This policy explains what personal information UFit Fitness collects, why we collect it, who we share it with, how long we keep it, and what your rights are. We have tried to keep it short and plain. If anything is unclear, ask us.
UFit Fitness is a trading name. Two companies are involved.
If you apply for a job with us, U Fit Community Leisure Ltd is the employer and is responsible for your application information (see section 3.12).
In this policy "we", "us" and "UFit" means both companies and their staff.
Questions and requests about your information are handled by our general manager. Contact them through info@ufit-fitness.com. This is also how to make a complaint (see section 9). Questions about your membership itself, such as payments, freezing or leaving, go to membership@ufit-fitness.com.
For each situation we say what we collect, why, and our lawful basis in plain words. The lawful bases come from the UK GDPR:
Health information is "special category" information and needs an extra condition. We explain that in section 3.2.
What we collect: your name, address, email address, phone number, date of birth, your membership type and history, your signed agreement to our membership terms, club rules and waiver, a photo, if one is added to your account, and notes about your account such as freezes and cancellations.
We use your date of birth to work out which age rules apply to you, including whether a parent or guardian must complete forms for you.
Why: to set up and run your membership, manage bookings and access, and deal with questions, changes and cancellations.
Lawful basis: contract. Where we keep records after your membership ends to deal with any dispute or claim, legitimate interests.
Where it is held: Glofox, our membership system.
What we collect: before you train, we ask you to complete the Health and Gym Experience Questionnaire as part of sign-up. It covers:
If you tick a health statement, or say you are not confident adjusting equipment, a member of staff will speak to you. We keep a short record of who spoke to you, the date, and the outcome (for example cleared to train, induction booked, or GP clearance needed). When you complete an induction, or we receive GP clearance, we add that date to the record, with a short note if needed.
Why: so that we can assess whether you need an induction or further support, and so that we can respond appropriately in an emergency.
Lawful basis: for the information itself, consent. Because health information is special category information, we also rely on your explicit consent (UK GDPR Article 9(2)(a)). You give this by ticking the health information consent box in the waiver.
If we keep a record after you withdraw consent or after your membership ends, we do so only where we need it to deal with a possible legal claim. For that we rely on legitimate interests and on the condition that the processing is necessary for the establishment, exercise or defence of legal claims (UK GDPR Article 9(2)(f)).
In a genuine emergency, where you cannot give consent, we may share relevant health information with paramedics or hospital staff to protect your life (vital interests, and UK GDPR Article 9(2)(c)).
For your emergency contact, we rely on legitimate interests: we need a way to reach someone if you are hurt or unwell. Please tell them you have given us their details.
Who sees it: health information is seen only by staff who need it for those purposes.
How long we keep it: it is held for six years after your membership ends. If you were under 18 at any time during your membership, it is held until your 25th birthday or for six years after your membership ends, whichever is later.
Withdrawing consent and deletion: you can withdraw your consent at any time. We will then stop using your health information to plan your training or induction, but we may keep a record of it for the period above where we need it to deal with a possible legal claim. You can ask us to delete it by contacting info@ufit-fitness.com, and we will, unless we need to keep it for that reason.
Where it is held: Glofox. The staff record of the conversation is kept on a paper form, signed by you and the staff member, in a locked cabinet at the club. We keep a list of which members have a form, so we can find it, and only managers can open that list.
What we collect: your name, billing details, and payment records (amounts, dates, whether a payment succeeded or failed). For direct debits, your bank account details are collected and held by GoCardless. For card payments, your card details are handled by the card payment provider. We do not keep your full card number.
How you might pay:
Why: to take payment, deal with failed payments and money owed, handle refunds, and keep accounts.
Lawful basis: contract, for taking payment. Legitimate interests, for recovering money owed. Legal obligation, for keeping accounting and tax records.
What we collect: a record each time you enter the building, including the date and time and the door or entry point used. You book and get into the club using the UFit app, which runs on Glofox. The door entry system itself is provided by Kisi.
Why: to let members in, to stop people entering who should not, to keep the building secure, and to know who was on site if there is an incident or emergency.
Lawful basis: contract, for giving you access. Legitimate interests, for security and incident records.
If a membership payment stays unpaid for 14 days, we may pause your door access until it is paid. If you think your access has been paused by mistake, contact us and a member of staff will look at it.
What we collect: the classes, sessions, inductions and studio hire you book, attend, cancel or miss, and any notes staff add to a booking.
Why: to run the timetable, manage class numbers and waiting lists, and contact you about changes.
Lawful basis: contract.
Where it is held: Glofox. Studio rental is also booked through the Glofox portal.
What we collect: CCTV video images of people in and around the club. CCTV is run by UFit. It records video only, with no sound. There are no cameras in changing rooms, showers or toilets.
Cameras do cover our recovery centre (the sauna and ice recovery area). They are there for the safety of members using it, because people using heat and cold can become unwell. There are signs in that area to tell you.
