications and the date of your last activity.
  8. The Controller declares that it does not process the following data: We do not store your date of birth, health data (for example body weight, heart rate) or location. Voice logging is transcribed to text by your browser itself (via Google in Chrome, via Apple in Safari); audio never reaches our servers and we do not keep the transcript after processing it.

IV. Source of personal data

  1. Unless this notice implies otherwise, most of the personal data we process as the Controller is given to us directly by you.
  2. From other sources we obtain this personal data about you:
    • your name, e-mail and profile photo from Google, if you sign in with it;
    • race results from the publicly available results of HYROX events;
    • data that a coach, gym or event organiser records about you (for example class results or a coach card), and a partner's name entered by another athlete for a Doubles race within the Service.

V. Disclosure of personal data (who sees it)

  1. Split Gate is a competitive, community application, so other Users can see part of your personal data. The data other Users can see is:
    1. Signed-in Users - your profile: name, photo, division, ELO, bio, home gym and race history.
    2. Members of leagues you join - name, home gym, ELO and league points on the leaderboard.
    3. League TV screen - a gym shows it on its premises through a link that needs no sign-in. It shows league members' names, ELO, rank, personal bests, station times, the number of sessions per week and benchmark workout times.
    4. Anyone with the link (= third parties) - races you choose to share (name, ELO and splits), and a coach card that a coach publishes, including the contact they put on it.
    5. Accepted connections, your coach and clients - personal best, league rank and your session list (name and date).
    6. A coach whose invitation you accept - your races, training, RPE, goals, plan adherence and AI brief. The coach does not see your e-mail.
    7. A gym and its admins - members' names and results in the monthly report, attendees of the gym's classes and events.
    8. Class board - attendees' names and their split into groups, through the class's unlisted link.
    9. Event organiser - the name, e-mail, division and results of registered participants. The organiser can export them and is itself responsible for any further use.
    10. Partner discovery - signed-in Users see your name, photo, division, personal best, gym and note; your contact is shown only after a mutually accepted connection.
  2. You can hide your races from other Athletes in Settings, in the Visibility section: your profile, the league TV screen, partner and crew cards, event start lists and the gym's monthly report then show none of your races or personal bests. League points and rank stay on the leaderboard, and your Coach still sees your races.

VI. Purpose, legal basis and retention period of personal data

  1. For each purpose we process only the personal data that purpose needs. The purposes of processing, the legal bases, the data subjects and the retention periods of personal data are set out in the table below. In the table, performance of a contract means performance of the contractual relationship under the Terms.

  • Registration, sign-in and user account management

    Legal basis
    Performance of a contract - Art. 6(1)(b) GDPR
    Data subjects
    Registered users
    Retention period
    While the account exists. After the account is deleted we erase the data without undue delay, except data we must keep under other rows of this table. Deleted data leaves the database backups within 30 days at the latest. An account nobody has signed in to for 24 months is deleted too, after two warnings by e-mail (30 and 7 days in advance); this does not apply to an account with a running plan or an unpaid invoice. An archived account is deleted 24 months after it was archived.

  • Providing the Service - race and training records, calculation of ELO and league points, leagues, leaderboards and personal bests

    Legal basis
    Performance of a contract - Art. 6(1)(b) GDPR
    Data subjects
    Registered users; other data subjects - a partner named for a Doubles race
    Retention period
    Until the record or the account is deleted

  • Finding and importing your results from the public results of HYROX events

    Legal basis
    Performance of a contract - Art. 6(1)(b) GDPR; for the data of other athletes in search results, legitimate interest - Art. 6(1)(f) GDPR (letting you find your own results)
    Data subjects
    Athletes; other data subjects - athletes whose name in the public results matches the search
    Retention period
    Search results 1 hour (temporary cache); imported races until the record or the account is deleted

  • AI features - race analysis, race plan, weekly AI insight and training plan, voice log processing, a Client brief for the Coach and machine translation of Coaches' and event texts

    Legal basis
    Performance of a contract - Art. 6(1)(b) GDPR
    Data subjects
    Athletes; Clients; Class attendees whose results a Coach records
    Retention period
    AI outputs until the record or the account is deleted; the voice log text is not kept

  • Coach-Client cooperation, bookings, classes and gyms - sharing training with a Coach, schedule, bookings, class results and the gym's monthly report

    Legal basis
    Performance of a contract - Art. 6(1)(b) GDPR
    Data subjects
    Coaches, Clients, Gyms, Gym members, Gym admins and Class attendees
    Retention period
    For the duration of the Coach-Client relationship or the gym membership, at the latest until the account is deleted

