Privacy policy.

The organisation responsible for your information

Base Defence Gym is the data controller for the personal information described in this policy unless another organisation clearly states that it is acting as a separate controller.

Address: Unit G1, 43–49 Fowler Road, Hainault, IG6 3FF
Email: info@basedefencegym.com
Telephone: 020 3663 0631

What personal information we collect

Depending on how you interact with BDG, we may collect:

• identity and contact details, including name, date of birth, address, telephone number and email address;
• parent or guardian details, emergency contacts and authorised collection information for junior members;
• membership, trial, package, booking, attendance, credit and coaching records;
• payment status, transaction references and billing information; payment-card and bank details are generally handled by our payment providers rather than stored directly by BDG;
• health, injury, disability, medication, accessibility and emergency information where relevant to safe participation;
• waivers, agreements, consent choices and communications with BDG;
• incident, accident, complaint, conduct and safeguarding records where required;
• photographs, video or audio where captured for an agreed coaching, operational or promotional purpose;
• website and device information, such as IP address, browser information and cookie choices; and
• information supplied when you enquire, join a mailing list, enter an event, apply for a role or otherwise communicate with us.

Please provide accurate information and tell BDG when important contact, health, emergency or safeguarding details change.

How we receive information

We normally receive information directly from you or, for a child, from their parent or legal guardian. We may also receive information through:

• MAAT membership profiles, class bookings and attendance records;
• Acuity private-coaching bookings and package purchases;
• Stripe and other approved payment services;
• CleverWaiver forms and agreements;
• Squarespace website forms, cookies and mailing-list tools;
• email, telephone, WhatsApp and social-media messages; and
• coaches, staff, emergency contacts or authorities where reasonably necessary for safety, safeguarding, complaints or legal compliance.

Why we use personal information

We use personal information only where there is a lawful basis. The basis depends on the activity:

• Contract: to create and administer memberships, trials and coaching packages; manage bookings, attendance, credits, payments, cancellations and customer service; and provide the service requested.
• Legal obligation: to meet applicable accounting, tax, health and safety, safeguarding, employment and regulatory duties and to respond lawfully to authorities.
• Legitimate interests: to operate and improve BDG, secure our systems and premises, prevent misuse and fraud, manage complaints and disputes, communicate essential service information and protect the rights and safety of members, staff and visitors. We consider whether these interests are balanced against individual rights.
• Consent: where permission is appropriate, including certain marketing, optional photography or video and some uses of health information. Consent can be withdrawn, although this does not make earlier lawful processing invalid.
• Vital interests: where information is needed to protect someone’s life or physical safety in an emergency.

Sensitive personal information

Health information is special-category data. BDG may use relevant health, injury, disability or medication information to assess safe participation, make reasonable adjustments, respond to incidents and protect participants. We rely on an appropriate condition under data-protection law, which may include explicit consent, employment or social-protection obligations, legal claims, substantial public interest or vital interests, depending on the circumstances.

Safeguarding and incident information is shared only on a need-to-know basis. Where necessary to protect a child or another person, BDG may share relevant information with safeguarding partners, emergency services, insurers, legal advisers or public authorities without consent where the law permits or requires it.

Children’s personal information

Children deserve particular protection. BDG uses junior members’ information to provide age-appropriate training, administer attendance, keep them safe, contact parents or guardians and meet safeguarding responsibilities.

• A parent or legal guardian should create or supervise the child’s account and provide required permissions and information.
• We aim to explain relevant uses of information in language appropriate to the child’s age and understanding.
• We do not sell children’s information or use it for behavioural advertising.
• Marketing directed to a child will only be used where lawful and appropriate, with suitable safeguards and any consent required.
• Photography and video involving children are managed through the applicable consent process and safeguarding arrangements.

A child’s data-protection rights belong to the child. A parent or guardian may usually act for them where appropriate, but BDG may consider the child’s age, understanding, wishes and best interests.

