Top Gym Privacy Notice
1. Purpose of this Notice
This Privacy Notice explains how Top Gym collects, uses, stores, shares and protects personal data relating to prospective members, members, guests, class participants, personal-training clients, website visitors and other people who interact with us.
We process personal data in accordance with applicable UAE data-protection law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL").
2. Personal data we collect
Depending on how you interact with Top Gym, we may collect:
- identity and contact data, including your name, date of birth, nationality, gender, telephone number, email address, residential address and emergency-contact details;
- a temporary image of your Emirates ID and the information visible on it, where required for our membership application and identity-verification process. We do not retain a copy after verification is complete;
- membership and service data, including your application, membership type and status, contract records, access credentials, class bookings, personal-training sessions, attendance and facility-access records;
- payment and transaction records, including the details needed to record membership, class or personal-training payments and any refunds or outstanding balances;
- health, fitness and wellness data that you choose to provide or that is generated through services you choose to use, including InBody scan results (such as weight, BMI, body-fat percentage, muscle mass and visceral-fat data), fitness goals, exercise programmes, trainer notes and relevant health information;
- communications, including emails, WhatsApp messages, calls, enquiries, feedback and complaints;
- security and premises data, including CCTV footage, incident records, visitor records and, where offered, Wi-Fi or website usage data and cookies.
3. Sources of your personal data
We collect personal data directly from you, including when you enquire, apply for membership, enter into a membership agreement, attend the gym, book a class or contact us. We may also receive limited data from an authorised family member, corporate account holder, trainer, payment provider, partner or another person acting with your authority.
4. Why we use your personal data
We use personal data only where necessary and for purposes including:
- considering and processing membership applications, temporarily verifying identity and preventing membership or access fraud;
- entering into, performing and administering membership, class, personal-training and other service arrangements;
- creating and managing your membership, access credentials, bookings, attendance and use of facilities;
- providing InBody, fitness, personal-training and wellness services that you request;
- recording payments, handling accounts, refunds, complaints, disputes and legal claims;
- maintaining the safety, security, cleanliness and proper operation of our facilities, members, guests, staff and equipment;
- communicating with you about your application, membership, bookings, services, safety and operational matters;
- operating, maintaining, securing and improving our CRM, website and other systems;
- complying with applicable legal, regulatory, accounting and record-keeping obligations; and
- establishing, exercising or defending legal rights and responding to lawful requests from competent authorities.
We do not currently use your personal data for direct marketing. If that changes, we will obtain any consent required by law separately from membership or service communications.
5. Our legal basis for processing
Where applicable under the PDPL, we process personal data with your consent or because processing is necessary to take steps at your request before entering into an agreement, perform or administer our agreement with you, comply with a legal obligation, protect our legitimate rights and interests, protect a person's vital interests, or establish, exercise or defend legal claims.
For an Emirates ID image, the relevant purpose is identity verification while assessing and administering your membership application and, if accepted, your membership. Before you provide the image, we will give you a clear notice of this processing. By sending the image after receiving that notice, you acknowledge and authorise Top Gym to receive, view and use it for that verification purpose. We do not retain the image after verification is complete.
Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect processing already carried out lawfully before withdrawal, and may mean that we cannot provide a particular optional service. If the relevant processing is necessary to consider or administer your membership, withdrawal may prevent us from accepting or continuing that membership.
6. Health and fitness data
Health and fitness information, including InBody results and trainer notes, is handled with enhanced care. We collect and use it only where you choose to use the relevant service, for the purposes explained to you, and with the consent or other safeguards required by applicable law. Please do not provide medical information that is not reasonably relevant to a service you request.
7. Who may receive your personal data
We may disclose personal data on a need-to-know basis to:
- authorised Top Gym personnel, including membership, operations, training, customer-service, finance and management staff;
- WhatsApp Business and its group companies, to the extent they provide the communications service through which you choose to send us messages or documents;
- Simplar, our CRM service provider, and authorised subcontractors that provide hosting, support, development, security or related services for Top Gym, subject to confidentiality and data-protection obligations;
- payment, accounting, legal, insurance, IT, communications, security and professional service providers where necessary for the purposes in this Notice;
- competent governmental, regulatory, judicial or law-enforcement authorities where legally required or permitted; and
- another person where you have directed us to do so or where disclosure is otherwise permitted by law.
Top Gym's brand partners may scan or verify a membership QR code to confirm eligibility for a partner offer. They are not provided with your personal data merely because they verify that membership status.
We do not sell personal data.
8. International transfers
Our CRM is provided by Simplar. We also use WhatsApp Business for member communications. The infrastructure or authorised support personnel used by these providers may be located outside the UAE. Where personal data is transferred outside the UAE, we will take the steps required by applicable law to ensure an appropriate level of protection, including contractual, organisational and technical safeguards, and will provide further information on request where required.
9. How long we keep personal data
We keep personal data only for as long as necessary for the purposes described in this Notice, including to meet legal, accounting, tax, fraud-prevention and dispute-resolution requirements.
Top Gym does not retain an Emirates ID image after identity verification is complete. The image is deleted from Top Gym's WhatsApp Business account and any local downloads as soon as practicable after verification, and no later than the end of the same business day. We retain only a limited verification record, such as confirmation that identity was verified, the date and the authorised staff member who completed it.
As a general rule, we retain membership records and the limited verification record for the membership period and six years after the membership ends. We may retain data longer where a legal obligation, ongoing dispute, claim, investigation or other lawful reason requires it. We then securely delete, anonymise or archive the data as appropriate.
10. Security
We use reasonable technical, organisational and physical safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These include access controls, role-based access, secure systems and staff confidentiality obligations. Emirates ID images received through WhatsApp Business are accessible only to authorised staff for the short verification period and are promptly deleted after verification. No system can be guaranteed completely secure; please take care when sending personal data to us, including through WhatsApp.
11. Your rights
Subject to the PDPL and any applicable exceptions, you may request:
- information about the personal data we process and the purposes of processing;
- access to, or a copy of, your personal data;
- correction of inaccurate or incomplete personal data;
- deletion of personal data where it is no longer needed or where applicable law otherwise requires deletion;
- restriction or cessation of certain processing;
- transfer of your data where applicable and technically feasible;
- withdrawal of consent where we rely on consent; and
- a review of certain decisions based solely on automated processing, where applicable.
To exercise a right or raise a privacy concern, email info@topgym-dxb.com. We may need to verify your identity before acting on a request. You may also have the right to lodge a complaint with the UAE Data Office or another competent authority.
12. Children and young people
If we offer membership or services to a person under the age at which they may lawfully provide consent under applicable law, we will require consent and involvement from their parent or legal guardian where required. Parents and guardians are responsible for ensuring that the personal data they provide is accurate and for supervising the young person's use of our services.
13. CCTV, website, Wi-Fi and cookies
We use CCTV in and around appropriate areas of our premises for safety, security, incident prevention and investigation. CCTV is not used in changing rooms, showers, toilets or sauna areas.
Our website and Wi-Fi services may use essential cookies, logs and similar technologies to operate securely, remember settings, diagnose technical issues and understand general usage. Where consent is required for non-essential cookies or similar technologies, we will ask for it separately.
14. Changes to this Notice
We may update this Notice from time to time to reflect changes in our services, systems or legal obligations. The latest version will be made available through our website, reception or on request. Material changes will be communicated where required by law.
15. Contact us
For any question about this Notice or how we process personal data, contact: