FITNESS TAKEOVER CIC PRIVACY POLICY
Effective date: 23rd July 2026
Last updated: 23 July 2026
This Privacy and Cookies Policy describes the personal data collected or generated when you interact with Fitness Takeover CIC through our website, booking platforms, membership services, weekly fitness classes, Step X Vibes events, community programmes, private fitness experiences, mental health and wellbeing events, social media pages, competitions, promotions or any other service delivered by us. Together, these are referred to in this policy as our “Services”.
This policy explains how we collect, use, share, store and protect your personal data. It also explains the choices available to you, your rights in relation to your personal data and how you can contact us if you have a question, concern or complaint.
Fitness Takeover CIC does not sell or rent your personal data. We only use personal data where it is necessary to provide our Services, manage our organisation, communicate with our community, maintain health and safety, meet our legal responsibilities or pursue another legitimate purpose explained in this policy.
CONTENTS
Who is responsible for processing your personal data?
What personal data do we collect and when?
Children and young people
Tools to manage the personal data we collect
Why and how do we use your personal data?
Sharing of your personal data
Protection and management of your personal data
Your rights relating to your personal data
Cookies, pixels and similar technologies
Using Fitness Takeover Services with third-party products and services
Changes to our Privacy and Cookies Policy
Questions, feedback and complaints
WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?
Fitness Takeover CIC is responsible for deciding how and why your personal data is processed when you interact directly with us. This means that Fitness Takeover CIC is normally the data controller for the purposes of the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable UK data protection legislation.
Our company details are:
Company name: Fitness Takeover CIC
Company number: 17316965
Registered office: 40 Montague Side, Basildon, England, SS14 3GS
Privacy email:info@fitnesstakeover.org
Website:www.fitnesstakeover.co.uk
In this Privacy and Cookies Policy, “Fitness Takeover”, “we”, “our” and “us” refer to Fitness Takeover CIC.
Some of our Services are delivered with venues, instructors, event partners, mental health professionals, wellbeing facilitators, community organisations or booking providers. Depending on the circumstances, these organisations may process personal data on our behalf as data processors, or they may act as independent data controllers responsible for their own use of personal data.
Where another organisation is independently responsible for processing your personal data, its own privacy policy will apply. We encourage you to read the privacy notices provided by venues, payment providers, ticketing platforms and other organisations that you interact with through our Services.
WHAT PERSONAL DATA DO WE COLLECT AND WHEN?
We ask you to provide certain personal data so that we can deliver the Services you request. The personal data we collect will depend on how you interact with Fitness Takeover.
We may collect personal data when you purchase a ticket, book a class, register for an event, become a member, complete a registration form, complete a Physical Activity Readiness Questionnaire, attend a mental health or wellbeing event, enter a competition, contact us, subscribe to receive communications, respond to a survey, participate in a community programme or otherwise interact with us.
Contact and identity information
We may collect information that identifies you or allows us to contact you. This may include your full name, email address, telephone number, postal address, date of birth, age range, gender or preferred pronouns where you choose to provide them.
We may also collect the name and contact details of a parent, guardian, carer, support worker or emergency contact where this is necessary for participation, accessibility, safeguarding or emergency purposes.
Booking, purchase and membership information
When you book or purchase one of our Services, we may collect information about the class, programme, event, ticket or membership you selected.
This may include your booking history, attendance history, membership status, ticket type, discount code, class package, booking reference, payment status, refund information, cancellation history and any reasonable adjustments or accessibility support you request.
Where we operate recurring memberships or class packages, we may use your information to manage renewals, track attendance, administer benefits, communicate changes and confirm whether your membership remains active.
Payment information
Payments may be processed through third-party ticketing, payment or booking providers. These providers may collect payment card details, billing addresses and other financial information directly from you.
Fitness Takeover does not normally receive or store your complete payment card number or security code. We may receive limited transaction information, such as your name, payment status, amount paid, payment date, transaction reference, last digits of a payment card or information required to manage a refund or payment dispute.
The third-party payment provider is responsible for processing your complete payment information in accordance with its own privacy policy and security standards.
