Privacy Policy

Alpha Gym is the data controller for the personal information described in this policy. Our address is 11 - 13 Little Horton Lane, Bradford BD5 0AB, United Kingdom.

Email info@alphagyms.co.uk for privacy questions, requests or complaints. This policy covers alphagyms.co.uk, online membership signup, the Alpha Gym member app, gym access, class and provider bookings, and related communications.

Membership and identity details: name, email address, phone number, date of birth, selected plan, account identifier, membership status and the date and version of the terms and privacy notice you accepted.

Student verification: a student-ID image and verification outcome. The image is access-restricted and deleted after approval or rejection; we retain the outcome and verification year while needed to administer the discounted plan.

Payments: Stripe customer, subscription and Checkout identifiers, payment status and limited billing information returned by Stripe. Alpha Gym does not receive or store your full card number or card security code.

Membership use: membership status, gym entry records, classes, sessions, facilities and provider bookings, attendance and account communications.

Face entry: if you choose face entry, a facial template used to recognise you at the door, and the date and time you gave consent. Section 3 explains how face entry works.

Enquiries and communications: contact details, message content, preferred appointment information and our response history. Please do not include medical information unless a relevant practitioner specifically asks for it through an appropriate channel.

Technical information: security and server logs, IP address and browser/device details generated when you use our systems. With your cookie consent, Vercel Analytics also provides aggregated website-usage information.

App notifications: if you enable them, we store a device push token and notification preferences. We do not use the website or app to track your precise location.

Face entry is optional. It lets members aged 18 or over into the gym at any time by recognising their face at the door. Staff register you at reception between 6am and 9pm, when the gym is staffed, using the gym’s own entrance system.

What we collect: when you register, the entrance system captures your face and creates a facial template, which is used to recognise you at the door. A facial template is biometric data, which is special-category personal data under Article 9 of the UK GDPR.

Purpose: we use your facial template only to let you into the gym, and for no other purpose.

Lawful basis: your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)). You give it at reception when you register for face entry, and we keep a record of when you gave it.

Who processes it: Hikvision supplies the gym’s entrance system and processes your facial template on our behalf as our processor. It may use your template only on our instructions, to run the entrance system.

Where it is stored: on the entrance device at the gym and in Hikvision’s cloud service for the entrance system. Your facial template is not stored on the Alpha Gym website, member app, servers or member records.

How long we keep it: we delete your facial template from the entrance device and from Hikvision’s cloud service on the day your membership ends or you withdraw consent, whichever comes first.

Withdrawing consent: you can withdraw consent at any time by telling reception or emailing info@alphagyms.co.uk. We will delete your facial template on the day we receive your request, and your membership continues. Withdrawing consent does not affect processing that took place before you withdrew it.

If you do not consent: you can still join and use the gym. Reception staff will let you in between 6am and 9pm, when the gym is staffed. Members under 18 cannot use face entry and are let in the same way.

The Alpha Gym website and member app do not collect or process biometric data. They never use your phone’s or browser’s camera.

Contract: to create and administer your account and membership, take payment, coordinate entrance registration, verify student eligibility, manage bookings, send service messages and deal with cancellation or support requests.

Legitimate interests: to answer enquiries, secure and improve our systems, prevent fraud and misuse, keep appropriate business records, manage capacity and operate the gym effectively. We balance these interests against your rights and expectations.

Legal obligation: to keep tax, accounting, safety and dispute records and to respond to lawful requests from regulators, courts or law enforcement.

Consent: to send optional direct marketing and to run non-essential website analytics. You can withdraw consent at any time without affecting earlier lawful processing.

Explicit consent: to register you for face entry, as explained in section 3.

The signup fields marked as required are needed to create and perform your membership contract, confirm age eligibility and contact you about the service. If you do not provide them, we cannot create the membership. Student-ID evidence is required only for a discounted student plan.

Marketing email is optional and is off by default. Service messages about payment, access, bookings, closures, security or your account are not marketing and may still be sent where needed to perform the membership contract.

You have an absolute right to object to direct marketing. Untick the marketing option when joining, use the unsubscribe method in a marketing message, or email info@alphagyms.co.uk. We may retain a minimal suppression record so that we honour the opt-out.

Authorised Alpha Gym staff and, where relevant to a booking you make, the trainer, coach or onsite service provider responsible for that booking.

Supabase for database, file storage and authentication; Stripe for payments and subscription billing; Vercel for website hosting and consent-based analytics; Resend for transactional and opted-in marketing email; and Expo for app push notifications.

Hikvision, which supplies the gym’s entrance system, processes facial templates for face entry as our processor (see section 3).

Professional advisers, insurers, regulators, courts, law enforcement or a buyer of the business where disclosure is necessary and lawful. We do not sell personal information or share it with third-party advertisers.

Some providers process information outside the United Kingdom. Where UK data-protection law requires it, the transfer must be covered by an adequacy regulation or appropriate contractual and organisational safeguards. Contact us if you want more information about the safeguards relevant to your data.

Unpaid signup records are normally removed after seven days. Student-ID images are deleted after approval or rejection, and are also removed when an unpaid signup expires.

Membership, payment, contract and current entrance records are kept while the membership is active and normally for up to six years afterwards where needed for tax, accounting, legal claims, fraud prevention or safeguarding. We delete or anonymise records sooner when they are no longer needed and no exception applies.

Facial templates for face entry are deleted on the day your membership ends or you withdraw consent, whichever comes first. We also keep a record of when you gave consent.

Enquiries that do not become a membership or booking are normally kept for up to 24 months. Marketing contact details are kept until you withdraw consent or they are no longer useful, subject to retaining a minimal suppression record. Security logs, analytics and provider records are kept for the shorter period set for their operational and security purpose.

Depending on the circumstances, you may have rights to be informed, access your data, correct it, erase it, restrict its use, object to processing and receive data you supplied in a portable format. You can also withdraw consent at any time. These rights are not all absolute and we may need to retain information required by law or needed to establish, exercise or defend legal claims.

Email info@alphagyms.co.uk to exercise a right. We may ask for enough information to verify your identity and will normally respond within one month.

If you are unhappy with our response, you can complain to the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113. Please give us the opportunity to resolve the issue first.

We use encrypted connections, role-based access, restricted storage, signed links, audit controls and trusted service providers for the website and app. No online service is risk-free, so tell us promptly if you believe your account has been compromised.

Online memberships are available from age 16. We minimise information about 16- and 17-year-old members and use it only to provide and protect the service. We do not knowingly offer online membership to children under 16. For their safety, members under 18 cannot use face entry. Reception staff let them in between 6am and 9pm, when the gym is staffed.

The website and app do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Student eligibility decisions are reviewed by authorised staff. Face entry matches your face automatically to let you into the gym. If it does not recognise you, reception staff can let you in between 6am and 9pm.

Our Cookie Policy explains necessary storage, Stripe Checkout and consent-based analytics. You can reopen cookie choices using Cookie settings in the website footer.

We may update this notice when our services or legal duties change. We will publish the revised date and notify members directly where a change is significant.