Privacy Policy
CrossFit Tooting & CrossFit Streatham
Last updated: 10 October 2026
This policy explains what personal information we collect, why we collect it, how we look after it and what your rights are. It covers our members, people who book a trial or enquire, MakeMomStrong clients, parents using our crèche, and visitors to our websites.
1. Who we are
CrossFit Tooting and CrossFit Streatham are run by Xfit Tooting Ltd, a company registered in England and Wales (company number 09248966). Our registered office is at 22a Langroyd Road, London SW17 7PL.
Xfit Tooting Ltd is the "data controller" for your information. This means we decide how and why it's used.
If you have any questions about this policy or your data, contact us:
2. What information we collect
Contact and account details
Name, email, phone number, address, date of birth
Emergency contact details
Membership and booking information
Your membership type, bookings, attendance, cancellations and no-shows
Training records you choose to log in our app, such as scores and personal bests
Payment information
Billing history and payment status
Card and bank payments are processed securely by our payment provider. We don't store your full card or bank details ourselves.
Health information
Injuries, medical conditions, pregnancy and postnatal information that you share with us, for example on a health questionnaire or with your coach
For MakeMomStrong, this may include postnatal recovery information
Location data (only if you turn it on)
If you allow location access in our booking app, it can sign you in automatically when you arrive at the gym. This is optional and you can switch it off at any time in your phone settings.
Children's information (crèche)
If you use our crèche, we collect your child's name, age, and any allergies, medical needs or care instructions you give us
Marketing and enquiries
Details you give us when you book a trial, fill in a form, or message us by email, WhatsApp or social media
Your marketing preferences
Website and photos
Basic website usage information collected through cookies (see section 9)
Photos and videos taken at the gym or at events, for example for our social media
3. Why we use your information
We only use your information when we have a lawful reason. The table below shows each purpose and the legal basis we rely on.
You can withdraw your consent at any time by contacting us. This won't affect anything we did before you withdrew it.
4. Who we share your information with
We never sell your data. We only share it with trusted providers who help us run the business. They may only use it for the service they provide to us.
Booking and membership software: WodBoard (and Wodify until 31 October 2026)
Payment processing: Stripe and SumUp
Email and documents: Google Workspace
Sales and follow-up messages: Pipedrive, Make.com and Jenny AI (including WhatsApp messages)
Our websites and online forms: Wix
Advertising and social media: Meta (Facebook and Instagram) and Google
Internal team communication: Slack (limited details, such as names of people booked onto trial classes)
Physiotherapy partners: only with your consent, for example for MakeMomStrong Mommy MOT referrals
Our accountants and professional advisers: where needed for tax, legal or accounting purposes
Authorities: if we are legally required to share information
5. International transfers
Some of our providers store data outside the UK, for example in the US or the EU. Where this happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, standard contractual clauses, or the UK–US Data Bridge.
6. How long we keep your information
Membership and attendance records: for as long as you're a member, then up to 2 years after you leave
Financial and payment records: 6 years, as required by law
Health information: for as long as you're a member, then up to 2 years after you leave
Trial and enquiry details (if you don't join): up to 2 years from your last contact with us
Crèche records: up to 2 years after your child last attends
After these periods, we securely delete or anonymise your information.
7. Your rights
Under UK data protection law, you have the right to:
ask for a copy of the information we hold about you
ask us to correct anything that's wrong
ask us to delete your information
object to how we use your information, including for marketing
ask us to restrict how we use your information
ask us to transfer your information to another organisation
withdraw your consent at any time
To use any of these rights, email us at the addresses in section 1. We'll reply within one month. There's normally no charge.
8. Keeping your information safe
We use reputable, secure software providers and limit staff access to what each person needs for their role. Health and crèche information is only shared with the coaches and staff who need it to look after you or your child.
9. Cookies
Our websites use cookies to work properly and to understand how visitors use them. You can manage your cookie preferences through the banner on our website or in your browser settings.
10. Making a complaint
If you're unhappy with how we've handled your information, please talk to us first and we'll do our best to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO):
ico.org.uk
0303 123 1113
11. Changes to this policy
We may update this policy from time to time. We'll let members know about any important changes by email or in our app. The latest version will always be on our website.