Privacy policy

1. General information

This Privacy Policy of the company Benefit Systems d.o.o. (hereinafter: Benefit Systems) applies to MultiSport card holders, business partners and others whose personal data are processed by Benefit Systems (hereinafter: data subjects) and it is applicable from 29 May 2025.

Considering that you entrust us with your personal data, this Privacy Policy describes which personal data we collect, how we collect and process them, for what purposes we collect and process them, the data retention period, data forwarding, how you can control these processes, as well as your rights related to your data.

We approach the processing of your data in a responsible and serious manner, fully in compliance with the General Data Protection Regulation, the Act on the Confirmation of the General Data Protection Regulation and other regulations by the European Union and/or Republic of Croatia which regulate personal data protection.

The controller is responsible for personal data processing:
BENEFIT SYSTEMS d.o.o., Ulica Vjekoslava Heinzela 44, Zagreb, PIN (OIB): 57845277445

You can contact us if you have any questions regarding the processing of your personal data:

by sending an email to the address that is also the address of the data protection officer: dpo@benefitsystems.hr,
by mail to the registered office address of the company Beneﬁt Systems d.o.o., Ulica Vjekoslava Heinzela 44, 10000 Zagreb, with a note “Personal data” on the envelope.

2. The types of personal data we collect and process, how we process them, purposes and legal bases for processing, data retention period and data forwarding

a) MultiSport card

Plastic MultiSport card

Regarding the issuance and use of the Plastic MultiSport card, we always collect and process the following personal data:

your name and surname, the number of your Plastic MultiSport card, card type and expiration date (which become your personal data after the card is issued in your name), place, time and location where you use the card and service type.

Sometimes we collect and process the following personal data:

your ID number with your employer and contact information (email address and mobile phone number)

if these data are also required to fulfil the purpose of processing your personal data.

We collect and process the aforementioned data for the purpose of:

issuing your Plastic MultiSport card that allows you to access the services included in our MultiSport programme;
notifying you of potential inability to use services included in our MultiSport programme;
performing calculations based on which your employer pays a fee for Plastic MultiSport card use for you or on your behalf;
delivering the Plastic MultiSport card;
improving the safety and functionality of the server we use to provide electronic services;
checking for potential misuse of the Plastic MultiSport card.

The legal basis for collecting and processing the aforementioned personal data is our legitimate interest.

Virtual MultiSport card

Regarding the issuance and use of the Virtual MultiSport card, we always collect and process the following personal data:

your name and surname;
email address;
mobile phone number;
your photograph.

For the issuing and use of the Virtual MultiSport card, you are required to identify yourself and provide your photo in the MyMultiSport application. Providing your photo when registering your Virtual MultiSport card is mandatory. Our partner will confirm your photo and name when you first visit a sports centre. You will not be able to enter a sports facility if your name and photo have not been confirmed. The photo must be visible on the same screen of your device as the QR code. The photo is stored only on your device in the Virtual Card application feature. After our partner identifies you, your photo is not processed any further, neither by us nor our partner.

Moreover, it is possible that, in relation to your Virtual MultiSport card use, we process your personal data that refer to your Virtual card use.

We also process the data related to the device which you use for our MyMultiSport website or application, specifically the following data:

your IP address, data stored as cookies or other similar technologies (see Cookie Policy on the link https://benefitsystems.hr/en/cookie-policy/), data related to your activities on our website or in the application, such as information about your preferred activities or activity locations, the content of HTTP requests sent to our server from your device (URL address, IP address, browser details, request date and time, HTTP response status code, error information, cookie identifier, viewed website resources). Data collected in this way are stored in the server log.

We process your data for the following purpose:

issuing a Virtual MultiSport card that allows you to access the services included in our MultiSport programme;
accessing the MyMultiSport website or mobile application;
solving technical and other issues related to Virtual MultiSport card use, which you report by email, by contacting the helpdesk, etc.

The legal basis for collecting and processing your personal data for the aforementioned purposes is the performance of the agreement you conclude with Benefit Systems by creating a Virtual MultiSport card.

We also process your data for the following purposes:

administration and server security, which includes improving the functionality of the services we provide electronically;
providing analysis and statistics for product development, as well as for monitoring activity within the application to improve the Virtual MultiSport card performance;
conducting analyses and statistics for market research to make decisions about our commercial policy and surveys on satisfaction with Virtual MultiSport card services via a telephone number as the communication channel you selected, all for the purpose of improving customer service and developing the products and services we offer;
checking whether the Virtual MultiSport card is used in line with the Terms of Use.

