Legal
Privacy policy
What personal information ODAAT Fitness collects through this website and at the gym, why we hold it, how long we keep it, and what you can ask us to do with it.
Last updated: 15 August 2026
Draft — not yet in force. This page is complete except where a business detail is marked [to be confirmed]. Those gaps are real facts about the business that could not be established, and have deliberately not been guessed. Once they are filled in, remove this notice by setting LEGAL_PAGES_ARE_DRAFT to false in src/lib/business.ts.
This document is a starting point written to reflect how the website and gym actually work. It is not legal advice, and it has not been reviewed by a solicitor.
1. Who we are
ODAAT Fitness is a gym at Unit 12, West Bowhouse Workshops, Irvine, KA11 1PR. For the purposes of UK data protection law, the data controller is [to be confirmed: the legal entity — limited company or sole trader — and its exact registered name].
You can contact us about anything in this policy:
- By phone or WhatsApp: 07958 198 961
- By email: [to be confirmed: a business email address for data protection enquiries]
- By post: Unit 12, West Bowhouse Workshops, Irvine, KA11 1PR
We are not required to appoint a Data Protection Officer, and have not appointed one.
2. What we collect, and why
This is the complete list of personal data the website and our systems hold. It is written from what the application actually stores, not from a template.
Class bookings and reserve list
When you book a class or join the reserve list through this website, we collect your name and email address. We also generate a random booking reference so you can manage or cancel your booking from a link in your confirmation email without needing an account or password.
We use this to hold your place, to email you your confirmation, to tell you if a space opens up on the reserve list, and to know how many people to expect in a session.
Event registrations
If you register interest in an event, we collect your name and email address and a booking reference, and use them the same way.
Membership records
If you become a member, we keep a membership record containing your name, email address, phone number, which plan you are on, your monthly amount and billing day, your join date, whether your membership is active, paused or cancelled, and a record of payments received. There is also a free-text notes field used for practical things such as access arrangements.
We use this to run your membership, take and reconcile payment, and keep the business’s accounts.
Membership enquiries
Membership enquiries are made by WhatsApp, phone, or social media rather than through a form on this site. If you contact us that way, we hold whatever you send us, on the platform you sent it on, for as long as we need it to answer you. Those platforms (Meta for WhatsApp, Facebook and Instagram; TikTok) are separate controllers for the data they hold about you and have their own privacy policies.
Health and fitness information
We do not store health information through this website.Before your first class booking we ask you to read a short set of pre-exercise questions and confirm that you have considered them. We record only that you confirmed, and when — not your answers, and not any detail about your health. This is deliberate: health data is a special category under UK GDPR, and the safest way to handle it is not to collect it.
If you choose to tell us about an injury, condition or pregnancy in person or by message — for example so a trainer can adapt a session — we will use it only for that purpose. If we ever need to keep such information in writing, we will ask for your explicit consent first and tell you exactly what we are keeping and why.
Technical information
Our servers briefly hold the IP address of requests to the booking and login forms so that we can rate-limit abuse. This is held in memory only, is not written to a database, and disappears within minutes. We do not use it to identify or profile you.
3. Our lawful bases
| What | Lawful basis (UK GDPR Article 6) |
|---|---|
| Class bookings, reserve list and event registrations | Contract— we cannot hold a place for you, or tell you a space has opened, without your name and an email address. |
| Membership records and payments | Contract— needed to provide the membership you have signed up to and to take payment for it. |
| Keeping accounting records | Legal obligation— UK tax and accounting law requires us to keep records of money received. |
| Confirming you have read the pre-exercise questions | Legitimate interests— running the gym safely and being able to show that members were asked to consider their own fitness to train. Only the fact and time of confirmation is stored. |
| Rate-limiting and site security | Legitimate interests— keeping the booking system available and protecting the owner login from brute-force attempts. |
We do not send marketing email, and we do not sell, rent or share your details with anyone for their own marketing.
4. Who processes your data for us
We use a small number of suppliers, each acting on our instructions:
- Supabase— hosts the database holding bookings, event registrations and membership records. The database is locked down so that it can only be read by our own server, never directly from a web browser. Our project is hosted in [to be confirmed: the Supabase project region, e.g. eu-west-2 (London)].
- Resend— sends booking, reserve list and event emails. Resend receives your name and email address in order to deliver the message. Resend is based in the United States.
- Vercel— hosts the website itself and handles the requests your browser makes.
5. International transfers
Some of our suppliers are based outside the UK, or may process data outside it. Where that happens, the transfer is covered by the supplier’s standard contractual clauses and the UK International Data Transfer Addendum, which is the mechanism UK law provides for this.
Specifically: Resend is a US company, so your name and email address are processed in the United States when we send you a booking confirmation. Where our database is hosted is [to be confirmed: the Supabase project region — this determines whether database records leave the UK/EU at all].
6. How long we keep it
- Class bookings and reserve list entries— deleted when you cancel. Otherwise kept while the class is upcoming and for a short period afterwards for attendance purposes.
- Event registrations— deleted when you withdraw, or shortly after the event has taken place.
- Membership records— kept while you are a member and for a reasonable period after you leave, in case you rejoin or a query arises.
- Payment and accounting records— kept for six years after the end of the relevant financial year, as UK tax law requires.
- Confirmations that you read the pre-exercise questions— kept alongside the booking they relate to.
[to be confirmed: whether Ryan wants specific retention periods (e.g. 'bookings deleted after 90 days') rather than the general periods described above]
7. Your rights
Under UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- ask us to delete your data, where we do not have to keep it for accounting or legal reasons;
- ask us to restrict how we use it, or object to us using it;
- ask for your data in a portable, machine-readable format; and
- withdraw consent at any time, where we have relied on consent.
You can cancel a class booking yourself at any time using the link in your confirmation email — doing so deletes that booking. For anything else, contact us using the details in section 1. We will respond within one month.
8. Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right. You also have the right to complain to the UK regulator:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
9. Cookies
This website does not use any tracking or advertising cookies, and it does not use analytics. There is no cookie banner because there is nothing to ask your consent for.
The only cookie the site sets is:
| Name | Purpose | Type |
|---|---|---|
odaat_admin | Keeps the gym owner signed in to the private management dashboard. It is only ever set after a successful owner login, and is never set for members or visitors. | Strictly necessary |
Strictly necessary cookies do not require consent under the Privacy and Electronic Communications Regulations. We do not use local storage, tracking pixels, session recording, or embedded third-party content that could set cookies on our behalf.
If we ever add analytics, we will ask for your consent before it loads and update this page.
10. Changes to this policy
If we change how we handle personal data, we will update this page and change the “last updated” date at the top.
See also our terms and conditions and house rules and safety information.