01. Who is responsible
Bison Strength & Fitness and TeamBison are trading names of Bison Strength and Fitness Limited, the controller responsible for deciding how customer information is used for our business.
Company number: 12293974
Registered office and postal correspondence: Office 6 7 - 11 High Street, Reigate, Surrey, United Kingdom, RH2 9AA.
Privacy contact: Adam Rice.
Email: info@bisonstrengthfitness.com — please put “Privacy” in the subject.
Gym: Smithers Farm, A281 Guildford Road, Rudgwick, West Sussex, RH12 3BX.
This notice covers website visitors, enquiries, purchasers, coaching clients, in-person youth participants and their parents or guardians. It applies to Personal Training, Hybrid, Online Coaching, Programming+, Nutrition+ and the 50-Day Fat Loss Academy.
02. Information we handle
- Enquiries and bookings: name, contact details, interests, questions, appointments and correspondence.
- Customer accounts: login identifiers, service selection, subscription status, onboarding responses and support requests. Authentication credentials are handled through the account system; do not send passwords to a coach.
- Training and nutrition: goals, exercise history, workouts, attendance, check-ins, food or macro entries, hydration, measurements, weight and progress records, where relevant to your plan.
- Health and safety: screening answers, relevant conditions, injuries, medication, pregnancy information, restrictions and incident records. Some fitness entries or photos may also reveal health information.
- Payments: order, invoice, transaction, refund and subscription information. Card details entered at Stripe are handled by Stripe; we do not ask you to send full card numbers or security codes.
- Optional content: progress photos, testimonials, community posts and any evidence you choose to submit for challenges.
- Technical records: IP address, device/browser information, access times, security and error logs, and storage or tracking information as described in section 8.
- Youth and emergency contacts: participant age where needed, guardian contact details, permissions and relevant emergency contacts.
We receive information directly from you, from a guardian where appropriate, from your coach’s records and from the platforms used for bookings, purchases and service delivery. If you give us another person’s details, tell them why and share this notice.
We request information relevant to your service. Payment and essential contact details are needed to administer purchases. Required safety information may be necessary to assess whether we can safely coach you. Optional publicity consent is never a condition of coaching.
03. Why we use it
The following table explains our purposes and Article 6 lawful bases. Health information also needs the separate condition in section 4.
| Purpose | Lawful basis |
|---|---|
| Respond to a service enquiry, arrange a consultation, deliver the purchased plan and manage your account | Contract, including steps you request before a contract |
| Take payments and manage subscriptions | Contract; legal obligation for required accounting records |
| Maintain security, prevent misuse, investigate complaints and establish or defend claims | Legitimate interests in protecting customers and running a safe business; legal obligation where applicable |
| Optional marketing and identifiable publicity | Consent |
| Manage a child’s participation where the guardian holds the contract | Contract for guardian information; legitimate interests in safe, appropriate delivery for the child’s information, with additional health-data safeguards |
Where relying on legitimate interests, we assess necessity and balance our interests against your rights. You may object. A privacy notice explains processing; accepting it does not create blanket consent.
04. Health information & consent
Health information is special category data. Contract necessity alone is not sufficient to process it. For routine coaching health data, we obtain explicit consent as the additional Article 9 condition, alongside the relevant Article 6 basis.
Before collecting it, we explain the particular information, purpose and recipients and request a separate, clear consent statement. You can withdraw that consent by emailing us. Withdrawal does not undo earlier lawful processing. We discuss what support can continue safely without that information; it does not automatically remove your cancellation or refund rights.
Limited retention or disclosure for legal claims may rely on the applicable legal-claims condition. In a genuine emergency, vital interests may apply where the legal requirements are met. We do not treat ordinary coaching as a medical-care exemption.
05. Who receives information
Authorised coaches and administrative staff receive information needed for their role. We also use the following platforms, used for our website, accounts, communication and coaching services.
| Provider | Role / information involved |
|---|---|
| Wix | Main website, technical visitor information and any Wix-managed forms or accounts |
| ChatGPT Sites / OpenAI | Hosted public pages and technical visitor information; any connected enquiry route must be mapped separately |
| Vercel | Hosting the coaching application, requests and technical logs |
| Supabase | Authentication, customer accounts and the coaching records stored in the application |
| Stripe | Payments, customer billing details and subscription records |
| Calendly | Consultation and coach-call booking details |
| Resend | Transactional and service emails, recipient details and delivery records |
| Systeme.io | Enquiry follow-up and permitted email campaigns, contact details and preferences |
| BridgeAthletic | Training delivery, accounts and relevant exercise/progress information |
| Tally | Responses to the specific forms used for onboarding or check-ins |
Not every provider receives every category of information. A provider may act on our instructions or as a separate controller for certain activities, such as its own security or regulatory obligations. Our use of a provider does not remove our responsibility for the information we control.
We may disclose necessary information to professional advisers, insurers, authorities or emergency services where justified. We do not sell personal information. Publicity or community disclosure is handled separately below.
06. Processing outside the UK
Our service providers operate internationally. Personal information may be processed outside the UK for hosting, payments, support or service delivery. A database’s selected hosting region does not necessarily limit every supplier’s support or subprocessor access.
