Privacy Policy

Last updated: 06/10/2025

We Are Fit Attitude Limited (“WAFA”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and protect your personal information when you interact with us, use our services, or visit our website. It also sets out your legal rights under UK data protection law.

1. Important information and who we are
WAFA is the controller of your personal data.

If you have any questions about this privacy policy or wish to exercise your legal rights, please contact:

Data Protection Officer: Anna Jenkins
Email: anna@wearefitattitude.com
Postal address:
We Are Fit Attitude Limited
c/o i-SYT Fifth Element
Basepoint Business Centre
Little High Street
Shoreham-by-Sea
West Sussex, BN43 5EG
Telephone: 07968 075041

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection (www.ico.org.uk). However, we would appreciate the chance to resolve your concerns first.

2. The data we collect about you
We may collect, use, and store different types of personal data, including:

Identity Data: name, date of birth, gender, images/videos.
Contact Data: home address, email, phone number, emergency contact, doctor’s details.
Financial Data: bank and payment card details.
Technical Data: IP address, login data, browser/device information.
Profile Data: account details, purchases, preferences, feedback.
Usage Data: information on how you use our services and website.
Marketing Data: preferences for receiving communications.
Special Category Data: medical history, injuries, medication, exercise history, fitness goals, body measurements.

We store certain health, contact, and emergency details within our club management app (GoTeamUp), which is securely hosted and GDPR compliant.

We do not collect information about criminal convictions or offences, nor do we collect other sensitive categories such as political or religious beliefs, except where required by law.

Our services are not intended for children under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

3. How we collect your personal data
We collect your data in the following ways:

Directly from you: when you sign up, complete forms, use our WAFA Club App (via GoTeamUp), or contact us by email, phone, WhatsApp, or receive informational texts (via Lead Connect).
Automatically: when you interact with our website (via cookies, analytics, and tracking tools).
From third parties: such as our CRM and communications systems (Fitness Business Profits / Lead Connect, Mailgun, Twilio, GoTeamUp, Stripe, GoCardless, ClickSend, and Google Analytics).

For more on cookies, see our Cookie Policy.

4. How we use your personal data
We only use your data when the law allows, including:

Contract: to provide our services to you.
Legitimate interests: such as improving our services, managing client relationships, and communicating with existing clients.
Legal obligations: where we must comply with laws.
Consent: for special category health data, using your photos/videos in promotional material, and sending marketing communications where required.

You can withdraw consent at any time by contacting us.

5. Marketing and communications
We may use your data to suggest services or offers that may interest you.

We will only share your data with third-party marketing providers if you give your express opt-in consent.

Currently, we use the following marketing and communication platforms:

Fitness Business Profits / Lead Connect (UK/USA) – our main CRM system for managing client relationships, communications, and marketing.
Mailgun (US) – integrated with Lead Connect to send automated emails.
Twilio (US) – integrated with Lead Connect to send SMS/text messages.
GoTeamUp (UK/EU) – our club management app that stores membership, contact, health, and emergency details.
ClickSend (Australia/Global) – for sending informative or service-related SMS texts (not marketing).
WhatsApp (Meta Platforms, Inc.) – for direct communication with members who have provided their phone numbers.

We may also use your photos, videos, or testimonials in our marketing materials or social media content (including Facebook and Instagram), but only where you have provided your explicit consent. Where such content is published on social media, the platform (Meta) acts as an independent data controller. You can view their respective privacy policies for more information on how they handle data.

If data is transferred outside the UK, safeguards are applied (see section 8 below). You can opt out of marketing at any time by clicking “unsubscribe” in our emails or contacting us directly.

6. Disclosures of your personal data
We may share your data with trusted service providers who help us deliver our services. These include:

GoTeamUp – manages your membership, bookings, attendance, health, and emergency details.
Stripe – processes card payments securely.
GoCardless – manages direct debit payments.
Fitness Business Profits / Lead Connect – CRM system for communications and client management.
Mailgun – integrated email delivery system.
Twilio – integrated SMS/text delivery system.
ClickSend – sends separate operational or informational SMS texts.
WhatsApp – facilitates direct messaging with members.
IT and website support providers – help us maintain our systems securely.

All providers must keep your data secure, use it only as instructed by us, and comply with UK data protection law.

7. Data retention
We will only keep your personal data for as long as necessary to fulfil the purposes for which we collected it, including legal, accounting, and reporting requirements.

Client data is generally kept for up to 7 years after your last interaction with us (for tax and legal purposes).
Marketing data is kept until you opt out or withdraw consent.
Health data is deleted once it is no longer necessary to provide our services or meet safeguarding requirements.

If you want more details about retention for a specific type of data, please contact us.

8. International transfers
Some of our service providers are located outside the UK. Whenever your personal data is transferred outside the UK, we ensure it is protected by one of the following safeguards:

The destination country has been granted an adequacy decision by the UK government.
We have signed UK-approved Standard Contractual Clauses (SCCs) with the provider.
For US providers, we may rely on the UK Extension to the EU–US Data Privacy Framework.

You can request further details about these safeguards by contacting us.

9. Your legal rights
Under UK data protection law, you have the following rights:

Access – request a copy of the data we hold about you.
Rectification – request correction of inaccurate or incomplete data.
Erasure – request deletion of your data (“right to be forgotten”).
Restriction – request restriction of processing in certain cases.
Portability – request transfer of your data to you or another organisation.
Objection – object to our processing (e.g., marketing).
Withdraw consent – where we rely on consent, you may withdraw it at any time.

To exercise your rights, please contact us at anna@wearefitattitude.com. We may need to verify your identity before responding.

10. Changes to this privacy policy
We may update this privacy policy from time to time. The latest version will always be available on our website. Please check back regularly for updates.

Third-Party Providers Summary

Contact us
If you have any questions or concerns about how we use your personal data, please contact our Data Protection Officer: Anna Jenkins – anna@wearefitattitude.com