Privacy Notice

Introduction

Fitness Finder Ltd ("Fitness Finder", "we", "us", "our") is committed to protecting your personal data and respecting your privacy.

This Privacy Notice explains how we collect, use, store and protect your personal information when you use our platform — whether as a Customer or as a Provider — in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Fitness Finder Ltd is a data controller in respect of the personal data we collect and process for our own purposes as the platform operator (for example, operating your account, processing payments and administering the Admin Hub). Fitness Finder acts as an intermediary connecting Customers and Providers, and where a Provider receives your booking or contact information in order to deliver a session, the Provider processes that data as an independent data controller in their own right, for their own purposes — they are not processing it on our instructions or on our behalf. This means Fitness Finder and the relevant Provider are each independently responsible for their own data protection compliance in respect of the data they control. Section 12 below explains this in more detail.

If you have any questions about how we handle your data, please contact us at support@fitnessfinderltd.co.uk.

Information We Collect

From all users:

• Name, email address, phone number and date of birth
• Account login details
• Booking information and session history
• Messages and communications sent through the platform
• Payment information (processed securely via Stripe — we do not store full card details)
• A mandatory emergency contact (name and contact number), provided at account registration

From Providers specifically:

• Business or trading name, company/registration number, registered address, and — for sole traders — proof of address submitted at registration
• Bank account details for payouts
• Qualification and certification documents
• Identity documents
• Insurance certificates
• DBS check documentation (where applicable)
• First Aid certification
• National Insurance number, VAT number and Unique Taxpayer Reference (UTR), where applicable, for tax reporting
• Country of residence, where applicable, for tax reporting

From Providers registering an additional business location (Branch):

• Branch name, address, postcode and phone number
• The type of service offered at the Branch
• Supporting documentation evidencing the Branch's existence (such as a business registration certificate, lease agreement or utility bill)

From anyone inviting users to a provider hub:

• Name, email address and date of birth of each manager or staff member invited

Booking for others: Where you book a session for another individual using the "Add Person" feature, we may collect their name, date of birth, and any information necessary to facilitate the booking. You are responsible for ensuring you have appropriate consent, including parental or guardian consent where the individual is under 18.

Fitness Finder does not knowingly collect personal data directly from individuals under 18 without appropriate parental or guardian consent.

Data exchanged directly between Customers and Providers: Some information is entered by Customers and Providers directly with each other through platform features, rather than being submitted to Fitness Finder. This includes:

• Dietary requirements and allergy information ("Dietary Labels") recorded by a Provider about a Customer
• Online Coaching intake information (such as fitness goals, weight, height and other details a Customer chooses to share, which may constitute special category data under UK GDPR)

Both Customers and Providers can view and update this information. Fitness Finder's administrative systems do not have access to this data, or to Online Coaching daily log submissions, questionnaire answers, or progress images — see Section 6 for further detail.

Information collected automatically:

• Device, technical and usage data
• IP address and browser information
• Booking history and session records
• Session verification codes, timing and attendance data
• Location data, including provider service areas, travel radius, and — where relevant to a dispute — GPS data associated with a session

Location Information

Fitness Finder uses location-based features to match customers with providers. We may collect and process:

• General service areas or travel radius set by providers
• Approximate location data used for matching customers with nearby providers
• Meeting locations agreed between users for confirmed bookings, including sessions delivered as part of an Online Coaching package (In-Package Sessions)

We do not display or share precise residential addresses. Location data is used at an approximate level only, to support booking functionality, and — for Providers — to resolve disputes over whether a session took place. Customers and Providers are responsible for agreeing a suitable and safe meeting location; Fitness Finder does not control or verify these locations.

3A. Events

Where you book or host an Event through the platform, we collect and process ticket booking data, images uploaded in connection with an Event, and attendance verification codes, in order to facilitate Event bookings, process refunds where an Event is cancelled or a ticket is cancelled in time, and resolve disputes about Event attendance.

