Last updated: 23rd September 2026
This Privacy Policy explains how GYMBOX (“we”, “our”, “us”) as a controller collect, use, store, and shares the personal data of our members, personal trainers and instructors who use our clubs.
In this policy, GYMBOX means Sparring Partners Ltd, registered in England and Wales (company number 4204345), whose registered office is at Unit 7, 38 New Kent Road, London, SE1 6TJ. GYMBOX is part of Urban Gym Group B.V., based in the Netherlands.
GYMBOX is committed to protecting your privacy and handling your personal data in a fair, lawful, and transparent way, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), as supplemented by the Data Use and Access Act 2025.
This Privacy Policy describes:
By visiting a GYMBOX Club, using our website(s), app(s), or contacting us, you acknowledge and agree to the terms of this Privacy Policy.
We collect and process the personal data necessary to provide our services and operate our business. This may include:
Category | Examples | When do we collect this? |
Personal identifiers
| Name, date of birth, gender, address, email address, contact number, company name, and membership details.
| When you sign up to become a member or visitor via our website or in person.
When you enter into a contract with us.
When you swipe your membership card to access our Clubs or sign up to a class.
When you ask us for more information in relation to a product or service.
When you sign up to a paid-for event we are hosting.
|
Financial information
| Payment details including bank account or card information (processed securely via third-party payment providers).
| When you sign up to become a member or visitor via our website or in person.
When you enter into a contract with us.
When you sign up to a paid-for event we are hosting.
|
Health and fitness information
| Health declarations (to ensure exercise readiness and safety), and any information you voluntarily provide to personal trainers or staff.
| When you sign up to become a member or visitor via our website or in person and complete a health commitment.
When you ask to freeze or cancel your membership on health grounds.
|
Photographs and identification
| A digital photograph is taken for security and club access. We may request identification for verification purposes.
| When you sign up to become a member or visitor via our website or in person.
When you attend an event where photographs will be taken and you have given your consent.
|
CCTV and video
| CCTV is used in all Clubs for health, safety, and crime prevention. Limited video monitoring may also be used for internal training or service quality assessments.
| When you use or visit any of our Clubs.
If you have any queries in relation to the use of CCTV operating in and around the clubs, please contact us at the details in section 13 of this policy.
|
Usage data
| Usage records and duration of visits, in the form of date, time, gym, and membership number.
| When you access our Clubs. |
Digital data
| We may collect:
Cookies and similar technologies are used to enhance your experience — see section 9.
| When you use our websites or apps. |
Marketing data
| Your marketing preferences | When you sign up to become a member or visitor via our website or in person.
When you ask for further information in relation to third party services / personal trainers / instructors operating within our Clubs.
|
Job application data | Alongside personal identification data, we may process your CV, interview notes and assessment results, references and right to work documentation | When you apply for a job at GYMBOX via our website. |
Special Categories of Personal Data
Certain personal data are defined as ‘Special Categories of Personal Data’ under the UK GDPR, such as data regarding race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of uniquely identifying a person, data concerning health (including mental and physical health), or data concerning sex life or sexual orientation.
Profile Picture
When entering into a membership, GYMBOX processes a profile picture of you and links it to your membership. This is because the membership is personal. We do this to prevent improper use of memberships and to support reliable access control in our clubs. We do not use facial recognition software or any other form of automated biometric identification.
CCTV and Camera Surveillance
Video surveillance (live where necessary) is used in our Clubs for the following purposes:
No other personal data is processed apart from camera footage of the buildings and premises, and the persons and objects located therein and thereon, together with data relating to the time, date, and location at which the footage was recorded.
No hidden cameras are used. GYMBOX is transparent about the use of cameras: where cameras are in use, this is clearly indicated by stickers, signs, or other notices, in line with the UK Surveillance Camera Code of Practice. No cameras are installed in changing rooms or restrooms at our clubs.
In practice, video surveillance is carried out by staff on-site at the relevant GYMBOX location. Occasionally, a third party may be engaged to record or monitor footage, such as an external control room during surveillance of temporarily unstaffed clubs. GYMBOX always remains ultimately responsible for the execution of the video surveillance.
Camera footage is retained for a maximum of 30 days, unless a longer retention period is necessary to handle a recorded incident. Individuals authorised to review footage are explicitly bound by confidentiality, and access to the footage is protected by a password.
A specific request from a data subject for access to and copies of footage, including the date, time period, and location in question, can be submitted using the contact details in section 13 of this policy. A request for deletion or blocking of footage may be submitted if the footage is incomplete or irrelevant for the purposes of the processing, or if it is otherwise processed in violation of legal requirements. A request may be denied if granting access would infringe upon the privacy rights of others.
