Legal
Privacy Policy.
XF is a Training and Recovery Club with clubs in Manchester, Liverpool and Merry Hill. We take the privacy of our members, prospective members and visitors seriously. This notice explains what personal data we collect, why we use it, who we share it with, how long we keep it, and the rights you have over it, in line with the UK GDPR and the Data Protection Act 2018.
On this page Who we areWhat we collectHow we collect itHow & why we use itHealth dataCCTVMarketingCookiesWho we share withInternational transfersHow long we keep itSecurityYour rightsAgeChangesContact & complaints
1. Who we are
This website is operated by XTRAFIT 1 Limited for XF Clubs, on behalf of itself and the other companies in the XF group (together, "XF", "we", "us", "our"). XTRAFIT 1 Limited is the data controller responsible for your personal data. XTRAFIT 1 Limited and XTRAFIT 2 Limited are registered in England and Wales, and their details are on the Companies House register.
- XTRAFIT 1 Limited — registered company number 12290108
- XTRAFIT 2 Limited — registered company number 12919298
- Registered office (both): Henwood House, Henwood, Ashford, Kent TN24 8DH
- ICO data-protection registration references: XTRAFIT 1 Limited — ZC218582; XTRAFIT 2 Limited — ZC218586
- Privacy contact: memberships.hq@xfclubs.com
2. What personal data we collect
Depending on how you interact with us, we may collect:
- Identity & contact data — name, date of birth, gender (where you provide it), email, phone number, postal address.
- Membership & account data — membership tier and club, start date, attendance and access records, class and facility bookings, membership history, member ID/photo where used for entry.
- Payment data — bank details for Direct Debit and billing records. Card and bank details are collected and processed by our payment providers; we do not store full card numbers ourselves.
- Health & fitness data — information you give us in a health commitment / pre-exercise questionnaire (PAR-Q), relevant medical conditions or injuries, and emergency contact details. This is "special category" data and is treated with extra care (see section 5).
- Images & CCTV — CCTV footage when you visit a club, and marketing photography or video where you have agreed to appear.
- Communications & preferences — messages you send us, enquiry and tour-booking details, reviews and feedback, and your marketing preferences.
- Technical & usage data — IP address, device and browser information, and how you use our website, collected through cookies and similar technologies (see section 8).
3. How we collect it
- Directly from you — when you enquire, book a tour, register your interest, join, use our facilities, contact us, or enter a competition or promotion.
- Automatically — when you use our website (cookies and analytics) or enter a club (access systems and CCTV).
- From third parties — our booking and sales platforms, payment providers, and analytics or advertising partners acting on our behalf.
4. How and why we use your data (and our lawful basis)
We only use your personal data where the law allows. The main purposes and lawful bases are:
| Purpose | Data used | Lawful basis (UK GDPR) |
|---|---|---|
| Set up and manage your membership and account; give you access to the clubs; take bookings | Identity, contact, membership, account | Performance of a contract |
| Collect payments and manage Direct Debits and billing | Payment, membership | Performance of a contract; legal obligation (financial records) |
| Keep you safe and manage health and safety (PAR-Q, injuries, emergencies) | Health & fitness, emergency contact | Legitimate interests (member safety); explicit consent for health data (see section 5) |
| Respond to enquiries, tour bookings and register-interest requests | Identity, contact, communications | Legitimate interests; steps prior to entering a contract |
| Send you service messages (bookings, changes, safety notices) | Identity, contact, membership | Performance of a contract; legitimate interests |
| Marketing to existing members and prospects | Contact, preferences, usage | Consent, and/or legitimate interests (existing members — "soft opt-in", see section 7) |
| Security, crime prevention and protecting people and property (CCTV) | CCTV images | Legitimate interests |
| Improve our website and understand how it is used | Technical, usage | Consent (non-essential cookies) |
| Meet legal and regulatory obligations and handle disputes | As relevant | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced those interests against your rights and are happy to explain that balancing on request.
5. Health & special category data
Information about your health (for example a medical condition, injury or the answers in a pre-exercise questionnaire) is "special category" data. We collect it only to help keep you safe while you train and to respond appropriately in an emergency. We rely on your explicit consent, and/or the condition in the Data Protection Act 2018 relating to health and safety, as confirmed on review. You can ask us to update this information at any time.