Why: safety and security, investigating incidents, and protecting members, staff and property. CCTV is not used for marketing.
Lawful basis: legitimate interests.
How long we keep it: footage is recorded over after 90 days. If there is an incident, we download the relevant clip and save it as evidence. A saved clip is kept for as long as the incident or any claim needs it, on the same rule as our accident reports: six years after the incident, or until the 25th birthday of the person involved if they were under 18 at the time, whichever is later.
Who we share it with: insurers, legal advisers or relevant authorities, such as the police, where necessary.
You can ask for a copy of footage of you (see section 8). We may need to blur other people.
What we collect: if you are injured or involved in an incident at the club, we complete an accident or incident report. It can include your name and contact details, what happened, when and where, any injury and first aid given, witness details, and related CCTV. It may include health information.
Why: to look after the person involved, find and fix the cause, meet our health and safety duties, and deal with any insurance claim or legal claim.
Lawful basis: legitimate interests. Legal obligation, where we must report or record an incident under health and safety law. For health information in the report, the condition that the processing is necessary for legal claims (UK GDPR Article 9(2)(f)), and vital interests (Article 9(2)(c)) in an emergency.
Who we share it with: our insurers, insurance brokers, solicitors and legal advisers when a claim arises or may arise. The Health and Safety Executive where the law requires a report.
What we collect: photos and video taken at the club for promotion, which may include members. We post on social media, mainly Instagram, and on our website.
Why: to promote the club.
Where reasonably possible, we will tell members before photography or filming takes place.
Lawful basis:
Taking an image down: if you ask us, we will remove a photo or video of you from our own website and social media, and we will not use it again. We cannot recall anything already printed, or anything already shared by others.
CCTV footage is separate and is never used for this.
What we collect: your name and email address, whether you have subscribed or unsubscribed, and whether you open our emails or click links in them.
Why: to send news, offers and updates about UFit.
Lawful basis: consent. We only send you marketing emails if you have said yes.
You can withdraw your consent at any time.
Your choice: every email has an unsubscribe link. You can also email info@ufit-fitness.com. Once you unsubscribe we keep your email address on a "do not contact" list so we do not email you again.
Where it is held: Mailchimp. If you sign up through the newsletter form on our website, your details are first received by Webflow, which hosts our website.
We only send marketing by email, not by text message. If we ever want to send you marketing texts, we will ask you first.
See section 10 for the detail of what our website loads.
What we collect: information about how you use our website, such as pages visited, the site you came from, device and browser type, approximate location, and your IP address.
Why: to run the website securely, protect forms from spam, and understand how the site is used so we can improve it.
Lawful basis: legitimate interests for security and running the site. For analytics, consent: Google Analytics cookies are only set if you accept analytics cookies (see section 10).
The website is built and hosted on Webflow.
What we collect: your name, contact details and whatever you tell us when you email, phone, message us on social media, or fill in a form on our website.
Why: to answer you.
Lawful basis: legitimate interests. If you are asking about joining, taking steps at your request before a contract.
Our email is hosted by Webjects Limited and sent through SMTP2GO.
Who is responsible: U Fit Community Leisure Ltd, company number 08447956, as the employer.
What we collect: your CV or application, contact details, work history, qualifications and certificates, references, interview notes, and your right to work documents if we make an offer.
Why: to consider your application, make a hiring decision, and meet legal duties such as right to work checks.
Lawful basis: taking steps at your request before a contract. Legal obligation for right to work checks. Legitimate interests for keeping records in case a decision is challenged.
Criminal records checks: staff and coaches who work with our junior classes have a DBS check.
If you are hired, we will tell you how we use your information as a member of staff.
We do not sell your information. We share it only where we need to, and only what is needed.
They act on our instructions.
Glofox
Membership system and the UFit app: sign-up, waiver and questionnaire, bookings, timetable, visit records.
Kisi
Door entry system, which you use through the UFit app.
Tossell Web Solutions Ltd
Manages our website, Glofox and access control. Can access member, enquiry and access control data in Glofox, Webflow and Kisi only where needed to provide those services.
RDM
Installs and maintains our CCTV system.
The Geek Company Ltd
IT support.
GoCardless
Collects direct debits.
Stripe
Takes one-off online payments.
Clover
Our card machine. Takes card payments at reception.
Mailchimp
Sends our marketing emails.
Website analytics, spam protection on forms, and the map on our website.
Webflow
Builds and hosts our website and its forms.
CookieYes
Runs the cookie banner on our website and records your cookie choices.
Webjects Limited
Our domain and business email.
SMTP2GO
Delivers our emails.
Sterling Bookkeepers
Bookkeeping.
James and Kahn Accountancy
Accountancy.
