Your Privacy Matters

Contents:

Who we are

“We” and “us” means YMCAfit which is the trading name for Access Training (Wellbeing) Limited. Our registered address is: Suite 14 Conwy House, Castle Court, Swansea Enterprise Park, SA7 9FS. 

Your privacy matters

At YMCAfit we are committed to keeping your personal data safe and secure.
This notice sets out in detail the purposes for which we process information about you, who we share it with, what rights you have in relation to that information and everything else we think it’s important for you to know.

If you have any questions about the processing of your personal information, or you would like to exercise any of your rights, please reach out to us in the following ways:

Email us: datarequest@accesstraininguk.co.uk
Write to us: Suite 14 Conwy House, Castle Court, Swansea Enterprise Park, SA7 9FS

Data Protection Officer: Data Privacy Simplified

Changes to this Privacy Notice 

We aim to keep this privacy notice regularly updated.  If we make any significant changes to the way in which we process your information, we will let you know by either reaching out to you or posting a banner on the website.  

This notice was last updated in March 2026. 

How we collect your information

We collect information on you if you are a participant of one of our courses. Your details will be registered on our systems and the information collected can include: name, date of birth, gender, ethnicity, medical information, learning needs, audiovisual recording, financial information, and identification documents. 

How we use this information 

We process your information for the following reasons: 

  • To administer course bookings and registration  
  • For delivering our services, courses and training 
  • To record attendance, participation and performance 
  • To support quality assurance processes during our programmes  
  • To provide assessment and certification for different programmes  
  • To record and manage any health and safety or safeguarding concerns 

Lawful Basis we use 

We process most of your information on the basis of contractual obligation when you engage with us for one of our courses. For supporting learners with any additional needs, we rely on legitimate interest. For processing any special category data such as health information or Equality, Diversity and Inclusion (EDI) information, we rely on substantial public interest read with additional conditions from the Data Protection Act 2018.  

To share your information with third parties, we rely on contractual obligation, public task or legitimate interest.  

In situations of safeguarding, we rely on legitimate interest, substantial public interest and conditions from the DPA. 

Who we share your information with

We share your information with several organisations involved in providing our services. These organisations act as data processors for us. When we work as joint controllers, both parties (YMCAfit) and the other party will process your information.

How we store your information and for how long 

We store your information in line with our retention policy. For any queries, please reach out to us with the details above. 

International Data Transfer 

Where personal data is stored outside of the UK and the EEA, safeguards to protect personal data may include but are not limited to the UK Addendum used in conjunction with the EU Standard Contractual Clauses (SCCs), or UK International Data Transfer Agreement (IDTAs). Such safeguards will be subject to Transfer Risk Assessments (TRAs).

General Information (Your rights, Complaints Procedure) 

Your rights 

You have the following rights: 

  • ‘Right to be informed’, which means we will be completely clear and transparent about how we plan to use your personal information. 
  • ‘Right of access’, which means you can request details of the personal information we hold about you and how we use it. We will provide this within one month. 
  • ‘Right to rectification’, which means you can ask us to update or amend the personal information we hold about you, if it is incorrect. 
  • ‘Right to restrict processing’, which means you can ask us to change, restrict or stop the way we are using your personal information. 
  • ‘Right to erasure’ (or ‘right to be forgotten’), which means you can ask us to remove your personal information from our records. 
  • ‘Right to object’, which means you can object to us using your personal information for marketing purposes. 
  • ‘Right to data portability’, which means you can obtain the personal information we hold about you and reuse it for your own purposes. 
  • ‘Right not to be subject to automated decision making’, which means if we use systems to make a decision about you, you have the right to ask for a person to intervene, which may change the outcome. 
  • Right to lodge a complaint with a supervisory authority, such as the Fundraising Regulator or the Information Commissioner’s Office (ICO), if you are not satisfied with our response to a request you make to us, or you feel we are not using your information correctly. 

Complaints procedure

If you are unhappy with the way we process your data, please get in touch with the Data Protection Officer using the contact email above. We will follow the process below: 

  • We will acknowledge your complaint within 30 days of receiving it.  
  • We will investigate your concerns.  
  • We may contact you if we need further information.  
  • We will respond as soon as possible and without undue delay.

Our response will explain:

  • What we have found  
  • Whether any action has been taken  

You can also make a complaint to the Information Commissioner’s Office (ICO) which regulates the use of information in the UK. They can be contacted by at 0303 123 1113 or you can write to them at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.