Privacy policy
Last updated: 28 September 2026
In short: we collect data only to deliver the session you booked, and to deliver it safely. We do not sell it, we do not analyse visitors to this website, and we do not set advertising cookies.
1. Who controls your data
The controller of your personal data is:
Forma X d.o.o., so.p.Jamova cesta 54
1000 Ljubljana
Registration number: 9039619000
Tax number: 36710504 (not VAT-registered)
Contact for data-protection questions:
- Training venue
- Gym24, Dunajska cesta 154, 1000 Ljubljana
- Data protection officer
- We are not required to appoint a data protection officer (DPO).
2. What we collect and why
We collect personal data in four situations: when you book a session through this website, when you submit a form on Facebook or Instagram, when you visit this website, and when we ask you in writing about health conditions before your first EMS session.
2.1 Booking a session through the website
When you book a session through our website, we collect the data you enter into the booking form: your name, email address, phone number and the slot you chose.
- Purpose
- handling the booking, confirming the slot, and communicating about the session
- Legal basis
- performance of a contract, or steps prior to entering into a contract at your request (Article 6(1)(b) GDPR)
- Retention
- for the duration of the business relationship and 5 years after the last contact
2.2 Submitting a form on Facebook or Instagram
When we advertise on Facebook or Instagram, you can submit an enquiry through a form that opens inside the app (Meta's “instant form”). In that case you never leave the app — we receive the data from Meta.
We receive your name, email address, phone number and your answer about which time of day suits you best. We use this data solely to call you and arrange a slot for a trial session.
We do not pass data from this form to third parties, and we do not use it to send general marketing messages unless you separately consent to that.
- Purpose
- contacting you at your request and arranging a slot
- Legal basis
- steps prior to entering into a contract at your request (Article 6(1)(b) GDPR)
- Retention
- 6 months from submission. If no business relationship follows within that time, we delete the enquiry. If you do start training with us, the period in section 2.1 applies.
When you fill in a form on Facebook or Instagram, Meta also processes your data as an independent controller. That processing is governed by Meta's privacy policy.
2.3 Visiting the website
When you visit the website, our hosting provider's server logs automatically record technical data (IP address, browser type, time of access, page visited). This data is necessary to operate and secure the site.
We do not analyse the website: we keep no visitor statistics and build no profiles.
- Legal basis
- legitimate interest in operating and securing the site (Article 6(1)(f) GDPR)
2.4 Health conditions before training
Before your first electrical-stimulation session we ask you in writing about health conditions that may rule out this kind of training (for example pregnancy, a pacemaker, epilepsy, acute injury). This is special category data under Article 9 GDPR and we treat it with particular care.
We do not analyse this data statistically, we do not use it for advertising or profiling, and we do not share it with anyone outside Forma X.
You can withdraw your consent at any time, but without this information we cannot deliver electrical-stimulation training, for safety reasons.
- Purpose
- solely your safety during training, and judging whether EMS training is suitable for you
- Legal basis
- your explicit consent (Article 9(2)(a) GDPR)
- Access
- only the trainer who leads your session
- Retention
- for the duration of the business relationship and 5 years after the last session
3. Who we share data with
We do not sell your personal data. Only the following processors have access to it, each under a data processing agreement:
| Processor | Purpose | Processing location |
|---|---|---|
| Lime Booking | booking system | EU |
| Vercel Inc. | website hosting | USA (standard contractual clauses) |
| Meta Platforms Ireland Ltd. | advertising and lead forms | EU / USA |
| Računovodski servis Mika (Maja Terzič) | issuing and storing invoices | Slovenia |
- In addition
- We may disclose data to competent authorities where the law requires it.
4. Transfers outside the EU
Some of the processors listed above may process data outside the European Economic Area. Where that happens, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision (EU–US Data Privacy Framework).
5. Cookies
The forma-x.si website uses only strictly necessary cookies, which enable the site's basic operation. We ourselves set no analytics or advertising cookies.
The one exception is the booking form, which is embedded from an external domain (Lime Booking). Besides strictly necessary cookies, that provider also uses cookies for usage measurement and marketing, which is why it shows its own consent banner with the form. You decide about those cookies in its banner, separately from our site.
6. Your rights
In relation to your personal data you have the right to:
- —access the data we process about you;
- —rectification of inaccurate or incomplete data;
- —erasure of your data (the “right to be forgotten”);
- —restriction of processing;
- —data portability;
- —object to processing based on legitimate interest;
- —withdraw consent where processing is based on consent. Withdrawal does not affect the lawfulness of processing before it.
- How
- Send your request to info@forma-x.si. We will respond within one month of receiving it at the latest.
6.1 Complaint to the supervisory authority
If you believe our processing of your data breaches the rules, you can lodge a complaint with the supervisory authority:
Information Commissioner of the Republic of SloveniaDunajska cesta 22, 1000 Ljubljana, Slovenia
gp.ip@ip-rs.si · www.ip-rs.si
7. Data security
We protect personal data with appropriate technical and organisational measures. Only people who need it for their work have access.
8. Changes to this policy
We may update this privacy policy from time to time. The version published on this page, with the last-updated date at the top, is always the one in force.