UFit Fitness privacy policy

This policy explains what personal information UFit Fitness collects, why we collect it, who we share it with, how long we keep it, and what your rights are. We have tried to keep it short and plain. If anything is unclear, ask us.

1. Who we are

UFit Fitness is a trading name. Two companies are involved.

• JNJ Leisure LTD, company number 07257842, trading as UFit Fitness. Your membership is with JNJ Leisure LTD. It is responsible for your member information, including the health information you give us. In data protection law it is the “controller” of that information. ICO registration number: ZC250445.
• U Fit Community Leisure Ltd, company number 08447956. It runs the club day to day and employs all of our staff. JNJ Leisure LTD makes member information available to those staff so they can run the club. ICO registration number: ZC250478.

If you apply for a job with us, U Fit Community Leisure Ltd is the employer and is responsible for your application information (see section 3.12).

In this policy “we”, “us” and “UFit Fitness” means both companies and their staff.

How to contact us about your information

• Email: info@ufit-fitness.com
• Phone: 029 2048 6488
• Post: JNJ Leisure LTD, trading as UFit Fitness, Unit 1B, Trident Park, Glass Avenue, Ocean Way, Cardiff CF24 5EN

Questions and requests about your information are handled by our general manager. Contact them through info@ufit-fitness.com. This is also how to make a complaint (see section 9). Questions about your membership itself, such as payments, freezing or leaving, go to membership@ufit-fitness.com.

2. The short version

• We collect what we need to run your membership, keep you safe, take payment and look after the building.
• Your health information is used only to decide whether you need an induction or extra support, and to respond in an emergency.
• We use CCTV for safety and security. It records video only, with no sound. Footage is recorded over after 90 days, unless we save a clip because of an incident.
• We only send marketing emails if you have said yes. You can unsubscribe at any time.
• We do not sell your information.
• You have rights over your information, and you can complain to us and then to the Information Commissioner’s Office (ICO).

3. What we collect and why, by situation

For each situation we say what we collect, why, and our lawful basis in plain words. The lawful bases come from the UK GDPR:

• Contract: we need it to give you the membership or service you signed up for.
• Legal obligation: the law requires it.
• Legitimate interests: it is needed for a sensible business reason, and it does not override your interests. You can object (see section 8).
• Consent: you have agreed, and you can withdraw that agreement.
• Vital interests: it is needed to protect someone’s life, for example in an emergency.

Health information is “special category” information and needs an extra condition. We explain that in section 3.2.

3.1 Joining and your membership

What we collect: your name, address, email address, phone number, date of birth, your membership type and history, your signed agreement to our membership terms, club rules and waiver, a photo, if one is added to your account, and notes about your account such as freezes and cancellations.

We use your date of birth to work out which age rules apply to you, including whether a parent or guardian must complete forms for you.

Why: to set up and run your membership, manage bookings and access, and deal with questions, changes and cancellations.

Lawful basis: contract. Where we keep records after your membership ends to deal with any dispute or claim, legitimate interests.

Where it is held: Glofox, our membership system.

3.2 Health and Gym Experience Questionnaire

What we collect: before you train, we ask you to complete the Health and Gym Experience Questionnaire as part of sign-up. It covers:

• health statements, for example heart conditions, chest pain, dizziness, joint or soft tissue problems, medication, and pregnancy or recent birth;
• brief details of anything you tick;
• your gym experience and the equipment you have used on your own;
• whether you are confident adjusting equipment;
• whether you would like a free induction;
• an emergency contact’s name, relationship to you and phone number.

If you tick a health statement, or say you are not confident adjusting equipment, a member of staff will speak to you. We keep a short record of who spoke to you, the date, and the outcome (for example cleared to train, induction booked, or GP clearance needed). When you complete an induction, or we receive GP clearance, we add that date to the record, with a short note if needed.

Why: so that we can assess whether you need an induction or further support, and so that we can respond appropriately in an emergency.

Lawful basis: for the information itself, consent. Because health information is special category information, we also rely on your explicit consent (UK GDPR Article 9(2)(a)). You give this by ticking the health information consent box in the waiver.