Account and login information
Where our website or booking system allows you to create an account, we may collect your username, encrypted password, unique customer identification number, membership number and account preferences.
We may also collect information about actions taken through your account, such as classes viewed, bookings made, cancellations, purchases, communication preferences and updates made to your profile.
You are responsible for keeping your login information confidential and for notifying us if you believe that another person has accessed your account without permission.
Health, fitness and accessibility information
Because Fitness Takeover delivers physical activity, fitness classes, community wellbeing programmes and mental health events, we may need to collect information about your health, physical ability or support needs.
This information may be collected through a Physical Activity Readiness Questionnaire, commonly known as a PAR-Q, a health declaration, registration form, consultation, reasonable adjustment request or conversation with an authorised member of our team.
Health and fitness information may include information about:
You may tell us about a medical condition that could affect your participation.
You may provide information about an injury, physical limitation or previous operation.
You may tell us about medication that may be relevant during an activity or emergency.
You may provide information about a disability, neurodivergence, mobility need or communication need.
You may inform us that you are pregnant or have recently given birth where this is relevant to safe participation.
You may tell us about allergies, breathing difficulties, heart conditions, seizures, fainting, blood pressure concerns or other relevant health matters.
You may provide your height, weight, fitness level, training experience or personal goals where these are relevant to a particular programme.
You may identify reasonable adjustments, alternative movements or additional support that will help you participate safely.
You may provide emergency medical information or instructions that should be followed if you become unwell.
Health information is treated as special category personal data under UK data protection legislation. We collect only the information that we reasonably need to assess safe participation, provide appropriate support, make reasonable adjustments, respond to an emergency or meet our health and safety responsibilities.
Completing a PAR-Q does not create a doctor–patient or therapist–client relationship with Fitness Takeover. Unless a Service is specifically delivered by an appropriately qualified and authorised professional, Fitness Takeover does not use PAR-Q information to diagnose, treat or provide clinical advice.
We do not use PAR-Q information or other health information to send you promotional communications, and we do not sell health information to third parties.
Mental health and wellbeing information
When you attend a mental health, personal development or wellbeing event, you may choose to share personal experiences, support needs or information concerning your emotional or psychological wellbeing.
We will not require you to disclose more information than is necessary to participate in the relevant Service. Information shared during a group activity may be heard by other attendees, and we will encourage everyone participating to respect each other’s confidentiality. However, we cannot guarantee that another attendee will keep information confidential after it has been shared in a group setting.
Where a session is delivered by an independent therapist, counsellor, psychologist or other mental health professional, that professional may be independently responsible for any confidential notes or clinical information they collect. Their own privacy notice, professional obligations and record-retention requirements may apply.
We may need to record or share limited information where there is a serious and immediate concern about someone’s safety, a safeguarding concern, a legal requirement or another situation in which disclosure is necessary and lawful.
Emergency contact and safeguarding information
We may collect emergency contact information so that we can contact a nominated person if you become injured, unwell or otherwise require assistance during one of our Services.
Where children, young people or adults at risk participate in our Services, we may also collect information necessary to manage safeguarding responsibilities. This could include parental or guardian details, authorised collection arrangements, accessibility needs, incident information or relevant communications with safeguarding professionals.
We will only use this information for appropriate safety, safeguarding, legal or operational purposes.
Communications and enquiries
When you contact us through our website, email, telephone, messaging services, social media or another communication channel, we may collect your contact details and the information contained in your message.
This may include questions about our Services, booking enquiries, complaints, requests for support, feedback, testimonials, collaboration enquiries, venue enquiries or communications concerning an incident.
We may retain a record of our communication where this is necessary to respond to you, provide support, resolve a dispute, improve our Services or maintain an appropriate business record.
Marketing and communication preferences
When you subscribe to our mailing list, join a community communication channel, request event updates or agree to receive promotional messages, we may collect your name, contact information and communication preferences.
We may record whether you have agreed to receive marketing by email, text message, messaging application, telephone or another channel. We may also record when and how your consent was obtained, whether you opened or interacted with a communication and whether you subsequently unsubscribed.