Disclosure of footage: recorded camera footage will only be provided to an authorised government body when a lawful (generally written) order from the respective authority is received, or when other legal obligations require GYMBOX to do so.
Camera Surveillance and Occupancy Analytics
In addition to the regular camera surveillance, GYMBOX uses an application to analyze the occupancy of zones and equipment within its locations. This enables GYMBOX to better design our facilities and improve our service to members.
The camera footage is processed entirely locally: the raw camera footage never leaves the location. Only anonymous, aggregated occupancy statistics (such as the number of people using a particular zone during a specific period) are sent for analysis to a secure cloud environment. No names, member numbers, or other identifying factors are processed, and the raw footage is not stored. The anonymous occupancy statistics are retained for the duration of the agreement with the relevant processor, plus a maximum of 90 days after its expiration (this is arranged in consultation).
The legal basis for this processing is legitimate interest pursuant to Article 6(1)(f) UK GDPR. GYMBOX’s interest in efficiently organizing its locations and providing optimal service to members outweighs the privacy interests of data subjects, particularly in light of the technical safeguards in place and the fact that only anonymized, aggregated data is transmitted.
Visit Data
Visit data (check-in time, check-out time, visit duration, and visit frequency): When you visit a GYMBOX location, you scan your personal QR code upon entry, which records your check-in time. When you leave, you check out again using the same QR code, after which your check-out time is registered. The visit duration is derived from these two timestamps.
Data or minors
We generally do not process personal data of children under the age of 16. This may differ if a child contacts us directly for more information. We do not knowingly process any special category data relating to children.
We process your personal data for the following purposes and under the lawful bases permitted by the UK GDPR:
Purpose | Lawful basis |
To provide and manage your membership, bookings, and payments | Performance of contract |
To contact you about membership, bookings, or operational updates | Legitimate interests |
To identify you and grant you access to our Clubs | Performance of contract |
To bill you for using our service as part of your membership and enforce the collection of debt if necessary | Performance of contract |
To send marketing and promotional communications (where applicable) | Legitimate interests – to receive marketing from us Consent – to receive third party marketing from any personal trainers/instructors operating in our clubs |
To improve services, analyse usage, and develop business insights | Legitimate interests |
To comply with legal and regulatory requirements | Legal obligation |
To ensure member safety and club security (CCTV, access systems) | Legitimate interests |
To answer FAQs through our automated website chat bot | Legitimate interests |
To process your job application if you apply for employment at GYMBOX | Legitimate interests |
To ensure members safety when using our clubs | Legitimate interests Special Category Article 9 Condition Explicit consent |
To handle an emergency relating to your health | Necessary to protect the vital interests of a data subject Special Category Article 9 Condition Vital interests |
Instructors and Personal Trainers
Purpose | Lawful basis |
To enter into and manage our agreements with you and maintain a record of our contractual obligations | Performance of contract |
To process payments for services provided by you and manage related invoices and tax reporting | Performance of contract Legal obligation (tax and accounting) |
To arrange classes, sessions and availability through our gym facility booking systems | Performance of contract Legitimate interests (efficient business operations) |
To verify your qualifications and right to work status | Legal obligation (employment and safety laws) |
To comply with health and safety regulations | Legal obligation (health and safety laws) |
To contact you in relation to the services provided by you | Performance of contract Legitimate interests |
To feature you in promotional content or materials including social media or website profiles | Consent |
To monitor your club access | Legitimate interests (security and fraud prevention) |
To handle complaints, disputes or legal claims | Legitimate interests Legal obligation |
We do not use your personal data for automated decision-making that produces legal or significant effects.
We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above.
Legal Basis for Visit Data Processing
We also process your visit data on the basis of our legitimate interest for the following two purposes:
We may contact you via email, SMS, phone, or app notifications for:
Compulsory communications
Certain communications (e.g. urgent updates, booking confirmations, payment reminders) are essential for service delivery and cannot be opted out of. These messages will not contain any direct marketing.
Marketing communications
If you have purchased or shown interest in our products, services or memberships, you will receive marketing communications from us via email, SMS, phone, or app notifications about similar offerings unless you have opted out of receiving marketing.
Third party marketing: with your explicit consent, we will share your contact information with our third party aggregators, partners, personal trainers or instructors so they can send you details about their services.
