Privacy Notice — "Match" Welcome Promotion
Last updated: April 2026
1. Controller
Digital Technologies OÜ, Reg. 16576446, Harju maakond, Tallinn, Kesklinna linnaosa, Estonia.
Place of central administration: Calle Conde de Altea 46, 46005 Valencia, Spain.
General contact: [email protected] — Data-protection contact: [email protected]
2. Data We Collect
| Category | Examples | Purpose |
|---|---|---|
| Identity | Full name, business name | Account creation, eligibility |
| Contact | Email, phone | Communication, verification |
| Business | Address, gym type | Eligibility, onboarding |
| Financial | Payment method (via Stripe) | Processing deposit |
| Technical | IP, device info, Promo Link ID | Fraud prevention, analytics |
3. Lawful Basis
- Email verification, promo delivery: Art. 6(1)(b) — contract performance
- Anti-fraud cross-referencing: Art. 6(1)(f) — legitimate interest
- Tax record-keeping: Art. 6(1)(c) — legal obligation
- Marketing emails: Art. 6(1)(a) — consent
4. Automated Decision-Making (Art. 22 GDPR)
When you apply for the Promotional Credit, our system automatically checks whether the same phone number, business address, or advertising platform account has been used by another participant. If a match is found, the credit is automatically denied.
You have the right to: (1) request human review of this decision, (2) express your point of view, and (3) contest the decision — via the dispute form in the dashboard or by emailing [email protected].
5. Cross-Referencing Disclosure
To enforce the "one promotion per business" rule, your data may be compared against data provided by other promotional participants. This is based on our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).
6. Obligation to Provide Data (Art. 13(2)(e))
Providing identity, contact, business, and financial data is required for participation. Without it, you cannot participate in the promotion.
7. Data Sharing
Recipients: Stripe (payments), Meta/Google (ads), Brevo (email). All within EU/EEA or protected by Standard Contractual Clauses.
8. Data Retention
- Converted accounts: duration + 7 years (Estonian Accounting Act)
- Non-converted links: 1 year after expiry
- Rejected/fraud data: 6 years
- Disputes: resolution + 3 years
- IP addresses: 90 days full, then anonymized for 1 year
9. Your Rights
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent. Contact: [email protected]
10. Supervisory Authority
Lead supervisory authority: Agencia Española de Protección de Datos (AEPD, aepd.es), as Pilotium's place of central administration is in Valencia, Spain. You may also complain to the Estonian Data Protection Inspectorate (aki.ee) or the supervisory authority of your habitual residence (Art. 77 GDPR).
11. Cookie
The pilotium_promo cookie is classified as strictly necessary (links your promo visit to registration). No consent required. Duration: 7 days.