Logo New
COME AND EXPLORE THE CLUB
Coolfit
BUY CARD
Logo New
Coolfit
COME AND EXPLORE THE CLUB

Privacy Policy

PERSONAL DATA AND CONSENTS PROTECTION POLICY

“PULSE MANAGEMENT” EOOD

  1. INTRODUCTION

“PULSE MANAGEMENT” EOOD, UIC 203779555, with registered office and management address: Sofia 1766, Mladost district, 251E Okolovrasten Pat St., Ring Tower Business Building, entrance A, floor 1, hereinafter referred to as “PULSE”, “we”, “us” or the “Company”, respects the right to privacy and the protection of personal data of its clients, members, visitors, partners and website users pulsefit.bg.

This Policy aims to inform you what personal data we collect and process, for what purposes we use it, on what legal basis, how long we store it, with whom we may share it, and what your rights are under applicable law.

“PULSE MANAGEMENT” EOOD processes personal data in accordance with Regulation (EU) 2016/679 (“GDPR”), the Personal Data Protection Act, and other applicable European and Bulgarian legislation.

For the purposes of this Policy, “personal data” means any information relating to an identified or identifiable natural person.

This Policy applies when using PULSE services, entering into and performing a membership agreement, visiting our facilities, using mobile applications and digital services, as well as using the website pulsefit.bg.

  1. PERSONAL DATA CONTROLLER

The controller of your personal data is:

“PULSE MANAGEMENT” EOOD
 UIC: 203779555
 Registered office and management address:
 Sofia 1766, Mladost district,
 251E Okolovrasten Pat St.,
 Ring Tower Business Building, entrance A, floor 1

Website: pulsefit.bg
 Phone: 0700 44 044
 E-mail: office@pulsefit.bg

“PULS MANAGEMENT” LTD determines the purposes and means of processing personal data and is responsible for their lawful processing in accordance with the GDPR, the Personal Data Protection Act and applicable legislation.

  1. WHAT PERSONAL DATA WE MAY PROCESS

Depending on the services used and how you interact with PULSE, we may process the following categories of personal data:

3.1. Identification data

  • first and last name;
  • date of birth;
  • photo;
  • data required for identification and access control;
  • membership card data, QR code or other identifier.

3.2. Contact data

  • phone number;
  • email address;
  • address, when required for a specific service or contract;
  • other contact details provided by you.

3.3. Membership and service usage data

  • type and term of membership;
  • contractual relationships;
  • payments and obligations;
  • visit history;
  • services used;
  • training reservations;
  • information on the use of the mobile app;
  • participation in campaigns, promotions and loyalty programs.

3.4. Financial and transaction data

Depending on the payment method, we may process information related to:

  • payments made;
  • invoices;
  • purchase and service history;
  • data required for direct debit or other payment transactions.

When payment is made through an external payment provider, the processing of payment data may be carried out directly by the relevant provider in accordance with its privacy policy.

3.5. Data on service use

We may process information about:

  • your visits to our facilities;
  • reservations;
  • use of training and other services;
  • participation in group classes;
  • use of the mobile app;
  • use of other digital services related to PULSE.

3.6. Photos and video recordings

For identification and access control purposes, a client photo may be used.

In certain areas of the facilities, video surveillance systems may be used for security, prevention of violations, and protection of life, health, and property.

When group workouts or other events are held, video recording may be carried out for the purpose of providing digital services or for marketing purposes, where applicable and where the necessary information has been provided and/or the required consent has been obtained.

  1. SPECIAL CATEGORIES OF PERSONAL DATA

PULSE does not require clients to provide medical information, except where this is necessary for a specific service and permitted under applicable law.

If you voluntarily provide information about your health condition, physical limitations, dietary requirements, or other information that may constitute a special category of personal data within the meaning of the GDPR, this information will be processed only where there is an appropriate legal basis and in compliance with the applicable requirements for the protection of such data.

  1. PURPOSES OF PROCESSING

PULSE processes personal data for the following purposes:

5.1. Conclusion and performance of a contract

  • creation and management of a customer profile;
  • conclusion and performance of a membership contract;
  • provision of fitness, sports, SPA, and other agreed services;
  • management of membership status;
  • processing of payments;
  • issuing documents and invoices;
  • management of obligations under the contract.

5.2. Identification and access control

  • identification of the client;
  • access control to the facilities;
  • prevention of improper use of membership cards;
  • management of QR codes, digital access, and other access technologies;
  • ensuring the safety of clients and staff.

5.3. Reservations and workout management

  • booking for group classes;
  • management of individual and group workouts;
  • management of available spots;
  • notification of changes, cancelled, or upcoming workouts;
  • tracking service usage.