The legal basis for collecting and processing your personal data for the aforementioned purposes is our legitimate interest.

With your consent, we can also process the data that refer to your geolocation in order to show you the centres and benefits closest to your location. In this case, the legal basis for the processing is your consent. You can find detailed information on the processing of personal data based on consent under item 5 of this Privacy Policy.

Test MultiSport card

Regarding the issuance and use of the Test MultiSport card, we always collect and process the following personal data:

your name and surname, Test MultiSport card number, card type and expiration date (which become your personal data after the card is issued in your name), place, time and the location where you use the card and service type.

We collect and process the aforementioned data for the purpose of:

issuing the Test MultiSport card that allows you to access the services included in our MultiSport programme during the test period;
notifying you of potential inability to use services included in our MultiSport programme;
delivering the Test MultiSport card,
improving the safety and functionality of the server we use to provide electronic services;
checking for potential misuse of the Test MultiSport card and responding to inquiries made using our contact forms and other communication channels;
notifying your employer of your participation in the test period.

The legal basis for collecting and processing your personal data is our legitimate interest.

Common provisions for all MultiSport cards

If you do not provide the aforementioned data, we will not be able to issue your MultiSport card and allow you access to services included in our MultiSport programme.

With your consent, we may send the data on service use time and location as well as service type included in the MultiSport programme to your employer for them to assess the justification of your participation in the MultiSport programme. In this case, the legal basis for your data processing and forwarding is your consent. You can find detailed information on the processing of personal data based on consent under item 5 of this Privacy Policy.

When identifying you as a MultiSport card holder, sports centres also have short-term access to your data, which is available exclusively for identification purposes.

We retain your personal data for 18 months from the moment your MultiSport card is deactivated. In case your card is a Test MultiSport card, we retain your data for 6 months from the moment the Test MultiSport card is deactivated. The aforementioned period is the period during which you can reactivate your MultiSport card. If you do not reactive your card in the aforementioned period, your card will be archived, and your data anonymised, which means they no longer exist in the form that allows for your identification as an individual.

When deactivating your MultiSport card, you can ask for the card to be archived immediately and the data to be erased, in which case we will immediately act on your request.

b) Business partners

If you are our business partner, we collect and process the following personal data:

your name and surname or company name, name and surname of the responsible person of the legal entity, name and surname of the legal entity’s contact person, address, personal identification number and/or company registration number, contact information (email address and phone or mobile phone number), website address, bank account number, credit/debit card number, information on the type and content of your contractual relationship with the company Benefit Systems, username and password if the business partner is the MultiSport card holder’s employer, sport facility name and location and the types of services it provides if the sport centre is a partner.

We process the aforementioned personal data for the purpose of concluding contracts, i.e. establishing a contractual relationship, execution of contracts, i.e. the fulfilment of rights and obligations arising from a concluded contract, e.g. issuing invoices for services provided if partners are employers or settling invoices for services provided if partners are sports centres, mutual use of logos and similar activities.

If you refuse to provide the aforementioned personal data, which are required for concluding an agreement and establishing a contractual relationship, we will not be able to conclude an agreement with you.

In relation to the personal data retention period, we point out that it depends on the type of collected personal data.

We retain your name and surname or company name, address and personal identification number and/or company registration number found on the invoice issued for our services for 11 years (counting from the last day of the year in which the invoice was issued) since this is the legally required period for retaining invoices issued to business partners. The aforementioned data are also in the agreement you concluded with the company Benefit Systems, as well as the data regarding the content of the contractual relationship, the responsible person and contact person, which data are retained for 5 years from the agreement termination since this is the longest limitation period related to potential claims arising from the contractual relationship.

We also retain the invoices we receive from business partners for 11 years (counting from the last day of the year in which the invoice was issued), since this is the legally required period for retaining received invoices.

We erase your contact information immediately upon the termination of the contractual relationship, i.e. service performance, unless you give your consent to the aforementioned data being stored in order to send notifications about new services we offer.

c) Event organisation

If you participate in events we organise, we process your personal data found in multimedia content created during those events, specifically:

your data found in photographs, video and audio recordings and other multimedia content.

We process the aforementioned data for the purpose of posting on our social media profiles (Facebook, Instagram, LinkedIn and all other social media) for marketing purposes and self-promotion.

If we process your personal data for the aforementioned purposes, we process them based on your consent. You can find detailed information on consent under item 5 of this Privacy Policy.

d) Organisation of prize contests

If you participate in prize contests we organise, we process the following personal data:

your name and surname, your MultiSport card number, your identification number with your employer (if applicable), email address, and your photo.

