Last updated: 1 October 2026
1. Who we are
This policy explains how Fiver Fitness, run by Ben Naughton as a sole trader ("we", "us"), collects and uses your personal data — including through our class booking service at book.fiverfitness.com. We are the data controller for the information described below. Contact us at hello@fiverfitness.com with any privacy questions, or to exercise any of the rights listed in section 6.
2. What data we collect
- Booking details: name, email address, and phone number, collected when you book a class through our website's booking system.
- Payment information: processed by Stripe, our payment processor — we do not store your full card details ourselves.
- Health information: before your first class, you'll complete a Health Declaration as part of sign-up, confirming there's no medical reason you shouldn't take part. This is treated as special category data under UK GDPR and is only used to keep your session safe.
- Attendance history: which classes you've booked and attended, used to manage capacity and membership benefits like priority booking.
- Membership data: your subscription status (active, past due, or cancelled), synced from Stripe.
- Account data: your booking account is stored in our database, hosted by Supabase, our database and authentication provider, in the EU (Germany).
- Analytics and advertising data: once added, cookies from tools such as Google Analytics and Meta/Instagram Pixel will collect data about how you use this website and, where relevant, to show you relevant ads on other platforms. See our Cookie Policy for details — you'll be asked for consent before any non-essential cookie is set.
3. Why we use your data, and our legal basis
- To take and manage your bookings, and provide the class you've paid for — necessary to perform our contract with you.
- To process payments and keep financial records — necessary to perform our contract with you, and to comply with our legal obligations (e.g. UK tax record-keeping requirements).
- To track late cancellations and no-shows — our legitimate interest in managing fair access to limited class spaces and recovering the cost of a space held but not freed up in time.
- To keep you safe during a class, based on any health information you share — your explicit consent, given when you share that information with us.
- To send you booking confirmations, class reminders, and important updates (e.g. a class being cancelled) by email via Resend, our transactional email provider — necessary to perform our contract with you.
- To send optional membership content or news, if you're a member — your consent, which you can withdraw at any time.
- To understand how the website is used, and to show relevant ads, once analytics and advertising cookies are added — your consent, given via the cookie banner.
4. Who we share your data with
Fiver Fitness's booking system is built in-house, using the following third-party services to run it. We share the minimum data necessary with:
- Supabase — hosts our database and handles user accounts/authentication for the booking system, in the EU (Germany).
- Stripe — processes payments for classes and memberships.
- Resend — sends booking confirmations, reminders, and other account emails on our behalf.
- Google Analytics and Meta/Instagram — once added, process website usage and advertising data as described in our Cookie Policy.
Some of these providers may store or process data outside the UK (for example, in the EU or US). Where they do, they provide appropriate safeguards required under UK GDPR, such as Standard Contractual Clauses. We do not sell your data, and we don't share it with anyone else except where required by law.
5. How long we keep your data
- Account and booking data: kept while your account is active, and for up to 2 years after your last booking or membership activity, then deleted or anonymised.
- Late-cancellation history: a rolling 12-month window.
- Health information (Health Declaration): kept only while you hold an active membership or booking history, deleted within 3 months of your account becoming inactive, and held separately from other account data with restricted access.
- Financial/payment records: retained for 6 years, to cover HMRC record-keeping requirements and any potential legal claims, then deleted.
6. Your rights
Under UK GDPR, you have the right to:
- Ask what personal data we hold about you, and get a copy of it.
- Ask us to correct anything that's inaccurate or incomplete.
- Ask us to delete your data, where we don't have a legal reason to keep it.
- Ask us to restrict or object to how we use your data.
- Withdraw consent at any time, where we're relying on consent (e.g. marketing content, or health data — though withdrawing consent for health data may mean you can't book classes until updated information is provided, for your own safety).
- Complain to the Information Commissioner's Office (ICO) if you think we've handled your data incorrectly.
To exercise any of these rights, contact us at hello@fiverfitness.com. As a small business we handle these manually — expect a response within 30 days, as required by law.
7. Cookies
See our Cookie Policy for details on cookies and similar technology used on this marketing website (fiverfitness.com). Our separate booking service at book.fiverfitness.com works differently: it uses only strictly necessary cookies to keep you logged in, with no analytics or tracking cookies.
8. Changes to this policy
We may update this policy as our booking system and services develop. The current version will always be available on this page.