How EWF Fit looks after your information
Privacy notice. Last updated 9 October 2026.
This page explains what information we keep about you, why, who else sees it, how long we keep it and what you can ask us to do. It covers everyone: people who ask about a class or a programme, members, people on the 6 Week Transformation, teens who train with us and their parents, and visitors to this website.
We have written it in plain words on purpose. If anything is unclear, ask us: info@ewfma.com.
1. Who we are
EWF Fit is the trading name of EWF Fit Market Harborough Ltd, company number 13387104, Unit 7 St Marys Business Park, Albany Road, Market Harborough, LE16 7QJ. We are the company responsible for your information (the law calls this the "controller"). We are registered with the Information Commissioner's Office (the ICO, the UK's data regulator), reference ZC268661.
The person in charge of data protection at EWF Fit is the owner, Amir Khorsan. Contact us by email at info@ewfma.com, by phone on 07480 773554, or by post at the address above.
2. The short version
- We keep the details you give us and a record of your training and payments.
- We use them to run your classes, keep you safe, take payments and talk to you about your training.
- Health details are only ever used to keep you safe, and only because you agreed to tell us.
- We never sell your information. We share it only with the companies that run our systems for us.
- Some of those companies are in the United States. We use the legal safeguards the UK allows for that.
- You can ask for a copy, a correction or a deletion at any time, and we will answer within a month.
- An AI assistant may reply to your first messages. You can always ask for a person.
3. What we collect
If you ask about a class or a programme (on this website, a Facebook or Instagram form, by message, by phone or in person): your name, phone number, email, what you asked about, what you tell us about your goals, and the messages between us.
If you join as a member or on a programme: everything above, plus your address, date of birth, emergency contact, how you pay (we never see or keep your card number: the payment companies keep that), your membership and payments, which classes you book and attend, and any notes your coach makes about your training.
Health information: injuries, medical conditions, medication and anything else you tell us on a health questionnaire or in a consultation, so your coaches can train you safely.
On the 6 Week Transformation or one-to-one coaching: your weight, measurements, progress photos, meal and check-in photos, your plan and targets, and messages with your coach. These sit in our own coaching app.
Teens (under 18): a parent or guardian gives us the teen's name, date of birth, any medical notes and their own contact details. We only collect a young person's information from the adult responsible for them.
On this website: how the site is used (pages visited, device, rough location from your internet address) through Google Analytics, and whether you came from one of our adverts, through Meta (Facebook) tools. Only if you say yes on the cookie banner. See section 12.
CCTV: the gym has CCTV cameras, signed at the entrance, for the safety of everyone training and to prevent crime. Recordings are kept for 30 days unless we need to keep one for an incident.
4. Why we use it, and the legal reason
The law says we need a reason from a fixed list for each use. Here is ours.
| What we do | Why | The legal reason |
|---|---|---|
| Reply to your enquiry, offer and book a free session or consultation, send you what you asked for | You asked us to | Steps you asked for before joining |
| Follow up an enquiry that went quiet | So you get an answer and a chance to come in | Our legitimate interest in running the business, balanced against yours. You can tell us to stop at any time |
| Run your membership, classes, bookings and payments | It is what you signed up for | Our contract with you |
| Keep health notes and act on them | To keep you safe in training | Your explicit agreement, and protecting your health |
| Coach you on a programme: plans, check-ins, weights, photos | It is the programme you joined | Our contract with you, and your explicit agreement for the health and body information |
| Send news, offers and reminders by text, WhatsApp or email | So you hear about events, courses and offers | Your consent, which you can withdraw with one reply ("STOP") or click. Members may also hear about similar services from us unless they opt out |
| Keep records of payments and contracts | The tax authorities require it | Legal obligation |
| Give our coaches a daily list of who is booked in, who has not been seen for a while, and who has a payment problem | So we look after members properly | Our legitimate interest in running the business well |
| Let an AI assistant answer first messages and book free sessions (section 7) | So you get a quick answer any time of day | Our legitimate interest in answering quickly. A person is always available |
| Measure this website and our adverts | To see what works and to spend ad money sensibly | Your consent (cookies), see section 12 |
| CCTV | Safety and crime prevention | Our legitimate interest |
| Respond to complaints, legal claims or the police | We have to | Legal obligation, or our legitimate interest in defending claims |
"Legitimate interest" means a normal business reason that does not override your rights. If you think one of ours does, you can object (section 11).
5. Health information
Health details are "special category" information and get extra protection. We:
- ask for them only so coaches can train you safely,
- rely on your explicit agreement, which you give when you fill in the health questions or the consent screen in the coaching app,
- show them only to the coaches who need them,
- never use them for marketing,
- delete them when you leave (section 9), unless we need them for an open injury claim.
You can withdraw your agreement at any time by telling us. If you do, we may not be able to let you train, because we cannot keep you safe without knowing about an injury or condition.
6. Under 18s
For anyone under 18 (for example CrossFit Teens):
- the parent or guardian gives the information and the agreements in this notice,
- we talk to the parent about enquiries, bookings and payments,
- we never market directly to a young person,
- photos and videos for social media or this website are only used with the parent's separate permission, asked for separately and never assumed,
- a parent can ask to see, correct or delete the young person's information at any time.
7. AI assistants
We use an AI assistant to help answer messages. When you first message us, or ask through an advert, the assistant may reply to your questions about classes, times and prices, offer and book a free introductory session or consultation, and send a reminder or a follow-up.
