Privacy Policy

Last updated: 5 October 2026

Who we are

Tim Jackson Fitness is operated by Timothy Jackson, who provides personal training and online coaching and is the data controller responsible for the personal information described in this policy. For privacy questions or requests, email info@timjacksonfitness.com.

Information collection and use

• Enquiries: your name, email, optional phone number, coaching interest and message, so we can reply and discuss your goals. Our website form sends enquiries to our business inbox. WPForms Lite does not store entries in the WordPress dashboard; copies may remain in email and backups.
• Coaching: contact details, goals, availability, exercise experience, training logs, measurements and check-ins, so we can deliver and adapt your service. You may choose to supply progress photos. We do not publish client photos or testimonials for promotional purposes without consent.
• Payments: bookings, invoices and transaction records for service administration and accounting. Card details are entered directly into Stripe; we do not receive or store full card details.
• Website: technical information such as IP address, browser/device details and security logs where recorded. Our Cookie Policy explains cookies.

Please do not send health details or progress photos through the initial enquiry form.

Our lawful bases for using information

We use information to take steps you request before a contract, perform our coaching contract, meet legal accounting duties, and pursue legitimate interests in website security, ordinary correspondence and handling complaints, balanced against your rights. Promotional use of client photos or testimonials requires separate permission.

• Contract and steps before a contract: responding to your requests about coaching, arranging and providing your service, and administering bookings and payments.
• Legal obligation: keeping accounting and tax records required by law.
• Legitimate interests: protecting the website, managing ordinary business correspondence and handling complaints, where those interests are not overridden by your rights.
• Consent: optional Google Analytics and promotional use of client photographs or testimonials. Health information requires an additional special-category condition, explained separately below.

Enquiries and service communications

We use your contact details to respond to enquiries and communicate with you about your personal training or coaching. We do not currently send promotional emails or newsletters. If we introduce email marketing, we will explain how it works and provide the choices and unsubscribe options required by applicable law.

Services for adults

Our personal training and coaching services are currently offered to adults aged 18 and over. If you believe a child has provided personal information through our website, please contact info@timjacksonfitness.com so we can review and handle it appropriately.

Health information and explicit consent

Health information you provide in the PAR-Q, health questionnaire, other relevant onboarding forms or during coaching is special-category personal information. We use relevant information to assess exercise readiness, adapt your training and provide your requested service safely. For this service use, we rely on our coaching contract under Article 6(1)(b) and your explicit consent under Article 9(2)(a). We obtain a separate active tick or signature, distinct from the exercise waiver and general terms, using the following statement:

I explicitly consent to Tim Jackson Fitness processing the health information I provide in the PAR-Q, health questionnaire, other relevant onboarding forms and during my personal training or coaching where necessary to assess exercise readiness, adapt my training and provide the service safely. I understand I can withdraw this consent, although this may mean Tim Jackson Fitness cannot continue providing training safely.

You may withdraw consent at any time by emailing info@timjacksonfitness.com. Withdrawal does not affect earlier lawful processing. If essential health information cannot be used, we will discuss your options and may be unable to continue training safely. Reading this policy or accepting the general terms does not itself provide explicit health-data consent.

For an actual or potential legal claim, we may retain or use necessary records under legitimate interests in Article 6(1)(f) and the legal-claims condition in Article 9(2)(f). We assess this separately; withdrawing consent does not require deletion of records that have another applicable lawful basis. Completed PAR-Qs, health questionnaires and other relevant onboarding forms containing health information are stored on a locked drive. Copies returned by email may also remain in our email account and provider backups.

Google Analytics

With your analytics consent, Google Analytics 4 measures website visits, page views, referral sources and general device/browser information to help us improve the website. It uses online identifiers and technical information, including IP information processed by Google. We do not send enquiry contents, card details or health information through this setup. Automatic enhanced measurement is off. You can withdraw consent using the cookie preferences icon; the page reloads to apply the change.

User and event data retention is set to two months, with reset on new user activity off. These controls do not cover most aggregated standard reports. Analytics cookie duration is separate and normally up to two years. Google may process data internationally; see Google’s Privacy Policy.

Providers and overseas processing

We use Everfit for coaching and Stripe for card payments. Relevant information is shared for the service involved. Advisers, insurers or authorities may receive information where needed for advice, claims or legal requirements. We do not sell your personal information.

Everfit processes coaching information on our behalf where it acts as a processor; it also has its own responsibilities for information it collects as an independent controller. Its Data Processing Agreement describes these roles and international processing, including in the United States, and refers to standard contractual clauses. You can ask us for information about the safeguards applicable to your data.

The website uses locally hosted fonts, so displaying these fonts does not require a connection to Google’s font servers. Our providers may process information outside the UK, including in the United States.

Stripe’s Data Processing Agreement incorporates its Data Transfers Addendum, which provides for the Data Privacy Framework and, where applicable, standard contractual clauses with the UK International Data Transfer Addendum.

Google Analytics is covered by Google’s Ads Data Processing Terms. Google describes its applicable transfer mechanisms, including the UK Extension to the EU–US Data Privacy Framework and contractual safeguards where applicable, in its international transfer information.

Links to other websites

Our website may include links to third-party websites, including Facebook and Instagram. Clicking these links takes you to websites operated by those providers, whose privacy policies apply to your use of their services.

We do not control the content or privacy practices of those websites. Please review their privacy policies before providing personal information.

Retention of information

We keep information only for as long as needed for its purpose, applicable legal duties and justified claims, then securely delete or anonymise it. Our normal retention periods are:

• Unsuccessful enquiries: up to 12 months.
• Client, coaching and relevant onboarding records (including PAR-Qs and health questionnaires): throughout the client relationship and normally up to six years afterwards where needed for contractual, safety, insurance or potential legal claims. This is not a blanket legal requirement to retain every item for six years.
• Progress photographs used only for coaching: deleted within 12 months after coaching ends.
• Promotional photographs and testimonials: we review permission at least every two years and remove material from channels we control when permission is withdrawn. We may retain a minimal permission or withdrawal record where needed to demonstrate how we handled your request or deal with legal claims.
• Financial records: retained for the applicable tax and accounting requirements.
• Marketing opt-out records: minimal information may be retained to honour marketing preferences.
• Google Analytics: user and event data retention is set to two months; analytics cookie duration is separate and normally up to two years, as explained above and in our Cookie Policy.

Records relating to an accident, complaint, dispute or actual or potential claim may need to be retained for longer where justified. Deletion from an active system may not immediately remove copies in provider backups; these remain subject to the provider’s backup and deletion arrangements.

Security and your rights

We use appropriate access controls and secure storage, but no system is completely risk-free. Depending on the circumstances, you can request access, correction, deletion, restriction or transfer of your information, object to certain uses, and withdraw consent. Some rights have legal exceptions. Email us to make a request. You can also complain to the Information Commissioner’s Office.

We will update this notice when our practices change.