Privacy notice — High Rep Society

01Who we are

The High Rep Society is a fitness coaching business run by Christian in Newmarket, Suffolk (“we”, “us”). We decide how your personal information is used, which makes us the controller under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Seigaiha Studio builds and runs our website, the THRS app and our back office. It handles your information only on our instructions, as our processor.

Questions about your information, or a request under your rights: [email protected].

02What we collect

Enquiries: your name, email and/or phone number, what you’re interested in, your message, how you’d like a reply, and whether you agreed to texts.
Training (members): your account details, programmes, the sessions you log (weights, reps, times), check-ins, progress and messages with Christian.
Health information: injuries, pain, medical conditions or body measurements, only when you choose to share them.
Payments: your plan, invoices and payment status. Card details are handled by our payment provider; we never see or store your full card number.
Website use: the pages you visit, clicks and how far you scroll, your type of device, your approximate location (country) and the site or campaign that sent you.

03Why we use it, and our lawful basis

To answer your enquiry and arrange a first session: our legitimate interest in replying to a request you made, and steps you asked for before joining.
To coach you and run your membership and the app: to perform our contract with you.
Health information is “special category” data. We use it only with your explicit consent: the optional tick box on our form, or when you join. You can withdraw it at any time; we’ll then stop using it, which may make your coaching less tailored.
Texts: only if you ticked the box to agree. Reply STOP to any text, or tell us, and we’ll stop.
Payments and records: to perform our contract, and to meet our legal duties (for example, tax records).
Website analytics: our legitimate interest in understanding how the site is used so we can improve it.
In an emergency during training, we may share relevant information with emergency services to protect your vital interests.

We don’t sell your information, we don’t add you to a mailing list, and we won’t send you marketing unless you ask for it.

04Analytics and cookies

We don’t use advertising cookies or third-party trackers. Our own analytics keeps a random ID in your browser’s session storage, which is deleted when you close the tab, and records the pages you view, clicks and how far you scroll.

Signing in to the app sets a cookie that is needed to keep you signed in.

You can switch analytics off on this device below. We also respect Global Privacy Control.

05Who we share it with

Only the providers we need to run the service, under contracts that require them to protect your information and use it only for us:

Seigaiha Studio: builds, hosts and maintains the website, the app and our back office.
OVHcloud: server hosting (data centre in Singapore).
Cloudflare: network, security and delivery of the website.
Resend: sends email notifications, such as the alert Christian gets when you send an enquiry.
AI services that help Christian organise notes and draft replies and training plans. Only what the task needs is sent.
Stripe, when online payments are switched on, to take card and Direct Debit payments.

We may also share information when the law requires it, or with professional advisers such as an accountant.

06International transfers

Our main server is in Singapore, and some providers (for example Cloudflare and Resend) may process information in the United States or elsewhere. These countries aren’t covered by UK “adequacy” regulations, so we rely on the safeguards the UK GDPR allows: the ICO’s International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, in our contracts with these providers.

You can ask us for more detail or a copy of the relevant safeguard.

07How long we keep it

Enquiries that don’t lead to training: up to 12 months after our last contact.
Training data, check-ins and health information: while you’re a member and for up to 12 months after you leave, then deleted or anonymised. Sooner if you ask.
Payment and invoice records: 6 years, as tax law requires.
Website analytics: up to 2 years.

08Your rights

You can ask us to:

give you a copy of your information
correct anything that’s wrong
delete your information
restrict or object to how we use it
send your information to you or another provider in a usable format
stop using information you gave consent for (withdrawing consent doesn’t affect what we did before)

Email [email protected]. It’s free, and we’ll reply within one month. We may need to confirm it’s you first.

09Complaints

If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.

10Under 18s

Our services are for adults. Anyone under 18 trains with us only with a parent or guardian’s consent, and the parent or guardian should contact us on their behalf.

11Changes to this notice

We’ll update this page when anything changes and show the date at the top.