Privacy Policy

Beyond Calisthenics Gym is a fitness training facility registered and operating in the Kingdom of Bahrain (CR No. 161081-1). For data-related matters, you can contact us at info@beyondcalisthenics.com, or by post at Once Mall, Second Floor, Unit 210, Building 69, Road 4108, Isa Town, Bahrain.

We collect the following categories of personal data:

• Identity data: Full name, date of birth (for minors' programmes), emergency contact details.
• Contact data: Email address, phone number.
• Booking data: Class type, session date and time, attendance history.
• Payment data: Transaction references and payment method type. We do not store full card numbers. Payment processing is handled securely by Tap Payments and Benefit Pay.
• Health & waiver data: Any medical conditions or physical limitations you disclose when completing our membership registration and liability waiver.
• Technical data: browser or device type and the page or screen where a fault occurred, collected automatically when our website or app encounters an error.
• Sign-in records: the IP address and the browser or device identifier recorded each time you sign in to your account, stored alongside that sign-in as a security record.
• Email delivery records: for each message we send about your account, the address it was sent to, the subject line, the type of message, whether it was delivered, bounced or reported, and, for a failed message, the reason we were given. We do not store the subject line of sign-in or password messages, since it contains a one-time code, and we never store the body of these messages.
• Staff activity records: when someone on our team changes something on your account — such as your name, your membership plan, your class credits, a discount applied to you, a booking, whether your account is archived, whether your training streak is on hold, the access level on your account, income recorded against you such as a personal training session, or a decision on a request you made to close your account — we record which of them did it, what was changed, whether it went through or was refused, and the date and time. Not every refused attempt leaves a record, though: one our system rejects as invalid never gets that far. Some of these records name you, either in a short description of the change such as “granted 8 credits to Sara Ahmed” or because your name is what was changed; the rest identify you only by an internal reference. We also record it when one of them sends you a message by hand: who sent it, when, and — for a message written to you alone — your name. We do not record what it said, and a message sent to everyone booked on a class records only how many people it reached. Its subject line is kept with the email delivery records above, under their shorter period. We keep the same record when one of them changes the class timetable or a discount code, or records the academy's own costs and income — the rent, a utility bill, what our payment provider charges us — but a record of that kind names no member and identifies our own staff only by an internal reference. Our team has no way to change your health information, CPR number or emergency contact details, so these records never contain them.

We use your personal data to:

• Process class bookings and manage your membership account.
• Process payments through Tap Payments and Benefit Pay.
• Send booking confirmations, schedule updates, and service communications.
• Maintain liability waiver records as required for participant safety.
• Diagnose technical faults in our website and app using automated error reports, which we configure to exclude your personal details.
• Keep your account secure and investigate unauthorised access, using the sign-in records described above.
• Detect when messages we send you are not arriving, so we can correct your contact details and make sure you receive booking confirmations, invoices and reminders.
• Keep a record of the changes our team makes to member accounts, so we can answer questions about your plan, credits or discounts, correct mistakes, and hold our own team accountable for what they change.
• Comply with our legal obligations under Bahraini law.

We do not use your personal data for automated decision-making or profiling.

We process your data on the following legal grounds:

• Contract performance: To deliver the services you have booked and paid for.
• Legitimate interests: To improve our services, communicate operational updates, maintain the safety of our facility, and protect member accounts against unauthorised access.
• Legal obligation: To comply with Bahraini regulations, including the PDPL 2018.
• Consent: Where you have provided explicit consent, such as for optional marketing communications.

We share data only with trusted processors who handle it strictly on our behalf:

• Tap Payments: online and in-person payment processing.
• Benefit Pay: local payment processing.
• Resend: delivery of booking confirmations and service emails.
• Sentry: automated error and performance monitoring for our website and app. Reports are configured to exclude names, contact details, CPR numbers, dates of birth and health information; where an account must be identified, only an internal account reference is sent. Data may be processed outside Bahrain.
• Vercel and Railway: hosting for our website, booking system and database. Data may be processed outside Bahrain.

We do not sell, rent, or trade your personal data to any third party.

Our website uses cookies only for core functionality: keeping you signed in and keeping your session secure. We do not use advertising or tracking cookies, and we do not share cookie data with advertisers. You can disable cookies in your browser settings, though you will not be able to sign in or book a class as a result.

We retain your data for as long as necessary to provide our services and meet our legal obligations:

• Active member records: for the duration of your membership plus 2 years.
• Liability waiver records: 5 years from the date of signing.
• Payment transaction records: 5 years, as required by Bahraini financial regulations.
• Technical error reports: 90 days.
• Sign-in records: 90 days after the session they belong to ends, whether you sign out or it expires.
• Email delivery records: 90 days.
• Staff activity records: 2 years.

Under Bahrain's PDPL 2018, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data, subject to our legal retention obligations.
• Withdraw consent at any time, where processing is consent-based.
• Lodge a complaint with the relevant Bahraini authority.

To exercise any of these rights, contact us at info@beyondcalisthenics.com. We will respond within 30 days.

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse. Payment data is processed entirely through PCI-DSS compliant third-party processors. We do not store card details on our systems.

Participants under 18 may attend our programmes. Members aged 12–17 may create an account only with an adult parent or guardian's contact details and consent; younger members must be registered through an adult's account. Guardian details are also used as the minor's emergency contact. We do not use minors' data for any purpose beyond service delivery and safety.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on our website. Your continued use of our services after any update constitutes acceptance of the revised Policy.