Privacy and cookie policy

1. Who we are

The 200 Strong is run by 200 Strong Limited, company number 15715716, 1A Nursery Court, Kibworth Business Park, LE8 0EX ("we", "us"). We're responsible for the personal information you give us. Contact us about your data at info@the200strong.com or 07576 552958. ICO registration number: 00015851137.

2. What we collect

When you join or buy from us

Your name, email, phone number, date of birth, address and emergency contact.

Your membership, the packs and passes you buy, and your payment history. Your bank details are held by GoCardless, not by us.

Your health and training

Your health questionnaire (PAR-Q), any injuries or conditions you tell us about, and your MAP movement assessment.

Your workouts, weights lifted, progress photos and measurements if you add them, check-in forms, and nutrition and habit records.

If you connect Apple Health, the daily activity figures you choose to share, such as steps and active minutes.

Using the gym

Your bookings, check-ins, door code entries and attendance.

CCTV images in and around the gym.

Your children

If you book Mini Engine, your child's first name and anything you tell us that's needed for their safety.

Talking to us

Messages you send in the app's chat, texts, WhatsApp messages, emails and calls to the gym number. We don't record calls; we keep a note of missed calls so we can call you back.

Feedback, votes and check-in answers. Some feedback check-ins are anonymous.

If you're interested but haven't joined (leads)

Your name, contact details, how you heard about us (including which advert, if you came from one), and notes about tours and our conversations. This includes anything you send us through a form on our website.

3. Why we use it, and our legal basis

4. Who we share it with

We never sell your data. We only share it with trusted companies that help us run the gym, under contracts that protect it:

• Supabase: our secure database.
• Vercel: hosts the app and website.
• GoCardless: Direct Debit payments.
• SumUp: shop and card payments.
• Resend: sends our emails.
• Twilio: texts and calls to the gym number.
• Meta (WhatsApp): if you message us on WhatsApp.
• Meta (Facebook and Instagram): only if you accept cookies on our website, to measure which of our adverts work. See section 8.
• Anthropic: powers the app's assistant and some automatic messages. Only the text needed for that reply is sent, and it isn't used to train their AI.
• Apple: only if you choose to connect Apple Health.
• Google: loads the fonts in the app and website, which means your device's IP address is shared with Google.
• Our accountant and advisers, and the police or authorities if the law requires it.

Some of these companies store data outside the UK, for example in the US or EU. Where they do, we rely on UK-approved safeguards such as the UK International Data Transfer Addendum or adequacy regulations.

5. How long we keep it

• Member records: while you're a member, then 2 years after you leave, in case you rejoin or there's a claim.
• Health questionnaires and injury records: 6 years after you leave, for insurance and legal claims.
• Payment and accounts records: 6 years, as required by HMRC.
• CCTV: 30 days, unless needed for an incident.
• Leads who don't join: 12 months after our last contact.
• Children's details: 12 months after their last Mini Engine session.

6. Your rights

You can ask us to:

• give you a copy of your data
• correct anything that's wrong
• delete your data, where we don't need to keep it by law
• stop or limit how we use it, or object to it
• give your data to you in a format you can move elsewhere
• withdraw your consent at any time, for example for marketing, photos, cookies or Apple Health

Email info@the200strong.com. We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.

7. Keeping it safe

Your data is stored securely and encrypted when sent. Staff only see what they need for their role. Coaches and front desk never see payment details. Logins are personal, and we review access when staff leave.

8. Cookies and similar technology

In the app

The app only uses what it needs to work:

• Keeping you logged in: a secure sign-in token stored on your device.
• Your settings: such as your chosen view or a message you haven't finished, stored on your device.

We don't use advertising or tracking cookies in the app, and we don't track you across other sites. Because these are strictly necessary, we don't need to ask your consent. Logging out removes your sign-in token.

On our website

Our website pages (such as our membership, programme and offer pages) keep a note of which advert brought you to us, if any, for the length of your visit, so we can see which adverts work. This is stored only in your browser and is sent to us only if you fill in a form.

With your permission, we also use the Meta Pixel, a cookie from Meta (the company behind Facebook and Instagram). It tells us when someone who saw one of our adverts visits a page or fills in a form, so we can measure and improve our adverts. It only switches on if you tap Accept in the cookie banner. If you tap No thanks, it never loads.

You can change your choice at any time:

Change my cookie choice

Our online shop at shop.the200strong.com is run separately and has its own cookie settings.

You can also block or delete cookies in your browser settings. Some parts of the site may not work without them.

9. Children

Our memberships are for adults aged 18 and over. We only collect children's details from their parent or guardian, for Mini Engine sessions.

10. Changes

We'll update this policy when how we use data changes. Important changes will be shown in the app.