We process the aforementioned personal data for the purpose of conducting the prize contest, publishing your photo on our social media profiles (Facebook, Instagram, LinkedIn and all other social media) and if you win a prize, in order to deliver your data to the prize issuer.

If we process your personal data for the aforementioned purposes, we process them based on your consent. You can find detailed information on consent under item 5 of this Privacy Policy.

e) Marketing

For marketing purposes, such as sending offers, newsletters and performing other marketing activities, we process the following personal data:

your name and surname, email address, mobile phone number and the name of your employer.

We process the aforementioned personal data for the purpose of sending offers and notifying you of our product and services.

If we process your personal data for the aforementioned purposes, we process them based on your consent. You can find detailed information on consent under item 5 of this Privacy Policy.

f) Body composition analysis

If we process your personal data for the purpose of body composition analysis (e.g. Tanita body composition analysis), we process the following personal data:

your name and surname, email, date of birth, sex, height, body fat percentage, visceral fat percentage, weight, BMI, muscle mass, lean body mass, skeletal muscle mass, bone mass, water percentage in your body, metabolic age, basal metabolic rate and daily calorie intake.

We analyse the aforementioned personal data for the purpose of conducting body composition analysis and generating and delivering measurement results.

The legal basis for the processing of the aforementioned personal data is the contractual relationship based on your request for body composition analysis and measurement result generation and delivery. If you do not provide the aforementioned data, we will not be able to provide you with the body composition analysis service and perform the necessary measurements.

We retain the aforementioned data only during 24 hours from the time you provide them, and we erase them immediately upon delivering your measurement results via email.

g) Signing up using a contact form

By filling out our contact forms that appear as surveys or questionnaires on the official websites of Benefit Systems, or its social media (Facebook, Instagram, LinkedIn, TikTok, YouTube), or as Microsoft or Google forms, you also entrust us with your personal data.

If you fill out contact forms as an employer, we collect the following personal data: name and surname of the person contacting us on behalf of the employer, company or sole proprietorship name, number of employees, employer’s PIN (OIB), employer’s email address and phone number.

If you fill out contact forms as an employee, we collect the following personal data: your name and surname, your employer’s company or sole proprietorship name, your employer’s email address and phone number.

If you fill out contact forms as an owner of a sports centre or facility, we collect the following personal data: name and surname of the person contacting us on behalf of the sports centre, sports centre’s name and registered office, service type which the sports centre provides, website address, sports centre’s email and phone number.

If you fill out contact forms as a user of a sports centre or facility, we collect the following personal data: your name and surname, the name of the sports centre, sports centre website address, your email and phone number.

We collect and process the aforementioned data for the purpose of contacting you in order to establish cooperation and store your data in our database.

If we process your personal data for the aforementioned purposes, we process them based on your consent. You can find detailed information on consent under item 5 of this Privacy Policy.

In case you withdraw your consent, we will immediately erase all your personal data.

We retain the data you entrusted us with based on your consent that has not been withdrawn for 18 months from the moment you granted consent for the processing of your personal data.

h) Employment candidates

If you have applied for employment and submitted your job application and CV, we process the following data:

your name and surname;
permanent or temporary residence address;
mobile phone number;
email address;
citizenship;
date of birth;
sex
work experience;
education and training;
personal skills;
as well as all other data you entered in your CV.

We process the aforementioned data for the purpose of your participation in the employment tender and employment candidate selection.

The legal basis for processing the aforementioned data is undertaking legal actions regarding your request to conclude an employment agreement with the company Benefit Systems.

At times, during the employment candidate selection, we conduct psychological testing which is performed by our business partner as a processor on our behalf, and in such cases, we additionally process the results of the conducted psychological testing. In this case, the legal basis for your personal data processing is our legitimate interest.

We retain the aforementioned data until we select the candidate whom we want to hire, i.e. conclude an employment contract, and we erase them immediately thereafter.

If you withdraw your application during the candidate selection process, we erase all your data immediately after you notify us of your withdrawal.

We deliver your aforementioned data to our business partner who acts as the processor and provides us with expert consulting services regarding the employment candidate selection.

i) Business premises video surveillance

Certain areas of the Benefit Systems’ business premises are covered by a video surveillance system which processes the following data subject’s data, but only when they enter the surveillance cameras’ recording perimeter:

recordings of data subjects (excluding sound).

The aforementioned personal data are processed for the purpose of the Benefit Systems’ assets protection.