6. CCTV
Our clubs are monitored by CCTV for the safety and security of members, Crew and property. Cameras are positioned in communal and training areas and are signposted. Footage is retained for 30 days unless it is needed for an investigation or legal claim, and is only shared where lawful (for example with the police).
7. Marketing and your choices
We may send you news, offers and content by email, SMS or other channels. Where the law requires consent, we ask for it and you can withdraw it at any time. If you are already a member, we may contact you about similar services under the "soft opt-in", and you can opt out at any time. Every marketing message includes an easy way to unsubscribe, and you can also contact us at memberships.hq@xfclubs.com. Opting out of marketing will not stop essential service messages about your membership.
8. Cookies and similar technologies
Our website uses cookies and similar technologies. You can accept or reject non-essential cookies through our cookie banner and change your choice at any time. We use them in three groups:
- Strictly necessary — needed for the site to work and stay secure, including our hosting and security provider (Cloudflare) and remembering your cookie choices. These are always on.
- Analytics — help us understand how the site is used so we can improve it (Google Analytics). Set only with your consent.
- Advertising — let us measure and tailor our advertising on Google, Meta (Facebook and Instagram) and TikTok. Set only with your consent.
9. Who we share your data with
We do not sell your personal data. We share it only with trusted providers who process it on our behalf under a contract, and where we are legally required to. These include:
- Membership, booking and sales platforms — Glofox (Manchester and Liverpool), Resamania (Merry Hill) and our enquiry and tour-booking system.
- Payment and Direct Debit providers who collect your membership payments.
- IT, hosting, email and website providers — including Cloudflare, IONOS and Microsoft 365.
- Analytics and advertising partners, where you have consented — Google, Meta (Facebook and Instagram) and TikTok.
- Professional advisers, and law enforcement or regulators where required by law.
10. International transfers
We keep your personal data in the UK and do not routinely transfer it overseas ourselves. Some of the third-party tools we use — for example analytics and advertising services (Google, Meta and TikTok) — may process data outside the UK. Where that happens, the transfer is protected by an approved safeguard, such as UK adequacy regulations or the International Data Transfer Agreement with Standard Contractual Clauses.
11. How long we keep your data
We keep personal data only for as long as we need it for the purposes above, then delete or anonymise it. In general:
- Membership and account records — kept indefinitely, so we hold an accurate record of your membership history with us.
- Enquiries and prospects who do not join — 2 years.
- CCTV — 30 days. Marketing consent records — until you withdraw consent, plus a short period to evidence it.
12. How we protect your data
We use appropriate technical and organisational measures to keep your data secure, including access controls, encryption in transit, vetting of our providers and staff training. No system is perfectly secure, but we work to protect your data and to respond quickly if anything goes wrong.
13. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your data (this notice);
- request a copy of your data (a "subject access request");
- have inaccurate data corrected;
- ask us to erase your data in certain circumstances;
- restrict or object to our use of your data, including for direct marketing;
- data portability, where the basis is consent or contract;
- withdraw consent at any time, where we rely on it.
To exercise any of these rights, contact us at memberships.hq@xfclubs.com. We will respond within one month. There is usually no charge.
14. Age and children
Anyone can view this website, whatever their age. XF membership, however, is for adults: you must be 18 or over to sign up. We do not knowingly collect personal data to sign anyone up unless they are 18 or over. If we become aware that someone under 18 has submitted membership or sign-up details, we will delete them. If you believe a child has given us their personal data, please contact us and we will remove it.
15. Changes to this notice
We may update this notice from time to time. The "last updated" date at the top shows when it last changed. Where changes are significant, we will tell members directly.
16. Contact and complaints
If you have any questions, or want to exercise your rights, contact us at memberships.hq@xfclubs.com or write to XTRAFIT 1 Limited, Henwood House, Henwood, Ashford, Kent TN24 8DH.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office (ICO), though we would appreciate the chance to put things right first. ICO: ico.org.uk/make-a-complaint · helpline 0303 123 1113.