Privacy notice
Last updated: 20 September 2026 · Draft (not yet formally published — see notes below where confirmation is still required)
This notice explains how Box Boiler Gym collects and uses personal information when you visit our website, contact us, create an account, book classes or events, or manage a membership.
Who we are
Box Boiler Gym is operated by BOILER ROOM PROJECT LTD, trading as Box Boiler Gym. We are responsible for deciding how your personal information is used (the controller).
Business address: 121 Westgate, Wakefield, United Kingdom, WF1 1EW
Privacy enquiries:
admin@boxboilergym.co.uk
Information we collect
Depending on how you use our services, we collect:
- Contact information: name, email address and telephone number where you provide them (for example on registration or event ticket checkout).
- Account information: login credentials (password stored as a hash), account role/status, email verification state, optional marketing preference, and related security settings for staff accounts (such as multi-factor authentication).
- Booking and membership information: class bookings, event ticket orders (including quantity and any ticket category choices), membership and pack purchases, cancellations and related status fields.
- Transaction information: amounts, currency, payment status, Stripe session/payment/subscription references and similar records needed to fulfil or support a payment.
- Communications: emails we send you (booking confirmations, password resets, verification and account setup messages). Our systems may keep an internal email delivery log including recipient, subject and message content for troubleshooting.
- Technical and security information: IP address used for rate-limiting and abuse prevention, request timing via hosting logs, and session identifiers needed to keep you signed in and protect forms.
We receive information directly from you. We also receive payment and subscription updates from Stripe (for example payment status and subscription lifecycle events via webhooks).
This website does not collect health questionnaires, injury details, emergency contacts, dates of birth, children’s ages, photographs uploaded by you, or CCTV footage. Those topics are only relevant if the gym handles them offline or by other means — see Offline and special-category information.
How and why we use your information
| Purpose | Legal basis |
|---|---|
| Create and manage accounts, memberships, class bookings and event tickets | Steps at your request before a contract, or performing our contract with you (UK GDPR Article 6(1)(b)) |
| Process payments and manage subscriptions, cancellations and applicable refunds | Performing our contract with you (Article 6(1)(b)) |
| Send booking confirmations, verification links, password resets and other essential service messages | Performing our contract with you (Article 6(1)(b)); these are not marketing |
| Answer enquiries about joining or booking (including when you email us) | Steps at your request before a contract (Article 6(1)(b)), or legitimate interests in responding to you (Article 6(1)(f)) |
| Handle complaints, disputes and support | Legitimate interests in supporting customers and resolving issues (Article 6(1)(f)); legal obligations where applicable (Article 6(1)(c)) |
| Protect accounts, prevent misuse, rate-limit abuse and investigate security problems | Legitimate interests in operating a safe and reliable service (Article 6(1)(f)) |
| Keep records needed for accounting and tax | Compliance with legal obligations (Article 6(1)(c)) |
| Optional gym news and offers by email (only if you opt in) | Consent (Article 6(1)(a)); you can withdraw at any time |
Where we rely on legitimate interests, we use only what is needed for that purpose (for example security rate-limits or answering a support email) and we consider your privacy rights. You can object — see Your privacy rights.
Marketing and service messages
When you create an account you may optionally tick to receive occasional gym news and offers by email. That box is unchecked by default. Creating an account or booking does not by itself count as consent to marketing.
Your marketing preference is stored on your account. Essential service messages (for example ticket confirmations, password resets and email verification) are sent because they are needed to provide the service — they are separate from marketing and are not controlled by the marketing tick-box.
To withdraw marketing consent or ask us to update your preference, email admin@boxboilergym.co.uk (there is not yet an in-account marketing toggle on the website).
Information needed to provide our services
Some information is necessary to create your account, fulfil a booking or process payment. Where a field is required, the form marks it as required (for example name and email on registration and event checkout; password on registration).
If you do not provide required information, we may be unable to provide the requested service. Optional fields (such as phone number and marketing preference) are identified separately.
Payments
Payments are handled through Stripe Checkout. When you proceed to payment, you are redirected to Stripe to enter your payment information. Card details are entered on Stripe’s pages; this website does not embed Stripe’s card fields via Stripe.js on the public pages checked in our cookie inventory.
We receive information needed to manage your payment, booking or subscription, including transaction references, amounts and payment or subscription status (including webhook updates from Stripe).
Stripe’s use of personal information is explained in its Privacy Policy and related data processing terms.
Who can access your information
Access within the gym is limited to people who need information to carry out their responsibilities (for example staff using the admin tools to manage bookings, members or email delivery).
We also use service providers to support our website and operations:
- Website hosting and technical support — the site runs on shared web hosting for this domain (application and database hosting).
- Email delivery — transactional email is sent using the gym’s configured SMTP settings (TLS). If SMTP is unavailable, the hosting server’s mail function may be used as a fallback.
- Stripe — payments, Checkout, subscriptions and related webhooks.
Display fonts (Bebas Neue and Barlow Condensed) are served from this website’s own files. We do not load fonts from Google’s font CDN.
We may disclose relevant information where required by law or where necessary to establish, exercise or defend legal claims. We do not sell your personal information.
