Privacy Policy

Unstoppable Mindset Ltd, trading as Just Train ("Just Train", "we", "us" or "our"), is responsible for deciding how and why your personal information is used. This means that we are the data controller for the personal information described in this policy.

This policy explains what personal information we collect, why we use it, how long we keep it, who we may share it with and the rights available to you.

It applies to members, prospective members, trial participants, course participants, pay-as-you-go customers, website visitors and people who contact us.

Depending on how you interact with Just Train, we may collect:

• your name, date of birth and contact details;
• your home address;
• emergency-contact information;
• parent or guardian information for members aged 16 or 17;
• membership, package, course, trial and booking information;
• attendance, cancellations and class history;
• payment status, transaction records and limited payment information;
• messages, enquiries, complaints and other communications;
• health and physical-activity information supplied through questionnaires or directly to our team;
• information about injuries, medical conditions, medication, pregnancy or exercise restrictions where relevant to participation;
• accident, incident, first-aid and safeguarding information;
• marketing preferences and records of consent;
• photographs or videos where separate permission has been given;
• technical information collected when you use our website or booking system, such as IP address, browser type, device information and cookie data;
• CCTV images where CCTV operates at our premises; and
• any other information you voluntarily provide to us.

We do not normally receive or retain complete payment-card or bank-account details. Payments are generally processed by our payment and Direct Debit providers.

We may collect personal information:

• directly from you when you enquire, register, make a purchase or complete a questionnaire;
• through our website, gym software or booking system;
• from a parent or legal guardian;
• from coaches or staff following attendance, an incident or a relevant conversation;
• through payment, Direct Debit and transaction providers;
• through cookies and similar website technologies;
• from CCTV systems where used; or
• from another person where you have authorised them to contact us on your behalf.

If you provide another person's information, such as an emergency contact, you should tell them that you have supplied their details to us.

We may use personal information to:

• create and administer memberships and customer accounts;
• process purchases, payments, renewals and cancellations;
• manage class bookings, attendance, waiting lists and course participation;
• communicate essential information about bookings, payments, closures, membership or safety;
• provide coaching services and make appropriate participation adjustments;
• assess whether further health information or professional medical advice may be needed before participation;
• respond to enquiries, requests and complaints;
• maintain the safety and security of members, staff, visitors and premises;
• record and manage accidents, incidents and first-aid matters;
• prevent fraud, misuse, unauthorised access and breaches of gym rules;
• maintain financial, tax and business records;
• establish, exercise or defend legal claims;
• improve our services and understand how they are used;
• send marketing where we have the necessary consent or another lawful basis; and
• comply with legal and regulatory obligations.

We will only use personal information where we have a valid lawful basis. Depending on the purpose, this may be:

• Contract: processing is necessary to provide a membership, booking, course or other service you have requested.
• Legal obligation: processing is necessary to comply with a legal duty.
• Legitimate interests: processing is necessary for a genuine business, safety or security interest, provided your rights do not override that interest.
• Consent: you have freely given clear permission for a particular use and may withdraw that permission.
• Vital interests: processing is necessary in a genuine emergency to protect someone's life.

Information about your physical or mental health is special-category personal information and receives additional legal protection.

We collect relevant health information to support exercise screening, participation safety, appropriate coaching adjustments and emergency assistance.

Where required, we rely on your explicit consent to process health information. In an emergency, or where legal claims or another condition under data protection law applies, we may rely on a different lawful condition.

Health information is not used for advertising and will not be sold.

You may withdraw your consent to future consent-based processing. However, if we cannot use information that is reasonably necessary for safe participation, we may be unable to provide some services.

Please tell us if your health information changes in a way that may affect your participation.

Members aged 16 or 17 must have permission from a parent or legal guardian to participate.

We may collect the parent or guardian's name, contact details, relationship to the member and record of consent. We may contact them where reasonably necessary for membership administration, safety or an emergency.

The young member also has data-protection rights in relation to their personal information. We will consider their age, understanding and circumstances when responding to requests.

Payments may be processed by third-party card, Direct Debit, banking or gym-software providers.

These providers may collect and process payment information under their own privacy terms. Just Train normally receives information such as the amount paid, payment status, transaction reference and limited account or card details rather than complete payment credentials.

We retain payment and transaction records where necessary for membership administration, accounting, tax, fraud prevention and legal obligations.

Service messages about bookings, payments, safety, closures or membership administration are not marketing and may be sent where necessary to provide your service.

We will only send promotional emails or text messages where permitted by applicable data-protection and electronic-marketing law. Where we rely on consent, marketing choices will be optional and separate from acceptance of our membership terms.

You may unsubscribe or withdraw marketing consent at any time by using an unsubscribe facility or contacting us. Withdrawing marketing consent will not affect your membership or essential service communications.

