NRG Privacy Notice
Last updated: 6 July 2026
1. Who we are
NRG Gym Limited and NRG Gym Two Limited operate the NRG Gym brand in the UK. Depending on the gym you join, you will contract with one of these entities for your membership. Our company details are:
- NRG Gym Limited with company registration number 07733307 and registered address Wellesley House, Duke of Wellington Avenue, London, England, SE18 6SS (NRG Gym); and
- NRG Gym Two Limited with company registration number 07472331 and registered address Wellesley House, Duke of Wellington Avenue, London, England, SE18 6SS (NRG Gym Two).
NRG Gym and NRG Gym Two are each the data controller of personal data that is collected, used and/or otherwise processed about you under this notice.
NRG Gym and NRG Gym Two will act as joint controllers in relation to certain activities such as for member account management purposes, shared customer services, conducting joint marketing campaigns or analytics / member insights across the memberships of both NRG Gym and NRG Gym Two.
Unless otherwise stated, all sections of this privacy notice apply equally to both NRG Gym and NRG Gym Two.
You can use the same contact details (as set out in this notice) for any questions or requests you have in relation to data protection and your personal information. We will ensure that your request is dealt with appropriately. NRG Gym and NRG Gym Two are referred to together as NRG, we, us or our in this notice.
We take our obligations to you under UK data protection law (including UK GDPR) seriously and have set out how we use, share and protect your personal data in this notice (the Privacy Notice). This Privacy Notice should be read together with our terms and conditions and any other documents referred to in the terms and conditions. Please carefully read this Privacy Notice to understand how we use and share your personal data and the measures we take to protect it.
2. How we collect and use your personal data and our lawful basis
We collect personal data directly from you when you join as a member, buy a day pass or guest pass, use our gyms, use our website, app or member portal, contact us, enter a promotion, register an interest in a product or service, sign up to receive direct marketing or otherwise interact with us. We also collect some information automatically when you use our website, app, and access-control systems. We will also process any personal data captured through CCTV operating at our premises. Where required for membership or access-control purposes, we may also collect a member photograph, app access data and location-related data from your device.
We rely on specific lawful bases under UK data protection law when processing your personal data. The following lawful bases apply to our use of your personal data:
- Consent: you have given your consent to the processing (for example if you consent to receiving direct marketing from us);
- Performance of contract: it is necessary for the performance of and compliance with your contract with us or in order to take steps prior to entering into that contract (for example as required to provide you with membership to one of our gyms);
- Protection of vital interests: we need to process your personal data to protect your vital interests or those of a third party (for example, to contact an emergency contact in the event of an emergency or medical issue of a member at one of our gyms); or
- Legal or Regulatory Obligation: we need to process your personal data to comply with a legal or regulatory obligation; or
- Legitimate Interests: it is necessary for our legitimate interests (or those of a third party). Please see the table below for more information.
Where we process special category data, such as health information, we also rely on an applicable additional condition under Article 9 UK GDPR and the Data Protection Act 2018 (where required).
We have set out, in the table below, the categories of personal data we collect, how we use this personal data and our lawful basis including our legitimate interests.
| Personal data we collect | How we use your personal data | Our lawful basis under UK data protection law |
|---|---|---|
Membership / account / portal / app / access-controls Name, address, email, phone number, date of birth, gender, home gym, membership type, membership number, account credentials, access control data, bookings, visit history, app / portal usage records, member photograph/headshot. Location-related data generated by your device where required to support app-based access functionality. | Creating and managing memberships; Recording agreement to our terms and conditions; Providing access to gyms and classes; Authenticating gym access through the app and access control systems; Providing and administering app features, including class bookings, workout and training plans, progress monitoring and activity tracking; Administering freezes, upgrades, downgrades and cancellations; Member support; Fraud prevention and misuse prevention; Sending service and operational updates; Conducting surveys / market research; Researching and analysing the services our members want and to improve our services; Enforcing our legal rights and managing any dispute and legal claims. | Performance of Contract Legitimate Interests (to manage and administer our services and operations, authenticating gym access and operating access control systems; providing app features, conduct surveys / market research, research, analyse and improve our services, prevent fraud and enforce our legal rights / manage disputes and claims). |
Day passes and guest passes Contact details, date of birth, gym choice, pass type, booking details, marketing preferences. | Providing day and guest-passes; Contacting the individual about the pass; Sending marketing about memberships and promotions (where consent has been provided). | Performance of contract Consent for direct marketing. |
Medical health and fitness declaration Responses to the health declaration agreement including name, membership details and agreement to the declaration. Please note we do not collect details of any health conditions. | To confirm that members have reviewed and agreed to the Medical Health and Fitness Declaration; to help ensure members can use our gyms safely; and to enforce our legal rights and manage disputes or claims. | Legitimate interests (to ensure members can use our gyms safely and to keep a record of agreement; enforce our legal rights / manage disputes and claims). |
