Privacy Policy

1. Introduction

Mz Fitness BxF ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website and services.

Data Controller: Mz Fitness BxF, PureGym Cardiff Bay, CF11 0JR
Contact: [email protected] | 07946 644180

2. Information We Collect

We collect the following types of personal information:

• Contact Information: Name, email address, phone number
• Health & Fitness Data: Medical history, fitness goals, body measurements (with your consent)
• Payment Information: Payment details for services (processed securely through third-party providers)
• Communication Records: WhatsApp messages, emails, and consultation notes
• Website Usage Data: IP address, browser type, pages visited (via cookies)

3. How We Use Your Information

We use your personal data for the following purposes:

• To provide personal training and coaching services
• To communicate with you about appointments, programmes, and updates
• To process payments and manage your account
• To improve our services and website functionality
• To send marketing communications (with your consent, which you can withdraw at any time)
• To comply with legal obligations

4. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases:

• Contract Performance: To deliver the services you've requested
• Legitimate Interests: To improve our services and communicate relevant updates
• Consent: For marketing communications and processing sensitive health data
• Legal Obligation: To comply with financial and regulatory requirements

5. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

• Service Providers: Payment processors, email providers (e.g., Gmail, WhatsApp)
• Legal Authorities: If required by law or to protect our rights
• Third-Party Apps: HEVY App (for online coaching clients) - see their privacy policy

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption, secure storage, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations. Client records are typically retained for 7 years after the end of our relationship, in line with financial and professional standards.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for marketing or sensitive data processing

To exercise any of these rights, contact us at [email protected]

9. Cookies

Our website uses cookies to enhance user experience and analyse site traffic. You can control cookie preferences through your browser settings. For more information, see our Cookie Policy (if applicable).

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

11. Complaints

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

ICO: www.ico.org.uk
Phone: 0303 123 1113