  • Finding a training and race partner

    Legal basis
    Consent - Art. 6(1)(a) GDPR, which you give by turning partner discovery on and withdraw by turning it off
    Data subjects
    Partners
    Retention period
    While you have discovery turned on; a contact exchanged in an accepted connection stays visible to the other Athlete until the account is deleted

  • Events - registration, start list and results

    Legal basis
    Performance of a contract - Art. 6(1)(b) GDPR
    Data subjects
    Event participants; Event organisers
    Retention period
    Until the event or the account is deleted

  • Subscription, trial, card payments and records of orders, consents and withdrawals from the contract under the Terms

    Legal basis
    Performance of a contract - Art. 6(1)(b) GDPR; checking one trial per person - legitimate interest, Art. 6(1)(f) GDPR
    Data subjects
    Customers
    Retention period
    While the account exists; this does not affect the keeping of accounting data to the extent and for the period needed to meet the Controller's statutory obligations

  • Invoicing, payment by bank transfer and bookkeeping

    Legal basis
    Legal obligation - Art. 6(1)(c) GDPR in conjunction with Slovak Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on Value Added Tax
    Data subjects
    Customers - natural persons and representatives of businesses
    Retention period
    10 years from the end of the year the invoice relates to - also after the account is deleted

  • Service e-mails and push notifications - e-mail verification, password reset, bookings, invoices, support replies, notices about the plan and the account, and announcements of changes to the Service

    Legal basis
    Performance of a contract - Art. 6(1)(b) GDPR
    Data subjects
    Registered users
    Retention period
    We do not keep sent e-mails; a push notification subscription until it is turned off or the account is deleted

  • Weekly league digest, monthly gym report and e-mails about partners and event results

    Legal basis
    Legitimate interest - Art. 6(1)(f) GDPR and Section 116(15) of the Electronic Communications Act (information about the Service you use)
    Data subjects
    Registered users
    Retention period
    Until you unsubscribe - with one click in the e-mail or in Settings

  • Support and handling your questions and requests

    Legal basis
    Performance of a contract - Art. 6(1)(b) GDPR
    Data subjects
    Users who contact us
    Retention period
    Until the account is deleted

  • Reporting and moderating content - receiving notices about content, deciding on them, restricting content or an account and giving reasons for the decision

    Legal basis
    Legal obligation - Art. 6(1)(c) GDPR in conjunction with Regulation (EU) 2022/2065 (Digital Services Act); legitimate interest - Art. 6(1)(f) GDPR (protecting the Service and Users from illegal content and breaches of the Terms)
    Data subjects
    Reporters; Users whose content or account the notice or the measure concerns
    Retention period
    While the notice is being handled and then for the limitation period of the claims that may arise from it

  • Security of the Service - protecting sign-in and registration from abuse, limiting the number of attempts and error records

    Legal basis
    Legitimate interest - Art. 6(1)(f) GDPR (security and functioning of the Service)
    Data subjects
    Registered users and Visitors
    Retention period
    Attempt records at most 30 days; technical logs and error records at most 90 days

  • Measuring traffic and use of the Service

    Legal basis
    Legitimate interest - Art. 6(1)(f) GDPR (improving the Service)
    Data subjects
    Visitors and Registered users
    Retention period
    The IP address and browser data are used only technically, when a page loads, to create an anonymous daily visit identifier and are not stored; only aggregated anonymous statistics are kept - no cookies and no identification of a person

  • Establishing and defending legal claims, handling data subject requests and cooperating with public authorities

    Legal basis
    Legitimate interest - Art. 6(1)(f) GDPR; legal obligation - Art. 6(1)(c) GDPR
    Data subjects
    Users and other data subjects
    Retention period
    For the limitation period and the duration of proceedings; records of handled requests 5 years

VII. Recipients of personal data

  1. Depending on the purpose and manner of processing, personal data may be made available in particular to these categories of recipients:
    1. providers of hosting, cloud, database and other IT infrastructure services,
    2. providers of payment and invoicing services,
    3. providers of electronic communication services, e-mail services and push notifications,
    4. providers of artificial intelligence services,
    5. providers of authentication, integration and external data services, including services that enable a connection with external sports platforms,
    6. providers of analytics services, where their use involves the processing of personal data,
    7. providers of accounting, legal and other professional services,
    8. coaches, operators of sports venues, organisers of sports events and other Users of the Service, to the extent that follows from the feature of the Service being used,
    9. public authorities and other entities to which the Controller is obliged or entitled to provide personal data under the applicable legislation.
  2. Some recipients or service providers we use in operating the Service may be established, or may process personal data, outside the European Economic Area (EEA), in particular in the United States of America. In that case such a transfer of personal data to third countries is governed by these rules:
    1. Where personal data is transferred to a third country for which the European Commission has adopted an adequacy decision under Art. 45 GDPR, the transfer takes place on the basis of that decision. For transfers to the United States of America we may rely in particular on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, where the recipient is certified under that framework.
    2. Where no adequacy decision applies to the transfer, we carry it out only with appropriate safeguards under Art. 46 GDPR, in particular on the basis of the standard contractual clauses adopted by the European Commission, where needed together with further measures required to ensure an adequate level of personal data protection.
    3. You can obtain more information about the specific transfer mechanism and the safeguards applied, and about how to obtain a copy of them, through the Controller's contact details given in this notice.