It cannot sign you up, take money or make any decision about you with a legal effect. It reads the message you send and your enquiry record to do this. The AI service we use does not use your messages to train its models, and deletes what it receives within 30 days. Our team can read any conversation, and you can ask for a person at any time: just say so.
We also use AI tools internally to help our coaches see their daily lists and reports. People, not the tools, make the decisions about members.
8. Who we share it with
We never sell your information and we never let other companies use it for their own marketing. We share it with the companies that run our systems for us (the law calls them "processors": they only act on our instructions and are bound by contract to protect your information):
| Company | What they do for us | Where your information is kept |
|---|---|---|
| TeamUp (TeamUp Sports, Inc., part of DaySmart Software) | Memberships, bookings, waivers and health questions, class timetable, payments | United States |
| GoHighLevel (HighLevel Inc.) | Enquiries, contact records, forms, text, WhatsApp and email messages, booking calendars | United States |
| Stripe | Card payments and payment plans (they keep your card details, we do not) | United States and Europe, through Stripe Payments UK Ltd |
| GoCardless | Direct debits for some memberships | United Kingdom |
| Cloudflare | Hosts this website, our forms and our own coaching app (your check-ins, photos and coach messages) | United States and Europe |
| Google (Workspace and Analytics) | Email, documents, some coaching spreadsheets, website statistics | United States and Europe |
| Meta (Facebook, Instagram, WhatsApp) | Lead forms on our adverts, the WhatsApp messages you send us, measuring adverts | United States |
Our team: your coaches and the owner.
Others, only when needed: our accountants (payment records only), insurers and lawyers if there is a claim, the police or a court if the law requires it, and a buyer if the business is ever sold (you would be told).
Where a company is outside the UK, we rely on the safeguards the UK allows: the UK's data transfer agreement (the "UK Addendum") built into our contract with them, or the company's listing on the UK Extension to the Data Privacy Framework. Payment card details go straight to Stripe or GoCardless and never touch our systems.
9. How long we keep it
| Information | How long |
|---|---|
| An enquiry that never joined | 2 years after the last message between us, then deleted |
| Membership details, bookings, attendance, contract | While you are a member, then 6 years (the time limit for tax records and legal claims) |
| Payments | 6 years after the end of the tax year they belong to |
| Health notes and questionnaires | While you train with us, deleted within 12 months of leaving, unless needed for an open injury claim |
| Programme check-ins, weights, measurements and photos | During the programme and for 12 months after, then deleted, unless you ask us to keep them or agree to another use |
| Messages (text, WhatsApp, email, app chat) | 2 years after the last message |
| CCTV | 30 days, unless kept for an incident |
| Marketing permission | Until you withdraw it. We check it is still wanted every 2 years |
When we delete, we also delete from the systems in section 8, except where a payment company must keep its own record by law.
10. How we keep it safe
- Our systems are protected with passwords, and only the people who need your information can see it.
- This website, our forms and the coaching app use encrypted connections (the padlock in your browser).
- The coaching app opens with a personal private link. Treat it like a password and do not share it. If you think someone else has it, tell your coach and we will give you a new one. The old one stops working at once.
- The companies in section 8 protect your information under written agreements with us.
- Paper forms are kept locked and shredded when no longer needed.
- If anything ever goes wrong with your information in a way that could harm you, we will tell you and the ICO.
11. Your rights
You can ask us, free of charge:
- for a copy of the information we hold about you,
- to correct anything that is wrong,
- to delete it (we will, unless we must keep it for tax or a legal claim, and we will tell you if so),
- to stop using it for a particular purpose, or to pause while we check something,
- to object to anything we do under "legitimate interest", including follow-ups and daily lists,
- to withdraw any consent you gave (health information, marketing, cookies, photos), without affecting what was done before,
- to receive the information you gave us in a file you can take elsewhere.
Email info@ewfma.com, message your coach, or write to the address in section 1. Tell us who you are and what you want. We reply within one month. If it is complicated we may take up to two more months, and we will tell you within the first month if so.
You are never asked to accept a decision made by a computer alone that has a legal or similarly serious effect on you.
12. Cookies and website tracking
This website uses:
- Essential cookies that make the site and its booking calendars work. These need no permission.
- Google Analytics, which counts visits and shows us which pages people use.
- The Meta pixel, which tells Facebook and Instagram when someone who saw our advert visited the site or sent an enquiry, so we can measure adverts and show them to the right people.
Google Analytics and the Meta pixel only run if you say yes on the cookie banner when you arrive. You can change your mind at any time: change your cookie choice, or clear the cookies in your browser. For the pixel, Meta and we are jointly responsible for collecting and sending the information, and Meta is then responsible for what it does with it. Meta's privacy policy (facebook.com/about/privacy) explains that and how to ask Meta about your information. If you ask us about pixel information, we pass your request to Meta within 7 days.
13. Marketing, and how to stop it
If you said yes to hearing from us, we may text, WhatsApp or email you about classes, courses, events and offers. Every message tells you how to stop: reply STOP to a text or WhatsApp, click "unsubscribe" in an email, or email info@ewfma.com. We stop at once. We will still send you the messages you need about your own bookings and membership.
14. How to complain
If you are unhappy about how we have handled your information, please tell us first so we can put it right. Email info@ewfma.com with the subject "Data complaint", write to the address in section 1, or tell any coach. We will acknowledge your complaint within 30 days (we aim for 3 working days) and tell you the outcome within a month.
You also have the right to complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, phone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, SK9 5AF.
15. Changes to this notice
We keep this notice under review and update it when something changes (for example a new system). The date at the top tells you when. If a change matters to you, we will tell you by email or in the app.