datapolicy | Understand Data Privacy - Join Safely

Data Protection Policy

Last updated: 15/09/2026 Version: 2.0

Introduction

At Vitality MicroGym, we're committed to protecting your privacy. This Privacy Notice explains how we collect and process personal data about you — to provide our gym services, operate our business, meet our legal obligations, keep our unstaffed facility secure, and communicate with you. It applies to anyone who enquires about membership, joins Vitality MicroGym, visits our website, subscribes to our newsletter, or uses our facility.

Identity of Data Controller

Vitality MicroGym is the data controller for the personal data we process about you.

Our contact information is:

Vitality MicroGym Unit 13, Derwent Business Centre, Clarke Street. Derby DE1 2BU.

Email: info@vitalitymicrogymderby.co.uk

Phone: 07362226567

If you have any queries about this Privacy Notice, please contact us using the details above.

Vitality MicroGym is registered with the Information Commissioner's Office (the "ICO") as a data controller under registration reference ZC175117

When Do We Collect Personal Data?

We collect your personal data when you:

Visit or browse our website
Fill out our online contact/enquiry form
Sign up to our email newsletter
Complete a membership application via our GymDesk member portal
Check in or gain access to the gym
Contact us by phone, email, or in person
Are recorded on our CCTV system while at our premises
Have an accident, or are involved in or witness an incident, at our gym

What Personal Data Do We Collect?

Membership data (collected when you join, via GymDesk): name, date of birth, gender, email address, postal address, telephone number, a photograph (used for member identification), and emergency contact name and details.

Payment data: Your membership payments are processed by Stripe. We do not store your full card or bank details on our own systems.

CCTV footage: Images of you visiting or using our unstaffed facility, captured 24/7.

Website enquiry data: Name, email address, and telephone number, if you complete our contact form.

Newsletter data: Your email address (and name, if provided), if you opt in to marketing emails.

We do not collect, request, or store any health, medical, or other special category data about our members. If a member voluntarily discloses medical information in an emergency, we only use it to protect their immediate safety — we do not record or retain it (see "Basis of Lawful Processing" below).

How We Use Your Personal Data

We use your personal data to:

Set up and administer your membership
Verify your identity and grant secure access to our unstaffed facility
Take payment for membership fees and maintain financial/accounting records
Respond to enquiries made through our website
Operate CCTV for the security of members, staff, and property
Contact an emergency contact on your behalf, should the need arise
Send you marketing offers and updates, where you've opted in
Respond to questions, complaints, or requests you raise with us
Comply with our legal and regulatory obligations
Prevent and detect fraud, or defend ourselves in relation to a legal claim

Basis of Lawful Processing

Vitality MicroGym must have a lawful basis to collect and process your personal data. We rely on the following:

In relation to your membership:

Contractual necessity — processing your name, contact details, DOB, gender, address, and photo is necessary to perform our membership agreement with you, including granting secure access to an unstaffed site.
Legal obligation — retaining payment and transaction records to meet accounting and tax obligations.
Legitimate interests — operating CCTV and access systems to keep our facility and members safe.

In relation to emergency contact and safety information:

Vital interests — we hold and use your emergency contact details, and any safety-related information you volunteer during an incident, solely to protect your life or prevent serious harm.

In relation to website visitors and marketing:

Consent — you have freely and explicitly opted in to receive our newsletter. You can withdraw this consent at any time.
Legitimate interests — responding to enquiries submitted through our contact form, and taking reasonable steps at your request before you become a member.

In relation to data we retain after your membership ends:

Legal obligation — to meet financial record-keeping requirements.
Legitimate interests — to resolve any outstanding billing or contractual matters.

Retention

Membership data — for the duration of your membership, and for 6 years from your last account activity afterwards, to meet accounting and legal obligations.
Emergency contact details — deleted when your membership ends.
CCTV footage — retained on 90 days on a rolling basis, unless we need to retain specific footage longer for an ongoing investigation, safety matter, or legal claim.
Payment/transaction records — 6 years, as required for accounting and tax purposes.
Website enquiry data (non-members) — 12 months from your last contact with us.
Newsletter data — until you unsubscribe or withdraw consent.

We may retain data for longer where we have a legitimate reason to do so, or where required by law (for example, health and safety, or anti-fraud obligations).