If we keep a record after you withdraw consent or after your membership ends, we do so only where we need it to deal with a possible legal claim. For that we rely on legitimate interests and on the condition that the processing is necessary for the establishment, exercise or defence of legal claims (UK GDPR Article 9(2)(f)).

In a genuine emergency, where you cannot give consent, we may share relevant health information with paramedics or hospital staff to protect your life (vital interests, and UK GDPR Article 9(2)(c)).

For your emergency contact, we rely on legitimate interests: we need a way to reach someone if you are hurt or unwell. Please tell them you have given us their details.

Who sees it: health information is seen only by staff who need it for those purposes.

How long we keep it: it is held for six years after your membership ends. If you were under 18 at any time during your membership, it is held until your 25th birthday or for six years after your membership ends, whichever is later.

Withdrawing consent and deletion: you can withdraw your consent at any time. We will then stop using your health information to plan your training or induction, but we may keep a record of it for the period above where we need it to deal with a possible legal claim. You can ask us to delete it by contacting info@ufit-fitness.com, and we will, unless we need to keep it for that reason.

Where it is held: Glofox. The staff record of the conversation is kept on a paper form, signed by you and the staff member, in a locked cabinet at the club. We keep a list of which members have a form, so we can find it, and only managers can open that list.

3.3 Payments

What we collect: your name, billing details, and payment records (amounts, dates, whether a payment succeeded or failed). For direct debits, your bank account details are collected and held by GoCardless. For card payments, your card details are handled by the card payment provider. We do not keep your full card number.

How you might pay:

• Direct debit, collected through GoCardless and set up from Glofox.
• One-off online payments through Stripe.
• Card payments at reception on our card machine, provided by Clover. Staff may take membership payments this way, for example if a direct debit keeps failing.

Why: to take payment, deal with failed payments and money owed, handle refunds, and keep accounts.

Lawful basis: contract, for taking payment. Legitimate interests, for recovering money owed. Legal obligation, for keeping accounting and tax records.

3.4 Visits and door entry

What we collect: a record each time you enter the building, including the date and time and the door or entry point used. You book and get into the club using the UFit Fitness app, which runs on Glofox. The door entry system itself is provided by Kisi.

Why: to let members in, to stop people entering who should not, to keep the building secure, and to know who was on site if there is an incident or emergency.

Lawful basis: contract, for giving you access. Legitimate interests, for security and incident records.

If a membership payment stays unpaid for 14 days, we may pause your door access until it is paid. If you think your access has been paused by mistake, contact us and a member of staff will look at it.

3.5 Classes and bookings

What we collect: the classes, sessions, inductions and studio hire you book, attend, cancel or miss, and any notes staff add to a booking.

Why: to run the timetable, manage class numbers and waiting lists, and contact you about changes.

Lawful basis: contract.

Where it is held: Glofox. Studio rental is also booked through the Glofox portal.

3.6 CCTV

What we collect: CCTV video images of people in and around the club. CCTV is run by UFit Fitness. It records video only, with no sound. There are no cameras in changing rooms, showers or toilets.

Cameras do cover our recovery centre (the sauna and ice recovery area). They are there for the safety of members using it, because people using heat and cold can become unwell. There are signs in that area to tell you.

Why: safety and security, investigating incidents, and protecting members, staff and property. CCTV is not used for marketing.

Lawful basis: legitimate interests.

How long we keep it: footage is recorded over after 90 days. If there is an incident, we download the relevant clip and save it as evidence. A saved clip is kept for as long as the incident or any claim needs it, on the same rule as our accident reports: six years after the incident, or until the 25th birthday of the person involved if they were under 18 at the time, whichever is later.

Who we share it with: insurers, legal advisers or relevant authorities, such as the police, where necessary.

You can ask for a copy of footage of you (see section 8). We may need to blur other people.

3.7 Accident and incident reports

What we collect: if you are injured or involved in an incident at the club, we complete an accident or incident report. It can include your name and contact details, what happened, when and where, any injury and first aid given, witness details, and related CCTV. It may include health information.

Why: to look after the person involved, find and fix the cause, meet our health and safety duties, and deal with any insurance claim or legal claim.

Lawful basis: legitimate interests. Legal obligation, where we must report or record an incident under health and safety law. For health information in the report, the condition that the processing is necessary for legal claims (UK GDPR Article 9(2)(f)), and vital interests (Article 9(2)(c)) in an emergency.

