Last updated: November 2026
Primarily AWS eu-west-1, Ireland. Exceptions are listed under sub-processors.
Video is processed on-premises using edge computing hardware. No continuous video feed is sent to GymPlus servers. Still images used for analytics and short video clips of suspected access misuse are transferred to our EU cloud environment and deleted automatically according to the retention periods below.
GDPR-compliant by design. Controller: Indoor Informatics Oy, Finland.
GymPlus data is stored primarily on AWS in the eu-west-1 region (Ireland). Some sub-processors process data outside the EEA, as listed below, under appropriate safeguards.
Data at rest is encrypted using AES-256. Data in transit is encrypted using TLS 1.2 or higher. Access to production systems is restricted to authorised Indoor Informatics personnel only.
Video is processed on-premises using edge computing hardware. No continuous video feed is sent to GymPlus servers. Still images used for analytics and short video clips of suspected access misuse are transferred to our EU cloud environment and deleted automatically according to the retention periods below.
When a machine becomes occupied or free: timestamp and zone identifier only.
Aggregated headcount per time interval. No individual tracking or identification.
Incident timestamp, zone and a short video clip, transferred to our EU cloud environment and accessible via the app. No biometric data.
Video streams are processed on your on-premises hardware. No continuous video feed is sent to GymPlus servers.
GymPlus does not perform facial recognition or collect any biometric identifiers.
Indoor Informatics Oy uses the following sub-processors to deliver the GymPlus service. All sub-processors are contractually bound to data protection obligations in line with the EU GDPR.
| Sub-processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Amazon Web Services (AWS) Amazon Web Services EMEA SARL |
Cloud infrastructure, data storage, compute | Ireland (eu-west-1) | EU |
| Microsoft Azure Microsoft Ireland Operations Ltd |
Cloud platform services, identity and access management | EU — Sweden | EU |
| Google Workspace Google Ireland Limited |
Business productivity and collaboration tools | EU | EU |
| Google LLC Google Analytics 4 |
Analytics, only with user consent | USA | EU-US DPF |
| Auth0 (Okta) Okta, Inc. — EU tenant |
Customer identity and access management, authentication | EU — Germany | EU |
| 1Password AgileBits Inc. — EU region |
Credential and secret management | EU | EU |
| Atlassian Atlassian Network Services — EU tenant |
Project management and internal documentation | EU | EU |
| Anthropic (Claude) Anthropic, PBC |
AI language model services for AI-assisted features and internal operations. Customer data not used for model training. | USA | EU SCCs (Module 2) + UK Addendum |
| Hikvision Hikvision Europe B.V. |
Camera hardware and firmware for on-premises computer vision | EU — Ireland | EU |
| Meta Platforms Ireland Ltd WhatsApp Business Platform |
Delivery of WhatsApp messages: service notifications, customer support and the GymPlus AI Assistant. Effective from 17 November 2026. | Ireland; data centres in USA, Denmark, Sweden, Ireland | Meta Global Processor Terms |
| Google LLC Gemini API |
AI validation of suspected access-misuse video clips | USA | EU SCCs |
EU-US DPF = EU-US Data Privacy Framework. Changes to this list are notified via website update at least 14 days before taking effect. This list is reviewed and updated at least annually. Last reviewed: November 2026.
To exercise your rights or to request an updated copy of the sub-processor list, contact us at:
For contractual terms and privacy documentation governing the use of the Service: