SHARING OF YOUR PERSONAL DATA
Fitness Takeover does not sell or rent your personal data.
We only share personal data where this is necessary to deliver our Services, operate our organisation, protect participants, meet legal obligations or pursue another lawful purpose described in this policy.
Where another organisation processes personal data on our behalf, we require it to use the information only for the agreed purpose and to apply appropriate security and confidentiality measures.
Fitness Takeover’s sharing
Fitness Takeover may share your personal data with the following organisations and individuals:
Booking, ticketing and payment providers
We may share personal data with third-party platforms that help us manage event registrations, ticket purchases, memberships, class bookings, payments, refunds and booking communications.
These providers may process information such as your name, contact details, booking information, payment status and transaction reference.
Payment providers normally collect your complete payment card information directly. Fitness Takeover does not usually receive or retain your complete card number or security code.
Some booking and payment providers may act as independent data controllers for parts of their processing. Their own privacy policies will explain how they use and protect your information.
Website, technology and communication providers
We may use trusted third-party providers to host and maintain our website, store business information, manage customer relationships, distribute emails, send text messages, operate booking systems, provide online forms, manage our mailing list and support our social media activities.
These providers may process limited personal data on our behalf so that they can provide the relevant service.
We will only provide information that is reasonably necessary for the provider’s role. We will take appropriate steps to ensure that providers handling personal data on our behalf are subject to suitable data protection and confidentiality obligations.
Venues and facility operators
Fitness Takeover delivers classes, events and community programmes at different venues.
We may share limited information with a venue where this is necessary to manage admission, accessibility, security, safeguarding, emergency arrangements, capacity, attendance or an incident.
For example, we may provide an attendee list to an authorised venue representative where names are required for entry or security purposes.
We will not routinely provide PAR-Q responses or detailed health information to a venue. Relevant health or accessibility information will only be shared where it is necessary to protect you, provide an agreed adjustment or respond to an emergency.
Venues may independently collect personal data through their own booking processes, visitor systems, Wi-Fi services or CCTV systems. Where the venue determines how this information is used, its own privacy policy will apply.
Instructors, coaches and facilitators
We may share relevant participant information with an instructor, coach, therapist, wellbeing facilitator or other professional delivering a Fitness Takeover Service.
The information shared will be limited to what that person reasonably needs to deliver the activity safely and appropriately.
For example, an instructor may be told that a participant requires an alternative movement because of an injury. They would not normally need access to the participant’s complete PAR-Q form or unrelated medical history.
Where an instructor or professional is directly employed or engaged by Fitness Takeover, they must follow our confidentiality and data protection requirements.
Where a professional delivers an independent clinical, counselling, therapeutic or specialist service, they may act as an independent data controller. In those circumstances, they will be responsible for explaining how they collect, use, store and protect any confidential information or professional records.
Event partners and community organisations
We may collaborate with charities, community organisations, local authorities, businesses, gyms, wellbeing organisations, educational providers, funders and other event partners.
Where a partner helps to organise or deliver a programme, we may share limited information needed to administer the activity.
This could include your name, contact details, attendance status, accessibility requirements or confirmation that you are eligible for a funded programme.
We will not share detailed health information with a partner unless this is necessary and lawful, and you have been given appropriate information about the proposed sharing.
Where Fitness Takeover and another organisation jointly determine why and how personal data will be used, we will clarify the organisations’ respective responsibilities where required.
Emergency services, medical professionals and safeguarding organisations
We may share personal data where it is necessary to protect your life, health or safety, or the life, health or safety of another person.
For example, if you become seriously unwell during a class or event, we may provide relevant information to paramedics, medical professionals, emergency services or your nominated emergency contact.
We may also disclose information to safeguarding professionals, local authorities, the police or another appropriate organisation where we reasonably believe that a child, young person or adult at risk may be experiencing abuse, exploitation, neglect or a serious risk of harm.
We will only share information that is relevant to the situation and will record the reason for making the disclosure where appropriate.
Insurers, professional advisers and claims handlers
We may share information with our insurers, insurance brokers, legal advisers, accountants, auditors, claims handlers and other professional advisers where this is necessary to obtain professional advice, manage a complaint, investigate an incident, respond to a claim or protect our legal rights.