Emergency contact Emergency contact details (name and phone number for your emergency contact) | Contact your emergency contact in the event of an emergency. | Legitimate Interests (in contacting your named emergency contact in an emergency) Vital Interests (where health information is shared) |
Payment information Bank account details for direct debit payments, partial payment card details, billing address, invoice information, details about payments to and from you and other details of services you have purchased from us. Please note that we do not store full payment card details. | Payment, billing and accounting purposes; Enforcing our legal rights and managing any dispute and legal claims. | Performance of contract Legitimate interests (to recover any debts, enforce our legal rights and manage disputes / legal claims) |
Member communications Your contact details including name, email address, address and phone number and the content of any communications. | Member communications including handling complaints, feedback, surveys and market research, responding to queries; Monitoring communications for training and development purposes; Developing and improving our services. | Legitimate interests (in managing our relationship with you and addressing any complaints or issues, conducting surveys and market research, training and development, developing and improving our services) |
Gym usage data Information about the way you use our gyms including time of entry / exit and class attendance. | Health and safety purposes; To provide membership of our gyms including access to classes and facilities; and Statistical analysis and research. | Legitimate interests (to ensure our gyms are safe, to provide gym access and for statistical analysis / research). |
CCTV / access control / tailgating monitoring CCTV footage collected in or around our gyms. Entry and exit records, QR scan data, access-event records and investigation material. | Keeping staff, members and premises safe; preventing unauthorised access and misuse of memberships; investigating incidents, complaints, appeals and claims; enforcing gym rules and membership terms. | Legitimate interests (to ensure the safety and security of our staff, members and gyms, to investigate membership misuse and enforce our rules and terms). |
Youth memberships Child member details, date of birth, proof of age, parent / guardian details, adult member details where required for supervision, induction records, and any consents or acknowledgements required by the sign-up process. | Setting up and managing youth memberships; verifying age and eligibility; administering inductions and supervision requirements; managing access during permitted hours; and communicating with parents or legal guardians where required. | Performance of contract Legitimate interests (in verifying eligibility, supervision and communicating with parents or legal guardians). |
HealthHero benefits Membership number, membership status. Please note we do not receive information on whether or not our members utilise HealthHero benefits. | Enabling access to optional health related membership benefits, sending access or activation information, and administering the relevant membership package. | Performance of contract |
Accidents / incidents at our gyms Contact details, date of birth, membership details, incident details including health information where relevant. | Recording, managing and investigating incidents; Safeguarding members and staff; Compliance with health and safety obligations; Insurance, complaints and legal claims handling. | Legal or Regulatory Obligation Legitimate interests (in managing incidents or accidents at our gyms, ensuring members and staff are safe and to analyse / report on accidents / incidents). Vital interests |
Providing WI-FI Your contact details, technical data, WI-FI and usage data. | To provide you with WI-FI at our gyms; To protect the security of our networks. | Performance of Contract Legitimate interests (in protecting the security of our networks) |
Student, Blue Light, 999 and corporate memberships Proof of employment, education, corporate eligibility or other eligibility evidence. | If you are a student, work for a 999 service or the NHS, or are eligible for a corporate membership or discount, we may ask you to provide evidence to confirm eligibility. | Legitimate interests (to confirm eligibility for specific discount). |
Direct marketing and profiling Contact details including name, email address, phone number and home address; marketing preferences; home gym; membership type; usage information; engagement with our communications; and any profiling information we generate to tailor or personalise marketing. | To send you direct marketing and to tailor and personalise our communications. | Consent Legitimate interests (for limited marketing analytics, audience segmentation and measuring the effectiveness of our campaigns, where permitted by law) |
Refer a friend scheme Contact details and membership information for the referring member and, where applicable, contact details for the referred friend. | To operate our refer a friend promotion and provide the qualifying referring member with 1 month’s free membership. | Legitimate interests (to offer our promotional refer a friend scheme). |
Technical data and device data Details of your visits to our website including, but not limited to, traffic data, location data, hardware and browser settings, page requests, IP address, weblogs, operating system, browser usage and other communication data. Device information such as operating system, unique device identifiers, the mobile network system. For further information on our use of cookies and similar technologies see our Cookie Notice. | To ensure effective administration, operation and management of our website; Provide and administer accounts on our website and app for members; Personalise our website; Ensure network and information security; Identify issues with the website and the user’s experience of it; and Monitor and analyse the way our website is used. | Legitimate interests (in operating our website, app and member portal, administering accounts, ensuring network and information security, and identifying and resolving issues) Consent |
Please note that personal trainers at our gyms may also collect your personal data including health information. Personal trainers are not employed by us when offering personal training services and operate as separate data controllers in respect of personal data they collect when providing their services to you. Please speak to your personal trainer for details of their processing of your personal data and privacy notice.
