PRIVACY NOTICE ON THE USE OF ACCESS WRISTBANDS AND EXIT TURNSTILES IN SELF-CHECKOUT AREAS

 

Through this Privacy Notice we would like to provide you with details about the processing of your personal data in the context of using the Therme access bracelet as well as the use of exit turnstiles equipped with systems for detecting unauthorized access in the self-service checkout area.

We recommend that you read this Privacy Notice together with the Privacy Policy, in order to obtain as much information as possible on how we protect your personal data.

Therme bracelets operate on RFID (Radio frequency Identification) technology, that allows us to manage customer access to the premises of the Therme complex in a secure and efficient way. It also helps us to streamline the process of purchasing products and services and using the IT systems made available to customers within Therme Bucharest, throughout the visit.

The use of Therme bracelets also helps to pseudomize your identity when you access the services within Therme Bucharest.

The exit turnstiles, used together with the self-checkout payment systems, allow guests to leave the premises without staff assistance. To prevent unauthorized use (for example, when two people attempt to exit using a single wristband), Therme uses a dedicated alarm system. A video camera is installed near the turnstiles to analyze the video feed and capture images when an unauthorized event is detected. The video analysis system is trained to detect the shape of the human body (or parts of it) and does not use facial recognition or process biometric data or personal characteristics such as age, gender, or hair color.

WHAT ARE THE CATEGORIES OF PERSONAL DATA THAT WE PROCESS?

The access bracelet collects and discloses personal data such as:

  • The bracelet number, which also represents the allocated locker number, including its location;
  • The unique ID of the access bracelet;
  • The colour and type of bracelet (green/blue/yellow/black, with or without a locker) that may reveal the types of services you have purchased;
  • Bracelet status (active / inactive) that may reveal whether or not you are still inside the Therme complex;
  • Data on accessed locations (date and time of entry into the complex, date and time of passage from one area to another, when scanning the bracelet at waypoints).
  • Data on the services purchased (type of access, additional charges at the time you access areas you did not initially purchase, duration of visit, consumption or any other services registered on the bracelet to be paid on departure, including information on the date and time of such recordings)
  • Data on the use of the locker room (status: Closed/open, including information on the date and time of these recordings).
  • Images (used by the turnstile detection system)

WHY DO WE PROCESS THIS PERSONAL DATA?

Access bracelets are used for purposes such as:

  • Allowing access to the Therme Bucharest complex, as well as the passing from one area to another, by scanning the bracelet at the access/crossing points.
  • Securing the locker (closing/opening) as well as the storage spaces dedicated for electronic devices, as well as investigating unauthorized access;
  • Making the process of purchasing products and services more efficient, including reservations within the Therme Complex, especially in areas where conventional methods could not be used;
  • Checking the consumption in real time, by scanning the bracelet in certain dedicated places.
  • Checking and paying for the consumption registered on the bracelet, at the time of check-out;
  • Keeping track of the occupancy rate in real time;
  • Protecting your identity when you purchase products and services in various locations of the complex;
  • Investigating and resolving complaints related to the use of the Therme services;
  • Preventing, investigating and recovering damage, investigating theft, checking incidents, defending rights in court,  prevention of unauthorized exit through the exit turnstiles or other legitimate interests.

WHAT ARE THE LEGAL GROUNDS ON WHICH WE PROCESS YOUR DATA?

The legal grounds for data processing in this context are:

  • The contract between you and Therme by facilitating your access to the services and compliance with contractual obligations, detailed here: https://therme.ro/regulament.
  • Therme’s legitimate interests:

- streamlining the sales process, taking into account the large flow of customers;

- efficiency of access and transit procedures;

- protection of property and people;

- reservations and appointments of services in the location;

- prevention and recovery of damages, material and financial losses;

- defending rights in court;

- other similar legitimate interests.

WHO ELSE HAS ACCESS TO YOUR PERSONAL DATA?

Personal data may also be accessed by other third parties to the extent that this is reasonably necessary in accordance with the purposes mentioned in this Privacy Notice.

For details, please see the dedicated section of the Privacy Policy.

HOW DO WE MANAGE INTERNATIONAL DATA TRANSFER?

As a rule, your personal data is processed in Romania, within Europe Union and countries that provide an adequate level of protection, as required by the General Data Protection Regulation no 679/2016.

Data processing outside the European Union and countries that do not provide an adequate level of protection, such as the United States, will only be carried out to the extent that the conditions set out in the “International data transfer” section of the Privacy Policy are met.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We periodically evaluate storage periods to ensure that we retain your data only for as long as necessary in relation to the purposes pursued.

The criteria on which we determine the retention of data are:

- legal retention periods, where applicable;

- contractual obligations to which you are a party, if any;

- Therme’s legal interests.

The deletion will only take place to the extent that such personal data are no longer necessary for other purposes.

WHAT ARE YOUR RIGHTS?

For the purposes of using your personal data for the purposes mentioned, you have the following rights:

  • Right to be informed;
  • Right of access;
  • Right to rectification;
  • Right to erasure, under the conditions stipulated by law;
  • Right to restriction of processing;
  • Right to data portability to another controller, under the conditions stipulated by law;
  • Right to object to the processing of your personal data;
  • Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or similarly affects you to a significant extent, with the exceptions set out in data protection laws;
  • Right to lodge a complaint with a supervisory authority.

UPDATING THE PRIVACY NOTICE

The information presented in this Privacy Notice will be reviewed periodically to reflect any changes in current processing activities.

Please visit this page periodically to make sure you always have up-to-date information.

However, if we intend to significantly change the way we use your personal data, we will notify you in advance.

Last update: February 2026