Who may receive information

BDG does not sell personal information. We may share the minimum necessary information with:

• coaches, employees, contractors and authorised volunteers who need it to perform their role;
• MAAT, Acuity, Stripe, CleverWaiver, Squarespace and other providers supporting membership, booking, payment, waiver, website, email, storage, communications and administration;
• professional advisers, accountants, insurers and legal representatives;
• emergency services, safeguarding bodies, regulators, courts, law-enforcement agencies or public authorities where required or permitted by law; and
• a successor organisation if the business is restructured, transferred or sold, subject to appropriate confidentiality and legal safeguards.

Some providers act as processors on BDG’s instructions; others may act as separate controllers for parts of their service. Their own privacy information may also apply.

Information processed outside the UK

Some technology or communications providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards, BDG will rely on an applicable adequacy decision, approved contractual protections such as the UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism.

You may contact BDG for further information about the safeguards relevant to your information.

How long information is kept

BDG keeps personal information only for as long as reasonably necessary for the purpose collected, including providing services and meeting legal, accounting, safeguarding, insurance and dispute-resolution requirements.

• Routine enquiries are normally retained for up to 12 months after the matter is closed, unless they become part of another record.
• Membership, contract, transaction and core account records may normally be retained for up to six years after the relationship or relevant transaction ends.
• Accident, incident, complaint, safeguarding and junior-member records may be retained for longer where necessary because of legal limitation periods, safeguarding responsibilities, insurance requirements or an ongoing matter.
• Marketing records are kept until consent is withdrawn or an objection is received; a minimal suppression record may be retained so that the preference continues to be respected.
• Images and recordings are reviewed periodically and retained only while there is a continuing lawful purpose.

Information may be securely deleted, anonymised or retained for longer where a legal duty, claim, investigation or safeguarding reason requires it.

Your communication and image choices

Where required, BDG will obtain consent before sending promotional email, text or WhatsApp messages. You can unsubscribe using the option provided or contact BDG at any time. Objecting to marketing will not stop essential membership, payment, booking or safety communications.

Photography and video may be used for coaching, community updates or promotion only where there is an appropriate lawful basis and the required permissions. You may withdraw optional promotional consent by contacting BDG. This will apply to future use where reasonably practicable, but may not require withdrawal of material already lawfully printed, published or incorporated into completed content.

Members and visitors must not record other people, particularly children, without BDG’s permission and all other consent required.

Cookies and online services

The BDG website may use strictly necessary cookies to operate and, depending on your choices, analytics or marketing technologies to understand use and improve services. Where consent is legally required, optional cookies should not be placed until you choose to accept them through the cookie controls.

You can review or change available cookie choices through the website’s cookie controls and can also manage cookies in your browser. Blocking some cookies may affect website functions. Links to external services are governed by the privacy information of those services.

How information is protected

BDG uses proportionate organisational and technical measures intended to protect personal information against unauthorised access, accidental loss, alteration or disclosure. These may include access controls, passwords, secure service providers, staff confidentiality, limited access based on role and procedures for responding to incidents.

No system can be guaranteed completely secure. If a personal-data breach creates a legal duty to notify the Information Commissioner’s Office or affected individuals, BDG will do so in accordance with the applicable requirements.

Your data-protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of information;
• request restriction of processing;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• challenge certain solely automated decisions with legal or similarly significant effects.

These rights are not absolute and exemptions may apply. BDG does not currently use personal information to make solely automated decisions producing legal or similarly significant effects.

To make a request, email info@basedefencegym.com. BDG may need to verify identity and will normally respond within one month, subject to any lawful extension.

Questions and concerns

Please contact BDG first if you have a concern so that we have an opportunity to investigate and respond.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection. Visit ico.org.uk/make-a-complaint for current contact details and guidance.

Updates to this policy

BDG may update this policy to reflect changes in services, technology, providers or legal requirements. The latest version will be published on this page with its effective date. Where a change materially affects how existing personal information is used, BDG will provide additional notice where appropriate.

Contact BDG about privacy

Email: info@basedefencegym.com
Telephone: 020 3663 0631
Address: Unit G1, 43–49 Fowler Road, Hainault, IG6 3FF

Helpful links: Membership Terms · Private Coaching · FAQs