Use of Location Data

Location data is used strictly to:

• Match customers with providers
• Display general service areas and availability
• Facilitate booking coordination between users
• Resolve disputes about whether a session was delivered

Users must not:

• Attempt to identify or infer another user's residential address
• Use location data for any purpose outside of an agreed booking
• Share, store or distribute location data inappropriately

How We Use Your Information

We use your personal data to:

• Create and manage accounts
• Facilitate bookings between customers and providers
• Enable communication between users through the platform
• Process payments and payouts via Stripe
• Verify provider qualifications, insurance, DBS checks and identity documents
• Review and process Branch applications submitted by Providers
• Correct typographical errors or inaccuracies in account and registration information, as described in Section 5.1 below
• Manage provider hub access and role-based permissions
• Send service communications such as booking confirmations, document expiry reminders, and (for Providers) an annual earnings summary
• Handle disputes, refunds, cancellations and support requests, including reviewing session verification data as evidence
• Maintain platform safety, prevent fraud and enforce our Terms
• Comply with safeguarding obligations in relation to sessions involving individuals under 18
• Meet our tax and regulatory reporting obligations, including HMRC digital platform reporting under the Digital Platform Reporting Rules (DPRR)
• Send marketing communications, where you have agreed to receive them
• Improve and develop the platform, including through analytics
• Comply with our other legal and regulatory obligations

Lawful bases for processing:

• Performance of a contract
• Legitimate interests (including platform safety, fraud prevention, dispute resolution and service improvement)
• Compliance with legal obligations (including tax reporting)
• Vital interests and substantial public interest (in connection with safeguarding and DBS processing)
• Explicit consent (for special category data exchanged directly between Customers and Providers, such as Online Coaching intake information and Dietary Labels, given by the Customer to the relevant Provider)
• Consent (for marketing communications and non-essential analytics or tracking, where used)

5.1 Correction of Account and Registration Information

Fitness Finder may, through the Admin Hub, correct typographical errors or inaccuracies in information you have already submitted to us. This function is used only to fix errors in information you have provided — it is never used to add information you have not submitted.

For Customers, this may include correcting your name, phone number, or email address. For Providers, this may include correcting:

• National Insurance number
• Proof of address
• VAT number
• Company registration number
• Registered company name
• Unique Taxpayer Reference (UTR)
• Full legal name
• Trading or business name
• Date of birth
• Email address

Where a correction is made, we will notify you at your registered email address or by message. Where the correction is to your registered email address, notification will be sent to both the previous and updated address. You remain responsible for ensuring your account information is accurate and up to date, and for notifying us promptly of any change. We accept no liability for errors or consequences arising from inaccurate information you have submitted.

The Fitness Finder Admin Hub

Fitness Finder operates an internal administrative hub through which authorised personnel may access booking data, location and branch information, qualification/insurance/DBS records, revenue data, ratings and reviews, and platform communications — solely to operate, verify and improve the platform, investigate disputes, and meet our legal obligations. Access is restricted to authorised personnel and protected by appropriate security measures.

Through the Admin Hub, authorised personnel may also view a summary of a Customer's account activity, including:

• Total bookings and total spend
• Reviews submitted and ratings received
• Registered children (where applicable)
• Booking history (including provider, service, date, amount and status)
• Any reports or disputes associated with the account

Tax and Compliance Reporting

For Providers, Fitness Finder is required to comply with the UK's Digital Platform Reporting Rules (DPRR) regime and may be required to report certain Provider earnings data to HMRC. For this purpose, we collect and may export the following each tax year:

• Full legal name
• Date of birth
• National Insurance number, VAT number, company registration number and Unique Taxpayer Reference (UTR), where applicable
• Phone number
• Registered or principal address and country of residence
• The financial account identifier (such as a bank account, sort code, or payment reference) used to pay you
• Booking earnings, Online Coaching earnings, total earnings, and sales count recorded within each calendar year
• Fees, commissions, or other amounts withheld from your earnings

Because Providers supply services rather than goods, no minimum earnings or transaction threshold applies for reporting purposes under the DPRR regime. We may be required to report any Provider with reportable earnings, regardless of amount, and disclose this data to HMRC or other relevant authorities as required by law. This position reflects the DPRR rules in force as at the date of this notice and is subject to change in line with any future amendment to those rules.

Annual Earnings Summary: At the end of each calendar year, we will send each Provider an email to their registered email address containing a PDF export of their earnings data and associated identity fields as recorded on the Platform for that year. This is provided as a courtesy to assist Providers in meeting their own tax reporting obligations, and does not affect or replace those obligations.

Provider Hubs

Where a Provider grants hub access to managers or staff, those individuals may access Customer booking information, which is processing of personal data under UK GDPR. Payment and financial information within the hub is accessible to the Provider (account owner) only, and is not visible to managers or staff. The Provider (as hub owner) is responsible for ensuring hub users understand their data protection obligations, use Customer data only to fulfil bookings, and have access removed when no longer needed.