VIII. Rights of data subjects

  1. Right of access to personal data: You have the right to obtain confirmation of whether we process your personal data and, if we do, the right of access to that personal data and to information about its processing to the extent set out in Art. 15 GDPR. You also have the right to receive a copy of the personal data we process about you.
  2. Right to rectification of personal data: You have the right to request the rectification of inaccurate personal data concerning you and, having regard to the purposes of processing, the completion of incomplete personal data.
  3. Right to erasure of personal data: You have the right to request the erasure of your personal data where one of the grounds under Art. 17 GDPR applies, in particular where the personal data is no longer needed for the purposes for which it was collected or processed, you withdraw consent and there is no other legal basis for the processing, you successfully object to the processing, or the personal data was processed unlawfully. The right to erasure does not apply where further processing is needed, for example, to comply with a legal obligation or to establish, exercise or defend legal claims.
  4. Right to restriction of processing of personal data: You have the right to request the restriction of processing of your personal data in the cases set out in Art. 18 GDPR, in particular while the accuracy of the personal data is being verified if you contest it, where the processing is unlawful and you request restriction instead of erasure, where you need the personal data to establish, exercise or defend legal claims, or while an objection to processing based on legitimate interest is being assessed.
  5. Right to portability of personal data: Where the processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data you gave us in a structured, commonly used and machine-readable format and the right to transmit that data to another controller. Where technically feasible, you have the right to have it transmitted directly to another controller.
  6. Right to object to the processing of personal data: Where we process your personal data on the basis of the Controller's legitimate interest under Art. 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation. In that case we will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims. Where personal data is processed for direct marketing purposes, you have the right to object to that processing at any time; after the objection the personal data is no longer processed for those purposes.
  7. Right to withdraw consent to the processing of personal data: Where the processing of your personal data is based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
  8. Right in connection with automated individual decision-making: Under the conditions of Art. 22 GDPR you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Split Gate may use automated calculations, ratings and artificial intelligence tools; as the Service currently works, however, these do not constitute such automated individual decision-making within the meaning of Art. 22 GDPR.
  9. Right to lodge a complaint with a supervisory authority: If you believe that the processing of your personal data has infringed the GDPR or the Data Protection Act, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. In the Slovak Republic the supervisory authority is the Office for Personal Data Protection of the Slovak Republic: https://dataprotection.gov.sk/sk/kontakt/.
  10. You can exercise your rights through the contact details given in this notice. We will inform you of the action taken on your request without undue delay, at the latest within one month of receiving the request. Where necessary, taking into account the complexity and number of requests, we may extend this period by two further months. We will inform you of any such extension and the reasons for it within one month of receiving the request. If we have reasonable doubts about the identity of the person making the request, we may ask for additional information needed to confirm their identity.

IX. Cookies

  1. In accordance with Section 109(8) of the Electronic Communications Act we use only strictly necessary cookies, without which the Service does not work, so we do not need your consent to use them. The Service uses no advertising or tracking cookies.
  2. The cookies and local storage currently in use are listed below (on a secure connection the sign-in cookies carry the prefix __Secure- or __Host-):

  • authjs.session-token

    Purpose
    Keeping you signed in
    Expiry
    30 days

  • authjs.csrf-token, authjs.callback-url, authjs.state, authjs.pkce.code_verifier

    Purpose
    Sign-in security and signing in with Google
    Expiry
    Until the browser closes, at most 15 minutes

  • NEXT_LOCALE

    Purpose
    Remembering the chosen language
    Expiry
    1 year

  • Browser local storage

    Purpose
    Workout in progress, stopwatch, onboarding progress and the TV screen view - stays on your device only
    Expiry
    Until cleared in the browser

X. Final provisions

  1. This notice on the processing of personal data is drawn up as of 5 October 2026. The current wording of this notice on the processing of personal data is always available on the Website.
  2. We may change or update this notice on the processing of personal data from time to time, in particular when the manner or purposes of processing personal data, the services and technologies used, or the applicable generally binding legislation change.
  3. We will inform you in a suitable way of material changes to this notice on the processing of personal data that may affect the processing of your personal data or the exercise of your rights before the change starts to apply.