CCTV

Because Vitality MicroGym is an unstaffed, 24/7 facility, CCTV is an important part of how we keep members and the premises safe. We follow ICO guidance and applicable data protection law in how we manage it:

Coverage: Cameras cover the gym floor, entrance/exit points, and record continuously, 24 hours a day. We do not position cameras in areas where you'd reasonably expect greater privacy.
Purpose: To deter and detect crime, protect the safety of members using an unsupervised facility, help resolve incidents or disputes, and protect our property.
Signage: Clear signage is displayed on-site to notify you that CCTV is in operation.
Access and review: Footage is only accessed and reviewed by authorised personnel, and only where necessary — for example, to investigate a specific incident, safety concern, or complaint.
Retention: Footage is retained on a rolling basis of 90 days and then automatically overwritten, unless we need to keep specific footage longer for an investigation or legal claim.
Disclosure: We will only share CCTV footage with third parties (for example, the police) where legally required, or with appropriate written authority.

Marketing and Your Opt-Out Rights

We will only send you marketing emails if you've opted in to our newsletter. You can opt out at any time by:

Clicking "unsubscribe" on any marketing email, or
Contacting us directly using the details above

We do not use your membership data for marketing purposes unless you've separately consented, and we will not share your data with third parties for their own marketing purposes.

Cookies

Our website may use cookies to support core functionality and, where enabled, analytics. Please read our cookies policy for further information.

Keeping Your Personal Data Secure

We take appropriate technical and organisational steps to protect your data, including:

Storing membership data within GymDesk's secure, access-controlled platform
Restricting access to CCTV footage and membership records to authorised personnel only
Never storing full payment card details ourselves — this is handled entirely by Stripe
Controlling physical access to our unstaffed facility through a secure entry system
Requiring that any organisation processing data on our behalf only does so under our instructions and appropriate contractual safeguards

Will We Disclose Your Personal Data to Third Parties?

We do not sell your personal data. We may share it with:

GymDesk (operated by Martial Arts on Rails, LLC, Austin, Texas, USA) — our membership management processor, which stores and processes your membership data on our behalf. As GymDesk is based in the US, transfers of your data to them are protected under the EU Standard Contractual Clauses (Module 2: Controller to Processor). GymDesk in turn engages its own sub-processors to help deliver its platform — covering areas like cloud hosting, payment integrations, and SMS/email delivery. GymDesk publishes its current sub-processor list at gymdesk.com/page/subprocessors, which you're welcome to review.
Stripe — our payment processor, connected via GymDesk's billing integration, for handling membership payments securely. Stripe is PCI DSS-compliant, and we never see or store your full card details.
Squarespace — our website provider, which processes the data you submit through our contact form and newsletter sign-up. Squarespace safeguards international transfers through its certification under the UK/EU–U.S. Data Privacy Framework, falling back to Standard Contractual Clauses where the Framework doesn't apply. Squarespace's own sub-processor list is available on request by emailing privacy@squarespace.com.
Professional advisors, such as our accountant, where necessary for legal or financial compliance.
Law enforcement, regulators, or courts, where we're legally required to disclose information, or where necessary to protect the safety of our members or property (for example, sharing CCTV footage with the police).
A future buyer or successor of our business, if Vitality MicroGym is ever sold or restructured. We would inform you if this happened.

International Data Transfers

Some of our service providers — including GymDesk and Squarespace — are based in, or transfer data to, the United States. Where this happens, we ensure appropriate safeguards are in place, such as the UK/EU Standard Contractual Clauses or, where applicable, the UK/EU–U.S. Data Privacy Framework, so your data continues to receive a level of protection equivalent to that required under UK GDPR.

Automated Decision-Making

We do not use your personal data for any automated decision-making that produces legal or similarly significant effects on you.

Membership Age

Membership is only available to individuals aged 18 and over. We do not knowingly collect data from individuals below this age.

Your Privacy Rights

You have the following rights in relation to your personal data:

Access — request a copy of the data we hold about you
Rectification — ask us to correct inaccurate or incomplete data
Erasure — ask us to delete your data, where applicable
Restriction — ask us to restrict how we use your data in certain circumstances
Notification — be informed of any rectification, erasure, or restriction applied to your data
Portability — receive your data in a format that can be transferred to another controller
Object — object to processing based on our legitimate interests, including direct marketing
Withdraw consent — where we rely on consent (for example, our newsletter), withdraw it at any time
Not be subject to automated decision-making that produces a legal or similarly significant effect

To exercise any of these rights, contact us using the details in "Identity of Data Controller" above. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Changes to This Privacy Notice

We may update this notice from time to time, particularly if our data processing activities change or new legal requirements apply. The "last updated" date at the top of this page shows when it was last revised.

Contact Us