Marketing Communications

With your consent, we may send Customers and Providers marketing communications about Fitness Finder services, promotions or platform updates, by email or through the platform. We will only do this where you have opted in, in accordance with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR.

You can withdraw your consent and unsubscribe at any time by using the unsubscribe link in any marketing communication, or by contacting us at support@fitnessfinderltd.co.uk. Withdrawing consent will not affect service communications (such as booking confirmations, document expiry reminders, or your annual earnings summary), which we send regardless of your marketing preferences as they are necessary to operate your account.

International Transfers

Payments made through the platform are processed by Stripe, Inc. and its group entities. This means your payment data may be processed on servers or by group entities located outside the UK and the European Economic Area (EEA), including in the United States, as part of Stripe's global payment infrastructure. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), UK-approved Standard Contractual Clauses, or reliance on an adequacy decision, as applicable. You can find more detail on Stripe's own data handling and transfer practices at stripe.com/gb/privacy.

Other than payment processing via Stripe, we store and process your data within the UK and the EEA. If this changes in future — for example, if we or another service provider we use begin processing data outside the UK/EEA — we will update this notice and ensure appropriate safeguards are in place.

Sharing Your Information

We may share your personal data with:

• Providers or Customers where necessary to fulfil a confirmed booking. Where we share your data with a Provider for this purpose, the Provider processes that data as an independent data controller for their own purposes (see Section 1) — they are not our data processor
• Authorised provider hub users (such as managers or staff invited by a Provider), solely to deliver your session
• Providers, where a Customer's emergency contact details are used by a Provider in the event of a medical emergency during a session. Emergency contact information is used solely for this purpose
• Stripe, for processing payments and payouts — their privacy policy is available at stripe.com/gb/privacy
• Our internal team through the Fitness Finder Admin Hub, for operating the platform, verifying compliance, investigating disputes and ensuring user safety
• Technology and service providers supporting the platform, all bound by data processing agreements
• HMRC, in accordance with our digital platform reporting obligations under the DPRR regime
• Authorities, regulators or professional bodies — including law enforcement, the ICO and the Disclosure and Barring Service — where required or permitted by law

Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, loss or misuse. These include:

• Encryption
• Access controls
• Role-based permissions within the provider hub and Admin Hub

All third-party service providers we work with are contractually required to apply equivalent security standards.

If you become aware of any unauthorised access to your account, please notify us immediately at support@fitnessfinderltd.co.uk.

Data Retention

• Booking and financial records: retained for at least six years, to meet HMRC requirements
• Provider qualification, insurance and DBS documentation: retained for the duration of the Provider's agreement with us. Following termination of that agreement, this documentation and other personal data we hold about the Provider is deleted from our systems, save for any information we are required to retain to meet a legal or regulatory obligation (such as financial records required for HMRC purposes, which are retained for six years as set out above)
• Session verification and location data used in a dispute: retained for as long as necessary to resolve the dispute and any future disputes
• Marketing consent records: retained until you withdraw consent or unsubscribe
• Online Coaching data relating to a Customer whose coaching relationship has been temporarily suspended by a Provider: retained for the duration of the suspension, so that the relationship and associated records can resume without loss of data
• Admin-suspended Customer or Provider accounts: data retained during the account suspension period and for 90 days thereafter, to facilitate account reinstatement, dispute resolution, appeals or permanent closure. Where a dispute or investigation is ongoing during suspension, data retention continues until resolution

When data is no longer required, it is securely deleted or anonymised.

Your Rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data in certain circumstances
• Restrict or object to certain processing
• Data portability, where processing is automated and based on consent or contract
• Withdraw consent at any time where we rely on consent as our lawful basis (including for marketing)

To exercise any of these rights, please contact us at support@fitnessfinderltd.co.uk. We will respond within one month. Some rights may be limited where we need to retain data for a legal or regulatory obligation, such as HMRC record-keeping or DBS compliance.

Contact and Complaints

If you have any questions about this Privacy Notice or how your data is handled, please contact us:

Email: support@fitnessfinderltd.co.uk

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113

Updates

We may update this Privacy Notice from time to time. Where changes are material, we will provide reasonable notice via email or through the platform. The updated version will always show the current effective date at the top of this page.

Fitness Finder Ltd — Registered in England & Wales