We may retain limited information on a suppression list to ensure that we respect an opt-out request.

We will obtain separate permission before using an identifiable photograph or video of you for advertising or promotional purposes.

Giving this permission is optional and is not a condition of membership. You may withdraw permission for future use by contacting us.

Withdrawal will not automatically require us to recall or destroy materials that were lawfully produced or published before permission was withdrawn, although we will consider reasonable requests concerning digital content under our control.

Photography or filming for security, incident evidence or legal purposes may rely on a different lawful basis where appropriate.

Where CCTV operates at our premises, it is used for safety, security, crime prevention, incident investigation and protection of people and property.

Signs will identify areas covered by CCTV. Access to footage is restricted, and footage will normally be retained only for a limited period unless it is required to investigate an incident, respond to a lawful request or establish, exercise or defend a legal claim.

CCTV footage may be disclosed to the police, insurers, legal advisers or other authorised recipients where there is an appropriate legal basis.

Our website may collect technical information through essential cookies and similar technologies required for security and operation.

Optional analytics, advertising or other non-essential cookies should only be used in accordance with applicable law and the choices provided through our cookie controls.

Third-party services embedded in the website may also collect technical information under their own privacy policies.

More information about the cookies used on our website should be provided through our cookie notice or cookie-preference tool where applicable.

Where necessary and lawful, we may share relevant personal information with:

• [INSERT GYM SOFTWARE NAME], which provides our membership and booking system;
• payment, card and Direct Debit providers;
• website-hosting, email, text-message, cloud-storage and IT providers;
• coaches, authorised staff and contractors who need the information to provide services safely;
• accountants, insurers, professional advisers and legal representatives;
• emergency services and healthcare professionals in an emergency;
• the police, courts, regulators, public authorities or safeguarding bodies where required or permitted by law;
• a parent or legal guardian where appropriate for a member aged 16 or 17; and
• a purchaser, investor or professional adviser involved in a genuine sale, restructuring or transfer of the business, subject to appropriate confidentiality and data-protection measures.

Service providers acting on our behalf may only use information according to our instructions and for the agreed purposes.

We do not sell personal information.

Some technology or service providers may store or process information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate legal safeguard is in place. This may include an adequacy decision, approved contractual protections or another safeguard permitted by data-protection law.

Information about the safeguards used for a particular provider may be requested using our contact details.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, tax, insurance and regulatory requirements.

The appropriate period depends on the type of information. In general:

• unsuccessful enquiries are normally retained for up to 12 months after the last meaningful contact;
• active membership, booking and account records are retained while the customer relationship continues;
• key membership, transaction, complaint and contractual records may normally be retained for up to six years after the relationship ends;
• accounting and tax records are normally retained for at least six years or as otherwise legally required;
• health questionnaires and participation-safety records are reviewed and retained only for as long as reasonably necessary, taking account of safety, insurance and legal-claim requirements;
• accident and incident records may be retained for the period necessary to meet legal, insurance and limitation requirements, which may be longer where a child is involved;
• marketing information is retained until consent is withdrawn or it is no longer needed, with limited suppression information retained to respect an opt-out;
• CCTV footage, where used, is normally kept for no longer than 30 days unless required for an incident, investigation or legal claim; and
• promotional photographs or videos are retained until no longer required or permission is withdrawn for future use, subject to the qualifications in section 9.

Information may be retained for longer where a complaint, investigation, safeguarding matter, legal claim or legal requirement makes this necessary.

We may securely anonymise information so that it can no longer identify you. Anonymised information may be kept for statistical or business-analysis purposes.

We use reasonable technical and organisational safeguards designed to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

These safeguards may include access controls, passwords, secure systems, staff confidentiality, restricted access to health information, appropriate service-provider arrangements and secure deletion or disposal.

No electronic system can be guaranteed completely secure, but we take reasonable steps appropriate to the nature and sensitivity of the information.

Depending on the circumstances, you may have the right to:

• ask for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information;
• ask us to restrict how information is used;
• object to processing based on legitimate interests or direct marketing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• complain to the Information Commissioner's Office.

These rights are not absolute and may be subject to legal exceptions.

We may ask for information needed to confirm your identity before acting on a request. We will normally respond within one month, although the law permits additional time in certain circumstances.

Withdrawing consent does not make processing carried out before withdrawal unlawful.

Please contact us first if you have a question or concern about how we use your personal information. We will investigate and try to resolve the matter.

You also have the right to complain to the Information Commissioner's Office:

We may update this policy to reflect changes in our services, technology, providers or legal obligations.

The latest version will be published on our website with its effective or last-updated date. We will provide appropriate notice if a change significantly affects how we use personal information.

For privacy enquiries or to exercise a data-protection right, contact: