Privacy notice

This notice explains what personal information Horsham Mixed Martial Arts Academy Limited collects through its websites, member app, café till, gym systems and CCTV, why, who it is shared with, how long it is kept and the rights you have under UK data protection law (UK GDPR and the Data Protection Act 2018).

Who we are

Horsham Mixed Martial Arts Academy Limited (company number 11993810, registered in England and Wales; registered office 2 Kings Court, Harwood Road, Horsham, West Sussex RH13 5UR) is the data controller. It trades as SWBJJ (Sonny Weston Brazilian Jiu-Jitsu), The Farm, Horsham Muay Thai, K-Cal Café and Yin Yoga with Lydia, which are all names of the same company, so this notice covers all of them. We train at Unit T, Blatchford Road, Horsham, West Sussex RH13 5QR.

Sonny Weston, our director, is responsible for data protection. Contact him with any privacy question or request by email to [email protected], at the front desk, on 01403 864444, through the contact page on our website, or by post to our registered office.

Home Hub Smart Solutions builds and runs our websites, app and systems for us and acts as our data processor under a written agreement. To run and fix the systems its administrator can reach any record, safeguarding records included; it acts only on our instructions, and every time it opens a safeguarding record that is logged where our Welfare Officer can see it.

What we collect

• Account details: name, email address, phone number, postcode and your password (stored only as a secure hash). If you set up a passkey, we store only its public key: the private key never leaves your phone, and we never see your face or fingerprint.
• Profiles for each person who trains, including children added by their parent or guardian: name, date of birth, belt or grade, membership status, bookings, attendance and check-ins, coach notes and grading history.
• Safety and safeguarding information: emergency contacts, the adults allowed to collect a child, signed waivers and consents, and the accident and incident book.
• Injury reports you send in the app, for yourself or your child: when and how it happened, where the injury is and what happened next, and for an adult’s own injury an optional photo. They go into the accident and incident book and are kept the same way.
• Health information (injuries, conditions, allergies), only if you choose to give it and tick the consent for it. You can withdraw that consent in the app at any time, which deletes the notes.
• Photos and avatars: a profile photo only if you upload one; otherwise the avatar you build.
• Messages you post in the app’s group chats, and reports you make about messages.
• Café and shop orders, your café tab, Raven Coins and payments made at the counter, in the app or online.
• Membership payments: payment references, amounts and dates. Your bank details are held by GoCardless, our Direct Debit provider, and card details by Square, not by us.
• Enquiries you send through the website, and the details you add when we email you after one: your phone number, who is training, the first name and age of each child you enquire for, experience, what you want from training, when you can come and how you heard about us.
• CCTV recordings of you when you are in or around the building (see CCTV below).
• Records of your choices: which version of this notice you accepted and when, and every consent you give or withdraw.
• Technical information: the app’s notification token so we can send you notifications and, if crash reporting is switched on, crash reports with personal details removed.

Location

If you switch on arrival check-in, your phone watches a circle around the building. Your location never leaves your phone: the only thing sent to us is that you arrived, so you can be checked in to the class you booked. You can switch it off at any time in the app.

CCTV

We use CCTV in and around the building to keep people, especially children, and property safe, to prevent and detect crime, and to look into accidents, incidents and claims (legitimate interests). Cameras never cover changing rooms, toilets or the treatment room, and do not record sound. Recordings are kept for up to 30 days and then recorded over, unless part of one is needed for an incident or claim. Screens inside the building may show a live view of the mats (the Mat Cam) during any class, children’s classes included, so parents who cannot get round the mat can watch. It is shown only inside the building, is not recorded, and may play live sound that is not recorded either. Please do not film, photograph or record the screens: what they show remains the property of the company and is for people in the building only. Our CCTV policy has the details.

Why we use it and our lawful basis

• To provide your membership, bookings, classes, gradings, café and shop (contract).
• To keep members, and especially children and adults at risk, safe, including emergency contacts, collection lists, accident and incident records and safeguarding records (legitimate interests, and legal obligation where the law requires it, for example reporting serious injuries under RIDDOR). Where these records include health information or allegations of crime, we rely on the substantial public interest in safeguarding children and individuals at risk (Data Protection Act 2018, Schedule 1, paragraph 18), on preventing or detecting unlawful acts (paragraph 10, which also covers CCTV), on establishing or defending legal claims, and in an emergency on protecting someone’s vital interests. We keep the appropriate policy document that Act requires.
• Health information you give us for your profile: your explicit consent (for a child, their parent’s or guardian’s), and in an emergency to protect someone’s vital interests. If you withdraw consent we delete your health notes, but accident and incident records that mention an injury are kept as set out below.
• To collect membership fees and keep accounts (contract and legal obligation).
• To run the academy well, for example attendance reports, and to keep the building safe with CCTV (legitimate interests).
• To show photos on gym screens or in the app, to send news and offers by email, and to use arrival check-in (consent, which you can withdraw at any time).

