Our Privacy Policy

This policy explains how New Fit Ltd, trading as Atrium Fitness, collects and uses personal information and the rights available to you under UK data protection law.

1. Who we are

New Fit Ltd, trading as Atrium Fitness, is the controller of the personal information described in this policy. This means we decide why and how that information is used.

New Fit Ltd is registered in England and Wales under company number 14791412. Our registered office is 39 Newnham Street, Ely, Cambridgeshire, CB7 4PQ.

We are registered with the Information Commissioner's Office under registration number ZB542559.

This policy applies to members, prospective members, guests, visitors and people who contact us or use our website, app, facilities or services.

2. Information we collect

Depending on your relationship with us, we may collect:

Identity and contact details, including your name, address, date of birth, telephone number and email address.

Membership information, including your membership plan, start and end dates, account status and membership photograph.

Usage information, including club entry records, class and appointment bookings, cancellations, attendance and use of services.

Payment and transaction information, including payment status, transaction references and limited payment details supplied by our payment providers. We do not normally hold complete card or bank account details.

Health and wellbeing information you choose or are required to provide, including health questionnaires, injuries, medical conditions, accessibility needs and information relevant to safe participation.

Emergency contact details.

Communications and records of enquiries, complaints, requests, incidents, accidents and any action taken.

CCTV images recorded in and around the club's public and operational areas.

Marketing preferences and records of whether you have opted in, opted out or objected to marketing.

Technical and website information, such as IP address, device information, cookies and website usage data, where collected.

Please make sure information you give us about another person, such as an emergency contact, is accurate and that they reasonably understand it may be provided to us.

3. How we obtain information

We collect personal information:

Directly from you when you enquire, join, complete a form, make a booking, contact us or use the club.

From a parent, guardian, payer or joint member where they arrange or pay for a membership.

From providers that support our membership, booking, payment, access-control, fitness and communication services.

From CCTV systems and records created by our staff during the operation of the club.

From healthcare or referral professionals where you have agreed to a referral or where another lawful basis applies.

From publicly available sources, insurers, professional advisers, law enforcement bodies or regulators where relevant and lawful.

4. Why we use information and our lawful bases

Membership and service delivery: We use identity, contact, membership, booking, access and payment information to set up and manage memberships, provide facilities and services, administer bookings and communicate about your account. Our lawful basis is performance of a contract or taking steps at your request before entering into a contract.

Payments and financial records: We process payment status and transaction information to collect fees, manage arrears, issue refunds and maintain financial records. Our lawful bases are contract, legal obligation and our legitimate interests in receiving payment and maintaining accurate accounts.

Health and accessibility: We use relevant health information to support safe participation, respond to accessibility needs and manage incidents. Health information is special category data. We normally rely on your explicit consent for routine health screening and support. In an emergency, we may use information where necessary to protect someone's vital interests. We may also process information where necessary to establish, exercise or defend legal claims.

Safety, security and CCTV: We use access records, photographs, CCTV and incident information to verify identity, protect members and staff, prevent misuse, investigate incidents and protect our premises. Our lawful basis is our legitimate interests in operating a safe and secure club and, where relevant, establishing, exercising or defending legal claims.

Complaints and legal matters: We use communications, account records, CCTV and incident information to investigate complaints, respond to requests, obtain advice and deal with disputes or legal claims. Our lawful bases are contract, legal obligation and legitimate interests.

Service improvement: We may analyse membership and usage information in an aggregated or limited form to understand demand, improve timetables, facilities and member service, and manage the business. Our lawful basis is our legitimate interests in improving and operating the club effectively.

Marketing: We may send information about our own relevant memberships, services and offers where you have consented or where the electronic marketing soft opt-in applies. We may also rely on legitimate interests for limited postal or other permitted marketing. You can object or unsubscribe at any time.

Legal and regulatory compliance: We may use and disclose information where necessary to comply with tax, accounting, health and safety, safeguarding, data protection and other legal obligations.

5. When information is required

Some information is needed to enter into or manage a membership, take payment, verify identity or meet legal and safety requirements. If you do not provide information that is reasonably required, we may be unable to provide the relevant membership, booking or service.

You do not have to provide information used only for optional marketing, and refusing or withdrawing marketing consent will not affect your membership.

6. Sharing personal information

We do not sell personal information. We may share information where necessary with:

Membership, booking and access providers used to administer memberships, appointments, classes and entry to the club.

Payment processors, banks and Direct Debit collection providers used to collect and administer payments.

Fitness technology and appointment-booking providers where you choose to use the relevant service.

Website hosting, email, communications, IT support, security and data-storage providers.

Accountants, auditors, insurers, banks, legal advisers, debt-recovery providers and other professional advisers.

Contractors who support the safe operation and maintenance of the club, where access to relevant information is necessary.

Police, emergency services, courts, regulators, local authorities or other public bodies where disclosure is required or lawful.

Another organisation involved in a genuine sale, transfer or restructure of all or part of our business, subject to appropriate confidentiality and data protection arrangements.