Who we share it with: our insurers, insurance brokers, solicitors and legal advisers when a claim arises or may arise. The Health and Safety Executive where the law requires a report.

3.8 Photography, filming and social media

What we collect: photos and video taken at the club for promotion, which may include members. We post on social media, mainly Instagram, and on our website.

Why: to promote the club.

Where reasonably possible, we will tell members before photography or filming takes place.

Lawful basis:

• Photos and videos where you are in the background, not the focus: legitimate interests. We may use them unless you opt out. You can opt out by ticking the box when you sign up, by telling a member of staff or the photographer, or by emailing info@ufit-fitness.com.
• Photos and videos where you are clearly the subject: consent. We will ask you first, and we will only use it if you say yes.
• Anyone under 18, in the background or as the subject: consent from their parent or guardian, who gives or refuses it. We will not use the image unless the parent or guardian has said yes.

Taking an image down: if you ask us, we will remove a photo or video of you from our own website and social media, and we will not use it again. We cannot recall anything already printed, or anything already shared by others.

CCTV footage is separate and is never used for this.

3.9 Marketing emails

What we collect: your name and email address, whether you have subscribed or unsubscribed, and whether you open our emails or click links in them.

Why: to send news, offers and updates about UFit Fitness.

Lawful basis: consent. We only send you marketing emails if you have said yes.

• Members: we only send you our marketing emails if you have said yes.
• Newsletter sign-ups: if you sign up through the newsletter form on our website, that is your yes.

You can withdraw your consent at any time.

Your choice: every email has an unsubscribe link. You can also email info@ufit-fitness.com. Once you unsubscribe we keep your email address on a “do not contact” list so we do not email you again.

Where it is held: Mailchimp. If you sign up through the newsletter form on our website, your details pass through Cloudflare, which hosts our website, on their way to Mailchimp.

We only send marketing by email, not by text message. If we ever want to send you marketing texts, we will ask you first.

3.10 Our website, cookies and analytics

See section 10 for the detail of what our website loads.

What we collect: information about how you use our website, such as pages visited, the site you came from, device and browser type, approximate location, and your IP address.

Why: to run the website securely, protect forms from spam, and understand how the site is used so we can improve it.

Lawful basis: legitimate interests for security and running the site. For analytics, consent: Google Analytics cookies are only set if you accept analytics cookies (see section 10).

The website is hosted on Cloudflare.

3.11 Enquiries

What we collect: your name, contact details and whatever you tell us when you email, phone, message us on social media, or fill in a form on our website.

Why: to answer you.

Lawful basis: legitimate interests. If you are asking about joining, taking steps at your request before a contract.

Messages from the contact form and suggestion box on our website are sent through Web3Forms, which delivers them to our email inbox. Our email is hosted by Webjects Limited and sent through SMTP2GO.

3.12 Job applicants

Who is responsible: U Fit Community Leisure Ltd, company number 08447956, as the employer.

What we collect: your CV or application, contact details, work history, qualifications and certificates, references, interview notes, and your right to work documents if we make an offer.

Why: to consider your application, make a hiring decision, and meet legal duties such as right to work checks.

Lawful basis: taking steps at your request before a contract. Legal obligation for right to work checks. Legitimate interests for keeping records in case a decision is challenged.

Criminal records checks: staff and coaches who work with our junior classes have a DBS check.

If you are hired, we will tell you how we use your information as a member of staff.

4. Children and young people

• Anyone under 18 must join with a parent or guardian, who must also be a member. The parent or guardian completes the Health and Gym Experience Questionnaire, gives the health information consent, agrees to our membership terms and signs the waiver on the young person’s behalf. We record the parent or guardian’s name, their relationship to the member, and their consent.
• Members aged 16 and 17 may use the gym on their own once the questionnaire has been completed and they have done any induction we ask for. Members under 16 may only use the gym floor in a supervised junior class, or with their parent or guardian staying with them at all times. Under 18s may not use the sauna and ice recovery area.
• If a member was under 18 at any time during their membership, we hold their health information and membership records until their 25th birthday or for six years after their membership ends, whichever is later. We do this because the law gives young people longer to bring a claim.
• A parent or guardian gives or refuses consent for anyone under 18 to appear in our promotional photos or videos. We will not use an image of a member under 18 unless their parent or guardian has said yes (see section 3.8).
• A young person can contact us about their own information. A parent or guardian can also contact us on behalf of a child.