Our legitimate interests are running the academy safely and efficiently, protecting people and property, and dealing with claims. We do not make decisions about you by automated means alone.

To become a member you must give us your name, contact details, date of birth and an emergency contact. Without them we cannot let you train safely. If you give us details of an emergency contact or an adult who can collect a child, please tell them and point them to this notice.

Who can see it

Staff see only what their role needs. Coaches see names, ages, belts, consents and health notes so they can teach safely, but not your contact details, a child’s date of birth or billing. If someone is hurt in class, the coach can open that person’s emergency contact; every time this happens it is recorded and the academy is told. Front desk staff and managers see contact details to run memberships. Safeguarding records are visible only to the Welfare Officer, Sonny Weston, and the Deputy Welfare Officer, Jayden Thompson (and, logged, to our systems supplier as described above).

Second parents

A child’s profile belongs to the account that set it up and pays for it. That parent can ask for the child’s other parent to be added with their own login. Our staff first check that the other parent has parental responsibility, and only then can they see and act for the child: the profile, health notes, bookings, check-ins and signing documents for the child. Changing the child’s name, date of birth or consents stays with the account that set the profile up. Neither parent sees the other’s own account, contact details, payments or receipts, and a second parent’s access ends when the child turns 18, when either parent ends it, or when our staff end it.

Who we share it with

We never sell your information, show no advertising and do no tracking. We share only what is needed with the companies that help us run the academy, bound by data processing agreements: Home Hub Smart Solutions (systems and hosting), Cloudflare (secure network delivery), Microsoft (email delivery), Apple and Google (delivering phone notifications) and, if switched on, Sentry (crash reports, with names, email addresses, phone numbers and other personal details removed before they are sent). GoCardless (Direct Debit) and Square (card payments in the app, at the counter and in the online shop) are also responsible in their own right for the payment information they handle, under their own privacy notices. We also share information with our insurers, accountants and legal advisers when needed, and with emergency services, the police or the local authority where the law or someone’s safety requires it.

Transfers outside the UK

Some of the companies above, such as Cloudflare, Microsoft, Apple, Google and Square, may process information outside the UK, including in the United States. Each transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by the UK International Data Transfer Addendum. Ask us for details.

How long we keep it

• Your account and profiles: while you have an account, until you delete it. Health notes, emergency contacts and the adults allowed to collect a child are deleted from a profile 3 years after its membership ended, even if the account stays open.
• In-app notifications: 90 days. Website enquiries that do not lead to membership: 12 months. Chat messages: 12 months.
• Payment and billing records: up to 7 years, as tax law requires.
• Signed agreements, the consent log, the record of who opened emergency details and the accident and incident book: at least 3 years after membership ends, or for a child until they turn 21, whichever is later, because injury claims can be made until then. When you delete your account, your name and contact details are removed from them, and the rest is kept.
• Safeguarding records: until the child concerned turns 25, and allegations about staff or coaches for 10 years or until the person’s normal retirement age, whichever is longer, as safeguarding guidance requires.
• Records of data protection requests: 6 years, so we can show they were handled properly.
• CCTV recordings: up to 30 days, unless part of one is needed for an incident, investigation or claim.
• Backups: information you delete stays in our encrypted backups until they are overwritten, after at most 8 weeks. Backups are only ever used to recover from a failure, never to bring deleted information back into use.

Children

Children do not have their own login. A parent or guardian creates and manages their profiles, signs consents for them and decides whether their photo can be used and whether health information is stored. Children appear on gym screens by first name only, and never with a photo unless their parent has consented. Children have their own data protection rights: from about age 12 a child can usually make a request themselves, and we will take their views into account.

Your rights

You can ask for a copy of your information (the app downloads it for you: Account, Download my data), ask for it in a format you can take elsewhere, ask us to correct it, restrict how we use it, withdraw any consent, and delete your account. To delete it, use the app (Account, Delete account), the delete-account page on our website (we email your account address a link to confirm), or ask at the front desk. We answer every request within one month, or within that month tell you if a complex request needs up to two more months.

You can object at any time to our use of your information based on legitimate interests, and you can always stop marketing emails, using the unsubscribe link or the app. If you are unhappy with how we handle your information, please tell us first; you can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Security

Your information is stored on secured servers in the United Kingdom operated for us by Home Hub Smart Solutions, sent only over encrypted connections, protected by role-based access and audit records, and backed up every night, with encrypted copies kept off site. Bank and card details never reach our systems.

Changes

When the way we use information changes we update this notice, show the new version and date here, and ask you to read and accept it in the app.