Business Privacy Notice

For gym owners and operators · Last updated: 16 July 2026

Who we are

Brawn provides market insights and services to gym operators. This notice is issued by Brawn Power Ltd (“Brawn”, “we”, “us”), a company registered in England and Wales (company number 13062748), registered office 1 George Street, Snow Hill, Wolverhampton, West Midlands, WV2 4DG.

For the purposes of UK data protection law, Brawn Power Ltd is the data controller for the personal data described in this notice.

You can contact us about data protection at dataprotection@brawn.co.uk.

Who this notice is for

This notice is for gym owners, operators and decision-makers who visit our websites, book a meeting with us, request a Patch Report, or otherwise engage with Brawn’s services for gym operators.

If you are a gym member using Brawn’s member services, a different notice applies: our Member Privacy Notice.

What this notice covers

This notice covers all of Brawn’s gym-operator-facing websites and services, including:

• our marketing website at brawn.co.uk
• the Patch Report at gym-patch-report.brawn.co.uk
• booking a meeting with us
• our business-to-business communications with gym operators

Not everything in this notice applies to every visit. For example, we only collect your phone number and message you on WhatsApp if you request a Patch Report. If you only browse our website, most of the sections about phone numbers and WhatsApp will not apply to you.

Links from our sites to third-party websites are not covered by this notice. Please read the privacy notice of any third-party site before proceeding.

What personal data we collect

Most of what a Patch Report analyses is business and public data (gym locations, published membership prices, population statistics) rather than personal data. The personal data we collect about you is:

You give us directly:

• Your name
• Your email address and any details you provide when you book a meeting with us (we use HubSpot’s scheduling tool for this)
• Your mobile phone number (used to send your report on WhatsApp, when you request one)
• Your gym’s name and its location, from which we derive the postcode of your site
• Operating figures you enter about your business: monthly membership price, member count, new members per month, cancellations per month
• Anything you tell us in messages or correspondence

We collect automatically:

• Usage and device data from our website (pages viewed, referrer, approximate location, device and browser) via analytics cookies, where you consent. See Cookies below.
• Records of the WhatsApp conversation between you and Brawn. The messages themselves are held in our messaging system, which is run for us by a provider acting as our processor rather than in the Patch Report system itself. That provider holds the conversation on our instructions and deletes it when we tell them to; we apply our 24-month WhatsApp retention to it (see the retention section).

We create and keep:

• Your Patch Report itself, and a stored copy of the underlying data used to produce it. We keep this so that, if you ever query a figure, we can show you exactly what we told you and when.
• A record of your consent: that you consented, when, and the exact wording you agreed to.

Note on business information. Your gym’s name, address, opening hours and published prices are business information, not personal data. But where you are a sole trader or the gym trades under your own name, that information may also identify you, and we treat it accordingly.

Where your data comes from

• Directly from you, when you request a Patch Report or communicate with us.
• Public and licensed data sources. To build the market analysis in your report, we use publicly available and commercially licensed information about areas, populations and businesses — for example population and demographic statistics, public records of gyms and leisure facilities, and published membership prices. These sources describe households, areas and businesses in general, not you personally.

We treat the specific providers and datasets behind our analysis as commercially confidential, but you can contact us if you have questions about how your report is produced.

Home-mover information. Some of our area analysis draws on housing-market activity. Brawn holds this only as aggregate counts per area (for example, “149 households moved into this area last month”) — never as named or address-level records. Because we retain only aggregates, no personal data about home movers is processed or stored by Brawn.

Why we use your data, and our lawful basis

Consent and WhatsApp. When you tick the consent box on the Patch Report form, you are consenting to receive your report and follow-up messages from us on WhatsApp. Under the Privacy and Electronic Communications Regulations (PECR), WhatsApp messages count as electronic mail for direct marketing.

You can withdraw consent at any time. Reply STOP to any WhatsApp message from us, or email dataprotection@brawn.co.uk. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

Who we share your data with

Service providers (processors) who help us run the service. Each is engaged under a written contract as required by Article 28 UK GDPR. We do not publish our specific suppliers, but we categorise them below and maintain a full sub-processor register, which we keep current and make available on request. Our processors fall into these categories:

• Hosting, infrastructure and application platforms
• Payment processing
• Messaging and communications (WhatsApp, SMS and email)
• Customer relationship management and meeting scheduling
• Analytics and error monitoring
• Accounting and electronic signature

We also share data with professional advisers (accountants, lawyers, insurers) where needed, and with regulators and authorities where we are legally required to disclose.

