Gym13 Privacy Notice

Last updated: 06/02/2026

This Privacy Notice explains how Gym13 (“we”, “us”, “our”) collects, uses, shares, and protects your personal data. We are committed to handling your information fairly, lawfully, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are (Data Controller)

  • Controller: Gym13

  • Registered/Trading Address: Unit 3D, Hallam Mill, Stockport, SK2 6PT, United Kingdom

  • Email: [info@gym13.co.uk]

If you have questions about this notice or how we use your data, please contact us via the above details.

2. The personal data we collect

We only collect what we need for the purposes outlined below. This may include:

  • Identity & contact: name, email, phone, address, date of birth, emergency contact.

  • Account & booking: membership details, class/PT bookings, attendance, cancellations/no‑shows, communications, preferences.

  • Payment & billing: partial card details (tokenised), transaction dates/times/amounts, billing address, receipts (via our payment processor—we do not store full card numbers).

  • Health & safety: PAR‑Q responses, relevant medical information you choose to disclose, injury/pregnancy status, incident/accident reports.

  • CCTV images: captured in/around the premises for security and safety.

  • Marketing & surveys: your opt‑in preferences, campaign interactions, review/feedback responses.

  • Technical/cookie data: IP address, device/browser, analytics, and cookies when you use our website or booking tools.

We do not collect more data than needed and we do not sell your data.

3. How we collect your data

  • Directly from you (online booking, sign‑up forms, PAR‑Q, emails, phone, in‑person).

  • Automatically via our website and booking/payment providers (cookies, analytics, device data).

  • From third parties where lawful (e.g., payment processors confirming transactions).

4. Why we use your data (Purposes & Legal Bases)

We process your personal data for:

  1. Membership & service delivery – to register you, manage bookings, provide access to facilities, and deliver classes/PT.
    Legal bases:

  • Contract (UK GDPR Art. 6(1)(b)) – to perform our contract with you.

  • Legitimate interests (Art. 6(1)(f)) – e.g., to manage capacity and ensure a safe, efficient service.

  1. Payments & invoicing – to process membership fees, class/PT payments, refunds, and accounting.
    Legal bases: Contract; Legal obligation (Art. 6(1)(c)) for tax/financial record‑keeping.

  2. Health & safety / PAR‑Q – to identify contraindications, adapt training, and record incidents.
    Legal bases:

  • Explicit consent for special category data (health) (Art. 9(2)(a)), obtained when you submit PAR‑Q or disclose health information.

  • Exercise of legal claims / health & safety may also apply in incident reporting (Art. 9(2)(f)/(h)).

  1. CCTV – to deter and investigate crime, protect people and property, and support health & safety.
    Legal bases: Legitimate interests (security/safety). Signage is displayed.

  2. Customer support & communications – service messages about bookings, changes, closures, terms updates.
    Legal bases: Contract; Legitimate interests (service continuity and clarity).

  3. Marketing (optional) – to send updates, offers, events, and news.
    Legal bases:

  • Consent (soft opt‑in may apply for similar products/services by email/SMS to existing customers, with opt‑out at any time).
    You can withdraw consent/opt out at any time (see §11).

  1. Analytics & site improvement – to understand usage and improve services.
    Legal bases: Consent (for non‑essential cookies); Legitimate interests (for minimal, privacy‑respecting analytics where applicable).

5. Special category data (health)

We may process health information you provide in PAR‑Q or during bookings to keep you safe and tailor training. We rely primarily on your explicit consent. You can withdraw consent at any time—however, if you do, we may not be able to provide certain services safely.

6. Children

Our services are intended for individuals aged 16+. Any exceptions (e.g., supervised 1‑to‑1 for under‑16s) require parent/guardian consent and limited data processing appropriate to the activity.

7. Sharing your data (Recipients)

We share data only when necessary and with appropriate safeguards:

  • Booking platform: [Gymcatch] – manages accounts, bookings, attendance, and notifications.

  • Payment processors: [Stripe] / [SumUp] / [GoCardless] for card/Direct Debit payments; we do not store full card details.

  • Communications: Email/SMS providers for confirmations and service notices.

  • IT & cloud services: Secure hosting, storage, and support providers.

  • CCTV provider: Security system maintenance and cloud storage (if applicable).

  • Professional advisors & insurers: For legal, accounting, audit, or insurance purposes.

  • Law enforcement/regulators: Where required by law or to protect vital interests.

We require our processors to protect your data under written contracts.

8. International transfers

Some providers may store or access data outside the UK. Where this occurs, we ensure appropriate safeguards—such as UK International Data Transfer Agreements (IDTAs) or Addenda to EU Standard Contractual Clauses, plus supplementary measures as needed. Details are available on request.

9. Data retention

We keep data only as long as necessary for the purpose collected:

  • Membership/booking records: typically 6 years after your last activity for tax/audit/legal purposes.

  • PAR‑Q/health data: for the duration of your membership/services and a further period aligned to limitation periods for claims (usually up to 3 years, or longer if an incident is recorded).

  • Incident/accident reports: generally 3–6 years (longer if involving a minor).

  • CCTV footage: usually 30–60 days, unless needed for an investigation.

  • Marketing data: until you opt out/withdraw consent or after a defined inactivity period (e.g., 24 months), then we either delete or securely anonymise.

Retention may vary if law or legitimate interests require longer/shorter periods.

10. Your rights

You have the following rights under UK data protection law:

  • Access – to request a copy of your data.

  • Rectification – to correct inaccurate or incomplete data.

  • Erasure – to request deletion in certain circumstances.

  • Restriction – to limit processing in certain cases.

  • Data portability – to receive data you provided in a structured format.

  • Object – to processing based on legitimate interests and to direct marketing.

  • Withdraw consent – where we rely on consent (e.g., health data, marketing).

To exercise your rights, contact [info@gym13.co.uk]. We will respond within one month (or explain if an extension is needed for complex requests). We may need to verify your identity.

11. Marketing preferences

We only send marketing if you opt in (or under soft opt‑in rules to existing customers for similar services). You can opt out at any time by:

  • clicking “unsubscribe” in emails,

  • replying “STOP” to SMS (where supported), or

  • emailing [info@gym13.co.uk].

Service‑critical messages (e.g., booking confirmations, closures, safety notices) will still be sent.

12. Cookies & website analytics

We use cookies and similar technologies for site functionality, performance, and analytics. Non‑essential cookies run only with your consent.
See our Cookie Notice for details of cookie types, providers, and how to change your preferences.

13. Security

We implement appropriate technical and organisational measures to protect your data—including access controls, encryption in transit where applicable, least‑privilege policies, staff training, and secure deletion. While no system is 100% secure, we work to continuously improve our safeguards.

14. Complaints

If you have concerns about how we handle your data, please contact us first at [admin@gym13.co.uk] and we will try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office (ICO):

  • Website: https://ico.org.uk/concerns

  • Phone: 0303 123 1113

  • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

15. Changes to this notice

We may update this Privacy Notice to reflect changes to our services, providers, or legal requirements. We will post the updated version on our website and indicate the “Last updated” date. Material changes may be notified by email.