You may opt out of promotional communications at any time. Instructions for opting out are provided later in this policy.
Surveys, competitions, promotions and feedback
When you complete a survey, enter a competition, take part in a promotion or provide feedback, we may collect your response, contact details, entry information and any content you choose to submit.
Where a prize is offered, we may use your contact details to administer the competition, verify eligibility, contact winners and arrange delivery or collection of the prize.
We may ask for permission before publishing a testimonial, review or case study in a way that identifies you.
Photographs, videos and audio recordings
Fitness Takeover may take photographs, videos or audio recordings during weekly classes, Step X Vibes events, private bookings, community programmes, workshops and other activities.
These materials may include identifiable images, voices, movements, participation in games, instructor demonstrations, group activities and footage showing the atmosphere of an event.
Photographs and recordings may be used for:
We may use them on the Fitness Takeover website.
We may publish them through our social media accounts.
We may use them to promote future classes, events and programmes.
We may include them in advertisements, flyers, posters and email campaigns.
We may use them in community impact reports, presentations or funding applications.
We may share event highlights with attendees and our wider community.
We may use them for staff training, quality review or internal records where appropriate.
We will provide reasonable notice when organised photography or filming is expected to take place. Notice may be provided through the event description, ticket information, registration process, venue signage, an announcement or direct communication.
You may tell us before or during an activity that you do not wish to be deliberately photographed or filmed. We will take reasonable steps to respect your request, particularly when capturing close-up or individually focused content.
Because many of our activities take place in active group environments, we cannot always guarantee that you will not appear incidentally in wide-angle, background or crowd footage. Where reasonably possible, we will avoid using clearly identifiable promotional footage of a person who has objected.
Additional consent may be requested for individual interviews, testimonials, close-up promotional content, case studies or content involving children and young people.
You may contact us if you believe that an image or recording of you has been used inappropriately or if you wish to withdraw consent for future use. Withdrawal will not automatically make previous lawful use unlawful, and it may not always be possible to remove materials that have already been printed, shared by others or incorporated into completed publications. However, we will consider reasonable removal requests and take appropriate action where possible.
CCTV and venue security
Fitness Takeover may operate CCTV or use venues where CCTV is in operation.
CCTV may capture images of participants, visitors, instructors, contractors and members of the public entering, leaving or moving through a venue.
CCTV is used for purposes such as maintaining safety and security, preventing and detecting crime, protecting property, investigating accidents or incidents, managing disputes and supporting the establishment, exercise or defence of legal claims.
CCTV will not be deliberately positioned in changing rooms, toilets or other areas where individuals would reasonably expect a high level of privacy.
Where Fitness Takeover operates the CCTV system, appropriate notices will be displayed. Access to footage will be restricted to authorised people who have a legitimate reason to view it.
Where CCTV is controlled by a third-party venue, the venue will normally be responsible for determining how the footage is used, stored and disclosed. Requests relating to that footage may need to be directed to the venue operator.
Information collected from other people and organisations
We may receive personal data about you from other sources. For example, a ticketing platform may provide us with attendee information after you purchase a ticket, a venue may provide information concerning an incident, or a community partner may refer you to one of our programmes.
We may also receive information from a parent, guardian, carer, support worker, emergency contact, instructor, event partner or organisation arranging a private booking.
Where someone provides personal data about another person, they should ensure that they have an appropriate reason and authority to share it.
Social media information
When you interact with Fitness Takeover on social media, we may receive information made available through the relevant platform. This may include your profile name, public profile information, comments, messages, photographs, videos, reactions and information showing how you interacted with our content.
If you tag Fitness Takeover, use a campaign hashtag, send us content or comment publicly on our pages, we may respond to, share or repost that content where appropriate. We will consider the context in which the content was originally shared and may ask for permission before using it for a separate promotional purpose.
Social media platforms are independently responsible for aspects of their own personal data processing. Their privacy policies and account settings will apply when you use their services.
Information collected automatically
When you visit our website or use an online booking service, certain information may be collected automatically from your device or browser.
This may include:
Your internet protocol address may be collected.
