Last updated: 28 October 2026
This notice explains how CrossFit Tunbridge Wells Ltd uses personal information collected through this website. It is written for people who contact us, request a free class or membership information, use our online forms, or book through the links and services available on the site.
Who is responsible for your information
CrossFit Tunbridge Wells Ltd is the controller of the personal information covered by this notice. The company is registered in England and Wales with company number 13208550. Its registered office is 11a Chapman House, Chapman Way, Tunbridge Wells, Kent, TN2 3EF.
You can contact us about this notice or your personal information by email at info@crossfittunbridgewells.co.uk, by telephone on 07700 170465, or by post at the registered-office address above.
Information we collect through this website
The information we collect depends on how you use the site. It can include your name, email address, telephone number and the details you put in a message or request. A free-class request asks for first name, last name, email address and telephone number. The beginner guide form asks for name, email address and telephone number. The referral form asks for your name and email address, and the name, email address and telephone number of the friend you refer.
We also receive the information you provide when you ask about pricing, membership, pausing or cancelling a membership. The website includes embedded or linked services for class calendar, drop-in booking and online forms. Information given directly to those services may also be processed by the provider of that service under its own arrangements.
Like most websites, the site and its suppliers may collect limited technical information about visits, such as device, browser, pages viewed, approximate location derived from an IP address, referral source and interactions with the site. The site uses a Google tag, Elfsight to display Google reviews, Google Fonts, LeadConnector or HighLevel forms, PushPress for the embedded calendar and drop-in booking journey, and website performance tracking supplied by Bravon Fitness. Website performance tracking records events such as viewing an enquiry form or clicking a booking button, together with the page on which the event happened.
How and why we use your information
We use contact and enquiry information to respond to you, arrange a free class or other requested visit, answer questions about membership, administer requests about an existing membership, and keep records of our communications. Where this is needed to take steps at your request before entering into a membership agreement, or to perform an agreement with you, our lawful basis is contract. Where the processing is not required for a contract, such as answering a general enquiry, managing the website and protecting our business from misuse, we rely on our legitimate interests in running and improving our gym and communicating with people who have asked to hear from us. We consider those uses to be proportionate and do not use them to override your rights and freedoms.
We use technical and usage information to operate, secure and understand the performance of the website, and to assess the effectiveness of our advertising and website activity. Where cookies or similar technologies require consent under the Privacy and Electronic Communications Regulations, we need your consent before using them. For essential operation and security we rely on our legitimate interests in providing a functioning, secure website. Where we process personal information for optional analytics on the basis of consent, you can withdraw that consent. This notice does not itself set or manage your cookie preferences.
We may use your contact details to send direct marketing about CrossFit Tunbridge Wells only where you have given the required consent or where the conditions for the PECR soft opt-in are met. The soft opt-in is limited. It may apply only where we collected your details directly during a sale or genuine negotiation for a sale, the marketing is for our own similar services, and we gave you a simple way to opt out when we collected the details and in every later message. Our data-protection basis for consent-based marketing is consent. Where a valid soft opt-in applies, our basis is our legitimate interests in promoting our own similar services. You can unsubscribe at any time using the link or contact details in a marketing message, or by contacting us. Submitting an enquiry or downloading a guide does not, by itself, amount to consent to marketing.
Our website forms include an optional tickbox, which is not ticked by default, where you can choose to hear from us about classes, events and offers by email and text. You do not have to tick it to send an enquiry or book. We collect your name, email address and mobile number through the forms on this website and use them to contact you about your enquiry. The first text message we send always includes “Reply STOP to unsubscribe”, and replying STOP stops all further texts. Marketing emails include an unsubscribe link. We do not text anyone whose enquiry is more than 12 months old.
We do not use information supplied in a referral form to market to the referred friend unless we have a valid lawful route to do so. If a member refers you, the member is the source of those details. We use referral records to administer the referral scheme, relying on our legitimate interests in managing that scheme. Please ask your friend to contact us directly wherever possible, and tell them before sharing their details.
Information collected outside the website
When you become a member, attend classes or use other gym services, we may need further information to provide those services, administer membership, take payments, manage safety, and meet legal obligations. The exact information and reasons for using it depend on the service and the information actually requested. We will provide separate privacy information at the relevant collection point where this is needed.
Adult members and new joiners. Adults complete a waiver through PushPress when they sign up or book their first class. Before a first class we also ask about training background and any injuries, by text or email. Coaches keep short notes on anything that affects how someone trains, such as injuries, illness or pregnancy, in a private channel that only coaches can access. For pregnant and postnatal members we also keep the stage of pregnancy, the due or birth date and any symptoms they tell us about, again accessible only to coaches. Membership hold and cancellation forms ask for a reason, which is sometimes health-related.
MumFit. MumFit members complete a participation agreement covering postnatal checks, pregnancy and birth complications, medication and an emergency contact.
Children (Kids, Pre-teens and Teens). Parents or guardians give us the child’s name and date of birth, medical conditions, allergies, injuries, any emergency medication, additional needs, emergency contacts, who is allowed to collect children under 11, and consent to first aid. We also keep attendance and incident records.
