Privacy Notice — Gym of Thrones

This notice explains what personal information Gym of Thrones collects about you, why we collect it, how long we keep it, and the rights you have over it under the Data Privacy Act of 2012 (Republic Act No. 10173).

1. Who is responsible

Gym of Thrones — House of Fitness, 4th Floor, JWMGI Building, Taguig City, Philippines 1630, is the Personal Information Controller for the information described here.

For any privacy question or request, contact us at gymofthrones2023@gmail.com or 0966 205 9526, or speak to staff at the counter.

2. What we collect

Identity and contact — name, email address, mobile number, date of birth, and your member code.
Emergency contact — the name, number and relationship of someone we can call if you are hurt.
Membership and payment — your plan, term dates, payment amounts, method and reference numbers, receipts, and any statutory discount applied.
Senior citizen or PWD identification number, where you claim the statutory discount. We are required to record this for BIR reporting.
Attendance — the date and time of each visit, and how you checked in.
Technical — a one-way, salted hash of the network address a check-in came from. We deliberately never store the address itself.

Sensitive personal information

These get additional protection under §3(l) of the Act, and we collect them only with your consent:

Health information — any condition, injury or limitation you choose to tell us so we can keep you safe.
Body measurements — height, weight and any progress readings you record.
Photograph — your member photo, where you provide one, and CCTV footage of the premises.

3. Why we use it, and on what basis

To provide membership — admitting you, managing your plan, taking payment, and running classes. Basis: performance of our contract with you.
To keep you safe — emergency contact and health information. Basis: your consent, and protection of your vital interests.
To meet legal obligations — BIR records for payments and statutory discounts. Basis: compliance with law.
To secure the premises — CCTV, and detecting shared or misused member codes. Basis: our legitimate interests, balanced against your privacy.
To tell you things you need to know — closures, schedule changes, renewal reminders. Basis: performance of our contract.

We do not sell your personal information, and we do not profile you for advertising. We do not use automated decision-making that produces legal effects for you.

4. Who we share it with

We share only what is necessary, and only with:

our staff, according to their role — front desk staff see less than management;
our service providers, who process data on our instructions: our database and authentication host, our email provider, and our hosting platforms;
emergency and medical services, if you are injured;
government authorities, where the law requires it.

Some of these providers store data outside the Philippines. Where they do, we rely on their contractual data-protection commitments.

5. What we deliberately do not show

The screen at the front desk shows staff only what they need to admit you: your name, photo, member code and whether your membership is valid. Your phone number, email, address, payment history, health notes and emergency contact are deliberately excluded from that display, because it faces a public counter for the whole day.

6. How long we keep it

Membership and payment records — for the life of your membership and afterwards for as long as tax and accounting law requires.
Attendance records — for the life of your membership.
Check-in scan logs — deleted automatically within 24 hours.
Consent records — for as long as you are a member and a reasonable period after, since they evidence what you agreed to.
CCTV — overwritten on a rolling basis.

7. Your rights

Under the Data Privacy Act you have the right to:

be informed — which this notice provides;
access a copy of the personal information we hold about you;
correct anything inaccurate;
object to processing, or withdraw consent you previously gave;
erasure or blocking, where the information is unlawfully obtained, no longer necessary, or you have withdrawn consent;
data portability — a copy in a commonly used electronic format;
damages, where you suffer loss from a violation of your rights;
complain to the National Privacy Commission at privacy.gov.ph.

To exercise any of these, email us at gymofthrones2023@gmail.com. We will respond within a reasonable period. Note that withdrawing consent for health information may mean we can no longer safely provide coaching, and that we must keep payment records for the period tax law requires even after you leave.

8. How we protect it

Access is controlled by role, so staff see only what their job requires. Passwords are never stored by us — sign-in is handled by our authentication provider. Data is encrypted in transit. Network addresses are hashed with a secret salt so that even a copy of our database cannot be walked back to a real address.

9. Children

Members below 18 require a parent or guardian’s consent, which is given as part of joining. We do not knowingly collect information from children below that age without it.

10. Changes

We may update this notice. When we make a change of substance we will publish a new version and ask you to review it the next time you sign in. The version and date are shown at the top of this page.