Privacy Policy

Functional Fitness Gym Ltd

Last updated: October 2026

1. Who We Are

Functional Fitness Gym Ltd ("we", "us", "our") is a UK-registered company (Company No. 13386226) providing personal training, group classes, open gym access and wellness services.

We are the data controller responsible for your personal data.

This Privacy Policy is written in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

Personal & Contact Information

  • Name
  • Date of birth
  • Email address
  • Telephone number
  • Emergency contact details

Membership, Booking & Account Information

  • Membership details
  • Class and session bookings
  • Attendance records
  • Online waiver and induction confirmations

Payment Information

  • Payment and billing details
  • Transaction history

Payment card details are processed securely by third-party providers and are not stored by us.

Health & Fitness Information

You may verbally disclose injuries, medical conditions or other health information to coaches before or during training sessions to ensure your safety. We do not record or store this information. It is your responsibility to inform staff of any conditions that may affect your ability to train safely.

Access Control Data

  • Door entry and exit logs (date, time, member identity)
  • Access credential information

This data is collected via our electronic access control system (Kisi) to manage building security and monitor who is on the premises.

CCTV & Remote Monitoring

  • CCTV footage and images
  • Remote monitoring observations

CCTV is in operation at the premises for safety and security purposes. During opening hours, live remote monitoring may be in operation via a third-party security provider (Secure24). Monitoring staff may contact emergency services if they observe an incident.

Accident & Incident Records

  • Details of any accidents or incidents involving you at the premises
  • First aid administered
  • Witness information

This information is recorded in our accident book as required by health and safety law.

Technical Data

  • IP address
  • Browser and device information
  • Cookies and website analytics

Enquiry Data

When you send us an enquiry, for example through a Facebook or Instagram lead form, we collect your name, email address, telephone number and your answers to the form's questions (such as which evenings suit you). If you ask about youth classes for your child, this includes your child's first name.

Email Activity

When we email you, we record whether the email was delivered and which links in it you click. Links in our emails go through our own web address (go.functionalfitnessgymltd.com) for a moment before taking you to the page, which is how we see the click. We don't use tracking pixels and we don't record when you open an email.

3. How We Use Your Personal Data

We use your personal data to:

  • Manage memberships, bookings and payments
  • Deliver safe and effective fitness services
  • Control and monitor access to our premises
  • Maintain waiver, induction and attendance records
  • Record and report accidents and incidents as required by law
  • Communicate important gym-related information
  • Reply to your enquiry and follow up with information about our courses, classes and memberships, including a few reminder emails
  • See which links in our emails are useful, so we can follow up properly and improve our emails
  • Improve our services and website
  • Meet legal, regulatory, health & safety and insurance obligations
  • Show you relevant advertising on social media platforms based on your interactions with our pages, profiles, or previous enquiry forms
  • Create audiences of similar people who may be interested in our services (lookalike audiences)

4. Lawful Bases for Processing

We process your personal data under the following lawful bases:

  • Contract – to provide gym services and manage memberships
  • Legal obligation – health & safety, accident reporting, insurance
  • Legitimate interests – administration, security, service improvement, following up enquiries, and advertising to people who have interacted with our business
  • Consent – where required, including health data and marketing

You may withdraw consent at any time.

Emails about your enquiry or purchase: if you enquire about our services or buy a pass from us, we may email you about similar services we offer, such as start dates for our Beginner Camp, or membership options after a Discovery Pass. Every email has an unsubscribe link, or you can reply STOP, and we won't email you again.

5. Health Information

We do not collect or store medical history or ongoing health records. Members may verbally share health information with coaches to ensure safe training, but this is not recorded in your membership profile.

Exception: We are legally required to record details of any accidents, injuries or first aid administered on our premises. These records are retained securely in our accident book in accordance with health and safety law.

In a medical emergency, we may share relevant information with emergency services to protect your vital interests.

6. Use of TeamUp (Gym Management Software)

We use TeamUp, a third-party gym management platform, to manage:

  • Memberships
  • Bookings and attendance
  • Online waivers and acknowledgements
  • Member communications
  • Payment processing (via integrated third-party payment providers)

TeamUp acts as a data processor on our behalf and processes personal data only in accordance with our instructions and applicable data protection laws.