5.4. Communication with the client

For sending:

  • membership information;
  • confirmations and reminders;
  • payment information;
  • booking information;
  • security and access-related messages;
  • important administrative notices;
  • information about changes to services, terms, or policies.

5.5. Marketing and commercial communications

Where the necessary legal basis exists, PULSE may use personal data for:

  • sending promotion information;
  • campaigns and special offers;
  • new services;
  • events;
  • loyalty programs;
  • personalized offers;
  • marketing research;
  • communication by phone, e-mail, SMS, push notification, or other permitted channels.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

5.6. Analytics and service improvement

We may process data for:

  • statistical analysis;
  • quality assessment;
  • service improvement;
  • optimizing the customer experience;
  • analyzing the use of our digital services;
  • planning new products and services.

5.7. Security and fraud prevention

  • fraud prevention;
  • detecting unauthorized access;
  • preventing misuse of memberships;
  • protecting customers, employees, and property;
  • investigating violations and incidents.

5.8. Compliance with legal obligations

We may process personal data when necessary for:

  • fulfilling accounting and tax obligations;
  • complying with legal and regulatory requirements;
  • providing information to competent public authorities;
  • protecting and exercising our legal rights.
  1. LEGAL BASIS FOR PROCESSING

Depending on the specific purpose, PULSE may process personal data on one or more of the following grounds:

  • necessity for the performance of a contract or to take steps at the customer's request before entering into a contract;
  • compliance with a legal obligation;
  • PULSE's legitimate interest, where that interest is not overridden by the customer's interests or fundamental rights and freedoms;
  • freely given, specific, informed and unambiguous consent;
  • other applicable legal basis under the GDPR or national law.

Not every processing of personal data requires consent. When processing is necessary for the performance of a contract or a legal obligation, it may be carried out without separate consent.

  1. CONSENT

When processing is based on consent, consent must be given freely, specifically, informedly and unambiguously.

Depending on the service used, you may be asked to give separate consents for:

  1. receiving marketing messages;
  2. personalized commercial offers;
  3. using certain photos or video materials for marketing purposes;
  4. participation in specific marketing or advertising campaigns;
  5. other purposes for which consent is required by law.

Refusing to give consent for marketing or another non-mandatory purpose will not prevent you from using PULSE services when the relevant processing is not necessary for providing the service.

  1. COOKIES AND ONLINE IDENTIFIERS

The website pulsefit.bg may use cookies and other similar technologies.

Some cookies may be technically necessary for the proper functioning of the site.

Other cookies may be used for:

  • statistics;
  • traffic analysis;
  • improving the site;
  • marketing;
  • personalized content;
  • integration with third-party services.

When consent is required for the use of certain cookies, they are activated only after consent is obtained, in accordance with applicable law.

  1. SHARING PERSONAL DATA WITH THIRD PARTIES

PULSE may disclose personal data to third parties when necessary to perform a contract, provide a service, comply with a legal obligation, or where there is another applicable legal basis.

Such recipients may include:

  • information and software system providers;
  • membership and access management system providers;
  • payment service providers;
  • accounting and financial providers;
  • communication service providers – SMS, e-mail, and push notifications;
  • IT and cloud service providers;
  • marketing and advertising partners, where applicable;
  • debt collection service providers;
  • legal and consulting firms;
  • state and municipal authorities, where required by law.

When a third party processes personal data on behalf of PULSE, the Company takes the necessary measures to enter into contractual arrangements and ensure an appropriate level of personal data protection.

  1. EXTERNAL SOFTWARE AND TECHNOLOGY SERVICE PROVIDERS

To operate its services, PULSE uses various software and technology solutions.

Depending on the specific service, certain personal data processing activities may be carried out through technology providers acting on behalf of and under the instructions of PULSE MANAGEMENT Ltd.

Such providers may offer services related to:

  • membership management;
  • access control;
  • reservations;
  • mobile applications;
  • payments;
  • electronic communication;
  • SMS and e-mail services;
  • IT infrastructure and cloud services;
  • technical support;
  • other services necessary for PULSE to function.

These providers do not independently determine the purposes of personal data processing when acting as processors on behalf of PULSE MANAGEMENT Ltd.

PULSE MANAGEMENT Ltd takes the necessary measures to ensure that persons entrusted with personal data processing process the data only within the scope of the activities assigned to them and at an appropriate level of protection.

  1. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Depending on the technology providers and services used, personal data may be processed outside the European Economic Area.