5. Who we share your information with

We do not sell your information. We share it only where we need to, and only what is needed.

Service providers who hold or process information for us

They act on our instructions.

Glofox

Membership system and the UFit Fitness app: sign-up, waiver and questionnaire, bookings, timetable, visit records.

Kisi

Door entry system, which you use through the UFit Fitness app.

Tossell Web Solutions Ltd

Manages our website, Glofox and access control. Can access member, enquiry and access control data in Glofox, Cloudflare and Kisi only where needed to provide those services.

RDM

Installs and maintains our CCTV system.

The Geek Company Ltd

IT support.

GoCardless

Collects direct debits.

Stripe

Takes one-off online payments.

Clover

Our card machine. Takes card payments at reception.

Mailchimp

Sends our marketing emails.

Google

Website analytics.

Cloudflare

Hosts our website and passes newsletter sign-ups to Mailchimp.

Web3Forms

Delivers messages from the contact form and suggestion box on our website to our email inbox.

Webjects Limited

Our domain and business email.

SMTP2GO

Delivers our emails.

Sterling Bookkeepers

Bookkeeping.

James and Kahn Accountancy

Accountancy.

Other organisations who make their own decisions about the information

• UKBJJA (the United Kingdom Brazilian Jiu Jitsu Association): if you are a UGrapple member. UGrapple is affiliated to UKBJJA, and we share the details it needs for your gradings and insurance.
• Our insurers and insurance brokers, when there is an accident, incident or claim.
• Our solicitors and legal advisers.
• The police, other law enforcement bodies, the Health and Safety Executive, HMRC or a court, where we are required or allowed to by law.
• Emergency services, in an emergency.
• A new owner, if the business or part of it is sold or transferred. Your information may pass to the new owner, who must use it in line with this policy.

Businesses on our site that are not UFit Fitness

All personal trainers at UFit Fitness are self-employed, and none is employed by UFit Fitness to deliver personal training. They, and the tenants on site such as the cafe and the barber, are separate businesses. They do not receive your member details from us. If you deal with them directly, they are responsible for the information you give them.

6. Information sent outside the UK

Some of our service providers are based outside the UK, or store information outside the UK. Where information goes outside the UK, we make sure it is protected, either because the UK government has recognised that country as giving adequate protection, or because the provider has signed contract terms approved for UK transfers.

You can contact us for more information about this.

7. Automated decisions

We do not make decisions about you using only automated means that have a legal or similarly significant effect on you. If your door access is paused because a payment is unpaid, you can ask a member of staff to look at it (see section 3.4).

8. Your rights

You have the right to:

• Access: ask for a copy of the information we hold about you.
• Correction: ask us to fix information that is wrong or incomplete.
• Deletion: ask us to delete your information. We will, unless we need to keep it, for example to meet a legal duty or to deal with a possible legal claim. This applies to health information as set out in section 3.2.
• Restriction: ask us to limit how we use your information, for example while we check a correction.
• Object: object to us using your information where we rely on legitimate interests. We will stop unless we have strong reasons to continue, or need it for a legal claim. You can always object to marketing, and we will stop.
• Portability: ask for information you gave us, which we hold electronically under contract or consent, in a format you can take elsewhere.
• Withdraw consent: where we rely on consent, you can withdraw it at any time. This does not affect what we did before you withdrew it.

How to ask: email info@ufit-fitness.com, or speak to reception and we will note your request. We may need to confirm who you are before we act.

How long it takes: we will reply without undue delay and within one month. If your request is complex, or you make several requests, we may take up to two more months, and we will tell you within the first month if so. If we need more information from you to deal with the request, such as proof of identity, the time runs from when we receive it.

It is usually free. We may charge a reasonable fee, or refuse, if a request is clearly unfounded or excessive.

9. How to complain

Complain to us first

If you are unhappy with how we have handled your information, tell us:

• Email: info@ufit-fitness.com
• In person or by post: at the address in section 1.

