Privacy Policy

At GymCert Academy, we are committed to protecting your personal data and respecting your privacy. This policy explains how we collect, use, store and protect your information when you use our website at gymcert.co.uk or enquire about or enrol on our courses.

Please read this policy carefully. By using our website or submitting your details to us, you agree to the practices described in this document.

Who We Are

GymCert Academy is a UK-based fitness education provider offering CIMSPA-endorsed Level 2 and Level 3 personal training qualifications. We are the data controller responsible for your personal data.

What Data We Collect

We may collect the following personal information from you:

• Your name and surname
• Your email address
• Your phone number
• The course you are interested in or enrolled on
• Any messages or queries you submit via our enquiry form
• Payment information (processed securely by our third-party payment providers — we do not store card details)

We also collect anonymised technical data about how you use our website (such as pages visited and device type) for analytics purposes.

How We Use Your Data

We use your personal data for the following purposes:

• To respond to your enquiry and provide course information
• To process your enrolment and manage your student account
• To communicate with you about your course, progress and assessments
• To send you relevant updates, offers or information about our courses (you can opt out at any time)
• To process payments for course enrolment
• To comply with our legal and regulatory obligations as an accredited education provider

Legal Basis for Processing

We process your personal data under the following legal bases under UK GDPR:

• Contract — processing is necessary to fulfil our obligations to you as a student or prospective student
• Legitimate interests — to respond to enquiries and improve our services
• Consent — where you have explicitly agreed to receive marketing communications from us
• Legal obligation — where we are required to process data to comply with applicable law

Who We Share Your Data With

We do not sell your personal data to third parties. We may share your information with the following trusted partners solely to deliver our services:

• Focus Awards — our awarding body, for qualification registration and certification purposes
• CIMSPA — for qualification recognition and membership purposes
• Supabase — the database underlying our own customer records system, where enquiry and enrolment records are stored
• Vercel — hosting provider for our customer records system
• IONOS — hosting provider for our website, and provider of our website visitor statistics
• Moodle — our online learning platform where course materials are hosted
• Stripe — our payment processor for secure transaction handling
• Klarna — where you choose to pay using Klarna, they act as their own data controller under their own privacy policy
• Resend — used to send transactional and notification emails
• WhatsApp (Meta) — where you choose to contact us by WhatsApp

All third-party providers are required to handle your data in accordance with UK GDPR.

How Long We Keep Your Data

We retain your personal data for as long as is necessary to fulfil the purposes outlined in this policy. Specifically:

• Enquiry data is retained for up to 2 years from your last contact with us
• Student records are retained for a minimum of 6 years following course completion, as required by our awarding body
• Payment records are retained for 7 years in line with HMRC requirements

After these periods, your data will be securely deleted or anonymised.

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right to access — you can request a copy of the personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate or incomplete data
• Right to erasure — you can ask us to delete your data in certain circumstances
• Right to restrict processing — you can ask us to limit how we use your data
• Right to data portability — you can request your data in a structured, machine-readable format
• Right to object — you can object to us processing your data for marketing purposes at any time

To exercise any of these rights, please contact us at . We will respond within 30 days.

Cookies

Our website uses essential cookies to ensure it functions correctly. We do not use advertising cookies and we do not sell data to advertisers.

We use IONOS SiteAnalytics to understand how our website is used — for example which pages are visited and which devices are used. This produces aggregated statistics and is not used to build a profile of you or to target advertising at you.

Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our website uses HTTPS encryption and your payment details are handled exclusively by our PCI-compliant payment providers — we never store card details on our systems.

Automated Decisions & Transfers

We do not make any decision about you based solely on automated processing, and we do not use profiling.

Our suppliers may process your data outside the UK. Where they do, we rely on the UK Government's adequacy regulations or on the International Data Transfer Agreement to ensure your data receives an equivalent level of protection.

Our Terms & Conditions

This policy sits alongside our Terms & Conditions, which govern enrolment on our courses, pricing and payment, and your right to cancel.

Changes to This Policy

We may update this privacy policy from time to time. The most current version will always be available at gymcert.co.uk/privacy-policy.html. We encourage you to review it periodically.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK's data protection regulator:

We would appreciate the opportunity to address your concerns directly before you contact the ICO — please reach out to us at first.