Privacy policy
This translation is provided for convenience. In case of any discrepancy, the Spanish version prevails.
This website collects very little data: what you give us if you write to us through the contact form, and little else. We don't do analytics, there's no advertising or commercial profiling, and we don't sell or share your data with anyone. Here are the full details.
Who is the controller
RONIN 49, SOCIEDAD LIMITADA is the controller of the data collected on this website. Here are our contact details:
- Company name
- RONIN 49, SOCIEDAD LIMITADA
- NIF
- B05630710
- Address
- LG. A Rocha, 114, 36400 O Porriño (Pontevedra), Spain
- contacto@roninbox.com
What we process and why
These are all the processing activities we carry out on this website. There are no others: if we added one, it would appear here before we started it.
Contact form
- Data
- Your name, and the email address or phone number you give us. Optionally, the name of your gym and the message you write.
- Purpose
- To answer your inquiry and, if you want to move forward, prepare a proposal for you.
- Legal basis
- Your request: taking pre-contractual steps at your request, and our legitimate interest in replying to whoever writes to us.
- Retention
- 12 months from the last exchange. If the inquiry leads to a contract, the data is then governed by that contract. You can ask us to delete it sooner.
Form spam protection
- Data
- Your IP address, and whether you filled in a hidden field that people can't see.
- Purpose
- To prevent the form from being used to send automated spam.
- Legal basis
- Legitimate interest in keeping the form working and protecting our systems.
- Retention
- The IP address is kept for a maximum of 15 minutes, the duration of the submission limit. Then it's gone.
Proof of cookie consent
- Data
- A random identifier that says nothing about you, which purposes you allowed or rejected, the date and the version of the texts. We don't store your IP address or your browser.
- Purpose
- To be able to prove that you gave (or refused) us consent, as the law requires.
- Legal basis
- Legal obligation to demonstrate consent.
- Retention
- About 25 months, so the record outlasts the maximum validity of a decision.
Server technical logs
- Data
- IP address, date and time, requested page and browser, as any web server records them.
- Purpose
- To keep the website running, detect errors and defend ourselves against attacks.
- Legal basis
- Legitimate interest in the security and maintenance of the service.
- Retention
- 14 days.
About automated spam scoring
If you allow spam protection, we use Google reCAPTCHA v3. Unlike classic captchas, it doesn't ask you to solve anything: it analyzes how you move around the page and your IP address, and returns a score indicating how likely you are to be a person. Based on that score, we automatically decide whether to accept the form submission.
That decision doesn't leave you without a reply. If the system gets it wrong, we tell you right away and give you our direct address, privacidad@roninbox.com, so you can still write to us. And if you reject spam protection, the form works exactly the same: we never ask you to accept anything in exchange for contacting us.
Who else sees your data
We don't sell or share personal data. Only the providers we need to deliver the service can access it, each under a data processing agreement and only for what we've asked them to do:
- Our email provider (Brevo, based in the European Union), which delivers the form message to our inbox.
- The provider that hosts our servers and makes backups.
- Google Ireland Limited, only for spam protection and only if you've allowed it.
We may also have to disclose data to the authorities when required by law. Beyond that, it goes nowhere else.
Transfers outside the European Union
Spam protection means Google processes data in the United States. This transfer is covered by the standard contractual clauses approved by the European Commission and by the EU-U.S. Data Privacy Framework. You can review the safeguards at policies.google.com/privacy. If you don't allow spam protection, no transfer takes place: the form works without it.
Connecting to Google Calendar
From your gym's app, you can connect your Google account so your classes show up in Google Calendar. It's optional and only happens if you request it and authorize it on Google's screen.
We request a single Google permission (calendar.app.created): to create a dedicated calendar named after your gym and manage the events in that calendar. We can't see, read or change any other calendar or event in your Google account, or your contacts, email or profile.
We use it only to add to that calendar the classes you book (or the ones you teach, if you're a coach): date, time, activity, coach, location, a link to the class and whether you're on the waitlist. We store the permission encrypted in your gym's database along with that calendar's identifier; nothing else from your Google account.
The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell this data, use it for advertising or to train artificial intelligence models, or share it with third parties, and no person reads it unless you ask us to in order to resolve an issue or the law requires it.
You can disconnect Google at any time from the same card in the app, or revoke the permission at myaccount.google.com/permissions. When you disconnect, we delete the stored permission and stop writing to your calendar; the same happens if you cancel your gym membership. Whatever is already in your Google Calendar is yours: you can delete that calendar from Google.
Your rights
You can exercise these rights at any time by writing to us at privacidad@roninbox.com. We'll reply within one month and won't charge you anything.
- Access: find out what data we hold about you.
- Rectification: correct any data that's wrong.
- Erasure: ask us to delete it.
- Objection: ask us to stop processing it.
- Restriction: ask us to keep it but not use it.
- Portability: receive a copy in a reusable format.
- Withdraw consent at any time, without affecting what we did before.
If you think we haven't handled your request properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es). Before that, if you like, write to us: it's almost always faster.
Your gym's management app
The above refers to this website. The app that gyms use is different, and the difference matters: there, members' data belongs to the gym, not to us. Each gym decides what data it collects and why; we only process it on their instructions, as a processor, under a signed agreement that forbids us from using it for anything else.
If you're a gym member and want to access, correct or delete your data, your request should go to your gym: it's responsible for that data and can make the decision. If you write to us, we'll put you in touch with them, but we can't touch their data on our own.
If you run a gym and need the data processing agreement or have questions about how we process data on your behalf, write to us at privacidad@roninbox.com.
The Android app
RoninBox has an Android app (Google Play, package com.roninbox.app) that opens your gym's member dashboard like any other app on your phone. It's the same web app described in the previous section: your data is your gym's data, and your gym is responsible for it.
The app contains no advertising or analytics tools of its own and doesn't request any permission except to send you notifications. You can decline it, or remove it at any time in Android settings. If you turn it on, those notifications go through Google's servers, which is what Android uses to deliver them.
To request deletion of your account and data, see how at Delete your account and data. Uninstalling the app doesn't delete your account.
Security
We encrypt traffic between your browser and our servers, each gym has its own database separate from the rest, access is limited to those who need it for their work, and we make regular backups. No system is foolproof, but if a breach ever occurred that posed a risk to you, we would let you know.
Changes to this policy
We review this policy when something described here changes, and periodically in any case. If the change affects the purposes, providers or data we process, we'll tell you before applying it.