The aforementioned data, i.e. recordings are delivered to the competent state authorities if unlawful conduct is recorded.

The legal basis for processing is legitimate interest of the Benefit Systems company to protect its assets.

The aforementioned data, i.e. recordings are retained for 1 (one) month after they are generated. In case unlawful conduct is recorded, a longer retention period may be conditioned based on appropriate judicial, administrative, arbitration or other proceeding, of which the data subjects will be informed in a timely manner by Benefit Systems.

3. Personal data forwarding

We do not forward or make available your personal data to unrelated third parties, and they remain securely stored on our chosen internal or external server and in our business premises, which sufficiently guarantee the implementation of appropriate technical and organisational measures, ensuring that processing complies with the requirements of the General Data Protection Regulation and that your rights are protected.

Our business partner who maintains and improves the safety of our information system also has access to your data, which enhances their safety.

Considering that we operate within a group, the companies we are affiliated with also have the possibility to access your data, specifically the company Benefit Systems International S.A., Mlynarska 8/12, 01-194 Warsaw, Poland and Benefit System S.A., Pl. Europejski 2, 00-844 Warsaw, Poland.

If we need your data to exercise our rights and/or defend legal claims before competent state authorities and/or comply with legal obligations, we will deliver your data to our legal representative who represents us in these proceedings (e.g. an attorney) or to a partner who fulfils these legal obligations on our behalf (e.g. an accounting firm or a tax advisor). In that case, depending on the type of the proceeding, your data may be made available to personal data recipients, e.g. courts, notaries public, Financial Agency and other state authorities that are in any way related to the court proceeding in question.

In certain cases, we also forward your data to the accounting company that performs bookkeeping and accounting tasks, such as posting invoices and preparing financial statements for tax calculation and payment on behalf of the company Benefit Systems and also fulfils other obligations that we as a company must fulfil based on accounting, bookkeeping and tax regulations. We forward some of your data to the Tax Administration as the recipient of your data for the aforementioned purposes.

We forward your personal data, specifically your name and surname or company name and address, to legal entities performing postal consignment delivery and which require the aforementioned data in order to deliver the consignment. This applies if deliveries are made via regular mail.

The bank where we opened our business account, through which monetary transactions are conducted, also has access to some of your data.

We will limit the data we forward and deliver to the smallest amount possible by forwarding to the aforementioned legal or natural persons we share your data with only the data they require for the processing purpose defined by the company Benefit Systems.

All legal and natural persons we forward your personal data to have to keep their confidentiality as part of the contractual relationship and have also implemented organisational and technical protection measures.

The processing of your personal data does not include profiling.

Certain data may be forwarded to the authorities of the Republic of Croatia upon their request in order for us to comply with the obligations prescribed by the law of the Republic of Croatia and/or the European Union.

Your personal data are not transferred to a third country (a country outside the European Economic Area) in any case nor to an international organisation or a recipient in a third country or international organisation.

4. Retention period

If we need to retain your data in order to comply with our legal obligations (e.g. applicable tax and bookkeeping regulations), we retain your data during the period determined by the said regulations.

Data required for the defence of legal claims in a proceeding before state authorities, as well as the entire case file, are retained for a period corresponding to the limitation period within which the execution of a decision made in that proceeding can be sought (e.g. 10 years from the date the court decision becomes final).

In case a court proceeding was initiated to resolve mutual rights and obligations arising from a contractual relationship, we retain your personal data for 10 years from the finality of the decision rendered in the aforementioned proceeding, all in accordance with the obligation to retain final court decisions as prescribed by the law of the Republic of Croatia, but we only retain the data that were necessary for us to defend our legal claims in the proceeding in question.

If an objection is lodged regarding our product and the service provided, your data are retained until the completion of the objection process.

5. Consent management

If we process your personal data based on a consent, we ensure that consent is always given in the form of a written statement (including an opt-in option if consent is given via electronic media) and that the consent is voluntary, specific, informed and unambiguous.

The statement whereby you give consent to the processing of your personal data will be drafted for each specific purpose of processing in an understandable and easily accessible form, using clear and plain language.

You have the right to withdraw your consent to personal data processing at any moment, which you will be additionally notified of prior to giving your consent and you will be notified of the way to withdraw your consent.

Please note that if consent was given for a one-time processing action which has already been completed, the withdrawal of the consent has no legal effect.

In case you withdraw your consent, we will immediately erase all your personal data except for those we have to retain according to the regulations of the European Union and the Republic of Croatia.

Please also note that personal data processing based on a valid consent before it was withdrawn is entirely lawful.