Information shared for these purposes may include booking records, communications, PAR-Q information, witness accounts, incident reports, photographs, videos or CCTV footage.
Access will be limited to people who have a legitimate need to receive the information.
Public authorities and law enforcement
We may disclose personal data where we are required to comply with a court order, legal obligation, regulatory request or lawful request from a public authority.
We may also disclose information where it is necessary to prevent or investigate fraud, criminal conduct, harassment, abuse, threats, damage to property or a serious breach of our terms and policies.
We will consider whether a request is lawful, necessary and proportionate before providing personal data, unless the law prevents us from informing you or requires an immediate response.
Marketing, analytics and advertising providers
Where you have provided any consent required by law, we may use marketing, analytics or advertising providers to help us understand how people interact with our website and communications.
These services may help us measure event campaigns, understand website traffic, evaluate the performance of advertisements or present Fitness Takeover content to audiences who may be interested in our Services.
Depending on your cookie and advertising choices, a provider may process online identifiers, cookie information, device data, website activity or information showing whether you interacted with an advertisement.
We do not provide PAR-Q information, private mental health disclosures or emergency information to advertising providers.
You will be able to manage non-essential cookies and related technologies through the cookie choices described in Part 3 of this policy.
Photography and media providers
We may work with photographers, videographers, graphic designers, social media managers and other media professionals to capture and produce content from Fitness Takeover activities.
These providers may have access to identifiable photographs, videos, audio recordings and limited event information.
They must only use the materials for the agreed Fitness Takeover purpose unless they have a separate lawful basis or agreement with the individual concerned.
We will take reasonable steps to ensure that raw footage and unpublished materials are stored securely and are not retained for longer than necessary.
Funders and impact partners
As a Community Interest Company, Fitness Takeover may receive funding or support to deliver community programmes.
We may provide funders and partners with attendance figures, feedback, programme outcomes and information demonstrating the impact of our work.
We will normally provide this information in an aggregated or anonymised format.
We will not include your name, photograph, personal story, testimonial or identifiable health information in a funding report or public case study without an appropriate lawful basis and any permission required.
Business changes
If Fitness Takeover is restructured, merged with another organisation, transfers part of its operations or ceases to provide a Service, relevant personal data may be transferred as part of that change.
Any recipient would only be permitted to use the personal data in a manner consistent with this policy and applicable data protection law, unless you are given further information and another lawful basis applies.
Other sharing with your consent
We may share personal data with another organisation or individual where you have specifically asked us to do so or provided valid consent.
You may withdraw that consent for future sharing at any time, although this will not affect disclosures that were lawfully made before consent was withdrawn.
Your sharing
Some Fitness Takeover Services may allow you to communicate or share content with other participants through social media, online communities, messaging groups, event pages or other interactive services.
Information that you post in a public or shared space may be visible to other people. This may include your profile name, photograph, comments, fitness experiences, event attendance or other information you choose to share.
You should avoid posting private health, financial, safeguarding or contact information in public comments or community groups.
Where Fitness Takeover manages an online community, we may establish rules to protect members and maintain a respectful environment. However, we cannot guarantee that other participants will keep information confidential or prevent them from saving, copying or sharing content they can access.
You are responsible for considering what information you make available through third-party social media and messaging platforms. The platform’s own privacy settings and terms will also apply.
PROTECTION AND MANAGEMENT OF YOUR PERSONAL DATA
Security and confidentiality
Fitness Takeover uses appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
The measures we use will depend on the type of information, the sensitivity of the data, the potential impact of a security incident and the systems used to process it.
Our measures may include:
We may use password protection, access controls and multi-factor authentication.
We may restrict access to personal data according to a person’s role and responsibilities.
We may store electronic information through reputable service providers.
We may use encrypted or secure methods when transferring sensitive information.
We may protect paper PAR-Q forms and other records in secure storage.
We may provide confidentiality and data protection guidance to team members.
We may maintain appropriate backup, recovery and incident-response processes.
We may review access when a staff member, contractor or instructor leaves their role.
We may delete, anonymise or securely dispose of information when it is no longer required.
