1. Who we are
This website is operated by XTRAFIT 1 Limited for XF Clubs, on behalf of itself and the other companies in the XF group (together, "XF", "we", "us", "our"). XTRAFIT 1 Limited is the data controller responsible for your personal data. XTRAFIT 1 Limited and XTRAFIT 2 Limited are registered in England and Wales, and their details are on the Companies House register.
- XTRAFIT 1 Limited: registered company number 12290108
- XTRAFIT 2 Limited: registered company number 12919298
- Registered office (both): Henwood House, Henwood, Ashford, Kent TN24 8DH
- ICO data-protection registration references: XTRAFIT 1 Limited, ZC218582; XTRAFIT 2 Limited, ZC218586
- Privacy contact: memberships.hq@xfclubs.com
2. What personal data we collect
Depending on how you interact with us, we may collect:
- Identity & contact data: name, date of birth, gender (where you provide it), email, phone number, postal address.
- Membership & account data: membership tier and club, start date, attendance and access records, class and facility bookings, membership history, member ID/photo where used for entry.
- Payment data: bank details for Direct Debit and billing records. Card and bank details are collected and processed by our payment providers; we do not store full card numbers ourselves.
- Health & fitness data: information you give us in a health commitment / pre-exercise questionnaire (PAR-Q), relevant medical conditions or injuries, and emergency contact details. This is "special category" data and is treated with extra care (see section 5).
- Images & CCTV: CCTV footage when you visit a club, and marketing photography or video where you have agreed to appear.
- Communications & preferences: messages you send us, enquiry and tour-booking details, reviews and feedback, and your marketing preferences.
- Technical & usage data: IP address, device and browser information, and how you use our website, collected through cookies and similar technologies (see section 8).
- Account credentials: the email address and the password you choose when you join through this website. That password creates your XF Clubs account and is the same one you use in the XF Clubs app. We pass it once to Glofox to create the account; we do not store it, log it or have any way to read it back.
- Acceptance records: when you accept the Studio Waiver and the Membership Terms and Conditions we record your account reference, the date and time, your IP address, your browser, and which version of each document you accepted. We keep this so we can show you what you agreed to.
3. How we collect it
- Directly from you: when you enquire, book a tour, register your interest, join, use our facilities, contact us, or enter a competition or promotion.
- When you join online: you enter your details on this website, choose a password, take a photo using your device camera, and accept the Studio Waiver and Membership Terms. Your photo is taken in your browser and sent straight to our membership platform. You can use an existing picture instead if your device has no camera.
- Automatically: when you use our website (cookies and analytics) or enter a club (access systems and CCTV).
- From third parties: our booking and sales platforms, payment providers, and analytics or advertising partners acting on our behalf.
4. How and why we use your data (and our lawful basis)
Set up and manage your membership and account; give you access to the clubs; take bookings
Data usedIdentity, contact, membership, account
Lawful basisPerformance of a contract
Collect payments and manage Direct Debits and billing
Data usedPayment, membership
Lawful basisPerformance of a contract; legal obligation (financial records)
Keep you safe and manage health and safety (PAR-Q, injuries, emergencies)
Data usedHealth & fitness, emergency contact
Lawful basisLegitimate interests (member safety); explicit consent for health data (see section 5)
Respond to enquiries, tour bookings and register-interest requests
Data usedIdentity, contact, communications
Lawful basisLegitimate interests; steps prior to entering a contract
Send you service messages (bookings, changes, safety notices)
Data usedIdentity, contact, membership
Lawful basisPerformance of a contract; legitimate interests
Marketing to existing members and prospects
Data usedContact, preferences, usage
Lawful basisConsent, and/or legitimate interests (existing members: "soft opt-in", see section 7)
Security, crime prevention and protecting people and property (CCTV)
Data usedCCTV images
Lawful basisLegitimate interests
Improve our website and understand how it is used
Data usedTechnical, usage
Lawful basisConsent (non-essential cookies)
Meet legal and regulatory obligations and handle disputes
Data usedAs relevant
Lawful basisLegal obligation; legitimate interests
Create your XF Clubs account when you join online, and confirm you are 18 or over
Data usedIdentity, contact, date of birth, account credentials, photo
Lawful basisPerformance of a contract, and steps taken at your request before entering it
Keep a record of the Studio Waiver and Membership Terms you accepted
Data usedAccount reference, date and time, IP address, browser, document version
Lawful basisLegitimate interests (being able to evidence what was agreed); legal obligation
5. Health & special category data
Information about your health (for example a medical condition, injury or the answers in a pre-exercise questionnaire) is "special category" data. We collect it only to help keep you safe while you train and to respond appropriately in an emergency. We rely on your explicit consent, and/or the condition in the Data Protection Act 2018 relating to health and safety, as confirmed on review. You can ask us to update this information at any time.
