Privacy & Data Policy

1. Introduction

ClassControl is committed to protecting your privacy and handling your personal information responsibly. This policy explains what information we collect, how we use it, how we protect it and your rights under the UK General Data Protection Regulation and the Data Protection Act 2018.

2. Who We Are

ClassControl is developed and operated by Eatwell Tech Solutions.

Individual gyms, fitness centres and organisations using ClassControl will usually act as the data controller for the personal information they collect.

Eatwell Tech Solutions will generally act as a data processor by providing, hosting and maintaining the ClassControl platform.

3. Information We Collect

Account information

• Full name
• Email address
• Securely hashed password
• User role and permissions
• Company or organisation membership

Booking and attendance information

• Class bookings and cancellations
• Waiting-list entries
• Attendance records
• Instructor assignments
• Class locations and times

PAR-Q and health-related information

Where enabled by the organisation providing access, ClassControl may collect Physical Activity Readiness Questionnaire information including health conditions, injuries, medication information, exercise restrictions, emergency contact details and medical clearance information.

Health information is treated as special-category personal data and is encrypted before being stored in the ClassControl database. It is decrypted only for authorised users through approved areas of the website and mobile applications.

Device and technical information

• Device type
• Operating system
• Application version
• Notification preferences
• Technical logs and error information

4. How We Use Your Information

• Create and manage user accounts
• Authenticate users securely
• Process bookings and cancellations
• Manage attendance and waiting lists
• Send service and class notifications
• Support administrators and instructors
• Protect accounts using multi-factor authentication where enabled
• Protect sensitive health information using encryption
• Maintain platform security and reliability
• Comply with legal obligations

5. Legal Basis for Processing

• Performance of a contract
• Legitimate interests
• Compliance with a legal obligation
• Consent where appropriate
• An appropriate lawful basis together with a valid condition for processing health-related information

6. Data Security

We use technical and organisational measures designed to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.

• HTTPS encryption for website and mobile API communication
• Secure password hashing
• AES-256 authenticated encryption for PAR-Q and health information stored in the database
• Multi-factor authentication for Super Administrator accounts
• Secure remembered-device tokens for up to 30 days using hashed validation
• Authenticated sessions and API tokens
• Role-based access controls
• Restricted database access
• Security updates and monitoring
• Secure server hosting
• Protected backups where configured

7. Sharing Your Information

We do not sell personal information.

Information may be shared with the organisation through which you use ClassControl, authorised administrators and instructors, hosting providers, trusted service providers and legal authorities where required.

8. Data Retention

Personal information is retained only for as long as needed for the purpose for which it was collected, including legal, accounting, security and operational requirements.

9. Your Rights

• Request access to your personal information
• Request correction of inaccurate information
• Request deletion where applicable
• Request restriction of processing
• Object to certain processing
• Request a portable copy of information
• Withdraw consent where applicable
• Complain to the Information Commissioner's Office

10. Cookies

The ClassControl website uses essential cookies to maintain secure sessions and provide core functionality. Super Administrators may choose to remember a trusted device for up to 30 days after successful multi-factor authentication. These secure cookies are used only for authentication and are not used for advertising or tracking.

11. Children's Privacy

ClassControl is not intended for use by children without suitable supervision or authorisation from the organisation providing access.

12. International Transfers

Where information is transferred outside the United Kingdom, appropriate safeguards will be used where required by data protection law.

13. Changes to This Policy

This policy may be updated to reflect changes to the ClassControl platform, legal requirements or the way personal information is handled.

14. Contact Us