3. Emergency contact
If you provide us with an emergency contact’s name and telephone number, we will store those details and use them only if there is an emergency or serious medical issue while you are at one of our gyms. In that situation we may share limited information necessary to explain the emergency, which may include information about your condition if needed to protect your vital interests.
Please ensure that you have brought this Privacy Notice to the attention of your emergency contact and the fact that you have provided their information to us and that we hold it as described here.
4. How long we retain your personal data
We keep personal data only for as long as necessary for the purposes described in this Privacy Notice. Different retention periods apply depending on the type of data and why we use it. We may retain information for longer where it is needed for an investigation, complaint, insurance matter, legal claim, regulatory request or to comply with a legal obligation.
We keep the majority of personal data we hold about you as a member or customer for 6 +1 years after your membership ends (or, for a day or guest pass, 6 + 1 years after the date of the pass). 6 + 1 years means that all personal data is retained for 6 years and then deleted in the next periodic deletion in the following 12 month period. Therefore, personal data is retained for a minimum period of 6 years plus up to an additional 12 months. This covers most of the personal data we hold about you, including your account and contact details, access and booking history, your fitness and health declaration, your notes and communications with us, and your payment and billing records.
Other retention periods are applicable in relation to specific categories of records, please see the table below for examples:
| Category of personal data | Examples | How long we retain this personal data |
|---|---|---|
| Emails | Emails you send us, and emails we send you. | 6+1 years from the date the email is sent or received. |
| Your membership photo and emergency contact details | Photo and emergency contact details. | Retained for the duration of your membership and for 12 months after termination of your membership. |
| Proof of eligibility for a discounted membership | Proof of employment, education, corporate eligibility or other eligibility evidence. | The proof of eligibility document is deleted once eligibility has been confirmed. We retain a record that eligibility has been confirmed for the duration of your membership and for 12 months after termination of your membership. |
| Youth membership information | Child member details, date of birth, proof of age, parent / guardian details, adult member details where required for supervision, induction records, any consents or acknowledgements required by the sign-up process and any accident / incident involving the youth member. | 6 years after the youth members 18th birthday. |
| CCTV footage | CCTV footage collected in or around our gyms. | Retained for approximately 30 days. This time period varies slightly across our locations. |
| Wi-Fi, network and technical data | Wi-Fi and network usage data, and website or app technical logs. | Retained for up to 12 months. Cookies are retained for the periods set out in our Cookie Notice. |
| Marketing preferences | Whether or not you have consented to direct marketing and any subsequent unsubscribe request. | Your consent to receive direct marketing is retained until you unsubscribe. Marketing preferences are reviewed after specific periods of inactivity. For example, we may delete marketing preferences after 24 months of inactivity. If you unsubscribe or choose not to consent to receive direct marketing, we retain a minimal record of your opt-out so that we do not send you direct marketing. |
| Enquiries that do not lead to membership | Details we collect if you contact us or register your interest but do not become a member. | Retained for 12 months. |
In some circumstances, you can ask us to delete your data. Please see Section 8 below for further information.
In some circumstances, we will anonymise your personal data (so that it can no longer be associated with you), in which case we may use this information indefinitely without further notice to you.
5. Legal requirements
We may use or disclose personal data where necessary to comply with a legal obligation, respond to lawful requests from courts, regulators or law-enforcement bodies, or establish, exercise or defend legal claims. We will not delete personal data if it is relevant to an investigation or a dispute. Your personal data will continue to be stored until those issues are fully resolved.
6. Information we share
Your personal data will be processed by our employees. NRG Gym and NRG Gym Two share your personal data in order to jointly operate the NRG business including for member management, payments and accounting, customer services and marketing / analytics purposes.
There are also certain circumstances where we will transfer your personal data to third parties. These include:
- Professional advisers. This may include lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services to obtain advice from the relevant professional advisers.
- HealthHero. Where you activate optional health-related membership benefits we will share your membership number and status with HealthHero so they can provide these benefits to you. We do not receive information from HealthHero on benefits you receive, and we do not share any other information with HealthHero.