If personal data are transferred to a third country or international organization, PULSE takes the necessary measures to ensure the lawfulness of the transfer in accordance with the GDPR, including, where necessary, through:

  • an adequacy decision by the European Commission;
  • standard contractual clauses;
  • other appropriate safeguards provided for in the GDPR.
  1. PERSONAL DATA SECURITY

PULSE takes appropriate technical and organizational measures to protect personal data from:

  • unauthorized access;
  • loss;
  • destruction;
  • alteration;
  • unauthorized disclosure;
  • other unlawful processing.

Only employees and persons who need access in connection with the performance of their official or contractual obligations have access to personal data.

  1. RETENTION PERIOD

PULSE retains personal data only for the period necessary to fulfill the specific purpose for which they were collected.

The retention period may be determined depending on:

  • the duration of the contractual relationship;
  • the Company’s legal obligations;
  • the applicable accounting and tax periods;
  • the need to protect legitimate rights and interests;
  • the period for which consent was given;
  • the nature of the specific information.

After the applicable period expires, personal data are deleted, destroyed, or anonymized, unless the law requires or allows longer retention.

  1. YOUR RIGHTS

Under the GDPR, you have the right, subject to the applicable legal conditions, to:

14.1. Receive information and access

To receive information on whether PULSE processes your personal data and, if so, to access it.

14.2. Correct the data

To request the correction of inaccurate or incomplete personal data.

14.3. Delete the data

To request the deletion of your personal data where the legal grounds are met.

14.4. Restrict processing

To request the restriction of processing in the cases provided for by the GDPR.

14.5. Object to processing

To object to certain processing of your personal data where the legal grounds are met.

14.6. Portability

Under the applicable conditions, to receive your personal data in a structured, commonly used, and machine-readable format and/or request its transfer to another controller.

14.7. Withdraw your consent

Where processing is based on consent, you have the right to withdraw it at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

  1. MARKETING COMMUNICATIONS

If you have consented to receive marketing messages from PULSE, you may withdraw it at any time.

Depending on the channel used, you can unsubscribe via:

  • the unsubscribe link in a received email message;
  • the settings in your user profile, when such functionality is available;
  • sending a request to PULSE;
  • other unsubscribe mechanisms provided by us.

After withdrawing your consent, we will not use your data for future marketing communications on the basis of that consent, unless there is another applicable legal basis.

  1. AUTOMATED DECISION-MAKING AND PROFILING

Depending on the services used, PULSE may use automated processes to analyze service usage, segment customers, or provide personalized information and offers.

When profiling is carried out that falls within the scope of Article 22 of the GDPR, PULSE will comply with the applicable legal requirements and will provide the necessary information about the relevant process.

  1. PERSONAL DATA OF MINORS

PULSE services may be used by persons under 18 years of age under the conditions set out in the Terms and Conditions and applicable law.

When the processing of a minor's personal data requires the consent of a parent or legal representative, PULSE takes appropriate measures to obtain it.

  1. LEGAL BASIS IN CONTRACTUAL RELATIONSHIPS

When entering into a membership agreement, certain personal data is required for customer identification, membership management, provision of the services, access control, payment, and fulfillment of PULSE's contractual and legal obligations.

If this data is not provided, PULSE may not be able to enter into or perform the contract or provide the relevant service.

  1. COMPLAINTS AND REPORTS

If you believe that the processing of your personal data violates applicable law, you may first contact PULSE so that we can review your report or request.

You may also exercise your rights or ask questions about the processing of your personal data via:

Phone: 0700 44 044
 E-mail: office@pulsefit.bg
 Website: pulsefit.bg

You also have the right to lodge a complaint with the competent supervisory authority:

Commission for Personal Data Protection (CPDP)
 Republic of Bulgaria

Contact information and the complaint procedure are available on the official website of the CPDP.

  1. CHANGES TO THE POLICY

PULSE may periodically update this Policy when necessary due to changes in legislation, the technologies used, the services, or the way we process personal data.

The current version of the Policy is published at pulsefit.bg.

We recommend that you review this Policy periodically to stay informed about how we protect your personal data.

Last updated: 17 August 2026

  1. ACKNOWLEDGEMENT AND CONSENT STATEMENT

By providing the required data and/or by signing the registration form, the customer confirms that they have received the necessary information regarding the processing of their personal data and are familiar with this Policy.

Where consent is required for a specific processing activity, it is given through a separate, clear, and unequivocal action by the customer.

Consent may be withdrawn at any time when processing is based on consent.

This Policy is an integral part of the documents related to the use of PULSE services, where applicable.


 “PULSE MANAGEMENT” EOOD
 UIC: 203779555
 Sofia
 Phone: 0700 44 044
 E-mail: office@pulsefit.bg
 Website: pulsefit.bg