Skip to main content

HC:FIT Ninja Fitness

Menu
Book Now

Legal

Privacy Policy

Last updated: 2 August 2026

Before this goes live: this policy should be reviewed by a solicitor before you rely on it, particularly the sections on health data and children's data, which carry real liability if wrong. One item still needs your confirmation: whether CCTV is in operation at the Liverpool premises (section 2 and section 6). Adjust or remove that wording to match reality.

1. Who we are

This website is operated by HC:FIT LTD (company number 10535493), a ninja obstacle training, calisthenics, and functional fitness gym based in Liverpool, UK ("HC:FIT", "we", "us", "our"). Our registered office is at Upper Floor, 1 Birchall Street, Liverpool, L20 8PD.

HC:FIT LTD is the data controller for the personal information described in this policy. If you have any questions about this policy or how we handle your data, contact us at henry@hc-fit.co.uk or 07794 649257.

2. What personal data we collect

We collect different data depending on how you interact with us: as a website visitor, a member, a class or session participant, or a parent/guardian booking on behalf of a child.

Contact and account details

  • Name, email address, phone number and postal address
  • Emergency contact details
  • Date of birth (used to confirm age eligibility for adult and kids' sessions)
  • Account login details, if you register for a member area or booking portal

Health and fitness information

To run classes and personal training safely, we may ask about relevant medical conditions, injuries, physical limitations, or fitness goals on a health/PAR-Q style form before your first session. This is "special category data" under UK GDPR, and we only collect it with your explicit consent, use it solely to plan safe, appropriate sessions, and do not use it for any other purpose.

Booking, attendance and payment information

This website does not currently process payments or take bookings online. Membership sign-up, class bookings, and payment are handled directly with the HC:FIT team rather than through the site. If that changes and we introduce online booking or payment, we'll name the provider here and update this policy before launch.

Enquiries and marketing

If you contact us through this website's enquiry form, we collect whatever details you provide (name, email, phone, and your message). Your submission is stored securely in our website's database and emailed to the HC:FIT team so we can respond to you. If you opt in to receive news, offers, or class updates, we collect your email address for that purpose. You can unsubscribe at any time.

Website and cookies

We use Google Analytics to help us understand how visitors use this website, such as which pages are viewed and how long visitors stay. This helps us improve the site. Google Analytics uses cookies to collect this information. See the Cookies section below for more detail on how to control this.

CCTV

If CCTV is in operation at our Liverpool premises, footage is recorded for the safety and security of members, staff, and visitors, and to help resolve accident or incident reports. Footage is retained for a limited period and only accessed when necessary. (This section assumes CCTV is in use. Remove it if it isn't, or confirm the details are accurate.)

3. How and why we use your data

We only use your personal data where we have a valid legal basis to do so under UK GDPR:

  • To provide our services: managing your membership, bookings, classes, and personal training sessions (performance of a contract).
  • For your safety: using health/fitness information you've explicitly consented to share, so sessions are run safely for your ability level (explicit consent, Article 9).
  • To take payment: processing membership fees, class payments, and refunds (performance of a contract).
  • To respond to enquiries: replying to messages sent through our contact form (legitimate interest).
  • For marketing: sending class updates, offers, or news, only where you've opted in (consent). You can withdraw this at any time.
  • To improve our website: using Google Analytics to understand how visitors use the site (consent, via cookies).
  • For safety and security on site: CCTV and incident records where applicable (legitimate interest).
  • To meet legal obligations: such as keeping financial records for tax purposes.

4. Children's data

We offer Kids Ninja Classes for children. Where a child is under 13, a parent or guardian must complete the booking and consent to the collection of the child's data (name, age, emergency contact, and any relevant health information) on their behalf. We collect only what is needed to run the session safely and do not use children's data for marketing.

5. Who we share your data with

We do not sell your personal data. We share it only where necessary, with:

  • Our website hosting provider, who stores the site's database (including enquiry form submissions) on our behalf.
  • Google, who provides our website analytics (Google Analytics). Google processes anonymised, aggregated usage data on our behalf, and their servers may be located outside the UK and EEA. Google maintains its own safeguards for this, including Standard Contractual Clauses, under its own privacy policy.
  • Professional advisors (accountants, insurers) where necessary.
  • Regulatory or legal authorities, where we're required to by law.

We don't currently use any third-party booking, payment, or marketing platforms that would receive your data. If we introduce one in future, for example for online bookings, payments, or an email marketing tool, we'll name it here and update this policy first.

6. How long we keep your data

We keep personal data only as long as necessary for the purposes it was collected:

  • Membership and booking records: for the duration of your membership plus a reasonable period afterwards for record-keeping.
  • Financial/payment records: as required by UK tax law (currently up to 6 years).
  • Health/fitness information: deleted or securely destroyed once no longer needed for your sessions, or upon request.
  • Marketing data: until you unsubscribe or withdraw consent.
  • Analytics data: Google Analytics retains data according to its own retention settings, which we review periodically.
  • CCTV footage (if in use): typically 30 days, unless needed for an ongoing incident investigation. (Confirm this matches your actual system's retention period.)

7. Your rights

Under UK GDPR, you have the right to:

  • Ask what personal data we hold about you and get a copy of it (right of access)
  • Ask us to correct inaccurate or incomplete data (rectification)
  • Ask us to delete your data, where there's no legal reason for us to keep it (erasure)
  • Ask us to restrict or object to certain processing
  • Ask for your data in a portable format, where technically feasible (portability)
  • Withdraw consent at any time, where we rely on consent (e.g. marketing, health data)

To exercise any of these rights, contact us at henry@hc-fit.co.uk. If you're not satisfied with how we've handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

Our website uses two types of cookies:

  • Strictly necessary cookies: the small number WordPress sets to keep the site secure and working correctly, for example to keep a logged-in team member's session active. These cannot be switched off, as the site would not function properly without them.
  • Analytics cookies: set by Google Analytics, so we can see how visitors use the site (for example, which pages are popular and how long visitors stay). This data is aggregated and does not identify you personally.

You can control or delete any cookie through your browser settings at any time, and you can opt out of Google Analytics specifically using the Google Analytics opt-out browser add-on. (Flag: since analytics cookies are not strictly necessary, UK PECR guidance expects a cookie consent banner giving visitors the choice before these cookies are set. This site does not currently have one. Recommend adding a consent banner before Google Analytics goes live.)

9. Data security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. This includes restricting access to those who need it to do their job, keeping the website software up to date, and using a reputable hosting provider.

10. Changes to this policy

We may update this privacy policy from time to time, for example if our services or legal obligations change. The "last updated" date at the top of this page will reflect the most recent revision.

11. Contact us

If you have any questions about this policy or how we handle your personal data, please get in touch: