Statutory basis: UK GDPR, Art. 13(1)(a)-(b) — the identity and contact details of the controller (and DPO, if any) must be stated.
Active Locker, operated by [COMPANY LEGAL NAME], is the data controller. Data protection contact: [DPO / CONTACT NAME & EMAIL]. ICO registration number: [ICO REGISTRATION NUMBER]. General contact: info@activelocker.co.uk.
Statutory basis: UK GDPR, Art. 13(1)(c) and Art. 6 — purposes and legal basis for each category of processing must be disclosed.
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password (hashed) | Create and manage your account | Contract |
| Payment data (via Stripe) | Process your Membership Fee | Contract |
| Verification documents / claimed gym | Verify eligibility, prevent fraud | Contract; Legitimate interests (fraud prevention) |
| Usage data (pages, clicks, device) | Improve the service, measure Offer engagement for Partners | Legitimate interests |
| Marketing email preferences | Send renewal reminders, optional marketing | Contract (renewal); Consent (marketing) |
Statutory basis: UK GDPR, Art. 13(2)(f) — where automated decision-making with legal or similarly significant effects occurs, the logic and consequences must be disclosed, and a right to human review provided.
Verification submissions may be assisted by automated checks (e.g. flagging low-confidence document reads), but at current scale, the decision to approve or reject a submission is made by a human reviewer, not solely by automated means. If this changes as the platform scales, this section will be updated to describe the automated logic and your right to request human review of any automated decision.
Statutory basis: UK GDPR, Art. 13(1)(e) — recipients or categories of recipients must be disclosed.
Statutory basis: UK GDPR, Art. 13(1)(f) and Art. 44-49 — if data leaves the UK/EEA, the safeguard relied upon (e.g. adequacy decision, Standard Contractual Clauses) must be stated.
Some of our service providers (e.g. Stripe, Supabase, and any hosting/CDN infrastructure) may process data outside the UK. Where this happens, transfers are made under appropriate safeguards such as Standard Contractual Clauses or an applicable adequacy decision.
Statutory basis: UK GDPR, Art. 13(2)(a) — the retention period, or criteria for determining it, must be disclosed.
We retain account and verification data for the duration of your membership, plus [RETENTION PERIOD, e.g. 24 months] after cancellation, to handle disputes, meet financial record-keeping obligations, and deter repeat fraudulent signups.
Statutory basis: UK GDPR, Art. 13(2)(b)-(d) — the existence of each right, and the right to complain to the ICO, must be stated.
See our Cookie Policy for full detail.
This service is not intended for anyone under 18. We do not knowingly collect data from children and will delete it if we become aware of it.