We may assess the security practices of third parties that process information on our behalf.
UK data protection law requires organisations to maintain appropriate security measures for the personal data they hold. (ICO)
No method of storing or transmitting information can be guaranteed to be completely secure. However, we will take reasonable and proportionate steps to reduce risks and respond appropriately if an incident occurs.
You should protect any password or login information connected with your Fitness Takeover account. Please contact us promptly if you believe your account or personal data has been accessed without permission.
Personal data breaches
A personal data breach may include personal data being lost, stolen, accidentally deleted, altered, sent to the wrong person, accessed without permission or made unavailable.
If we become aware of a possible breach, we will take reasonable steps to contain the incident, assess the information affected, consider the risk to individuals and prevent a similar incident from occurring again.
Where a breach is likely to create a risk to people’s rights and freedoms, we will report it to the Information Commissioner’s Office without undue delay and, where feasible, within the applicable 72-hour period. Where a breach is likely to result in a high risk to an individual, we will also inform the affected person unless an exception applies. (ICO)
We will maintain appropriate records of personal data breaches, including decisions about whether notification was required.
International transfers of personal data
Fitness Takeover is based in the United Kingdom. However, some of the technology, booking, payment, website, email, cloud-storage, analytics or social media providers we use may process personal data in other countries.
The data protection laws of another country may not provide exactly the same protections as UK law.
Where our use of a provider involves a restricted transfer of personal data outside the United Kingdom, we will take steps to ensure that an approved transfer mechanism applies.
Depending on the destination and provider, this may include:
The transfer may be covered by UK adequacy regulations.
The provider may participate in an approved arrangement recognised by the UK.
We may use the United Kingdom International Data Transfer Agreement.
We may use the United Kingdom Addendum to approved standard contractual clauses.
We may rely on another appropriate safeguard permitted by data protection law.
In limited circumstances, we may rely on a specific legal exception.
Where appropriate safeguards are used, Fitness Takeover will consider whether the transferred information will receive a standard of protection that is not materially lower than the protection it receives in the United Kingdom. Current ICO guidance requires restricted transfers to be covered by adequacy regulations, appropriate safeguards or a permitted exception. (ICO)
You may contact us for more information about the safeguards applying to a particular transfer.
Retention of personal data
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected.
We may retain information for a longer period where this is necessary to meet legal, regulatory, accounting, tax, insurance, safeguarding, health and safety or claims-related responsibilities.
There is no single retention period that applies to every category of personal data. UK data protection law requires organisations to determine and justify retention periods according to the purpose for which the information is held, and to erase or anonymise information when it is no longer needed. (ICO)
When setting retention periods, we consider:
The purpose for which the information was collected.
The nature and sensitivity of the information.
Whether you continue to attend or use our Services.
The potential risk caused by unauthorised use or disclosure.
Legal, regulatory, insurance and contractual requirements.
The time within which a complaint or legal claim could arise.
Safeguarding and child-protection considerations.
Whether the information can be anonymised instead of deleted.
Whether you have requested deletion or withdrawn consent.
Our general retention approach is described below.
Booking, membership and attendance information
We normally retain active membership and booking information while you continue to use our Services.
When your relationship with Fitness Takeover ends, we may retain necessary records for a reasonable period to manage refunds, complaints, disputes, financial reporting, insurance matters and potential legal claims.
Information that is no longer required will be deleted, anonymised or reduced to a limited record.
Financial and transaction records
Information needed for accounting, audit and tax purposes may normally be retained for up to six years after the end of the relevant financial period, or longer where required by law or an ongoing dispute.
This may include invoices, transaction references, refund records and evidence of payments.
Fitness Takeover does not normally retain full payment card details.
PAR-Q forms and health information
PAR-Q forms and other health information will be retained for as long as reasonably necessary to support safe participation and manage relevant health, safety, insurance or legal responsibilities.
Where you attend regular classes or maintain a membership, we may ask you to review or update your PAR-Q periodically or whenever your health circumstances change.
When you stop participating, we will review whether the health information must continue to be retained. It may be retained for a reasonable period where it could be relevant to an accident, complaint, insurance matter or legal claim.
Health information that is no longer necessary will be securely deleted or destroyed.