If you do not consent to data processing based on consent, we are not able to perform the processing based on consent.

6. Data subject’s rights

Right of access
We can issue a confirmation as to whether your personal data are being processed, and if so, grant you access to that data and the following information: purpose of the processing, personal data categories in question, recipients or recipient categories to whom the personal data were or will be disclosed, estimated period during which the personal data will be stored and the existence of data subjects’ rights regarding personal data processing (which rights are listed below in this Privacy Policy).

Right to rectification
If your personal data that we process are incomplete or inaccurate, you can ask us to rectify or complete them at any moment by providing an additional statement. Please note that you are responsible for providing correct data and you also have to inform us about relevant changes to your personal data. Personal data rectification and update may take up to 5 business days, which is related to our system’s technical conditions.

Right to erasure
You are entitled to request erasure of your personal data if you filed a complaint to processing based on our legitimate interest, or if you believe your data were unlawfully processed, or you believe your data should be erased based on the law of the European Union or the Republic of Croatia. We will erase your data immediately after you file your request for erasure, except for the data we have to retain according to the regulations of the European Union and the Republic of Croatia.

Right to restriction of processing
You can ask us to restrict the processing of your data:

if you dispute the accuracy of the data during the period that allows us to verify the accuracy of those data;
if data processing was not allowed, but you refuse erasure and instead request the restriction of their use;
if we no longer require the data for intended purposes, but they are still necessary in order to fulfil legal requirements.

If data processing is restricted, such personal data may only be processed with your consent, except in case of data storage or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural person or legal entity or for important public interest. If you obtain a restriction of data processing, we will inform you before the restriction is lifted.

Right to object
Considering that we refer to our legitimate interests when processing your personal data, you can submit an objection to such data processing if there is an interest in protecting your data. If you submitted an objection to such processing, we will no longer process your data unless we demonstrate compelling and legitimate grounds for the processing that override your interests, rights and freedoms or if it is required for the establishment, exercise or defence of our legal claims.

Right to lodge a complaint
If you believe that we acted against the law of the European Union or the Republic of Croatia when processing your personal data, please contact us to resolve any potential issues. You have the right to submit a request for determination of a violation of rights regarding the processing of your personal data at any time to the Personal Data Protection Agency, Ulica Metela Ožegovića 16, 10 000 Zagreb, and you can find the request form on the following link https://azop.hr/zahtjev-za-utvrdivanje-povrede-prava/.

Right to be informed about a personal data breach
In case a breach of your personal data occurs despite all measures taken, we will inform you of such a breach if the breach is likely to result in a high risk to your rights and freedoms. In that case, we will notify you without undue delay and in written form.

The aforementioned notification will contain a description of the nature of the personal data breach, provide the contact information of the data protection officer from whom additional information about the breach can be obtained, describe the likely consequences of the personal data breach and the measures taken by the company Benefit Systems to address the personal data breach, including measures to mitigate harmful effects.

Exercise of the rights
If you wish to exercise any of the aforementioned rights, you can contact us using the following communication channels:

email address which is also the address of the data protection officer: dpo@benefitsystems.hr,
registered office address of the company Beneﬁt Systems d.o.o., Vjekoslava Heinzela 44, 10000 Zagreb with the note “Personal data” on the envelope.

The company Benefit Systems will respond to your requests to exercise your rights in accordance with the deadlines and authorisations prescribed by the General Data Protection Regulation.

In any case, when exercising the aforementioned rights, keep in mind that we must unequivocally verify your identity, which serves to protect your rights and privacy.

If you exercise any of the aforementioned rights too frequently or with an obvious intent of misuse, we may charge you a reasonable fee considering the administrative costs of providing information or notifications or acting on a request or we may refuse to act on your request.

7. Personal data protection measures

The company Benefit Systems has implemented appropriate technical, organisational and personnel-related measures to enable effective application of data protection principles, such as reducing the amount of data and the integration of safety measures into processing, measures necessary to protect personal data from accidental loss or destruction, unauthorized access or alteration, unauthorized disclosure and any other misuse, in relation to all data regardless of storage or processing location or format, all to meet the requirements of the General Data Protection Regulation and protect data subjects’ rights.

The company Benefit Systems trained its employees who participate in personal data processing and those employees have to keep these data confidential based on a confidentiality statement.

8. Privacy Policy amendments

This Privacy Policy may be amended at times in accordance with the law or industry and practice development. You will be notified of any change in a timely manner by highlighting the Privacy Policy amendment on the Benefit Systems’ website.

Benefit Systems d.o.o.