Privacy Policy

A Little Gym (“we”, “us”, “our”) is a small neighbourhood strength gym in Kings Heath, Birmingham. This policy applies to the personal data we collect through this website, our chat assistant and our email communications. “Personal data” means any information that identifies you, or that relates to an identifiable person.

A Little Gym is run by its owners, Joshua Charles Preece and Jamal Ali, who are jointly responsible for your personal data (the “controllers”). You can reach us about anything in this policy — including to exercise your rights — by email at alittlegymkh@gmail.com, or by post at 21a York Road, Kings Heath, Birmingham, B14 7SZ.

We are the “controller” for your personal data under UK data protection law — the UK GDPR and the Data Protection Act 2018. We are not required to appoint a Data Protection Officer; please use the contact details above for any data protection query.

We only collect what we need to run the gym and respond to you. Depending on how you use A Little Gym, this may include the following — each with the “lawful basis” we rely on to use it:

• Enquiry data— your name, email address, phone number (if you give it), the service you’re interested in and your message, when you submit the enquiry form. Basis: your consent to join our mailing list, and our legitimate interests in responding to your enquiry.
• Studio-hire & personal-training enquiries — your name and phone number when you use the quick studio-hire or PT consultation forms. We use these only to call you back. Basis: taking steps at your request before entering a contract, and our legitimate interests.
• Chat assistant messages — the messages you send to our website chat assistant (see section 03). Basis: our legitimate interests in helping you.
• Technical data — your IP address and basic request information, used briefly to keep the site secure and stop abuse (for example, limiting how often a form can be submitted), plus standard server logs kept by our hosting provider. Basis: our legitimate interests in keeping the site secure and working.

We do not collect health data, and there is no account to create on this website.

Our website has a chat assistant that answers common questions about the gym. When you send it a message, your message is sent to our AI provider, Anthropic, which processes it to generate a reply. Anthropic does not use messages sent through its API to train its models, and we don’t store your conversation after it ends.

Please don’t type sensitive personal or health information into the chat — and note the assistant doesn’t give medical advice. Anthropic may process your message outside the UK (see section 06).

If you ask us to (by submitting the enquiry form), we’ll send you occasional news and offers by email, using our email provider Brevo. We rely on your consent, and you can unsubscribe at any time using the link in every email, or by emailing us — and we’ll stop.

A while after you get in touch (or, for existing members, from time to time) we may email you to ask whether you’d leave us a Google review. You can opt out the same way. We may also send you service messages (for example, replying to your enquiry) where we don’t need consent. We never sell your data or share it for anyone else’s marketing.

We share personal data only where necessary, and we require anyone who processes it on our behalf to protect it and use it only on our instructions. We may share data with:

• Service providers acting on our instructions — Brevo (email delivery and storing our contact list, EU), Anthropic (our chat assistant, US) and Hostinger (website hosting, UK/EU).
• Momence— when you click “Book” or “Buy”, you’re taken to Momence, a separate bookings and payments company with its own privacy policy and terms. They handle your booking and card payment; we never see or store your card details.
• Professional advisers such as our accountant, where needed.
• Authorities or regulators where we’re required to by law, or to protect our rights or someone’s safety.
• A buyer or successor if we sell or reorganise the business, with your data staying protected.

We never sell your personal data.

We keep your data in the UK or EU where we can. Brevo processes data in the EU(covered by UK “adequacy”) and Hostinger hosts in the UK/EU. Some providers — such as Anthropic— may process data outside the UK (for example, in the US). Where data goes to a country without UK “adequacy”, we rely on an appropriate safeguard — such as the UK’s International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework. You can ask us for more detail using the contact details in section 13.

• Enquiry & mailing-list contacts — until you unsubscribe or ask us to remove you, after which we delete or anonymise your details within 30 days.
• Studio-hire & PT call-back enquiries — kept only as long as we need to deal with your enquiry, then deleted.
• Chat assistant messages — not kept after your conversation ends.

We don’t hold any payment or card records — Momence keeps those under its own policy.

We use appropriate technical and organisational measures — including encryption in transit (HTTPS), limiting access to those who need it, and using reputable providers — to protect your personal data against unauthorised access, loss or misuse. No method of transmission or storage is completely secure, but we work hard to protect your data and will notify you and the ICO of a breach where we’re legally required to.

Our website is deliberately light on cookies. We don’t use analytics, advertising or tracking cookies, and we don’t show a cookie banner because we don’t set any non-essential cookies. Your browser may still use strictly necessary storage to load the site and keep it secure; this doesn’t identify you and doesn’t need your consent. If we ever add analytics or tracking, we’ll ask for your consent first and list it here.

Under UK data protection law you have the following rights, free of charge in most cases:

• Access — get a copy of the data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data in certain circumstances.
• Restriction — ask us to limit how we use your data.
• Portability — receive certain data in a portable format.
• Object — object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent— where we rely on consent, withdraw it at any time (this won’t affect processing already carried out).

We don’t make decisions about you by solely automated means. To exercise any right, contact us using the details in section 13. We’ll respond within one month, and we may need to verify your identity first.

A Little Gym’s classes and training are for adults, and this website is aimed at people aged 18 and over. We don’t knowingly collect personal data from anyone under 18. If you believe a child has given us their data, please contact us and we’ll delete it.

We may update this policy from time to time to reflect changes in how we work or in the law. When we do, we’ll change the “last updated” date at the top and, where the changes are significant, we’ll tell you directly. Please check back from time to time.