Last updated: September 23, 2026
At CDA Fitness, we prioritize the safety and integrity of our members, staff, and facilities. In accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), this policy outlines how personal data and video footage collected through our video surveillance system are processed.
1. Data Controller
- Data Controller: Ian David Field (hereinafter, CDA Fitness)
- Website:
https://cdafitness.es - Data Protection Contact: dpo@cdafitness.es
2. Purpose of Processing
The capturing and recording of images across CDA Fitness premises are conducted solely for the purpose of ensuring the safety of individuals, assets, and facilities, controlling venue access, and preventing unlawful acts or incidents.
3. Lawful Basis for Processing
The processing of video footage is based on the legitimate interest of the data controller (Article 6.1.f of the GDPR) to safeguard the physical integrity of our members, staff, and overall facilities.
4. Scope and Limitations (Proportionality Principle)
In strict compliance with statutory regulations and the guidelines of data protection authorities:
- Exclusion of Private Areas: Video surveillance is strictly prohibited and absent in private zones such as locker rooms, changing areas, restrooms, or rest lounges where individuals have a reasonable expectation of privacy.
- Restricted Coverage: Cameras are pointed exclusively at entrance points, reception desks, and common training areas where monitoring is strictly necessary for safety.
- Audio Recording: Cameras do not record audio or private conversations, adhering to the principle of data minimization and proportionality.
5. Data Retention Period
Footage is retained for a maximum period of 30 days from the time of recording, after which it is automatically and securely deleted.
Exception: Footage may be retained for longer periods exclusively if requested by Law Enforcement Agencies, Courts, or Judicial Authorities in connection with an investigation into unlawful acts or security incidents.
6. Disclosures and Data Recipients
Recorded images will not be shared with third parties, except where required by law. Authorized access is restricted to:
- Law Enforcement and Judicial Authorities upon formal legal request.
- Authorized Technical & Maintenance Personnel (duly designated as Data Processors under formal confidentiality and security contracts).
7. Individual Rights (Data Subject Rights)
Under the GDPR, you have the right to exercise your rights regarding your image data, including:
- Right of Access: Confirm whether your images are being processed and request access, provided it does not adversely affect the rights and freedoms of third parties.
- Right to Erasure / Restriction: Request the deletion or restriction of image processing where applicable by law.
To exercise your access rights, you must submit a formal request accompanied by a recent photograph (to verify identity) and specify the approximate date, time, and camera location.
Where to submit your request:
Send your request via email to dpo@cdafitness.es or by mail to our facility address, specifying “Data Protection – Surveillance Rights” in the subject line.
If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.