All personal trainers at UFit are self-employed, and none is employed by UFit to deliver personal training. They, and the tenants on site such as the cafe and the barber, are separate businesses. They do not receive your member details from us. If you deal with them directly, they are responsible for the information you give them.
Some of our service providers are based outside the UK, or store information outside the UK. Where information goes outside the UK, we make sure it is protected, either because the UK government has recognised that country as giving adequate protection, or because the provider has signed contract terms approved for UK transfers.
You can contact us for more information about this.
We do not make decisions about you using only automated means that have a legal or similarly significant effect on you. If your door access is paused because a payment is unpaid, you can ask a member of staff to look at it (see section 3.4).
You have the right to:
How to ask: email info@ufit-fitness.com, or speak to reception and we will note your request. We may need to confirm who you are before we act.
How long it takes: we will reply without undue delay and within one month. If your request is complex, or you make several requests, we may take up to two more months, and we will tell you within the first month if so. If we need more information from you to deal with the request, such as proof of identity, the time runs from when we receive it.
It is usually free. We may charge a reasonable fee, or refuse, if a request is clearly unfounded or excessive.
If you are unhappy with how we have handled your information, tell us:
We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.
If you are not happy with our response, you can complain to the Information Commissioner's Office, the UK data protection regulator:
Cookies are small files a website saves on your device. Similar technologies do the same kind of job. Some are needed for the site to work. Others help us understand how the site is used.
Google Tag Manager
Provided by Google. Loads Google Analytics on our pages. Loads other tools.
Google Analytics 4
Provided by Google. Counts visits and shows how people use the site. Its cookies are only set once you accept analytics cookies. Analytics.
Google reCAPTCHA
Provided by Google. Protects our forms from spam and bots. Collects information about your device and how you use the page. Security.
Adobe Fonts
Provided by Adobe. Displays our fonts. Your browser connects to Adobe's servers, which see your IP address. Display.
Map
Provided by Snazzy Maps, which runs on Google Maps. Shows where we are. Embedded content.
Instagram feed
Provided by Elfsight, showing posts from Instagram. Shows our latest Instagram posts. Embedded content.
Webflow site scripts, jQuery and a slider script from jsDelivr
Provided by Webflow and jsDelivr. Make the site work and display properly. Needed for the site to work.
Cookie banner
Provided by CookieYes. Asks for your cookie choices and remembers them, using a cookie. Needed for the site to work.
When a page loads content from another company, that company receives your IP address and basic browser information, and may set its own cookies. Their use of it is covered by their own privacy policies.
We only use analytics cookies if you say yes. When you first visit our website, a banner asks for your choice. Google Analytics cookies are not set until you accept. You can change your mind at any time using the cookie settings button on our website.
You can also block or delete cookies in your browser settings. Some parts of the site may not work properly if you do.
We use access controls so staff only see what they need, password-protected systems, and reputable providers. Health information is limited to staff who need it. No system is perfectly secure, and if something goes wrong that puts your rights at risk, we will tell you and the ICO where the law requires it.
Some information is needed to give you a membership, for example your contact details, payment details and a completed Health and Gym Experience Questionnaire. Without it we cannot set up your membership or let you train. Marketing is always optional.
Sometimes we receive information about you from someone else, for example when a member names you as their emergency contact, a parent or guardian signs up a child, a witness describes an incident, or an insurer or solicitor contacts us about a claim.
We keep information only as long as we need it. When the period ends we delete it or make it anonymous.
Health and Gym Experience Questionnaire, including emergency contact, and the staff record of any health or induction conversation, wherever it is kept
Six years after your membership ends. If you were under 18 at any time during your membership, until your 25th birthday or six years after your membership ends, whichever is later.
Membership account, signed terms and waiver, booking history
Six years after your membership ends. If you were under 18 at any time during your membership, until your 25th birthday or six years after your membership ends, whichever is later.
Payment and accounting records
Six years from the end of the financial year they relate to, as company and tax rules require.
Door entry records
12 months.
CCTV footage
90 days, then recorded over.
Accident and incident reports, and CCTV clips saved because of an incident
Six years after the incident. If the person involved was under 18 at the time, until their 25th birthday or six years after the incident, whichever is later.
Promotional photos and video
Until you ask us to remove them. We review them every two years.
Marketing email list
Until you unsubscribe. After that, only your email address on our "do not contact" list.
Website analytics
No longer than 14 months.
Enquiries that do not lead to a membership
12 months after our last contact.
Job applications that are not successful
6 months after the decision.
Data protection requests and complaints
Three years after they are closed.
Where a legal claim is made or likely, we keep the information needed for it until the claim is finished and any time limit for appeal has passed.
We will update this policy when the way we use information changes. The current version is always at ufit-fitness.com/privacy-policy. If we make an important change, for example using your information for a new purpose, we will tell members by email before it takes effect.
Last updated: 17 September 2026
JNJ Leisure LTD (07257842), trading as UFit Fitness.