We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

Then the ICO

If you are not happy with our response, you can complain to the Information Commissioner’s Office, the UK data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113 (Monday to Friday, 9am to 5pm)
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

10. Cookies and what our website loads

Cookies are small files a website saves on your device. Similar technologies do the same kind of job. Some are needed for the site to work. Others help us understand how the site is used.

What our website currently loads

Google Tag Manager

Provided by Google. Loads Google Analytics on our pages. It only loads once you accept analytics cookies.

Google Analytics 4

Provided by Google. Counts visits and shows how people use the site. Its cookies are only set once you accept analytics cookies. Analytics.

Instagram feed

Shows our latest Instagram posts. Our website fetches them from Instagram (Meta) and shows the pictures from our own site, so your browser doesn’t connect to Instagram. If a picture can’t be shown that way, your browser loads it straight from Instagram’s servers, which then see your IP address. Embedded content.

Booking pages

Provided by Glofox. Shows our timetable and studio rental booking on our pages. Glofox may set its own cookies on these pages. Embedded content.

Website hosting

Provided by Cloudflare. Delivers our website to you. Your browser connects to Cloudflare’s servers, which see your IP address. Needed for the site to work.

Cookie banner

Part of our own website. Asks for your cookie choice and remembers it in your browser for six months. Needed for the site to work.

When a page loads content from another company, that company receives your IP address and basic browser information, and may set its own cookies. Their use of it is covered by their own privacy policies.

Your choices

We only use analytics cookies if you say yes. When you first visit our website, a banner asks for your choice. Google Tag Manager and Google Analytics do not load, and their cookies are not set, until you accept. You can change your mind at any time using the Cookie settings link at the bottom of every page. If you change to reject, we delete the Google Analytics cookies from your browser.

You can also block or delete cookies in your browser settings. Some parts of the site may not work properly if you do.

11. Keeping your information safe

We use access controls so staff only see what they need, password-protected systems, and reputable providers. Health information is limited to staff who need it. No system is perfectly secure, and if something goes wrong that puts your rights at risk, we will tell you and the ICO where the law requires it.

12. If you do not give us information

Some information is needed to give you a membership, for example your contact details, payment details and a completed Health and Gym Experience Questionnaire. Without it we cannot set up your membership or let you train. Marketing is always optional.

13. Information we get from other people

Sometimes we receive information about you from someone else, for example when a member names you as their emergency contact, a parent or guardian signs up a child, a witness describes an incident, or an insurer or solicitor contacts us about a claim.

14. How long we keep information

We keep information only as long as we need it. When the period ends we delete it or make it anonymous.

Health and Gym Experience Questionnaire, including emergency contact, and the staff record of any health or induction conversation, wherever it is kept

Six years after your membership ends. If you were under 18 at any time during your membership, until your 25th birthday or six years after your membership ends, whichever is later.

Membership account, signed terms and waiver, booking history

Six years after your membership ends. If you were under 18 at any time during your membership, until your 25th birthday or six years after your membership ends, whichever is later.

Payment and accounting records

Six years from the end of the financial year they relate to, as company and tax rules require.

Door entry records

12 months.

CCTV footage

90 days, then recorded over.

Accident and incident reports, and CCTV clips saved because of an incident

Six years after the incident. If the person involved was under 18 at the time, until their 25th birthday or six years after the incident, whichever is later.

Promotional photos and video

Until you ask us to remove them. We review them every two years.

Marketing email list

Until you unsubscribe. After that, only your email address on our “do not contact” list.

Website analytics

No longer than 14 months.

Enquiries that do not lead to a membership

12 months after our last contact.

Job applications that are not successful

6 months after the decision.

Data protection requests and complaints

Three years after they are closed.

Where a legal claim is made or likely, we keep the information needed for it until the claim is finished and any time limit for appeal has passed.

15. Changes to this policy

We will update this policy when the way we use information changes. The current version is always at ufit-fitness.com/privacy-policy. If we make an important change, for example using your information for a new purpose, we will tell members by email before it takes effect.

Last updated: 6 November 2026

JNJ Leisure LTD (07257842), trading as UFit Fitness.