You may request deletion of your health information. We will comply where no legal, safeguarding, insurance, safety or claims-related reason requires continued retention.
Where we cannot immediately delete information, we will explain the reason and consider whether its use can be restricted.
Emergency contact information
Emergency contact information will normally be retained while you are actively participating in the relevant class, membership or programme.
It will be deleted or updated when it is no longer required, subject to any reason to retain it as part of an incident or safeguarding record.
Enquiries and communications
General enquiries may be retained for a reasonable period after the enquiry has been resolved.
Communications concerning a booking, complaint, safeguarding issue, accident, contractual matter or legal dispute may be retained for longer where necessary.
Incident, accident and safeguarding records
Incident and accident records may be retained for the period necessary to meet health and safety, insurance and legal claims requirements.
Safeguarding records may be retained for longer periods because concerns involving children or adults at risk may remain relevant after the immediate programme or event has ended.
The retention period will be determined according to the nature of the concern, legal requirements, safeguarding guidance and advice from appropriate professionals.
Marketing information
We may retain your marketing information until you unsubscribe, withdraw consent or object to direct marketing.
If you opt out, we may retain a minimal suppression record containing information such as your email address or telephone number. This allows us to recognise and respect your preference and avoid adding you back to a marketing list accidentally.
A suppression record will not be used to send promotional communications.
Photographs and videos
Published photographs and videos may be retained for as long as they continue to serve a legitimate promotional, historical, reporting or community-impact purpose.
We will periodically review stored media and remove raw or unused material that is no longer reasonably required.
Where content was based on your consent, you may withdraw consent for future use. We will consider whether the material can reasonably be removed from our website, social media accounts or future campaigns.
Withdrawal may not require us to recall printed materials or remove content that has already been copied, reposted or independently published by another person.
CCTV footage
Where Fitness Takeover controls a CCTV system, footage will normally be retained for no longer than 30 days.
Footage may be retained for longer where it is required to investigate an incident, support an insurance matter, respond to a lawful request or establish, exercise or defend a legal claim.
Where CCTV is controlled by a venue, the venue’s own retention policy will apply.
Survey and impact information
Identifiable survey responses and impact information will be retained only for as long as necessary to analyse the relevant programme and report its outcomes.
Where possible, we will anonymise information used for long-term research, statistics or community-impact reporting.
Competition information
Competition entries will normally be retained until the competition has been completed, prizes have been issued and any reasonable dispute period has passed.
Winner information may be retained for longer where necessary for accounting, publicity or legal purposes.
Deletion and anonymisation
At the end of an applicable retention period, personal data will be securely deleted, destroyed or anonymised.
Anonymised information that can no longer identify you may be retained and used for research, statistics, service evaluation and community-impact reporting.
YOUR RIGHTS RELATING TO YOUR PERSONAL DATA
UK data protection law gives you a number of rights relating to your personal data.
These rights are not always absolute. The right that applies may depend on the type of personal data, the purpose for which it is being used and the lawful basis relied upon.
We will consider every request fairly and explain our decision if a right does not apply in full.
The right to be informed
You have the right to receive clear information about how your personal data is collected and used.
This Privacy and Cookies Policy forms part of the information we provide. We may also provide additional notices through booking forms, PAR-Q forms, membership documents, photography notices, event information and cookie settings.
The right of access
You may ask us to confirm whether we process your personal data and request a copy of the information we hold about you.
This is commonly known as a subject access request.
You may also request information about the purposes of processing, categories of personal data, recipients, retention periods and the source of the information where it was not collected directly from you.
Subject access requests may be made verbally or in writing. Organisations must generally respond without undue delay and within one month, although the period may be extended where a request is complex or several requests are received from the same person. (ICO)
The right to rectification
You may ask us to correct personal data that is inaccurate or complete information that is incomplete.
Please inform us promptly if your contact details, emergency contact information, health information or accessibility needs change.
Where appropriate, we may ask you to confirm updated health information through a new PAR-Q or health declaration.
The right to rectification permits people to request correction of inaccurate information or completion of incomplete information. (ICO)
The right to erasure
You may ask us to delete personal data in certain circumstances. This is sometimes called the right to be forgotten.
