At Amazing Fitness Gym, we take your privacy seriously. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website, gym services, and online store. We are committed to complying with applicable data protection regulations in the United Republic of Tanzania.
1Information We Collect
1.1 Personal Information
When you register for a membership or create an account, we collect:
Full name, date of birth, and gender
Email address and phone number
Residential address and occupation
Emergency contact name and phone number
Username and encrypted password
1.2 Health Data (Sensitive Information)
To provide personalized fitness services, we collect health-related information, including:
Weight, height, and calculated BMI
Existing medical conditions (e.g., asthma, heart conditions, previous injuries)
Exercise intentions and recommended programs
Health tracking progress over time
This information is collected with your explicit consent during the membership onboarding process and is used solely to customize your fitness experience and ensure your safety.
1.3 Payment Information
When you make a payment for memberships, clothing, or food products, your payment is processed securely through AzamPay, our third-party payment processor. We do not store your full credit card numbers, bank account details, or mobile money PINs on our servers. AzamPay handles this data in accordance with their own security standards and privacy policy.
1.4 Biometric Data
Our facility uses biometric identification (fingerprint scanning) for secure member access and attendance tracking. Biometric data is collected with your consent and stored in an encrypted format. This data is used solely for identity verification and attendance purposes and is never shared with third parties.
1.5 Usage and Technical Data
We automatically collect certain technical information when you visit our website:
IP address and browser type
Pages visited and time spent on our site
Device information (mobile or desktop)
Approximate location based on IP
1.6 Communication Data
We collect records of communications you have with us, including SMS messages sent for verification and notifications, push notifications delivered through Firebase Cloud Messaging, and email correspondence.
2How We Use Your Information
Providing Services: To manage your membership, schedule classes, create workout plans, and track your fitness progress.
Processing Payments: To process membership fees and product purchases through AzamPay.
Health & Safety: To customize exercise programs based on your health data and alert staff to any medical concerns.
Communications: To send you SMS verification codes, push notifications about classes and offers, and important account updates.
Security: To verify your identity through biometric data, monitor for unauthorized access, and protect your account.
Improvement: To analyze usage patterns and improve our services, website functionality, and user experience.
Legal Compliance: To comply with legal obligations and respond to lawful requests from authorities.
3Legal Basis for Processing
We process your personal data under the following legal bases:
Consent: For health data collection, biometric data, and marketing communications. You may withdraw consent at any time.
Contract Performance: For processing membership, billing, and service delivery data necessary to fulfill our agreement with you.
Legal Obligation: For retaining financial records and complying with Tanzanian law.
Legitimate Interest: For security monitoring, website analytics, and service improvement.
4Data Sharing & Third Parties
We do not sell your personal data to any third party. We share data only with the following trusted service providers who help us operate our business:
Third Party
Purpose
Data Shared
AzamPay
Payment processing
Transaction details, name, phone
Firebase / Google
Push notifications
Device token, notification data
SMS Provider (Beem)
SMS verification & alerts
Phone number, message content
Cloud Hosting Provider
Website & database hosting
All stored data on our servers
Each third party processes data in accordance with their own privacy policies and applicable laws. We ensure that data sharing agreements are in place with all providers.
5Data Security
We implement robust technical and organizational measures to protect your personal data:
Encryption: Sensitive data is encrypted using industry-standard encryption keys.
Access Controls: Role-based access control ensures that only authorized staff (admin, manager, trainer, reception) can access specific data.
Secure Authentication: Login systems include CSRF protection, rate limiting, account lockout after failed attempts, and session security.
Audit Logging: We maintain logs of critical actions (logins, user changes, sales) for security monitoring.
Despite our efforts, no method of transmission over the Internet or electronic storage is 100% secure. In the event of a data breach, we will notify affected users and relevant authorities as required by law.
6Data Retention
We retain your personal data only for as long as necessary:
Membership data: For the duration of your membership plus 3 years after termination for legal and accounting purposes.
Health data: For the duration of your active membership. You may request deletion upon leaving.
Payment records: Retained for 7 years as required by Tanzanian tax and financial regulations.
Biometric data: Deleted within 30 days of membership termination upon request.
Usage logs: Retained for 12 months for security analysis.
7Your Rights
You have the following rights regarding your personal data:
Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data (subject to legal retention requirements).
Right to Withdraw Consent: Withdraw consent for processing health data, biometric data, or marketing communications at any time.
Right to Object: Object to processing of your data for marketing or legitimate interest purposes.
Right to Data Portability: Receive your data in a structured, machine-readable format.
To exercise any of these rights, please contact us using the details in Section 10 below.
8Cookies
Our website uses cookies and similar technologies to maintain login sessions, remember preferences, and analyze traffic. You can control cookies through your browser settings. Disabling cookies may affect some website functionality.
9Children's Privacy
Our services are primarily intended for individuals aged 16 and above. For members under 18, parental or guardian consent is required. We do not knowingly collect personal data from children under 16 without verified parental consent. If you believe we have collected data from a child without consent, please contact us immediately.
10International Data Transfers
Some of our service providers (e.g., Firebase/Google for push notifications) may process data on servers located outside Tanzania. By using our services, you acknowledge that your data may be transferred to and processed in countries with different data protection laws. We take steps to ensure that such transfers comply with applicable data protection standards.
11Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Significant changes will be communicated through email or push notifications where possible.