1. Who we are

Downham Ladies Fitness is run by Downham Fitness Ltd (company number 15241773, 3 Bartons Court, Downham Market, PE38 0QR. We are the "controller" of the personal information described in this policy, which means we decide how it is used and are responsible for looking after it.

If you have any questions about this policy or your information, contact Lisa Jarratt at lisa@downhamladiesfitness.co.uk or on 07795 214954.

 

2. The information we collect

• Contact details: your name, email address and phone number.

• Membership and booking details: your membership, the sessions you book and attend, cancellations, and your account history.

• Payment details: what you've paid and when. Card and bank details are handled by our payment providers (Stripe and GoCardless). We never see or store your full card number.

• Health and fitness information: information you tell us at your induction or in a health questionnaire, such as injuries, medical conditions, medication or pregnancy, plus your goals and training notes. We only collect this so we can coach you safely.

• Messages: anything you send us by email, Facebook Messenger, WhatsApp, Instagram or through our website.

• CCTV images: recorded at the studio for security (see section 8).

• Marketing preferences: whether you've agreed to hear from us about offers and news.

 

3. Where it comes from

Almost everything comes from you: when you contact us, fill in the form on our website, book a discovery call through Calendly, join, book sessions or complete forms and waivers in our booking system (TeamUp), or message us on social media. Our coaches also add training notes as you train with us.

 

4. How we use it, and our legal reasons

• To answer your enquiries and tell you about joining. Our legitimate interest in running and growing our business.

• To provide your membership: bookings, coaching, reminders, changes and payments. To carry out our contract with you.

• To keep you safe while you train, using any health information you give us. Your explicit consent, which you can withdraw at any time (though we may then not be able to coach you safely).

• To send you news and offers, only if you've agreed. Your consent.

• To keep financial and tax records. Our legal obligations.

• To keep the studio, our members and our equipment secure (CCTV). Our legitimate interests.

• To run the business well: planning the timetable, coach rotas and capacity. Our legitimate interests.

 

5. How we handle your messages, including our use of AI

To make sure we reply quickly, messages you send us by email, Facebook Messenger, WhatsApp or our website are collected into our own admin system. Some of these messages are processed by an artificial intelligence (AI) service, Claude, provided by Anthropic, to help us sort them and prepare a draft reply. To do that, it may see your message and the relevant parts of your booking details (such as which sessions you're booked on).

A real person always reads your message and the draft and decides what to reply and whether to change anything on your account. We do not use AI to make decisions about you that have legal or similarly significant effects. Our AI provider does not use your messages to train its AI models.

Our team is notified about new messages through a private Telegram group, which includes a short summary and the draft reply.

 

6. Who we share it with

We never sell your information. We share it only with the people and services that help us run DLF, and only what they need:

• TeamUp - our booking and membership system

• Stripe and GoCardless - card payments and Direct Debits

• Wix - our website and contact form

• Calendly - booking discovery calls

• IONOS - our email

• Meta (Facebook, Messenger, Instagram, WhatsApp) - when you contact us through them

• Anthropic - the AI service described in section 5

• Telegram - private staff notifications about new messages

• Google - encrypted backups of our admin system

• Our coaches, who see the details they need to coach you, and our accountant, for financial records

We may also share information if the law requires it, or to protect someone's safety.

 

7. Information stored outside the UK

Some of these services store or process information outside the UK, for example in the USA or the EU. When that happens, it is protected by legal safeguards approved by the UK, such as UK adequacy regulations (including the UK-US "Data Bridge") or the UK's standard data transfer agreements.

 

8. CCTV

We use CCTV at the studio to keep it, our members and our equipment secure. Signs show where it is in use. Recordings are kept for about [30] days and then automatically deleted, unless they are needed to look into an incident. Cameras are not placed anywhere you would expect privacy, such as toilets or changing areas.

 

9. How long we keep it

• Enquiries from people who don't join: 12 months from our last contact.

• Membership, booking and payment records: while you're a member, then 6 years (financial records the law requires us to keep).

• Health information and training notes: while you're a member, then 3 years, in case of any insurance or injury claim.

• Messages and drafts in our admin system: 2 years.

• Marketing: until you unsubscribe.

• CCTV: as in section 8.

 

10. Keeping it safe

Access to your information is limited to the people who need it. Our admin system runs on a secure server we manage in the UK. Only a single locked-down address, which receives messages from Meta, is reachable from the internet, and our backups are encrypted.

 

11. Your rights

You have the right to:

• ask for a copy of the information we hold about you

• ask us to correct anything that's wrong

• ask us to delete your information (we may need to keep some records for legal reasons)

• ask us to limit how we use it, or object to how we use it

• ask for your information in a format you can take elsewhere

• withdraw your consent at any time, for marketing or health information

To do any of these, contact Lisa using the details in section 1. We'll reply within one month, and it's free.

 

12. Marketing

We'll only send you news and offers if you've agreed to it. You can stop them at any time by using the unsubscribe link in any email, or by telling us.

 

13. Cookies

Our website uses cookies, set by Wix, to make the site work and to understand how it's used. You can choose which cookies to accept using the banner when you first visit, and change your choice at any time.

 

14. Children

Our services are for adults. We don't knowingly collect information from anyone under 18.

 

15. Changes to this policy

If we change this policy, we'll update it here and change the date at the top.

 

16. Complaints

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113. Our ICO registration number is ZB629218.