6. CCTV
Our clubs are monitored by CCTV for the safety and security of members, Crew and property. Cameras are positioned in communal and training areas and are signposted. Footage is retained for 30 days unless it is needed for an investigation or legal claim, and is only shared where lawful (for example with the police).
7. Marketing and your choices
We may send you news, offers and content by email, SMS or other channels. Where the law requires consent, we ask for it and you can withdraw it at any time. If you are already a member, we may contact you about similar services under the "soft opt-in", and you can opt out at any time. Every marketing message includes an easy way to unsubscribe, and you can also contact us at memberships.hq@xfclubs.com. Opting out of marketing will not stop essential service messages about your membership.
8. Cookies and similar technologies
Our website uses cookies and similar technologies. You can accept or reject non-essential cookies through our cookie banner and change your choice at any time. We use them in three groups:
- Strictly necessary: needed for the site to work and stay secure, including our hosting and security provider (Cloudflare) and remembering your cookie choices. These are always on.
- Analytics: help us understand how the site is used so we can improve it (Google Analytics). Set only with your consent.
- Advertising: let us measure and tailor our advertising on Google, Meta (Facebook and Instagram) and TikTok. Set only with your consent.
9. Who we share your data with
We do not sell your personal data. We share it only with trusted providers who process it on our behalf under a contract, and where we are legally required to. These include:
- Membership, booking and sales platforms: Glofox (Manchester and Liverpool), Resamania (Merry Hill) and our enquiry and tour-booking system.
- Payment and Direct Debit providers who collect your membership payments.
- IT, hosting, email and website providers: including Cloudflare, IONOS and Microsoft 365.
- Analytics and advertising partners, where you have consented: Google, Meta (Facebook and Instagram) and TikTok.
- Professional advisers, and law enforcement or regulators where required by law.
10. International transfers
We keep your personal data in the UK and do not routinely transfer it overseas ourselves. Some of the third-party tools we use, for example analytics and advertising services (Google, Meta and TikTok), may process data outside the UK. Where that happens, the transfer is protected by an approved safeguard, such as UK adequacy regulations or the International Data Transfer Agreement with Standard Contractual Clauses.
11. How long we keep your data
We keep personal data only for as long as we need it for the purposes above, then delete or anonymise it. In general:
- Membership and account records: kept indefinitely, so we hold an accurate record of your membership history with us.
- Enquiries and prospects who do not join: 2 years.
- CCTV: 30 days. Marketing consent records, until you withdraw consent, plus a short period to evidence it.
- Waiver and terms acceptance records: for the life of your membership and six years afterwards, matching the period in which a claim about the agreement could be brought. Evidencing what was agreed is the only reason we hold them.
12. How we protect your data
We use appropriate technical and organisational measures to keep your data secure, including access controls, encryption in transit, vetting of our providers and staff training. No system is perfectly secure, but we work to protect your data and to respond quickly if anything goes wrong.
When you join through this website, the password you choose is sent once over an encrypted connection to create your account on our membership platform. We do not store it, write it to any log, or keep any copy of it. Your card details are entered into a form hosted by our payment provider and never reach our website at all.
13. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your data (this notice);
- request a copy of your data (a "subject access request");
- have inaccurate data corrected;
- ask us to erase your data in certain circumstances;
- restrict or object to our use of your data, including for direct marketing;
- data portability, where the basis is consent or contract;
- withdraw consent at any time, where we rely on it.
To exercise any of these rights, contact us at memberships.hq@xfclubs.com. We will respond within one month. There is usually no charge.
14. Age and children
Anyone can view this website, whatever their age. XF membership, however, is for adults: you must be 18 or over to sign up. We do not knowingly collect personal data to sign anyone up unless they are 18 or over. If we become aware that someone under 18 has submitted membership or sign-up details, we will delete them. If you believe a child has given us their personal data, please contact us and we will remove it.
When you join online we ask for your date of birth and check it. Anyone under 18 cannot complete a membership on this website.
15. Changes to this notice
We may update this notice from time to time. The "last updated" date at the top shows when it last changed. Where changes are significant, we will tell members directly.
If you have any questions, or want to exercise your rights, contact us at memberships.hq@xfclubs.com or write to XTRAFIT 1 Limited, Henwood House, Henwood, Ashford, Kent TN24 8DH.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office (ICO), though we would appreciate the chance to put things right first. ICO: ico.org.uk/make-a-complaint · helpline 0303 123 1113.