Your browser type, browser version and language settings may be recorded.
Your device type, operating system and screen information may be collected.
Information about the pages you visit and the actions you take may be recorded.
The date, time and duration of your visit may be collected.
The website or link that directed you to our website may be recorded.
Cookie identifiers, session information and consent preferences may be collected.
Information about ticket pages, classes or Services viewed may be recorded.
Approximate location information derived from an internet protocol address may be collected.
Technical error, security and performance information may be collected.
More information about these practices is provided in the “Cookies, Pixels and Similar Technologies” section of this policy.
We do not normally use website information to make decisions that produce legal or similarly significant effects about you without meaningful human involvement.
CHILDREN AND YOUNG PEOPLE
Some Fitness Takeover Services may be suitable for children or young people. The age requirements and supervision arrangements may vary depending on the activity, venue, instructor, insurance conditions and level of physical risk.
Where parental or guardian consent is required, we may ask the responsible adult to provide registration, health, emergency contact and participation information on behalf of the child or young person.
We may require a parent or guardian to confirm that they have authority to provide the child’s personal data and to agree to the relevant participation conditions.
Where we rely on consent to process a child’s personal data, we will take reasonable steps to ensure that the consent is valid and has been provided by an appropriate person. Separate consent may be requested for photography, filming, case studies or promotional use involving a child.
We will explain our use of personal data in language that is appropriate to the age and understanding of the child or young person where reasonably possible.
Parents and guardians should not provide unnecessary health, family or personal information. They should only provide information relevant to safe participation, accessibility, safeguarding or the delivery of the requested Service.
A parent or guardian may contact us to ask about personal data held in relation to their child. Depending on the child’s age, understanding, rights and circumstances, we may need to consider whether the child can exercise their own data protection rights.
Our website is not intended to encourage children to purchase tickets or memberships independently where they do not have the legal capacity or required parental permission to do so.
If we discover that personal data about a child has been collected inappropriately, we will take reasonable steps to investigate and delete or restrict the information where required.
TOOLS TO MANAGE WHAT PERSONAL DATA WE COLLECT
Fitness Takeover aims to provide clear information and meaningful choices about personal data.
Where consent is required, we will ask for it through an appropriate method. This may include an online consent box, booking form, PAR-Q declaration, photography consent form, membership form, cookie banner or direct written request.
Consent requests will be separated from general terms where appropriate and will explain what you are agreeing to. You are not required to agree to optional marketing or promotional uses in order to purchase a ticket or attend a Service.
You can manage certain information and preferences by:
You can update information through your account or booking profile where this functionality is available.
You can change your marketing preferences by contacting us.
You can unsubscribe using the link included in a promotional email.
You can follow the opt-out instructions included in a text or messaging communication.
You can adjust cookie choices through our cookie banner or Cookie Settings tool.
You can change browser settings to block, delete or restrict cookies.
You can adjust privacy and advertising settings on your mobile device.
You can manage what information is visible through your social media account settings.
You can inform an instructor or event team member if you do not wish to be deliberately photographed or filmed.
You can contact us to request access to, correction of or deletion of eligible personal data.
You can withdraw consent to the future processing of health information where consent is the condition we rely upon.
Changing a preference does not necessarily require us to delete all existing information. We may continue to retain certain information where it is required for accounting, legal, safeguarding, insurance, health and safety, dispute-resolution or other lawful purposes.
Your browser and mobile device may provide additional controls governing cookies, location information, camera access, notifications and advertising identifiers. We encourage you to review the privacy settings available on each device and platform you use.
WHY AND HOW DO WE USE YOUR PERSONAL DATA?
We use personal data for the purposes described below.
To provide the Services you request
We use your personal data to process bookings, issue tickets, register you for classes, manage memberships, confirm attendance and provide the event, programme or service you requested.
For example, when you purchase a ticket for a Fitness Takeover event, we may use your contact and transaction information to issue confirmation, provide joining instructions, communicate venue details, notify you of timetable changes and respond to questions about your booking.
When you join a weekly class or membership programme, we may use your information to manage attendance, administer class credits, monitor membership status, communicate renewals and provide information relevant to your participation.
