Legal

Who looks after your data

Vibes Gym (the gym) is the controller of your personal data. That means the gym decides why and how your data is used.

The gym uses GymStrato, the software that runs the gym, as its processor. GymStrato only handles your data on the gym's instructions and does not use it for anything else.

Card payments

Your card details are held by Stripe, our payment provider. The gym and GymStrato never see or store your full card number.

Other companies that handle data for us

GymStrato uses these companies (sub processors) to run the service.

• Stripe: Takes card payments and keeps card details. Sees: Name, email, card details (held only by Stripe) and payment amounts. Where: EU and USA.
• Netcup: Hosts the GymStrato servers and database. Sees: All member records held in GymStrato. Where: Germany.
• Twilio: Sends text messages and WhatsApp messages. Sees: Mobile number and message text. Where: EU and USA.
• Postmark: Delivers email. Sees: Email address and email content. Where: USA.
• Lightspeed: Till and stock for gyms that use it. Sees: Product and sales totals, no member details. Where: EU.

What we keep and for how long

• Payments, invoices and refunds: Kept for at least 6 years, because tax law requires it.
• Member details: Kept while you are a member and afterwards for as long as the gym needs them. The gym has not set automatic deletion periods.

Your rights

You can ask the gym to:

• show you the data it holds about you
• correct anything that is wrong
• delete your data (we keep payment records the law requires)
• stop using your data for marketing at any time
• give you a copy of your data to take elsewhere
• stop or limit how your data is used

To use any of these, contact the gym using the details above. If you are not happy with the answer you can complain to the Information Commissioner's Office at ico.org.uk.