Provider-published arrangements include:
- Wix: processing in Israel and worldwide Wix entities and subprocessors, including the United States, EEA, India and other locations listed in its subprocessor register.
- Stripe: international processing under its data processing and transfer terms, including the UK Extension to the Data Privacy Framework and the UK Addendum where applicable.
- OpenAI: international processing as described in its privacy notice, using applicable adequacy regulations or contractual safeguards.
- Supabase: project hosting locations and international processing covered by its data processing addendum. The configured region and applicable subprocessors depend on the service used.
For restricted transfers, the applicable arrangement must provide a lawful UK transfer mechanism, such as adequacy regulations or appropriate contractual safeguards, with any required data protection test. Safeguards available from a provider are not a statement that every possible configuration has been independently audited.
Contact us for information about a particular provider’s processing locations and applicable safeguards, or a copy of relevant safeguards with confidential details redacted where necessary.
07. Service messages, marketing & publicity
Appointment confirmations, invoices, password/account messages and coaching communications are part of administering your enquiry or service. They are different from optional promotions.
We use a consent-based approach for promotional emails, texts or similar messages. Refusing marketing does not stop you making an enquiry or purchasing coaching. Unsubscribe in a message or email us to stop marketing; necessary service messages may continue.
We keep a limited suppression record so that an unsubscribe is respected. We do not use health information to target marketing without a separately assessed basis and the required explicit consent.
Identifiable transformation photos, results and testimonials need separate permission specifying the channels and purpose. Publicity is optional. You can withdraw permission for future consent-based use; we explain removal from channels we control and any limits involving printed material or independent third-party sharing.
09. How long information is kept
We retain identifiable information only while needed for its purpose, then delete or genuinely anonymise it. Retention depends on the record and its purpose, as set out below; it is not the same for every category.
| Record | Retention criterion |
|---|---|
| Enquiries that do not become clients | Until follow-up is complete, plus a justified short review period |
| Accounts, coaching and health records | Active service, then only the necessary records for documented insurance, safeguarding or claim requirements; youth records considered separately |
| Invoices and transactions | The applicable tax/accounting record period confirmed with our accountant |
| Marketing preferences | Until withdrawal or inactivity review; limited suppression records retained to honour objections |
| Publicity material | For the agreed use period, reviewed when consent is withdrawn |
| Security logs, backups and complaints | The shortest operationally justified period, with documented incident or legal holds where needed |
10. Keeping information secure
We take reasonable steps to protect personal information, including restricting access to people who need it and using password-protected systems and appropriate service providers. The level of protection must reflect the sensitivity of the information involved.
Tell us promptly if you suspect unauthorised access or receive a message that exposes someone else’s information. No system offers absolute security. We assess incidents and make any legally required notifications.
11. Youth coaching & community content
Under-18 services are in-person only. We collect relevant participant and guardian information to arrange sessions, assess safe participation and manage safeguarding. We provide information in language appropriate for the child and involve guardians as appropriate.
The correct person to provide consent or exercise rights depends on the child’s understanding, parental responsibility, circumstances and interests. A guardian’s permission to attend is not blanket permission to process or publish every type of data. Photos and promotional use require separate consideration and permission.
Where a service offers community posts, challenges or leaderboards, the audience must be clear before posting. Avoid sharing private health information there. Information deliberately posted to a group can be seen by its members; tell us about unwanted disclosure.
12. Scores, targets & automated features
Where included in your service, coaching tools calculate progress scores, suggested nutrition targets or programme progression from entries such as weight, logged training, nutrition and check-in completion. These calculations personalise the guidance or progress information you see and may involve health-related information.
A score reflects the information entered and the rules used by that feature; incomplete or inaccurate entries can affect the result. Contact your coach to correct information, question a target or ask how a calculation works. Do not treat an automated target as medical advice.
If processing involves a solely automated decision with legal or similarly significant effects, applicable data protection safeguards and rights apply. Contact our privacy contact with any concern about an automated feature or its impact.
13. Your data protection rights
Depending on the processing and applicable exceptions, you may ask for access and a copy, correction, erasure, restriction or portability. You can withdraw consent without affecting earlier lawful processing, and may have rights concerning significant automated decisions.
You can object to processing based on legitimate interests. You have an absolute right to object to the use of your information for direct marketing.
Email our privacy contact to make a request. We may ask for proportionate identity checks. We normally respond without undue delay and within one calendar month, subject to lawful timing rules, clarification or permitted extensions. If an extension or exception applies, we explain it.
Rights are not all unconditional. Some records may need to remain for legal obligations or claims. Withdrawing health-data consent may affect the support we can safely deliver, which we discuss with you.
14. Complaints & policy updates
If you are concerned about our handling of personal information, email our privacy contact with the details. We provide a clear complaint route, acknowledge within 30 days, investigate appropriately and communicate the outcome without undue delay. We keep you informed if more time is needed.
You also have the right to complain to the Information Commissioner’s Office (ICO). Contacting us first can help resolve an issue, but does not remove that right.
We update this notice when our processing changes and communicate material changes as appropriate. A policy update does not itself authorise a new purpose, replace consent or change your contract.