You can manage or withdraw your preferences at any time by:
Categories of third parties
We share limited personal data with trusted third parties, including:
All processors act under written contracts, process data only on our instructions, and are required to maintain confidentiality and security consistent with UK GDPR.
Data Processing within Urban Gym Group
Urban Gym Group B.V. is the parent company, which includes brands such as GYMBOX, TrainMore, Clubsportive, The CLB, RUSH, PILAT3S, and TRIB3. For specific purposes, we may share your personal data within the Urban Gym Group corporate group. We are permitted to do so, and will only do so, for administrative purposes, service improvement, internal management (internal analyses), and/or the performance of our contract with you.
Personal Training Services
As part of our personal training services, we may share the contact details (first and last name, email address, and/or phone number) that you have provided via our online contact form with the independent personal trainer (self-employed contractor) working at the GYMBOX location of your choice. The initial details from the form are sent to the Personal Trainer Manager (PTM), a GYMBOX employee, who then forwards the contact details to the relevant PT. This PT will then contact you directly to follow up on your training request. In doing so, the relevant PT acts as an independent data controller for the further processing of your personal data. We advise you to contact the relevant PT for information about their data processing.
Please note that some countries outside of the UK or EEA have a lower standard of protection for personal data, including lower security requirements and fewer rights for individuals. Where your personal data is transferred, stored and/or otherwise processed outside the UK or EEA, we will take all reasonable steps to ensure that your personal data is treated securely and in accordance with this policy. When personal data is transferred internationally to a country that is not deemed adequate by the European Commission or the UK Secretary of State, we will rely on acceptable and defined legal mechanisms such as using standard contractual clauses which have been approved by the European Commission or the UK Government.
From time to time, we may process your personal data using AI and other similar technology. This could include generative artificial intelligence (GenAI) serviced by third party providers to better manage risks and improve the quality of efficiency of our services (e.g. keepme.ai).
Where we use any other AI systems, we will ensure such uses are properly validated, and would be used fairly, ethnically and with appropriate human oversight of the decision-making process. If the relevant individuals do not wish for personal data to be processed via AI tools, please contact us using the contact details at the end of this notice.
We take appropriate organisational and technical measures to protect personal data from unauthorised access, loss, or misuse.
This includes but is not limited to:
We will retain your personal data only for as long as we need it for the purposes set out in this policy, or as long as legally required, except where we need to retain it for longer to comply with legal obligations or to pursue legal claims. We will retain your personal data only for as long as we need it for the purposes set out in this policy, except in circumstances where we need to retain it for longer to comply with legal obligations or to progress legal claims. At the end of the retention period, we will take steps to delete your personal data or hold it in a form that no longer identifies you.
Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data so that we can respect your request in future.
You have the following rights under UK GDPR:
Right |
Description
|
To be informed | A right to be informed about the personal data we hold about you. |
Of access | A right to access the personal data we hold about you. |
To rectification | A right to require us to rectify any inaccurate personal data we hold about you. |
To erasure
| A right to ask us to delete the personal data we hold about you. This right will only apply where (for example):
|
To restrict processing
| In certain circumstances, a right to restrict our processing of the personal data we hold about you. This right will only apply where (for example):
|
To data portability
| In certain circumstances, a right to receive the personal data you have given us, in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal data to another organisation, at your request. |
In relation to automated decision making and profiling | A right for you not to be subject to a decision based solely on an automated process, including profiling, which produces legal effects concerning you or similarly significantly affect you. We do not carry out any automated processing. |
To withdraw | A right to withdraw your consent, where we are relying on it to use your personal data (for example, to provide you with brochures and newsletters). |
To exercise these rights, contact . We will respond within one month in accordance with the UK GDPR.
There may be conditions or limitations on these rights. It is therefore not certain for example you have the right of data portability in the specific case – this depends on the specific circumstances of the processing activity.
If you have any concerns regarding our processing of your personal data or are not satisfied with our handing of any request made by you, or would otherwise like to make a complaint, please contact GYMBOX in the first instance using the details in this privacy policy, so that we can do our very best to sort out the problem.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. The ICO can be contacted by telephone on 0303 123 1113 or by post as follows: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or via email at .
We may occasionally update this Privacy Policy to reflect changes in our operations or legal requirements.
The most current version will always be available at www.gymbox.com. Material changes will be communicated via email or club notice.
Data Protection Officer
For privacy queries, please contact the Urban Gym Group Privacy Team via and/or Bente van den Beuken, the Data Protection Officer (DPO) for Urban Gym Group Netherlands B.V., via . Queries relating to UK or Irish data protection law will be handled with the support of the relevant local privacy advisers”
