Privacy policy
Last updated: 28 July 2026
This policy explains what we do with your personal data when you visit gymfindshub.com or buy from us. It's written to be read, not to be skimmed past.
Who we are
Gymfindshub is a general partnership established in the United Kingdom, trading from:
66 Paul Street, London, EC2A 4NA, United Kingdom
support@gymfindshub.com
For the purposes of UK GDPR and the Data Protection Act 2018, Gymfindshub is the data controller for the personal data described here. There is no separate data protection officer — data protection questions come straight to support@gymfindshub.com and are handled by the partners.
What we collect
When you buy from us
- Name, email address, delivery address, billing address, phone number (if you provide one)
- Order details — what you bought, when, for how much
- Payment confirmation and the last four digits of your card
We never see or store your full card number. Card details go directly to our payment processors (Shopify Payments, PayPal). We couldn't store them if we wanted to.
When you just visit
- IP address, browser and device type, operating system
- Pages viewed, time on site, what you clicked, where you came from
- Cookie and similar identifiers (see Cookies below)
When you contact us or sign up
- Your email address, and whatever you choose to tell us in your message
- Marketing preferences
When you leave a review
- Your name (or the name you choose), review content, and whether the order was verified
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Process your order, take payment, arrange delivery | Contract |
| Send order confirmations, dispatch and tracking emails | Contract |
| Handle returns, refunds and support enquiries | Contract, and legal obligation |
| Keep financial and tax records | Legal obligation |
| Detect and prevent fraud | Legitimate interests |
| Understand how the site is used and improve it | Consent (analytics cookies) |
| Send marketing emails | Consent, or soft opt-in if you've bought from us and haven't objected |
| Show relevant ads and measure them | Consent (marketing cookies) |
Where we rely on consent, you can withdraw it at any time — unsubscribe links are in every marketing email, and cookie choices can be changed from our cookie banner. Withdrawing consent doesn't affect anything we did before you withdrew it.
Where we rely on legitimate interests, we've weighed our interest against your rights and concluded it doesn't override them. If you disagree, tell us.
Who we share it with
We don't sell your personal data. Full stop.
We do share it with the companies that make the shop work:
- Shopify Inc. — our e-commerce platform. Hosts the store, processes orders, stores customer and order data.
- Shopify Payments (Stripe) and PayPal — payment processing, fraud screening. They act as controllers of your payment data in their own right.
- CJ Dropshipping and our supplier/fulfilment partners — we pass your name, delivery address, phone number and order contents so your parcel can be picked, packed and shipped. Nothing more. They don't receive your payment details and aren't permitted to use your data for anything other than fulfilling your order.
- Shipping carriers (Royal Mail, Evri, USPS, and international partners) — name, address, contact details.
- 17TRACK — order tracking on our site.
- Judge.me — product reviews, if you choose to leave one.
- Google Analytics, Meta and TikTok — analytics and advertising measurement, where you've consented to analytics/marketing cookies.
- Email service providers — transactional and (if opted in) marketing emails.
- Professional advisers, accountants and authorities — where legally required, or to establish or defend a legal claim.
International transfers
Some partners are outside the UK — notably CJ Dropshipping and our supplier partners in China, and Shopify, Google, Meta and TikTok in the United States.
When your data leaves the UK, we rely on one of:
- The country having UK adequacy status; or
- The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
- The UK Extension to the EU–US Data Privacy Framework, where the recipient is certified.
For deliveries to China-based fulfilment partners, we transfer only the minimum needed to ship your order — name, address, phone number, order contents — under contractual terms requiring them to use it for fulfilment and nothing else. We're telling you this plainly because you should be able to make an informed decision before you order.
You can request details of the safeguards we use by emailing support@gymfindshub.com.
How long we keep it
| Data | Retention |
|---|---|
| Order and transaction records | 7 years — required for UK tax and accounting |
| Customer account details | While open, plus 2 years of inactivity |
| Support emails | 3 years from the last message |
| Marketing contacts | Until you unsubscribe, then 1 year to honour the suppression |
| Analytics data | Up to 26 months |
| Cookie consent records | 12 months |
After that, data is deleted or anonymised.
Cookies
- Strictly necessary — cart, checkout, security, load balancing. Can't be switched off; the shop won't work without them.
- Analytics — how people use the site. Off until you consent.
- Marketing — ad relevance and measurement (Meta Pixel, TikTok Pixel, Google Ads). Off until you consent.
You can change your choices at any time via the cookie banner, or block cookies in your browser — though blocking necessary cookies will break checkout.
Your rights (UK GDPR)
You have the right to access, rectification, erasure, restriction, portability, to object (and to object to direct marketing at any time, absolutely), to withdraw consent, and not to be subject to automated decision-making with legal or similarly significant effects. We don't do the latter; our payment providers run automated fraud checks, and if one blocks your order, email us and a human will look at it.
To exercise any of these, email support@gymfindshub.com. It's free, and we'll respond within one month. If your request is unusually complex we may extend by up to two further months — we'll tell you why within the first month. We may ask you to confirm your identity first.
Complaints
If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk/make-a-complaint · 0303 123 1113
If you're in California or elsewhere in the US
We serve US customers, and the rights above are available to you too — we apply the same standard globally rather than running two systems.
Under the California Consumer Privacy Act (as amended by the CPRA), California residents have the right to know what personal information we collect and why, to request deletion, to request correction, to opt out of "sale" or "sharing", and not to be discriminated against for exercising any of these.
We do not sell your personal information for money. However, using advertising cookies (Meta, TikTok, Google) may count as "sharing" for cross-context behavioural advertising under California law. You can opt out at any time by rejecting marketing cookies, or by emailing support@gymfindshub.com with "Do Not Sell or Share My Personal Information" in the subject line. We honour Global Privacy Control (GPC) signals where our platform transmits them.
To make any US privacy request, email support@gymfindshub.com. We'll verify your identity and respond within 45 days.
Children
Our store isn't intended for anyone under 16, and we don't knowingly collect their data. If you believe a child has given us personal data, email us and we'll delete it.
Security
We use HTTPS across the site, Shopify's PCI-DSS Level 1 certified infrastructure for payments, and restrict access to customer data to the partners who need it. No system is perfect, and we won't pretend otherwise — but if a breach ever put your rights at risk, we'd notify you and the ICO as the law requires.
Changes to this policy
If we change this policy, we'll update the date at the top. If the change is significant, we'll tell you by email or a notice on the site before it takes effect.
Gymfindshub
66 Paul Street, London, EC2A 4NA, United Kingdom
support@gymfindshub.com