Privacy Policy
This notice sets out how Fitness HQ Limited (company number 16092256), trading as Plus Fitness UK ("we", "us", "our"), processes personal data in connection with Plus Central UK (the "Portal").
The Portal is a login-gated operations system. It is separate from www.plusfitness.co.uk and from ClubWise.
Controller: Fitness HQ Limited. Registered office: 71 Queen Victoria Street, London EC4V 4BE. Contact: [email protected]. Portal: https://pluscentral.co.uk.
Accounts are issued to persons authorised by Fitness HQ Limited or by the relevant club. Franchisees and club managers are not employees of Fitness HQ Limited. A franchisee may request the addition or removal of its staff.
Scope
This notice applies to the Portal only. It does not apply to gym-member data held in ClubWise, to www.plusfitness.co.uk, or to systems operated by other Plus Fitness territories.
Personal data is not sold. The Portal is not used to collect gym-member payment-card data, to process public membership applications, or for advertising or retargeting.
Personal data processed
- Account data, comprising name, work email address, club or site, user group, role, account status and a hashed password.
- Content and activity data, comprising material submitted or posted through the Portal, records of use of the Portal, and records of documents accessed.
- Technical and audit data, comprising sign-in and security logs, and a log of create, edit and delete actions.
Source
Personal data is obtained from the user, from Fitness HQ Limited or the relevant club when an account is created or amended, and from the systems used to host and secure the Portal.
Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Provision of the account and the Portal | Contract |
| Security, audit logs and operations-manual access records | Legitimate interests |
| Shop requests | Contract |
| Account and security communications | Contract, or legitimate interests where the communication concerns security |
| Disclosure to the recipients named below | Contract or legitimate interests, as applicable to the purpose |
Where processing is based on legitimate interests, the data subject may object as set out below.
Recipients
Personal data may be accessed by the user, the relevant club, UK head office, Supabase (database, authentication, file storage and edge functions), Cloudflare (hosting and security), and Viva Leisure and/or Plus Fitness Australia.
Personal data may also be disclosed where required by law, or where necessary to protect rights, safety or security.
Location of processing
The Portal database is located in the United Kingdom (Supabase, West Europe, London). Cloudflare may process connection and security data outside the United Kingdom. Where it does so, appropriate safeguards are applied.
Retention
| Record | Period |
|---|---|
| Active account | For the duration of access |
| Deactivated profile | 12 months, then deleted or anonymised |
| Audit log | 12 months |
| Shop orders | 6 years |
| Operations-manual access records | While the document is held, or 12 months after the account ends, whichever is later |
| Backups | Until overwritten in the ordinary backup cycle |
Security
Access is role-based. Connections are encrypted. Passwords are hashed. Database access is controlled. Account credentials must be kept confidential. Suspected misuse must be reported to [email protected].
Rights
A data subject may request access, rectification, erasure, restriction, or portability, and may object to processing based on legitimate interests, where those rights apply. A complaint may be made to the Information Commissioner's Office at https://ico.org.uk.
Requests must be sent to [email protected]. Identity may be verified before a request is actioned.
Children
The Portal is not directed at persons under 18.
Changes
This notice may be updated. The last-updated date will be amended accordingly.
Contact
Fitness HQ Limited (Plus Fitness UK)
[email protected]
https://pluscentral.co.uk
71 Queen Victoria Street, London EC4V 4BE