The right may apply where:
The information is no longer required for the purpose for which it was collected.
You withdraw consent and no other lawful basis applies.
You successfully object to processing.
The information has been processed unlawfully.
Deletion is required to comply with a legal obligation.
The right to erasure is not absolute. We may need to retain information to comply with a legal obligation, protect public safety, manage safeguarding responsibilities or establish, exercise or defend legal claims. (ICO)
Requesting deletion of health information
You may specifically request deletion of information collected through a PAR-Q, health declaration or accessibility form.
We will delete the information where it is no longer necessary and no legal, health and safety, insurance, safeguarding or claims-related reason requires us to retain it.
Where we must retain part of the record, we will limit the information retained where reasonably possible and explain the reason for our decision.
Deleting health information may affect our ability to safely provide certain Services. In some circumstances, you may need to complete a new PAR-Q before participating again.
The right to restrict processing
You may ask us to temporarily limit the use of your personal data in certain circumstances.
This may apply while we investigate whether information is accurate, consider an objection, assess whether processing was lawful or determine whether information is still needed for a legal claim.
When processing is restricted, we may continue to store the information but will not normally use it for another purpose unless an exception applies. ((ICO)
The right to data portability
Where processing is based on consent or a contract and carried out by automated means, you may request personal data that you provided to us in a structured, commonly used and machine-readable format.
You may also ask us to transfer eligible information directly to another organisation where this is technically feasible.
This right does not apply to every category of information and will not normally apply to paper records or information created entirely by Fitness Takeover. ((ICO)
The right to object
You may object to processing based on legitimate interests where your particular circumstances give you a reason to do so.
We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for legal claims.
You have an absolute right to object to your personal data being used for direct marketing. (ICO)
Rights relating to automated decision-making
You may have rights where an organisation makes a decision about you using solely automated processing and that decision produces legal or similarly significant effects.
Fitness Takeover does not currently expect to make significant decisions concerning participation, membership or access to Services entirely through automated processing without meaningful human involvement.
If this practice changes, we will provide appropriate information about the processing and the rights available to you.
The right to withdraw consent
Where we rely on consent, you may withdraw it at any time.
This may include consent relating to marketing communications, optional photography, testimonials, case studies, health information or non-essential cookies.
Withdrawal will apply to future processing and will not make processing carried out before withdrawal unlawful.
Withdrawing consent may affect our ability to provide a Service where the relevant information is genuinely necessary for safe or appropriate participation.
Opting out of promotional communications
You may opt out of Fitness Takeover promotional communications at any time.
You can do this by:
Selecting the unsubscribe link in a marketing email.
Following the opt-out instructions in a text or messaging communication.
Changing your communication preferences through your account where available.
Contacting Fitness Takeover using the details provided in this policy.
Asking a member of our team to update your preferences.
We may need a reasonable period to update all relevant systems.
After opting out, you may continue to receive essential communications relating to an active booking, membership, payment, safety issue, timetable change or Service you requested.
We may retain a limited suppression record to ensure that your marketing preference continues to be respected.
How to exercise your rights
To exercise a data protection right, contact:
Email: info@fitnesstakeover.org
Postal address: Fitness Takeover CIC, 40 Montague Side, Basildon, England, SS14 3GS
Please describe the information or processing your request concerns.
We may ask for information reasonably required to confirm your identity. This is intended to protect personal data from being disclosed, changed or deleted at the request of an unauthorised person.
Where another person makes a request on your behalf, we may ask for evidence that they have your authority to act.
We will not normally charge a fee. A reasonable fee may be charged, or a request may be refused, where permitted by law because it is manifestly unfounded or excessive.
Where we refuse a request or cannot comply with it in full, we will explain the reason and inform you of your right to complain to the Information Commissioner’s Office.
Complaints to the Information Commissioner’s Office
You have the right to complain to the Information Commissioner’s Office, which is the United Kingdom’s independent data protection regulator.
We encourage you to contact Fitness Takeover first so that we have an opportunity to investigate and respond to your concern.
Making a complaint to Fitness Takeover does not prevent you from contacting the Information Commissioner’s Office or exercising another legal right.