- Payment providers. We share your personal data with payment providers so they can process transactions.
- Third party service providers. Third parties may process your personal data on our instructions. These include IT suppliers (including website, software and app providers), cloud hosting providers, CCTV providers, credit reference agencies, debt agencies, health and safety advisors, marketing agencies, database providers, backup and disaster recovery specialists and email providers.
Our service providers will be required to meet appropriate standards on processing information and security when processing your personal data. The information we provide them, including your information, will only be processed in connection with the performance of their function. They will not be permitted to use your information for any purposes other than those outlined in this Privacy Notice.
Your personal data may be transferred to other third-party organisations in certain scenarios, such as:
- If we’re discussing selling or transferring part or all of our business – the information may be transferred to prospective purchasers under suitable terms as to confidentiality;
- If we are reorganised or sold, information may be transferred to a buyer who can continue to provide services to you;
- If we’re required to by law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority – for example the Police e.g. in order to assist fraud protection and minimise credit risk; or
- If we are defending a legal claim your information may be transferred as required in connection with defending such claim.
Your personal data may be shared if it is made anonymous and aggregated, as in such circumstances the information will cease to be personal data.
7. Where your information will be held
We may transfer your personal data to locations outside of the UK including, depending on the service provider, to the EU, US, Canada, Australia and New Zealand. To ensure your personal data is protected in accordance with UK data protection law we will only transfer data outside the UK where appropriate safeguards as required by UK data protection law are in place. This includes where a jurisdiction has been deemed adequate under UK data protection law or, where there is no adequacy decision, by putting in place the UK International Data Transfer Agreement or Addendum to the EU SCCs.
Please complete our webform [HERE] if you would like further information on the specific safeguards used by us when transferring your personal data.
8. Your rights
You have a number of rights in relation to our handling of your personal data. These rights are not applicable in all circumstances and exemptions may apply. Your rights may include the following:
- Access: you are entitled to ask us if we are processing your personal data and, if we are, you can request access to your personal data (commonly known as a data subject access request). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Correction: you are entitled to request that any incomplete or inaccurate personal data we hold about you is corrected.
- Erasure: you are entitled to ask us to delete or remove personal data in certain circumstances. There are also certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for compliance with law or in connection with claims.
- Restriction: you are entitled to ask us to suspend the processing of certain of your personal data about you, for example if you want us to establish its accuracy.
- Transfer: you may request the transfer of certain of your personal data to another party in some circumstances.
- Objection: where we are processing your personal data based on a legitimate interest (or those of a third party) you may object to processing on this ground. However we may be entitled to continue processing your information based on compelling legitimate grounds or for the establishment, exercise or defence of legal claims. You also have the right to object to processing of your personal data for direct marketing purposes including profiling.
- Withdraw consent: where you have provided your consent to the collection and processing of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.
- Complaint: you may complain to us about how we use your personal data.
If you wish to exercise any of your rights, please complete our webform [HERE].
You also have a right to lodge a complaint with the Information Commissioner’s Office (www.ico.org.uk).
9. Direct Marketing
If you have given your consent, we will send you direct marketing about memberships, classes, promotions, events, guest passes and related gym offers by email or SMS. We may use information such as your home gym, membership type, usage information or previous engagement with our communications to tailor the marketing we send you and for marketing analytics and profiling purposes.
If you do not want us to use your personal data for the purposes of direct marketing you can withdraw your consent at any time by clicking unsubscribe in marketing communications.
Please note that if you choose not to consent to direct marketing or withdraw your consent to direct marketing we will still communicate with you in relation to your gym membership and other service-related messages. For example, messages relating to gym closures or confirmation of appointments or classes at our gyms.
10. Automated decision making
We do not make any significant and solely automated decisions relating to our members.
11. How to contact us
If you have any questions about this Privacy Notice or want to exercise your data protection rights, please contact us by completing our webform [HERE].
12. Third party links
You might find links to third party websites on our website. These websites should have their own privacy notices which you should check. We do not accept any responsibility or liability for their policies as we have no control over them.
13. Changes to the policy
This Privacy Notice may change from time to time and is available on our website. You can tell when this Privacy Notice was last updated by looking at the date at the top of the Privacy Notice. If we make changes to this Privacy Notice, we will post the updated version on our website.
If we make a change that significantly affects your rights or, to the extent we are permitted to do so, significantly changes how or why we use personal data, we will notify you by way of a prominent notice on our website or, if we have your email address, by email where required by applicable law.
Any changes to this Privacy Notice will become effective when posted. We encourage you to review this website from time to time for the latest information.