Providers acting on our behalf are required to use personal information only for the agreed purposes and to protect it appropriately. Some providers may also act as separate controllers for particular activities, such as payment processing.

7. International transfers

Some of our service providers may store or access personal information outside the United Kingdom. Where this happens, we will ensure that an appropriate safeguard is used, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, unless another lawful exception applies.

You may contact us if you would like more information about the safeguards relevant to your information.

8. CCTV

CCTV operates in and around parts of the premises for safety, security, crime prevention and incident investigation. Cameras are not used in toilets or private changing areas.

Recordings may be viewed by authorised staff and disclosed to the police, insurers, legal advisers or other appropriate recipients where necessary and lawful.

CCTV recordings are normally retained for up to 30 days and then overwritten, unless footage is required for an incident, complaint, insurance matter, legal claim or law-enforcement request. Preserved footage will be kept only for as long as reasonably necessary.

Signs are displayed where CCTV is in use. Requests for footage containing your personal information can be made using the contact details in section 15. We may need proof of identity and enough information to locate the footage, and the rights and privacy of other people may limit what can be supplied.

9. Marketing communications

Marketing messages are separate from service communications about your membership, payments, bookings, safety or changes affecting the club.

Every electronic marketing message will identify us and provide a straightforward way to unsubscribe. You can also object at any time by contacting us.

If you opt out, we may keep a minimal suppression record so we can respect your preference and avoid contacting you again for marketing.

10. How long we keep information

We keep information only for as long as reasonably necessary. Our normal retention periods are:

Membership, payment and core account records: normally for up to six years after the membership or account relationship ends, where needed for contractual, tax, accounting or legal purposes.

Financial and transaction records: normally for six years after the end of the relevant financial year, or longer where legally required.

Health questionnaires and routine health information: normally for the duration of membership and up to three years afterwards, unless a longer period is needed for an incident, complaint or legal claim.

Accident, incident and complaint records: for the relevant legal limitation period and longer where a claim, investigation or safeguarding matter remains open. Different periods may apply where a child is involved.

CCTV: normally up to 30 days, unless preserved for a specific matter.

Unsuccessful or uncompleted membership enquiries: normally up to 12 months after the last meaningful contact.

Marketing records: while marketing remains appropriate and permitted. Suppression records may be retained for longer so that we continue to respect an opt-out.

We may retain information for longer where required by law or where reasonably necessary for a complaint, investigation, debt, insurance matter or legal claim. Information will be securely deleted or anonymised when it is no longer required.

11. How we protect information

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, access, disclosure or misuse.

Access is restricted to staff and providers who need the information for their work. We use access controls, staff procedures, supplier checks and secure disposal arrangements appropriate to the nature of the information.

No system is completely secure, but we review our arrangements and respond to suspected personal data breaches in accordance with legal requirements.

12. Your data protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

Ask for access to your personal information.

Ask us to correct inaccurate or incomplete information.

Ask us to delete information where there is no lawful reason to keep it.

Ask us to restrict how information is used.

Object to processing based on legitimate interests and object at any time to direct marketing.

Receive certain information in a portable format where the legal requirements for portability apply.

Withdraw consent at any time where we rely on consent. This will not affect processing carried out before withdrawal.

These rights are not absolute and exemptions may apply. We may ask for information needed to verify your identity. We normally respond within one month, although the law allows more time for particularly complex requests or multiple requests. We will tell you if an extension is needed.

13. Automated decision-making and profiling

We do not use personal information to make decisions that have legal or similarly significant effects solely through automated processing, and we do not carry out automated profiling. If this changes, we will update this policy and provide the information required by law.

14. Children and young members

Atrium Fitness does not offer general membership to children under 16. Where a 16 or 17-year-old joins with parental or guardian involvement, we may process the young member's information and relevant parent, guardian or payer information to administer the membership, take payment and support safe participation.

Privacy information should be explained to a young member in a way they can understand, and their data protection rights belong to them unless another person is legally authorised to act on their behalf.

15. Contacting us

For privacy questions or to exercise a data protection right, contact our data protection contact:

Email: [email protected]

Telephone: 01353 668888

Post: New Fit Ltd trading as Atrium Fitness, 39 Newnham Street, Ely, Cambridgeshire, CB7 4PQ

16. Complaints to the ICO

If you are unhappy with how we have used your personal information, please contact us first so we have an opportunity to resolve the matter.

You also have the right to complain to the Information Commissioner's Office. Visit www.ico.org.uk, telephone 0303 123 1113, or write to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

17. Cookies and website services

Our website may use cookies and similar technology. Where required, non-essential cookies will not be placed without your consent. Further information about the cookies used, their purposes and how to manage them should be provided in our Cookie Policy or cookie settings tool.

18. Changes to this policy

We may update this policy to reflect changes in our services, providers, systems or legal obligations. The latest version will be published on our website, and we will highlight material changes where appropriate.

Last updated: 19 August 2026.