Privacy Policy

Ohana Barbell ("we", "us", "our") operates from 41a Newton Street, Manchester, M1 1FT. We are committed to protecting the privacy of our members, visitors, and customers. This policy explains what personal data we collect, why we collect it, and how it is used, stored, and protected in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We may collect and process the following types of information:

• Contact details: name, email address, and phone number, submitted via our enquiry form, return form, or when you sign up for a membership or day pass.
• Membership information:details relating to your membership and attendance, collected when you join through ClubWise or in the gym. This website does not collect health questionnaires. Please do not send medical information through the enquiry form.
• Order information: when you purchase from the Ohana Store, we collect billing and delivery details and order history. Payments are processed securely by our third-party payment provider; we do not store full card details.
• Technical information:standard web log data such as IP address, browser type, device information, and pages visited, collected automatically when you use our website.

We use the information we collect to:

• Respond to enquiries and provide the information you request.
• Set up and manage gym memberships and day passes.
• Process and fulfil orders placed through the Ohana Store.
• Send important updates about your membership, bookings, or orders.
• Improve our website, services, and facilities.
• Meet our legal, accounting, and regulatory obligations.

We use contact and order details to take steps you request before entering a contract and to perform purchases and membership agreements. We process records required for tax and accounting to meet legal obligations. We rely on our legitimate interests to answer general enquiries, secure our services and resolve disputes, balancing those interests against your rights. Optional website analytics relies on consent, which you can withdraw through our Cookie Policy.

This website does not collect health or medical data. If ClubWise or an in-gym form asks for health information to provide membership safely, that collection must state its purpose and the extra UK GDPR condition it relies on at the point you give the information.

Our website uses essential cookies and local storage to make core functionality work (such as remembering items in your basket) and, only with your consent, analytics cookies to help us understand how visitors use the site. See our Cookie Policy for full details and how to manage your preferences.

We do not sell your personal data. We share information with the providers this website actually uses, only where needed for the purpose described:

• Stripe: store checkout, card payments, order, billing and delivery details, and stock records. We do not store full card numbers; Stripe collects those in its payment fields.
• Resend: enquiry and return requests (name, email, and message) to our support inbox, and order confirmation, shipping and cancellation emails.
• Supabase: website content, images, size guides, order-fulfilment notes, and staff sign-in. Customer store orders are not stored as a separate customer database in Supabase; they are held with Stripe.
• Vercel: website hosting, request handling and, if you accept analytics, Vercel Web Analytics.
• Google: Google Analytics, only after you accept analytics; and Google Maps when you view the map on our visit section.
• ClubWise Software Ltd:membership and day-pass joining. Join links open ClubWise's own service at secure10.clubwise.com. Membership applications, online day passes, and member records are collected on ClubWise, not through our checkout. Day passes can also be bought in gym.
• Delivery and courier services, to fulfil store orders.
• Regulatory or law enforcement bodies, where we are required to do so by law.

These providers are only permitted to use the information to provide their service to us, except where they act as an independent controller (for example Google Analytics under Google's measurement terms, or Stripe for some payment-regulatory processing).

We are established in the United Kingdom. Some of the providers above process personal data in, or can access it from, countries outside the UK, including the United States. Where a transfer is not covered by UK adequacy regulations, we rely on the safeguards those providers publish: typically the UK Extension to the EU–US Data Privacy Framework, the EU Standard Contractual Clauses, and the UK International Data Transfer Addendum (or International Data Transfer Agreement). Those documents sit in each provider's terms or data processing agreement. The locations below are taken from this website's code and from each provider's public terms, not from a separate audit of live dashboards.

• Stripeprocesses payments through its global platform. For UK businesses this includes Stripe entities in the UK and Ireland, with further processing in the United States and other Stripe locations as needed to complete a payment. Stripe's Data Processing Agreement includes the UK International Data Transfer Addendum and EU Standard Contractual Clauses, and Stripe, LLC is certified under the UK Extension to the EU–US Data Privacy Framework.
• Resendstores account data, email metadata, logs and API records in the United States, even if a message is sent from another region. This site does not configure a non-US sending region. Resend's Data Processing Addendum includes Standard Contractual Clauses, and Resend is certified under the EU–US Data Privacy Framework and the UK Extension.
• Supabasehosts the project's database, authentication and storage in AWS London (eu-west-2). Backups, logs, support access and subprocessors can involve processing outside that region, including by US entities. Supabase's Data Processing Addendum includes the EU Standard Contractual Clauses and the UK Addendum.
• Vercelhosts this site on a global network. This codebase does not set a function region, so serverless processing follows Vercel's platform default, which Vercel documents as the United States, with content also served from other locations. Vercel states that its primary processing facilities are in the United States. Vercel's Data Processing Addendum (for eligible plans) includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
• Googleprocesses Analytics data as a controller under Google's measurement terms. For UK users the relevant Google entity is Google LLC in the United States. Transfers are covered by Google's UK Standard Contractual Clauses and by Google LLC's certification under the UK Extension to the EU–US Data Privacy Framework. The Google Maps embed may also send technical data such as IP address to Google, including in the United States. See Google's privacy policy and how Google uses data on partner sites.
• ClubWiseis ClubWise Software Ltd, a UK company based in Princes Risborough. Joining happens on ClubWise's UK membership service. ClubWise's public website privacy notice does not itself govern gym member records; those are handled under ClubWise's managed-services agreement with us. ClubWise publicly operates with an affiliated development and support company in India (Clubwise Development India Private Limited). Support work from India is an international transfer covered by that agreement and its safeguards.

You can read more in Stripe's privacy policy, Resend's privacy policy, Supabase's privacy policy, Vercel's privacy policy and ClubWise's privacy notice.

We keep personal data only for as long as needed for the purpose it was collected, including UK tax, accounting and legal requirements:

• Enquiries: kept in our support inbox until we have answered and closed the query, then deleted unless we still need the message for a complaint, dispute or to show how the request was handled.
• Store orders: payment, billing, delivery and order records are held by Stripe and in our order emails for six years from the end of the tax year of the transaction, which is the usual UK period for tax and accounting records.
• Staff accounts: kept while the person is authorised to manage this website, then deleted when that access is removed.
• Analytics: Google Analytics cookies last one year. We do not keep a separate analytics customer database. Vercel Web Analytics does not store personal identifiers.
• Browser storage: the site-access cookie lasts 30 days. Your basket, delivery-country preference and analytics choice stay in local storage until you clear them or change them.
• Membership records:held by ClubWise while you are a member. After you leave, we keep what we still need for UK tax, accounting and legal claims (typically up to six years for payment records). ClubWise's published retention for a gym that stops using ClubWise is: archive the database within four weeks of that contract ending, hold the archive for three months, then delete it. You can ask us to erase your own record sooner where the law allows.

Under UK data protection law, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data, where applicable.
• Object to or restrict how we process your data.
• Request a copy of your data in a portable format.

To exercise any of these rights, please contact us using the details below. If you are unhappy with how we have handled your data, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Our facilities and services are intended for adults. Where a junior membership or activity involves a minor, information is provided and managed by a parent or legal guardian, and is used solely for the purpose of administering that membership safely.

We may update this privacy policy from time to time to reflect changes in our practices or for legal and regulatory reasons. Any updates will be posted on this page with a revised effective date.

If you have any questions about this policy or how your data is handled, please get in touch by email at aloha@ohanabarbell.com, by phone on +44 161 547 3340, or by post at 41a Newton Street, Manchester, M1 1FT.