1. Introduction & Data Controller
This Privacy Policy describes how Avoya Fitness Limited, trading as Avoya Fitness. (the “Gym”, “we”, or “us”), acting as a Data Controller, collects, uses, shares, and protects your personal data when you join our Gym, use our facilities, or visit our website. We process your personal data in strict compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
2. Information We Collect and How We Use It
We process your personal data to deliver our services, maintain safety, and manage your membership.
| Data Category | Specific Information Collected | Lawful Basis for Processing (UK GDPR) |
|---|---|---|
| Identity & Contact Data | Full name, date of birth, home address, email, phone number | Contract Performance: Required to register you as a member and manage your account. |
| Financial & Payment Data | Bank account details, Direct Debit mandates, payment history | Contract Performance: Required to process your monthly membership fees. |
| Health & Medical Data (Special Category) | Physical Activity Readiness Questionnaire (PAR-Q) details (e.g., heart conditions, injuries) | Explicit Consent / Vital Interests: Required for physical safety screening. |
| Surveillance Data | CCTV images, video recordings, and timestamp logs | Legitimate Interests: Required to maintain security, prevent tailgating, and ensure member safety. |
3. Special Category Data: Health Screening
3.1 PAR-Q and Health Questionnaires: To ensure your physical safety when using our heavy equipment, free weights, sauna, and ice baths, we collect medical details on a digital PAR-Q form.
3.2 Health data is classified as “Special Category Data” under Article 9 of the UK GDPR. We process this data strictly under the condition of your explicit consent.
3.3 This consent must be provided via a separate, unbundled, un-pre-ticked digital checkbox during the registration flow. Health data is stored securely on our local database, with access restricted strictly on a need-to-know basis, and is never used for marketing purposes.
3.4 No Biometrics: Avoya Fitness Limited. does not collect, process, or store biometric data (such as fingerprint scans or facial recognition profiles).
4. CCTV and 24/7 Security Monitoring
4.1 The Gym operates with 24/7 member access and 24/7 CCTV surveillance across the premises to detect tailgating, prevent crime, and protect public safety.
4.2 Strictly Private Areas: CCTV cameras are strictly prohibited from filming or covering private areas, including changing rooms, showers, and toilets.
4.3 14-Day Retention: CCTV footage is digitally recorded and stored securely on the Gym’s local hard drives. Footage is automatically deleted and overwritten after fourteen (14) days, unless it is required for an ongoing civil claim, insurance investigation, or police inquiry.
5. Personal Trainer Data Protection Boundaries
5.1 Employed Personal Trainers: Any personal trainers directly employed by the Gym who manage your fitness plans, progress tracking, or nutritional logs act as agents of the Gym (the Data Controller). This data is protected under this Privacy Policy and stored securely on Gym-approved systems.
5.2 Self-Employed Personal Trainers: Self-employed personal trainers renting space at our facility operate as independent Data Controllers. They are solely responsible for their own data protection practices, maintain separate client files, and are required to provide you with their own privacy notice and secure your consent directly.
6. No Children’s Data
6.1 Membership is strictly limited to individuals aged 18 and over. The Gym does not knowingly collect or process any personal data of minors, completely bypassing children-specific privacy regulations.
7. No Third-Party Digital Sharing or Profiling
7.1 We do not sell your personal data.
7.2 The Gym integrates with or shares data with external CRM platforms, third-party electronic identity check databases, or external marketing retargeting trackers or cookies (such as Meta pixel, Google tracking, TikTok, etc.). All of your data remains processed locally.
8. Data Retention and Storage Limitation
8.1 Personal data is not kept longer than necessary.
8.2 For active members, we retain your data for the duration of your membership.
8.3 Post-Membership Retention: Once your membership is cancelled or terminated, we securely archive and retain your personal and financial data for no more than six (6) years from your last active account interaction (defined as a gym entry, a completed payment, or a documented written communication). This retention is necessary for tax auditing, corporate compliance, and to defend against potential civil contract or personal injury claims under the Limitation Act 1980. After 6 years, your data is permanently deleted or anonymised.
9. Your Information Rights
Under the UK GDPR and DPA 2018, you have the following rights:
- Right of Access (SAR): You have the right to request a copy of the personal data we hold about you (including your CCTV footage) free of charge, which we will provide within one calendar month.
- Right to Rectification: You can request that we correct inaccurate or incomplete data.
- Right to Erasure (Right to be Forgotten): You can request that we delete your data under certain circumstances, subject to our statutory and civil liability retention obligations.
- Right to Withdraw Consent: You can withdraw your consent for health data tracking at any time.
To exercise any of these rights, please contact our Data Protection representative at hello@avoyafitness.co.uk. If you believe we have handled your data unlawfully, you have the right to file a complaint with the Information Commissioner’s Office (ICO).