Some information that may be collected outside the website could concern health, injury, disability or other matters requiring additional protection under data-protection law. Health information needs an additional legal condition as well as an ordinary lawful basis. The relevant collection notice must explain that condition and any consent requested. Please do not include detailed medical information in a general enquiry or membership-request form. Contact us to arrange an appropriate way to discuss anything relevant to safe participation.
CCTV
We do not run any CCTV ourselves. There is estate CCTV across the common areas at Chapman House, but it is run by the managing agent, not by us.
Photos and videos
We share photos and videos of classes on our website and social media. For children and MumFit members we ask for separate opt-in consent for the website, social media and in-gym display. We never use children’s surnames or tag children. Anyone can withdraw their consent at any time by emailing info@crossfittunbridgewells.co.uk.
Who we share information with
We may share information with suppliers that provide website forms and customer-relationship tools, calendar and booking services, website hosting and support, analytics and advertising measurement, review-display services, communications, payment or professional services. We share only what is necessary for the relevant purpose. Some suppliers process information on our instructions, while others may process it as separate controllers for their own services. Their own privacy notices may also apply.
The main systems and suppliers we use are: PushPress (memberships, billing, waivers and bookings); Stripe (card payments, through PushPress); GoHighLevel, provided through our website supplier (CRM, forms, texts and email); Slack (coaches’ notes); Xero, run for us by our accountants, Naylor Accountancy; Google Workspace (email); Monzo Business (banking); and Claude by Anthropic (administrative support).
We do not sell your personal information. We may disclose information where required by law, to establish, exercise or defend legal claims, or to protect people or property.
International transfers
Some of the suppliers used by this website may store or make personal information accessible outside the UK. A transfer can include remote access by a separate organisation. Where a restricted transfer takes place, we must use an appropriate UK transfer mechanism, such as UK adequacy regulations, appropriate safeguards or a permitted exception. HighLevel publishes a Data Processing Addendum that includes contractual safeguards for UK transfers. You may contact us for details of the locations and safeguards applicable to your information and how to obtain a copy.
Cookies and embedded services
Cookies and similar technologies can store information on your device or access information already there. Embedded forms, timetables, reviews and externally hosted fonts can also send your IP address and browser information to their providers when they load. Google tracking helps measure visits and interactions. Some storage is necessary for a service you request; other uses require consent unless a specific legal exception applies. Continuing to browse does not amount to consent.
Your browser allows you to block or delete cookies, although this can affect forms and bookings and does not prevent every type of data collection. Browser controls are not a substitute for any consent the website is legally required to obtain. Contact us if you would prefer to enquire by telephone or email.
How long we keep information
We keep information only for as long as reasonably necessary for the purpose for which it was collected. We set retention by considering the type of request or relationship, whether an agreement is current or has ended, legal and accounting requirements, limitation periods, safety and dispute-management needs, and whether information is needed to maintain a marketing opt-out record. We then securely delete, anonymise or restrict information when it is no longer needed. For enquiries, the relevant factors are whether your request is resolved and whether discussions remain active. For membership requests and related records, they include the duration of membership and any outstanding billing or dispute. For technical records, they include the time needed to investigate security issues and assess website performance. We may keep a minimal record of an opt-out to prevent further unwanted marketing. You can ask us about retention for a particular record.
In particular:
- Enquiries that do not go on to join: 12 months.
- Former members: 6 years after they leave, for financial records. Health notes are deleted after 12 months.
- MumFit health information: 7 years after the last class.
- Children’s records: until the child’s 25th birthday.
- Health information from a children’s taster session: deleted within 3 months if the child does not join.
Providing information and keeping it safe
You can browse without submitting a form. If you do not provide the contact or booking details needed to handle a request, we may be unable to respond or arrange that service. Marketing choices are separate from information needed to provide a service. For enquiries about a child or young person, a parent or guardian should contact us so we can explain the relevant membership and privacy arrangements.
We use reasonable measures to protect information against loss, misuse and unauthorised access. No website or email system can guarantee complete security. Please do not send payment-card details or detailed medical records through a general enquiry.
Your rights
Subject to the conditions and exemptions in data-protection law, you may ask us for access to your personal information, correction of inaccurate information, deletion, restriction of processing, or a portable copy of information you provided where the right applies. You may withdraw consent at any time where we rely on consent. Withdrawing consent does not affect processing carried out before its withdrawal.
Your right to object: You have the right to object at any time to processing for direct marketing. If you object, we must stop using your personal information for that purpose. You may also object to processing based on legitimate interests in certain circumstances.
To exercise a right, contact us using the details above. We normally respond within one calendar month. We may ask for reasonable information to confirm your identity, and the law allows limited extensions or exceptions in particular circumstances.
Complaints
Please contact us first if you have a concern, so that we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO). Details of how to complain are available at ico.org.uk/make-a-complaint.
Changes to this notice
We may update this notice when our website, services or legal obligations change. The current version will be published on this website with its revision date.