We do not sell your personal data.

Sending data outside the UK

Some of our service providers process data outside the UK. Where that happens, we make sure your data is protected to UK standards by relying on one of the following, depending on the provider and country:

• the country having UK ‘adequacy’ status (the UK government recognises its protection as equivalent); or
• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, incorporated into our contract with that provider, together with additional safeguards where needed.

You can ask us which safeguard applies to a particular provider, and request a copy of the relevant terms.

How long we keep your data

We keep your data no longer than we need it, and we can justify each period below.

• Your name, and the figures you enter about your gym: 24 months from your last interaction with us
• Report inputs and generated reports (including the stored copy of the underlying data): 24 months from your last interaction with us
• Your phone number and marketing consent record: until you withdraw consent. We then keep a record of the withdrawal itself, so we can continue to honour it
• WhatsApp message history: 24 months
• If you become a customer: for the duration of our relationship and 6 years afterwards, reflecting the limitation period for contract claims and HMRC’s record-keeping requirement
• Records required for tax and accounting: 6 years from the end of the relevant accounting period

We review what we hold and delete what we no longer need.

Automated decision-making and profiling

We do not make automated decisions about you, and we do not profile you.

The Patch Report is generated from public and market data about your area and the figures you enter about your gym. Everyone who requests one receives the same analysis, produced the same way. We do not score, rank, grade or segment the people who request a report, we do not build a profile of you, and no decision that affects you is made by automated means. A person at Brawn decides whether and how to follow up.

You therefore have nothing to opt out of here, but your general right to object to automated decision-making and profiling is set out below.

Cookies and similar technologies

We do not use Google Analytics, and we do not run third-party advertising scripts.

Our own first-party analytics. With your consent, we store an identifier on your device and record how you use the site: the pages you view, how you arrived (including any advertising click identifiers in the link you followed), your referring site, your browser and device type, screen size, language and time zone. This stays in our systems and is not shared with advertising networks.

HubSpot meeting scheduler. Our websites use HubSpot’s meeting-booking tool, which sets its own cookies to make scheduling work and to recognise you. To make booking fast, every page opens an early network connection to HubSpot when it loads; this shares your device’s IP address with HubSpot but sets no cookies and stores nothing on your device. We make this early connection under our legitimate interest in providing a fast, responsive booking experience. The scheduler itself loads when you accept non-essential cookies, or when you choose to book a meeting (because it is needed to provide the booking you asked for). When you book, the details you enter go to HubSpot, which acts as our service provider.

We ask before we store anything non-essential. When you first visit, you can Accept or Reject. Rejecting is as easy as accepting. If you reject, we store no analytics identifier, and we do not load the HubSpot scheduler as part of the page — it loads only if you later choose to book a meeting. You can change your mind at any time using the Cookie settings link in the footer; if you withdraw consent, we stop recording and delete the identifier we placed.

Strictly necessary storage. Some storage is essential to deliver what you asked for and does not require consent: the token that ties your submission to your Patch Report, and the record of your marketing consent.

Data Protection Impact Assessment

Because we process personal data in newer ways and at scale, we treat our services as higher-risk and assess them accordingly. Brawn carries out and maintains a Data Protection Impact Assessment (DPIA) to identify and reduce privacy risks, and keeps it under review.

Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your data (this notice)
• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data, in certain circumstances
• Restrict how we process your data, in certain circumstances
• Data portability, where processing is based on consent or contract and is automated
• Object to processing based on legitimate interests, and to direct marketing at any time, absolutely
• Withdraw consent at any time, where we rely on consent
• Not be subject to solely automated decisions with legal or similarly significant effects

To exercise any of these, email dataprotection@brawn.co.uk. We will respond within one month. There is no charge, unless a request is manifestly unfounded or excessive.

Complaints. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk), the UK’s data protection regulator.

Changes to this notice

We may update this notice as our business or the law changes. The “last updated” date at the top will change accordingly.