International processing
Some processing involves organisations that operate outside the United Kingdom. In particular:
- Stripe may process payment-related personal data in the United States and other countries. Stripe describes the safeguards it uses (including standard contractual clauses and, where applicable, frameworks such as the UK extension to the EU–US Data Privacy Framework) in its privacy and data-processing materials linked above. You can ask us for more information about the safeguards that apply to our use of Stripe, or review Stripe’s published documentation.
- Hosting and SMTP for this website are configured on the gym’s hosting/email infrastructure. The exact geographic location of every server and backup copy is not fully verified from the application code; do not assume that all copies remain in the UK. See owner confirmation questions for hosting location and backup geography.
How long we keep information
We keep personal information for the purposes described in this notice. The website does not currently run an automated job that deletes customer accounts, bookings, payments or email logs on a fixed timetable. Short-lived security tokens and rate-limit windows are an exception (see below). Fixed business retention periods (for example for tax) still need gym confirmation.
| Information | Retention period or criteria (current practice) |
|---|---|
| Account and membership records | Kept in the live database while the account/membership is used to provide the service. There is no self-service “delete my account” feature and no automated purge of closed accounts in the application today. Target period after closure: awaiting gym confirmation. |
| Class and event booking records | Kept as operational and financial history linked to your account or event order. No automated booking deletion job in the application today. Target period: awaiting gym confirmation. |
| Payment and accounting records | Payment references, amounts and statuses are kept to fulfil purchases and support disputes/accounting. No automated financial-record purge in the application today. Statutory/accounting period (for example Companies House / HMRC expectations): awaiting gym confirmation. |
| Email delivery log | Internal log may include full message content for troubleshooting deliverability. No automated purge of this log in the application today. Target period: awaiting gym confirmation. |
| Enquiries by email | Kept as needed to handle your enquiry and any follow-up. Target period after resolution: awaiting gym confirmation. |
| Security tokens (password reset, email verify, account setup) | Single-use hashed tokens with coded expiry (for example password reset typically 2 hours; email verification typically 48 hours; some admin-triggered links longer). Expired or used tokens are not reused. |
| Rate-limit / abuse-prevention records | Short windows keyed by IP and/or email; older windows are cleaned on a best-effort basis by the application. |
| Session cookie / server session | Browser session cookie for the site session id; server-side session lifetime follows the host PHP session settings (see the cookies & browser storage page). |
| Backup copies | Backups are controlled through the hosting control panel. Schedule, encryption and off-site retention are not verified from the application filesystem. Confirm in the hosting panel. |
Relevant records may be retained longer where needed for an ongoing complaint, dispute or legal obligation.
Cookies and browser storage
Our website uses cookies and similar browser storage. Details of each item, how we classify it, and controls (including objecting to display preferences) are on our Cookies & browser storage page.
In summary: a session cookie is used as strictly necessary for login and form security; optional display preferences (remembering that you closed a notice or popup) use the appearance exception with an objection control on that page; fonts are served from this website; payments use Stripe Checkout on Stripe’s pages. We do not load advertising or analytics scripts in the application code. If non-exempt tracking is added later, it must not run until valid consent is obtained.
Offline and special-category information
The website application does not provide forms for health information, injuries, emergency contacts, children’s details, member photographs or CCTV. Website code alone cannot establish what the gym collects on paper, in person, by messaging apps or via premises CCTV.
If the gym processes special category data such as health information, UK GDPR requires both an Article 6 lawful basis and an additional Article 9 condition. A membership or booking contract does not automatically cover health data, and simply providing this privacy notice is not explicit consent for health data.
Awaiting gym confirmation: whether health questionnaires, injury notes, emergency contacts, children’s information, CCTV, photographs or significant automated decisions are used offline (or elsewhere). Until confirmed, this notice only covers the website and payment flows described above.
Protecting your information
We use technical and organisational measures designed to protect personal information against unauthorised access, loss and misuse (for example hashed passwords, HTTPS where configured, CSRF protection on forms, rate limits, and staff multi-factor authentication where enabled).
No online service can guarantee complete security. Please keep your login details private and contact us if you suspect someone has accessed your account without permission.
Your privacy rights
Depending on the circumstances and the legal basis for using your information, you may have the right to:
- Request access to your personal information.
- Have inaccurate or incomplete information corrected.
- Request deletion of your information.
- Restrict how your information is used.
- Receive certain information in a portable format.
Where we rely on consent (including marketing), you can withdraw it at any time by contacting us. Withdrawal does not affect processing that was lawful before you withdrew consent.
Your right to object
You can object to processing based on legitimate interests on grounds relating to your particular situation. You can object to the use of your information for direct marketing at any time.
To exercise your rights, email admin@boxboilergym.co.uk. We may need to verify your identity before responding. If a request cannot be fulfilled in full, we will explain why. Note that some deletion requests may be limited while we still need records for a contract, dispute or legal obligation, and the website does not yet offer automated account erasure.
Questions and complaints
Please contact us at admin@boxboilergym.co.uk if you have a concern about how we use your information.
You can also raise a complaint with the UK’s Information Commissioner’s Office through ico.org.uk/make-a-complaint.
Changes to this notice
We may update this notice when our services or information-handling practices change. The latest version will appear on this page with an updated date. Where appropriate, we will bring significant changes to your attention.