Privacy Policy
Effective date: 01/08/2026
Who we are
UrbanX Fitness LTD operates UnitG1A, Inspire Business Park, Carrowreagh Road, Dundonald, BT16 1QT. We provide gym access and instructed group classes, including memberships and pay‑as‑you‑go options. This policy explains how we collect, use, and protect personal data.
Contact details
Data controller: UrbanX Fitness LTD, UnitG1A, Inspire Business Park, Carrowreagh Road, Dundonald, BT16 1QT
Email: info@urbanxfitness.co.uk
Phone: 07349888026
Data protection lead (if appointed): Rhianna Sinton, Managing Director
The data we collect
Information you provide to us
Identity data: name, date of birth, gender (optional), photo (for membership card/profile), emergency contact.
Contact data: email, phone number, postal address.
Account data: username, membership ID, preferences, communication choices.
Payment and transaction data: payment method details (handled by our payment processor), billing address, purchases, refunds.
Health and safety data: relevant health information you choose to share for fitness screening, PAR‑Q forms, injuries, accessibility needs, and incident reports. We collect only what is necessary to keep you safe and deliver services.
Consents and records: waivers, parental/guardian consents for juniors, marketing opt‑ins, class sign‑ups, and attendance records.
Communications: feedback, enquiries, complaints, and support requests.
Information we collect automatically
Usage data: check‑ins, class bookings, equipment or facility usage logs (where systems support this).
Technical data: device and log information when you use our website/app (IP address, browser type, app version, cookies, analytics).
CCTV: video images in and around our facilities for security, safety, and loss prevention. Signage onsite indicates CCTV coverage.
Junior members (ages 11+)
We collect junior member details and require consent from a parent or legal guardian for juniors under the age of 16.
We limit profiles for juniors to essential information, store it securely, and restrict access to authorized staff.
How we use personal data
We process your data to:
Provide services: create and manage accounts, verify identity, issue membership access passes, process payments, enable pay‑as‑you‑go entry, schedule classes.
Safety and safeguarding: assess exercise readiness, adapt training, manage incidents, and operate CCTV for safety and security.
Communication: send service messages (e.g., booking confirmations, schedule changes, policy updates), respond to enquiries, and provide customer support.
Operations and improvement: monitor facility usage, plan staffing and classes, maintain equipment, improve our services and app/website.
Legal and compliance: meet legal obligations, handle disputes, prevent and detect fraud or misuse, and maintain accurate records.
Marketing (optional): send news, offers, and events by email/SMS or in‑app, with clear opt‑in and the ability to opt out at any time.
Legal bases we rely on (where applicable):
Contract: to provide the services you request.
Legitimate interests: to run, secure, and improve our services, provided your rights are not overridden.
Consent: for marketing, certain cookies/analytics, and junior processing where required.
Legal obligation: health and safety, tax, accounting, and regulatory requirements.
Vital interests: safeguarding and emergencies.
Payments
We use third‑party payment processors to handle card and digital payments. Your full payment details are processed and stored by the processor, not by us. We receive limited information (e.g., last four digits, card type, transaction IDs) to confirm payments and manage your account. See the processor’s privacy notice: Privacy Policy.
Sharing your data
We share personal data only as necessary with:
Service providers: IT, booking systems, payment processors, email/SMS providers, access control, analytics, and CCTV/security vendors—under contracts requiring confidentiality and data protection.
Professional advisors: legal, accounting, insurance.
Authorities: law enforcement or regulators where required by law or to protect rights, safety, and property.
Transfers: if we reorganize, merge, or sell assets, data may transfer to a successor entity under this policy’s protections.
We do not sell your personal data.
Data retention
We keep personal data only as long as needed for the purposes described:
Account and membership data: for the life of your account and a reasonable period after closure (e.g., 6 years for tax/contract records, subject to local law).
Health/safety and incident data: as required for legal and insurance purposes.
CCTV: typically 30–60 days unless needed for an investigation.
Marketing preferences: until you opt out or we delete inactive contacts.
We securely delete or anonymize data when no longer required.
Your rights
Depending on your location, you may have rights to:
Access: get a copy of your data.
Rectification: correct inaccurate or incomplete data.
Erasure: request deletion in certain cases.
Restriction: limit how we use your data.
Objection: object to certain processing, including marketing.
Portability: receive data in a structured, commonly used format.
Withdraw consent: where processing is based on consent.
To exercise rights, contact us using the details above. We will verify your identity and respond within the required timeframe. You can opt out of marketing at any time via unsubscribe links or by contacting us.
If you are unhappy with our response, you may complain to your data protection authority. In the UK: Information Commissioner’s Office (ICO), ico.org.uk.
Juniors and safeguarding
Consent: We require a parent/guardian’s consent for juniors under 16. We verify consent reasonably (e.g., signature and contact details).
Limited profiles: We collect the minimum information necessary for junior participation and safety.
Communications: Service messages may be sent to the parent/guardian contact for juniors under 16; marketing to juniors is not sent without the appropriate consent.
Access control: Junior accounts and any health notes are accessible only to authorized staff with a need to know.
Classes and check‑ins: We record junior attendance for safety and safeguarding.
Cookies and analytics
We use essential cookies to make our website/app work and optional analytics cookies to help us improve performance. Where required, we ask for your consent for non‑essential cookies. You can change preferences via our cookie banner or browser settings.
Security
We use organizational and technical measures to protect personal data, including:
Encrypted connections (HTTPS/TLS) and encryption at rest where appropriate.
Access controls, role‑based permissions, and staff training.
Secure payment processing through PCI‑compliant providers.
Regular backups, monitoring, and incident response procedures.
No system is 100% secure. If a data breach occurs that risks your rights and freedoms, we will notify you and regulators as required by law.
Third‑party links and classes
Our site/app may link to third‑party services (e.g., class partners, wearable integrations). Their privacy practices are their own; review their policies before sharing data with them.
Changes to this policy
We may update this policy from time to time. We will post changes here and update the effective date above. For significant changes, we may notify you by email or in‑app notice.
How to contact us
Questions or requests about this policy or your data:
Email: info@urbanxfitness.co.uk
Address: Unit G1A, Inspire Business Park, Carrowreagh Road, Dundonald, BT16 1QT
Phone: 07349888026