Boxly

Terms for gyms

Last updated: 26 October 2026 · Italiano · Français

These terms govern the Boxly service for gyms (the "Customer") and, in the second part, the data processing agreement required by Article 28 GDPR. The gym owner accepts them when the gym is activated on Boxly; the gym's members are instead subject to the member terms.

Part A · Service terms

A1. Subject

Boxly (a service by Tommaso Rosso, [email protected]) provides the gym with a web panel to manage schedules, classes, members, memberships, fees, attendance, medical certificates and messages, and an app with which the gym's members book classes. Boxly does not sell memberships to the gym's members and does not collect money on its behalf.

A2. Activation

The gym is created by Boxly at the owner's request, who provides the email of their account. From activation the owner manages the staff and assigns roles (admin, front desk, coach) and is responsible for who they let into the panel and how it is used.

A3. Plan and price

• One plan with everything included: €25 per month per gym, VAT included. For the first 10 active gyms the price is €20 per month, VAT included, for as long as the gym stays active.
• The first period is a free trial, with the duration stated at activation.
• The fee is paid in advance by card through Stripe, from the panel, and renews automatically every month on the same date as the first payment. Boxly never sees or stores card details, which are handled by Stripe. The invoice for each charge is emailed to the owner.
• If a charge fails, Stripe retries it for a few days and the panel warns the owner. If payment does not arrive, at the end of the period already paid the panel locks and members cannot book until the plan is active again.

A4. Gym obligations

• Use Boxly lawfully and provide its members with its own privacy notice, as the controller.
• Collect medical certificates only where required by sports regulations or its own rules, and use them only for that purpose.
• Never write health data, diagnoses or other clinical information about members in free-text notes.
• Assign staff roles according to actual duties, remove access from people who no longer work with the gym, and keep credentials safe.
• Report suspicious access or data loss to Boxly without delay.

A5. Availability and liability

Boxly is provided "as is", with a commitment to keep it available and secure; interruptions for maintenance (announced when foreseeable) or failures are possible. Boxly performs daily encrypted backups. To the extent permitted by law, Boxly's liability towards the gym is limited to the amount paid in the 12 months preceding the event and excludes indirect damages or lost profits; liability for wilful misconduct or gross negligence and for breaches of Part B remains unaffected.

A6. Duration and termination

The service is monthly and renews month by month. The gym may cancel at any time from the panel, in the Subscription section: the service stays active until the end of the period already paid and then does not renew. Periods already paid are not refundable. Until expiry the cancellation can be undone from the same page. Boxly may terminate with 60 days' notice, or immediately in case of serious breaches or non-payment after a reminder. On termination the gym may request an export of its data; Boxly deletes it within 30 days of termination, subject to statutory retention duties.

A7. Changes

Boxly may change these terms or the price with 30 days' notice by email to the owner; the gym may terminate before the change takes effect. The early-bird price is never changed for gyms that have it.

A8. Law and jurisdiction

These terms are governed by Italian law. Italian courts have jurisdiction over any dispute, unless mandatory rules provide otherwise.

Part B · Data processing agreement (Article 28 GDPR)

B1. Roles

For the data of its members and staff handled with Boxly (enrolments, memberships, bookings, attendance, recorded payments, medical certificates, messages) the gym is the controller and Boxly is the processor. For the Boxly account itself (email, password, name, language, notification device) Boxly is an independent controller, as described in the privacy policy.

B2. Subject, duration, nature and purpose

Boxly processes data on the gym's behalf for the duration of the service and solely to provide it: letting members book, managing memberships, fees and attendance, storing and showing the medical certificate to authorised staff, sending notifications. Processing is automated, on Boxly's servers, through the functions of the panel and the app.

B3. Data and data subjects

• Data subjects: the gym's members; staff members; participants in events published by the gym and their team members (even if not gym members).
• Ordinary data: name, email, phone, profile photo, gyms and roles, memberships, entries, fees, recorded payments, bookings, waitlists, attendance and no-shows, messages, staff notes.
• Events and competitions: email, name, phone, category, team and members (name, date of birth, sex, tax code, size, email), documents required by the gym, recorded consents, scores, check-in. The gym chooses which documents to require, whether and how to publish participants and leaderboards, and the retention periods (documents: at most 90 days after the event ends; accounts: from 30 days to 2 years); it is responsible for informing participants and, for minors, for collecting parental consent. The medical certificate or fitness self-certification is special category data: the guarantees of the next point apply.
• Special categories (Article 9 GDPR): the medical certificate, with issue and expiry dates, type and file. The gym warrants it has a legal basis and collects the data subject's explicit consent, which the app requests at upload (for events, at registration).

B4. Instructions

Boxly processes data only on the gym's documented instructions: the instructions are the functions of the service and these terms. Boxly does not use the data for its own purposes, does not sell it and does no profiling. If an instruction infringes the law, Boxly will say so.

B5. Confidentiality and security

Anyone processing data for Boxly is bound by confidentiality. Boxly applies appropriate technical and organisational measures, including: encryption in transit (TLS); argon2id password hashing; role-based access to the panel, with health data restricted to the owner, admins and front desk; login attempt limits; logging of staff actions; servers in the European Union; daily encrypted backups; automatic deletion of certificates 12 months after expiry and of technical logs after 12 months; data export and deletion at the data subject's request.

B6. Sub-processors

The gym gives Boxly general authorisation to use the following sub-processors, for the stated functions only:

• Hetzner Online GmbH (Germany): hosting of servers and backups.
• Cloudflare, Inc. (USA, with EU locations): network, protection and certificates for the site and the API.
• Google Ireland Ltd (Firebase Cloud Messaging): delivery of push notifications on Android and iOS.
• Apple Distribution International (Apple Push Notification service): delivery of push notifications on iPhone.
• Resend, Inc. (USA): sending of service emails.

Boxly notifies the owner by email of any new sub-processor at least 15 days in advance; the gym may object on reasonable grounds and, failing a solution, terminate. Transfers to the United States go to providers certified under the EU-US Data Privacy Framework or under the European Commission's standard contractual clauses.

B7. Assistance to the gym

Boxly helps the gym respond to data subject requests (access, rectification, erasure, portability): members can download their data and delete their account from the app; for the rest, Boxly answers the gym's requests within 10 working days. Boxly provides the information needed for a data protection impact assessment, where required.

B8. Data breaches

Boxly informs the gym owner without undue delay, and in any case within 48 hours of becoming aware of it, of any personal data breach affecting data processed on its behalf, with the information useful for notifying the supervisory authority and the data subjects.

B9. Audits

Boxly makes available the information needed to demonstrate compliance with this agreement and allows, once a year and with 30 days' notice, documentary audits by the gym or an appointed auditor, without access to other gyms' data.

B10. End of processing

On termination of the service the gym may export its data; Boxly then deletes the data processed on its behalf within 30 days, including backups within their rotation cycle, subject to statutory retention duties.

B11. Liability

Each party is liable for the GDPR infringements attributable to it. Boxly is liable to the gym for damage caused by processing only where it has not complied with the GDPR obligations specifically directed to processors or has acted against the gym's instructions.

Contact

Boxly, a service by Tommaso Rosso · [email protected]