1 Who we are
Surefit Gym (“Surefit”, “we”, “us” or “our”) operates fitness facilities, a membership platform and an online store. We are the data controller responsible for the personal information described in this policy.
Registered entity: [Insert registered business name & RC number]. Registered address: [Insert address]. We are committed to handling your personal data lawfully, fairly and transparently in line with the Nigeria Data Protection Act, 2023 (NDPA) and any other applicable data protection laws.
2 Scope of this policy
This policy applies to personal data we process when you:
- Register for, hold or manage a Surefit membership;
- Use the membership portal to manage your data, subscriptions and attendance;
- Make payments to us or set up recurring subscriptions;
- Enter our premises using the fingerprint (biometric) access system;
- Shop on our online store for gym wear and related products;
- Contact us, visit our website, or otherwise interact with our services.
It does not cover third-party websites or services we link to, which have their own privacy practices.
3 Information we collect
Account & registration data
Full name, date of birth, gender, photograph, email address, phone number, home or billing address, emergency contact details, and the username and password for your portal account.
Subscription & attendance data
Membership type and status, start and renewal dates, the gym location(s) you are registered to, class or session bookings, and check-in / attendance records generated each time you access a facility.
Payment & billing data
Transaction history, amounts, dates, payment method type and billing details. Card and bank details are processed by our regulated payment providers — we do not store full card numbers on our own systems. See Sharing & disclosure.
Biometric data
A fingerprint-derived template used solely to verify your identity at entry points. This is sensitive personal data and is handled with additional safeguards described in Section 4.
Health-related information
Where you provide it — for example a pre-exercise health questionnaire, injury notes or accessibility needs — we may collect limited health information to support your safety. Providing this is [optional / a condition of membership — confirm].
Store & purchase data
Orders, products purchased, sizes and preferences, delivery address and order communications.
Technical & usage data
Device and browser type, IP address, approximate location, log data, and how you interact with our website and portal, collected through cookies and similar technologies (see Section 12).
4 Biometric data & gym access
To enter the gym with an active subscription, you may enrol in our fingerprint access system. We take particular care with this information.
We collect and use your biometric data only with your explicit, informed consent, given at enrolment. You may decline biometric enrolment and request an alternative access method where available: [describe alternative — e.g. access card / front-desk check-in].
- What is stored: we store a mathematical template derived from your fingerprint, not an image of the fingerprint itself. The template cannot be used to reconstruct your fingerprint.
- Purpose: the template is used solely to confirm you are an active member when you scan to enter. It is not used for any other purpose.
- Storage & security: templates are encrypted [describe encryption / storage location — at rest and in transit] and access is strictly restricted.
- Retention: we delete your biometric template [insert period — e.g. within 30 days] after your membership ends or you withdraw consent.
- Withdrawing consent: you can withdraw biometric consent at any time via [insert channel]. We will delete your template and switch you to an alternative access method.
5 How we use your data
We use personal data to:
- Create and manage your membership and portal account;
- Verify identity and grant secure access to our facilities;
- Process payments, subscriptions, renewals and refunds;
- Maintain attendance records and provide them to you in your portal;
- Fulfil and deliver online store orders and handle returns;
- Provide customer support and respond to your enquiries;
- Keep our members, staff and premises safe;
- Send service messages, and — where permitted — marketing you can opt out of;
- Produce internal, aggregated reports to operate and improve our business;
- Comply with legal, tax, accounting and regulatory obligations;
- Detect, prevent and address fraud, abuse and security incidents.
We do not sell your personal data to anyone. We do not trade, rent or release your data to third parties for their own marketing.
6 Lawful basis for processing
Depending on the activity, we rely on one or more of the following lawful bases:
- Contract — to deliver the membership and services you sign up for;
- Consent — for biometric data, certain marketing, and optional features;
- Legal obligation — for tax, accounting and regulatory requirements;
- Legitimate interests — to run, secure and improve our business in a way that does not override your rights.
Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.
8 Online store
When you buy gym wear or other products from our store, we process your order, delivery and payment details to fulfil the purchase, handle returns or exchanges, and meet our record-keeping obligations. Order-related communications are part of providing the service. Marketing about new products is sent only where you have opted in, and you can opt out at any time.
9 Data retention
We keep personal data only as long as needed for the purposes set out here, or as required by law. Indicative periods:
- Membership & portal data — for the life of your membership and [insert period] afterwards;
- Biometric templates — deleted [insert period] after membership ends or consent is withdrawn;
- Payment & transaction records — [insert statutory period] for tax and accounting;
- Store orders — [insert period] for warranty, returns and records.
When data is no longer needed, we securely delete or anonymise it.
10 How we protect your data
We apply technical and organisational measures appropriate to the sensitivity of the data, including [encryption, access controls, secure hosting, staff training, audit logging — confirm specifics]. While we work hard to safeguard your information, no system can be guaranteed completely secure. If a data breach occurs that is likely to affect your rights, we will notify you and the relevant authority as required by law.
11 Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate or incomplete data;
- Request deletion of your data in certain circumstances;
- Object to or restrict certain processing;
- Withdraw consent, including biometric consent;
- Request a portable copy of data you provided to us;
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or other competent authority.
To exercise any right, contact us using Section 16. We may need to verify your identity and will respond within the timeframes required by law.
13 Children & minors
Our services are intended for members aged [insert minimum age] and above. Where membership for minors is permitted, registration, payment and biometric enrolment must be completed with verifiable consent from a parent or legal guardian. We do not knowingly collect data from children outside these arrangements, and will delete such data if discovered.
14 International transfers
Some of our service providers may process data outside Nigeria. Where this happens, we take steps to ensure your data receives an adequate level of protection through appropriate safeguards [describe — e.g. contractual safeguards / adequacy arrangements], consistent with the NDPA.
15 Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you through the portal or by email. Your continued use of our services after an update means you accept the revised policy.
16 Contact us
For any privacy question, to exercise your rights, or to reach our data protection contact:
- Email: [privacy@surefit...]
- Phone: [Insert phone]
- Address: [Insert address]
- Data Protection Officer / contact: [Insert name / role]