When you contact us, we may use your information to answer your question, investigate a concern, provide support, process a refund or resolve a complaint.
To manage health, safety and participation
We use relevant health, accessibility and emergency information to help determine whether an activity is suitable, identify necessary adjustments and support safe participation.
For example, an instructor may need to know that a participant has a previous injury so that alternative movements can be offered. An authorised team member may need access to emergency contact details if a participant becomes unwell.
We may use attendance records, incident reports, PAR-Q responses and relevant communications to meet our health and safety responsibilities, review incidents, manage insurance matters and improve our procedures.
Providing health information does not guarantee that participation will be risk-free. Participants remain responsible for following instructions, working within their abilities, seeking medical advice where appropriate and notifying us of relevant changes.
To provide inclusive and accessible Services
Fitness Takeover is committed to creating welcoming and inclusive environments.
We may use information about disabilities, neurodivergence, mobility, communication needs, sensory needs or other accessibility requirements to make reasonable adjustments and improve participation.
This may include providing alternative movements, adjusting instructions, allowing additional support, identifying an accessible venue or communicating with a carer or support worker where authorised.
We will only share accessibility information with people who reasonably need it to provide the relevant support.
To communicate about our Services, events and community activities
We use contact information to send essential communications connected with a booking, purchase, membership, event or programme.
These communications may include booking confirmations, payment receipts, cancellation information, safety instructions, venue updates, timetable changes, reminders and information needed to access the Service.
These service communications are not promotional marketing, and you may continue to receive them even if you have opted out of marketing.
To send promotional communications
Where permitted by law, we may send information about upcoming Fitness Takeover classes, Step X Vibes events, community projects, private hire services, offers, competitions and wellbeing activities that may interest you.
We may communicate by email, text message, telephone, social media, messaging service or another channel you have selected.
Where consent is required, we will ask for your consent before sending promotional communications. You may withdraw that consent at any time.
Direct marketing
Where you have previously purchased or booked a similar Service, we may use your contact details to tell you about related Fitness Takeover Services where the law permits us to do so and where you were given a clear opportunity to opt out.
In other circumstances, we will ask for your consent before sending electronic direct marketing.
We do not use information contained in PAR-Q forms or private mental health disclosures to target marketing communications.
We do not sell your name, contact details or marketing profile to another organisation.
Personalisation
We may use information about your bookings, attendance, interests and communication preferences to make our communications more relevant.
For example, we may send information about a new Step class to people who previously attended a Step X Vibes event, or provide information about a local community programme to people who have expressed an interest in similar activities.
We may use general audience groups to understand which Services are most relevant to different parts of our community. We will not use sensitive health or mental health information to create advertising profiles without an appropriate lawful basis and any consent required by law.
Photography, filming and promotion
We use photographs and videos to document our work, celebrate our community, demonstrate what takes place at our events and promote future Services.
Depending on the nature of the content and the circumstances in which it was captured, we may rely on consent or our legitimate interests.
For close-up interviews, testimonials, individual promotional features and content involving children, we may seek specific permission before publication.
For general event photography, crowd footage and images showing the atmosphere of an event, we may rely on our legitimate interest in promoting Fitness Takeover and demonstrating the impact of our work, provided that this use does not unfairly override the rights and interests of the people shown.
We will consider objections and reasonable removal requests carefully.
To operate, improve and maintain Fitness Takeover
We use personal data to operate and develop our organisation.
This may include managing finances, maintaining business records, administering memberships, planning staffing, reviewing attendance, managing venues, conducting audits, monitoring service quality, troubleshooting website issues and measuring the success of our programmes.
We may review aggregated or statistical information to understand attendance patterns, popular activities, community needs and the effectiveness of our events.
Where possible, research, reporting and evaluation information will be anonymised or presented in a way that does not directly identify individual participants.
To protect rights, property and safety
We may use personal data to prevent, detect or investigate fraud, unauthorised access, threatening behaviour, abuse, theft, damage, harassment, violations of our terms, safeguarding concerns or other unlawful or inappropriate conduct.
