Data processing terms

Brawn Power Ltd (company number 13062748), 1 George Street, Snowhill, Wolverhampton, WV2 4DG — Version 1.0, last updated 18 September 2026

About these terms

1. These terms apply to every gym that accepts Brawn’s licence agreement. They are the “data processing terms” referred to in clause 8 of that agreement, and they form part of it.
2. If these terms conflict with the licence agreement on a data protection matter, these terms take priority.
3. In these terms, “we”, “us” and “Brawn” mean Brawn Power Ltd, and “you” means the gym named on the licence agreement.

Words we use

1. Data protection law means the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.
2. Member data means personal data about your members, prospective members, leads and personal trainer clients that is processed under the licence agreement.
3. Health information means information about a member’s health, including injuries, medical conditions and other answers to health questions in our calculators. It is a special category of personal data under UK GDPR.
4. Sub-processor means a company we use to help provide the platform that may process member data.
5. Personal data breach means a security incident that leads to member data being lost, destroyed, changed, disclosed or accessed without authorisation.
6. Controller and processor have the meanings given to them in UK GDPR.

Who is responsible for what

1. You and Brawn are each an independent controller of the member data each of us collects and uses for our own purposes. For example, you control your membership records, and Brawn controls the data it needs to sell session packs to members under its own member terms.
2. Where Brawn processes member data on your behalf and on your instructions, Brawn acts as your processor and you are the controller. This includes:
   1. sending WhatsApp messages to your members using the marketing consent you have obtained;
   2. routing leads to your personal trainers; and
   3. preparing reports about your members for you.
3. Your instructions to us are set out in the licence agreement and these terms, and in any further written instructions you give us that are consistent with them.

Details of the processing we carry out for you

1. Purpose: to run Brawn’s member onboarding and personal trainer conversion programme at your sites, as described in the licence agreement.
2. Duration: for as long as the licence agreement lasts, and afterwards only as set out in section 13.
3. Nature of the processing: collecting, storing, organising, analysing, sending messages to, reporting on and deleting member data.
4. People the data is about: your members, prospective members, leads and personal trainer clients, and your personal trainers.
5. Types of data: name, email address, mobile number, site, membership status, booking data, payment data, calculator answers, plan outputs, message content and engagement data.
6. Special category data: health information given in the calculators, collected only with the member’s explicit consent (see section 7).

What Brawn promises as your processor

When Brawn acts as your processor, we will:

1. process member data only on your documented instructions, unless the law requires otherwise, in which case we will tell you before processing unless the law prevents us;
2. tell you promptly if we believe an instruction breaks data protection law;
3. make sure everyone who can access member data is bound by a duty of confidentiality;
4. apply appropriate technical and organisational security measures, as summarised in section 11;
5. use sub-processors only as set out in section 9;
6. help you respond to members exercising their rights, as set out in section 12;
7. tell you about any personal data breach affecting member data without undue delay, and give you the information you reasonably need to meet your own obligations;
8. help you with data protection impact assessments and any consultation with the Information Commissioner’s Office, where they relate to our processing;
9. delete or return member data when the licence agreement ends, as set out in section 13; and
10. give you the information you reasonably need to show that we comply with these terms, and allow audits as set out in section 14.

What you promise

You will:

1. have a lawful basis for any member data you give us, or ask us to process, on your behalf;
2. make sure any marketing consent you ask us to rely on was validly obtained and is up to date, and tell us promptly when a member withdraws it;
3. give members the privacy information that data protection law requires about how their data is used, including that Brawn processes it; and
4. only give us instructions that comply with data protection law.

Health information

1. Our calculators may ask members about their health, including injuries and medical conditions. The questions can be configured for each gym, and we review them with you before launch.
2. We ask for the member’s explicit consent before any health question is shown. We keep a record of each consent, including the date, the time and the wording the member agreed to, in the Brawn platform alongside the member’s record.
3. Personal trainers see health information only where they need it for their role. By default a trainer sees a flag, not the detail, and the member chooses whether to share nothing, a summary or everything.
4. Plans are produced by fixed, approved rules. A personal trainer must apply their own professional judgement to a member’s suitability, injuries and disclosures before delivering any training.

Marketing messages and opt-outs

1. Where we contact your members on your behalf, we rely on the marketing consent you have obtained and act on your instructions. Where we collect consent ourselves, we do so in the calculator.
2. Members can opt out of messages at any time by replying STOP to any WhatsApp message, which takes effect automatically, or by contacting us at dataprotection@brawn.co.uk. We record every opt-out in the Brawn platform and respect it across all channels.

Sub-processors

1. You authorise Brawn to use the sub-processors listed below. We have written terms with each of them that protect member data to the standard these terms require, and we remain responsible to you for their performance.

2. We will give you at least 14 days’ notice by email before adding or replacing a sub-processor. If you have reasonable data protection grounds to object, tell us within that period and we will work with you to find a solution. If we cannot, you may end the licence agreement for the affected sites by written notice.

Transfers outside the United Kingdom

1. Some member data is held in the European Union, which the UK recognises as providing adequate protection for personal data.
2. Where a sub-processor transfers member data to the United States or another country without that recognition, the transfer is protected by the sub-processor’s data processing agreement, including the standard contractual clauses and the UK International Data Transfer Addendum, or by the UK Extension to the EU-US Data Privacy Framework where the sub-processor is certified under it.

How we keep member data secure

1. All data is encrypted when it travels over the internet and when it is stored.
2. The database is not reachable from the public internet; only the Brawn platform can connect to it.
3. Access to live systems is limited to named members of the Brawn team, following the principle of least privilege, and multi-factor authentication is enforced on every system that holds or gives access to member data.
4. The database is backed up every night, and backups are kept for at least three months.
5. Application errors are logged with personal data removed.
6. We maintain a written incident response plan and a record of all personal data breaches.

Members’ rights

1. You lead on requests from your own members to exercise their data protection rights, such as requests for a copy of their data or for it to be deleted.
2. If we receive a request that relates to data we process on your behalf, we will pass it to you within 5 working days and help you respond, using the platform where we can.
3. Where a member asks Brawn to delete their data, we remove it from Brawn’s systems and our sub-processors within 30 days, unless we must keep it by law.

How long we keep member data

1. Leads who do not buy are deleted 12 months after their last activity.
2. Health information is deleted when the member asks, or 12 months after the member’s last activity, whichever is sooner.
3. Payment and transaction records are kept for 6 years to meet accounting and tax requirements.
4. When the licence agreement ends, we will, at your choice, return or delete the member data we process on your behalf within 30 days, unless the law requires us to keep it, and confirm in writing once this is done. Data we hold as an independent controller, such as records of session pack sales, is kept under our own retention rules above.

Information and audits

1. On request, we will give you the information you reasonably need to show that we comply with these terms.
2. If that information is not enough to meet a legal requirement, you may audit our compliance, or appoint an independent auditor bound by confidentiality to do so, no more than once a year and on at least 30 days’ written notice. You meet the cost of the audit unless it shows that we have materially breached these terms.

Liability

Each party’s liability under these terms is subject to the limits and exclusions in the licence agreement.

Changes to these terms

We may update these terms, for example to reflect a change of sub-processor or a change in the law. We will give you at least 30 days’ notice by email of any change that materially affects you, except where the law requires a change sooner. The version and date at the top of this page show when the terms were last updated.

Contact

Data protection questions, requests from members and breach notifications: dataprotection@brawn.co.uk