All data stored within TeamUp is protected by appropriate technical and organisational security measures. Where data is processed outside the UK or EEA, appropriate safeguards are in place.

7. Use of Kisi (Access Control System)

We use Kisi, a third-party access control platform, to manage:

  • Electronic door access credentials
  • Entry and exit logs
  • Access schedules and permissions

Kisi acts as a data processor on our behalf. Access logs are used to monitor building security and ensure we know who is on the premises at any time. This data may be shared with emergency services or insurers in the event of an incident.

8. CCTV & Remote Monitoring

CCTV cameras are in operation at our premises for the following purposes:

  • Safety and security of members, staff and visitors
  • Crime prevention and detection
  • Incident investigation

During opening hours, live remote monitoring may be provided by Secure24, a third-party security provider. Monitoring staff may observe the premises via CCTV and contact emergency services if they witness an incident. However, remote monitoring is not a substitute for on-site supervision and assistance may be delayed.

CCTV footage is retained for up to 30 days unless required for longer in connection with an incident or legal proceedings.

Signage is displayed at the premises to inform visitors that CCTV is in operation.

9. Children & Young People (Under 18s)

We offer Youth memberships for members aged 11-17. For members under 18:

  • A parent or legal guardian must complete the membership waiver on their behalf
  • We collect the parent/guardian's contact details as the primary contact
  • Youth members may only attend designated youth classes and are not permitted to use the open gym unsupervised
  • We take appropriate steps to ensure the safety and privacy of young members

We do not knowingly collect personal data from children under 11.

10. Sharing Your Personal Data

We do not sell or rent your personal data.

We may share data with:

  • TeamUp (gym management system)
  • Kisi (access control system)
  • Secure24 (remote monitoring provider)
  • Payment processors
  • Booking and communication platforms
  • Resend (sends our emails)
  • Cloudflare (hosts the systems that send our follow-up emails, and parts of our website)
  • Google (website analytics)
  • Insurers and professional advisers
  • Emergency services
  • Regulatory or legal authorities where required

Meta (Facebook/Instagram): We share limited data with Meta Platforms, Inc. to deliver and measure the effectiveness of our advertising. This includes creating custom audiences from people who have interacted with our social media pages or submitted enquiry forms, and lookalike audiences to reach similar people. Meta acts as a joint controller for this data. You can manage your ad preferences at facebook.com/adpreferences. For details on how Meta processes data, see Meta's Data Policy at facebook.com/privacy/policy.

All third parties are required to protect your data appropriately.

11. Cookies

Our website uses cookies to enable core functionality and analyse usage. We use Google Analytics to understand how our website is used. We may also use tracking technologies (such as the Meta Pixel) to measure the effectiveness of our advertising and to show you relevant ads on other platforms. You can manage cookie preferences through your browser settings. For more information on how Meta uses cookies for advertising, see facebook.com/policies/cookies.

12. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse.

While no system can guarantee absolute security, we take reasonable steps to safeguard your information.

13. Data Retention

We retain personal data only for as long as necessary:

  • Membership and waiver records: up to 6 years after membership ends (limitation period for legal claims)
  • Access control and CCTV: as required for security purposes
  • Accident records: as required by health and safety law
  • Financial records: as required for tax and accounting purposes
  • Enquiries and the emails we send about them: 1 year, then your name and contact details are removed
  • Records of which email links you clicked: 1 year

14. Your Rights

Under UK GDPR, you have the right to:

  • Access your personal data
  • Rectification – request correction of inaccurate or incomplete data
  • Erasure – request deletion in certain circumstances
  • Restrict processing – limit how we use your data
  • Data portability – request your data in a portable format
  • Object – object to processing based on legitimate interests
  • Withdraw consent at any time

To exercise any of these rights, contact us at functional-fitness18@outlook.com. We will respond within one month.

15. Complaints

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

16. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices.

17. Changes to This Policy

We may update this Privacy Policy from time to time. The most current version will always be available on our website and at the gym on request.

18. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact:

Functional Fitness Gym Ltd