We may also use personal data to establish, exercise or defend legal claims, respond to insurance matters, comply with court orders and cooperate with law enforcement or regulatory authorities where required.
To maintain venue safety and security
Where CCTV is operated, we use footage to protect participants, staff, instructors, visitors and property.
CCTV may be reviewed following an accident, complaint, safeguarding concern, suspected offence, security incident or dispute.
Access will be limited to authorised individuals, security providers, venue operators, insurers, legal advisers or public authorities where there is a legitimate and lawful reason for access.
For research, evaluation and community impact
As a Community Interest Company, Fitness Takeover may evaluate how its Services contribute to fitness, wellbeing, inclusion and community connection.
We may use attendance figures, surveys, feedback and anonymised outcomes to improve Services, demonstrate community impact and support funding or partnership applications.
Where a report includes an identifiable case study, testimonial, photograph or personal story, we will obtain appropriate permission before publication unless another clear lawful basis applies.
Processing health and wellbeing information
Fitness Takeover processes health, fitness and accessibility information where it is necessary to support safe participation, make reasonable adjustments, respond to emergencies or deliver a requested programme.
Because this information is sensitive, we take additional steps to limit access, protect confidentiality and reduce unnecessary collection.
We will normally ask you to provide an explicit statement confirming your agreement to the processing of health information through a PAR-Q or related form where explicit consent is the appropriate special-category condition.
In an emergency, we may process or disclose relevant health information where this is necessary to protect your vital interests or those of another person and you are unable to provide consent.
Other conditions may apply where processing is necessary for legal claims, safeguarding or another purpose recognised by data protection legislation. We will identify and document the relevant lawful basis and special-category condition before relying on it.
You may request deletion of your health information. We will comply where the information is no longer required and no legal, safety, insurance, safeguarding or claims-related reason requires us to retain it.
Other purposes
We may use personal data for another purpose that is compatible with the reason it was originally collected.
Where a proposed use is materially different or unexpected, we will provide additional information and obtain consent where required before proceeding.
LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
The lawful basis we rely upon depends on the purpose for which personal data is processed.
Contract
We process personal data where it is necessary to enter into or perform a contract with you.
For example, we need your name, contact details, booking information and payment confirmation to sell a ticket, administer a membership, reserve a class space or provide a private booking.
Consent
We rely on consent where you have made a free, informed and specific choice allowing us to process personal data for a particular purpose.
This may include certain marketing communications, optional photography, testimonials, case studies, non-essential cookies or the processing of health information where explicit consent is the appropriate special-category condition.
You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
Legitimate interests
We may process personal data where it is necessary for our legitimate interests or those of another organisation, provided that those interests are not overridden by your rights and freedoms.
Our legitimate interests may include operating and improving our Services, managing memberships, understanding attendance, communicating with existing participants, promoting events, maintaining security, preventing fraud, documenting community impact and defending legal claims.
Before relying on legitimate interests, we consider the purpose of the processing, whether it is necessary and whether your rights or reasonable expectations outweigh our interests.
Legal obligations
We process personal data where it is necessary to comply with a legal obligation.
This may include accounting and tax requirements, health and safety duties, safeguarding responsibilities, responding to valid legal requests and maintaining records required by law.
Vital interests
In limited circumstances, we may process personal data where it is necessary to protect someone’s life or physical safety.
For example, relevant health or emergency contact information may be disclosed to emergency services if a participant becomes seriously unwell and cannot communicate.
Special category personal data
Where we process health, disability, mental health or other special category personal data, we identify both a lawful basis under Article 6 of the UK GDPR and an appropriate condition under Article 9.
Depending on the circumstances, this may include explicit consent, vital interests, legal claims or another condition permitted by applicable law.
Where a condition under the Data Protection Act 2018 requires additional safeguards or an appropriate policy document, we will put those measures in place before relying on that condition.
Balancing your rights
When we process personal data on the basis of legitimate interests, we assess whether the processing is proportionate, whether it is reasonably expected and whether it could cause unjustified harm.
You may contact us if you would like further information about the legitimate interests we rely upon in a particular situation.