Privacy Policy

Last updated: 20 July 2026

This policy explains how Revamp collects, uses, and protects your personal data, whether you enquire with us, follow us on social media, book a consultation, or become a member. Revamp is a trading name of Cardy Co Limited, the “data controller” responsible for your information. We run boutique small group personal training studios in Hadleigh (Suffolk) and Halstead (Essex).

If you have any questions about this policy or how we handle your data, email us at hello@revampgym.com or speak to the team at your studio.

The information we collect

When you get in touch or enquire

If you fill in an enquiry or lead form (including forms on Facebook and Instagram, forms on our website, or a message on WhatsApp), we collect the details you give us. This is usually your name, email address, phone number, the studio you’re interested in, and anything else you choose to tell us about your goals.

When you become a member (the Revamp app)

When you use the Revamp app (iOS, Android, or the web version at revampgym.com) we collect and process:

Account information — your name and email (to identify you, sign you in, and contact you about your membership), your phone number (to contact you about sessions or membership), your date of birth (to confirm you meet the minimum age and personalise pre-exercise screening), and your home studio.
Health information (PAR-Q) — before your first session you complete a Physical Activity Readiness Questionnaire covering cardiovascular conditions, chest pain, joint problems, medications, and pregnancy. It is used solely to decide whether you can safely take part, is reviewed only by our coaches and studio managers, and is never shared with third parties.
Emergency contact — a name, phone number, and relationship, used only to contact your nominated person if a medical or safety incident occurs during a session.
Signature — a digital signature you provide when you agree to our terms and the waiver during onboarding, stored securely as an image.
Booking and attendance history — the dates, times, and locations of sessions you book, attend, cancel, or miss, used to manage capacity, track your training, and calculate your membership entitlement.
Payment information — we do not store your card details. Payments are processed by Stripe, which holds your card data under its own privacy terms. We keep a reference to your Stripe customer account so we can take agreed payments and let you manage saved cards via Stripe’s hosted portal.
Messages you send us — the content of emails, texts, and app messages you exchange with us, so we can respond and keep a record of our conversation.
Device and technical information — standard information such as device type, operating system, IP address, and activity timestamps, used for security (e.g. spotting unusual sign-ins) and to diagnose technical issues.

How we use your information

We only use your data where the law allows. Depending on the situation, our lawful basis under UK GDPR is one of the following:

To respond to your enquiry and offer a free consultation — because it’s in our and your legitimate interests, and to take steps towards a possible membership at your request.
To provide membership, bookings, and payments — to perform our contract with you.
To send you marketing about Revamp (emails or texts about our services, offers, and community) — with your consent, which you can withdraw at any time (see below).
To keep you and other members safe during sessions, including handling your health information — with your explicit consent, and to protect vital interests in an emergency.
To meet our legal obligations — including keeping accounting records for HMRC.

We do not sell your data, share it with advertisers, or use it for targeted advertising of any kind.

Marketing and your choices

If you’ve agreed to hear from us, we may send occasional emails or texts about Revamp. You can opt out at any time:

click the unsubscribe link in the footer of any marketing email;
reply STOP to any marketing text;
or email hello@revampgym.com and we’ll take you off the list.

Opting out of marketing won’t stop essential service messages about your bookings, payments, or membership.

We share limited personal data only with trusted providers who process it on our behalf under written data-processing agreements, and with the ad platforms you contact us through:

Meta Platforms Ireland Ltd — when you submit a lead form on Facebook or Instagram, Meta passes your details to us. See Meta’s privacy policy.
Stripe Payments Europe Ltd (Ireland) — payment processing and card storage.
Supabase Inc (US) — database hosting and sign-in.
Resend, Inc (US) — sending emails.
Twilio Inc (US) — sending and receiving text messages.
Google LLC — email and calendar scheduling for consultations.
Vercel Inc (US) — hosting the app and website.

Where data is transferred outside the UK (for example to US providers), that transfer is protected by Standard Contractual Clauses and, where applicable, the UK extension to the EU–US Data Privacy Framework.

How long we keep it

We keep your personal data for as long as you are a member or an active enquiry, plus six years afterwards to meet HMRC accounting obligations. Health information (PAR-Q responses) is kept for the same period in case of a post-membership injury claim. If you ask us to delete your data, we will anonymise records we’re legally required to keep and fully delete anything that isn’t.

Your rights

Under UK GDPR you have the right to:

access the personal data we hold about you;
correct anything that’s inaccurate;
delete your data (subject to records we must keep for HMRC for six years after your membership ends);
withdraw consent for marketing at any time;
object to processing in certain circumstances;
receive your data in a portable, machine-readable format.

To exercise any of these, email hello@revampgym.com or speak to your studio. We’ll respond within one calendar month. If you believe we’ve mishandled your data, you can also complain to the Information Commissioner’s Office at ico.org.uk.

Cookies

Our website and app use only the cookies needed to make them work — for example, to keep you signed in and to keep your session secure. We don’t use advertising or cross-site tracking cookies.

Children

Revamp is for adults aged 18 and over. We don’t knowingly collect personal data from children. If you believe a child has used the app, contact us and we will delete their data promptly.

Changes to this policy

We’ll post any changes on this page. If a change is material (for example, adding a new provider or a new category of data), we’ll let members know by email at least 14 days before it takes effect.

Contact us

Cardy Co Limited (trading as Revamp)
Email: hello@revampgym.com