Last updated: 24 September 2026
[Full legal operator name], trading as The Southwold Gym, is responsible for the personal information described in this policy.
Our address is: 4 The Old Hospital, Field Stile Road, Southwold, IP18 6LD.
For privacy questions or requests, email [privacy email].
This policy explains how we use information about members, prospective members, website visitors and people who contact us.
Depending on your interaction with us, we may collect:
[Confirm whether emergency contacts, health questionnaires, accessibility requirements or accident records are collected. Add the relevant categories and remove any that are not used.]
We receive information directly from you, through our membership and booking providers, and through our access and security systems.
Payment providers handle payment credentials under their own arrangements. [Confirm what payment information the gym itself can access.]
Where we rely on legitimate interests, we consider the impact on your privacy and use only information reasonably necessary for the purpose.
[If health information is collected, specify each purpose, the applicable ordinary lawful basis and the additional special-category condition. Optional health or accessibility information may use explicit consent where it can genuinely be freely given. Accident records and legal claims may require different conditions.]
Information needed to administer your membership, take payment and control access is necessary to provide those services. If you do not provide it, we may be unable to create or maintain your membership. Optional marketing consent is not a condition of joining.
We use CCTV and recorded door access to support safety, protect property, prevent unauthorised access and investigate incidents.
CCTV operates 24 hours a day. This does not mean footage is watched continuously or that staff are always on site.
[Confirm camera coverage, whether audio is recorded, authorised viewers and the CCTV provider. Cameras must not intrude into toilets or private changing areas.]
Footage is retained for [period], unless relevant footage needs to be preserved for an incident, insurance matter or legal claim.
Where necessary for the purposes above, we share information with:
We limit sharing to information relevant to the service or purpose.
[Confirm provider identities and whether each acts on our instructions or as an independent controller. Add links to relevant independent provider privacy notices.]
[Confirm whether any provider stores or accesses personal information outside the UK. Identify the relevant countries and safeguards, such as UK adequacy regulations or approved contractual safeguards. Explain how people can obtain further information or a copy of applicable safeguards.]
We retain information only for as long as needed for its purpose, including applicable legal requirements and the reasonable handling of disputes.
Records are securely deleted or anonymised when no longer required.
We send optional promotional emails where you have agreed to receive them. You may unsubscribe using the link in a message or by contacting us.
You can object to the use of your information for direct marketing at any time.
Essential messages about your membership, payments, bookings or safety are separate from marketing.
Depending on the circumstances, you may ask us to give you access to your personal information, correct inaccurate or incomplete information, delete information, restrict its use, or provide certain information in a portable format.
You may also object to processing based on legitimate interests.
Where we rely on consent, you can withdraw it at any time without affecting processing that was lawful before withdrawal.
Email [privacy email] to exercise your rights. We may need proportionate information to verify your identity. We normally respond within one month; if a lawful extension applies, we will explain it.
[Confirm whether any solely automated decisions with legal or similarly significant effects are made. If none, state that clearly. If used, explain the decisions, effects and relevant safeguards.]
Please contact [privacy email] if you are concerned about how we handle your information.
We will acknowledge a data-protection complaint within 30 days, investigate appropriately and tell you the outcome without undue delay.
You may also complain to the Information Commissioner’s Office.
We may update this policy when our services or data practices change. The latest version will appear on our website, with its revision date. We will draw significant changes to your attention where appropriate.
