Privacy Policy

FITPRO-X LIMITED is the controller of personal information described in this policy unless a programme-specific notice states otherwise. We are registered in England and Wales under company number 12745206, with registered office at Unit 1 Lime Street, Newcastle upon Tyne, Tyne and Wear, England, NE1 2PQ.

Website: www.fitpro-x.com. Email: [email protected].

In some funded, college, employer or partner programmes, FITPRO-X and another organisation may each be an independent controller, may be joint controllers, or FITPRO-X may process information on another organisation’s instructions. Programme-specific information will explain the arrangement where necessary.

This policy explains what personal information we collect, why we use it, the lawful bases we rely on, who we share it with, how long we keep it, international transfers, security, individual rights and how to complain.

The information collected depends on how a person interacts with FITPRO-X and the type of programme or service involved.

• Directly from you through enquiries, applications, enrolment, learning activity, assessments, payments, calls, messages, forms and events.
• From an employer, college, funder, government department, referral partner, gym, mentor or other organisation involved in a programme.
• From awarding organisations, assessors, tutors, quality assurers and learning or assessment platforms.
• From payment or finance providers, identity or eligibility checking services and publicly available professional sources where appropriate.
• Automatically through website and platform technologies, subject to cookie and privacy controls.

We identify a lawful basis before using personal information. More than one basis may apply where information is used for different purposes.

Health, disability and other sensitive information may be used where necessary for safe practical participation, reasonable adjustments, safeguarding, equality monitoring, legal claims or substantial public interest conditions. FITPRO-X will collect only what is relevant and apply additional protection.

Criminal offence information may be handled for eligible workforce checks, safeguarding, risk management or legal requirements. Access will be restricted and processing will be supported by an appropriate legal condition and policy where required.

We share personal information only where necessary, proportionate and lawful. Recipients may include:

• Awarding organisations, external quality assurers, assessors and certification bodies.
• Colleges, funders, the Department for Work and Pensions, education or skills bodies, auditors and government authorities connected with a programme.
• Partner gyms, employers, mentors and placement providers where needed for practical delivery, interviews or placement support.
• Tutors, assessors, contractors and professional advisers working under appropriate confidentiality obligations.
• Website, learning platform, communications, email, cloud storage, CRM, form, analytics and IT security providers.
• Payment processors, finance providers, banks, accountants, debt advisers and insurers.
• Safeguarding services, local authorities, police, courts, regulators and other bodies where required to protect people or comply with law.
• A purchaser, investor or successor organisation in connection with a genuine business reorganisation, subject to appropriate safeguards.

We may send information about relevant Courses, events and services where consent has been given or where electronic marketing law permits. Every marketing message will provide an appropriate way to opt out. Service messages about an existing enquiry, enrolment, payment, assessment or safety matter are not marketing.

Marketing preferences may be updated at any time by using the unsubscribe function or contacting [email protected]. We may keep a minimal suppression record to ensure the preference is respected.

FITPRO-X does not intend to make decisions that produce legal or similarly significant effects solely by automated means unless this is explained separately and appropriate safeguards are provided. Digital systems may prioritise enquiries, detect fraud, analyse engagement or support staff decisions, but meaningful decisions should involve appropriate human review.

Before publication, FITPRO-X must confirm whether current CRM, finance, advertising or learning systems carry out profiling or significant automated decision-making and update this section if necessary.

Some technology or service providers may process information outside the United Kingdom. Where personal information is transferred internationally, FITPRO-X will use an applicable adequacy regulation, approved contractual safeguard, recognised certification or another lawful transfer mechanism, and will assess supplementary protections where required.

A current record of relevant providers, locations and transfer mechanisms must be maintained as part of the data protection review.

We keep personal information only for as long as needed for the purpose collected, legal or regulatory requirements, funding and awarding organisation rules, safeguarding, disputes and legal claims. The schedule below provides working periods that must be checked against each contract and programme.

FITPRO-X uses proportionate technical and organisational measures to protect personal information, including access controls, secure accounts, role-based access, staff guidance, supplier controls, backup and incident response. No system is completely secure, but risks are assessed and controls are reviewed.

Personal data breaches must be reported internally without delay. FITPRO-X will assess notification to affected people, the Information Commissioner’s Office, funders, awarding organisations or other bodies within applicable deadlines.

Depending on the circumstances, you may have the right to:

• Be informed about how your personal information is used.
• Request access to your personal information.
• Ask for inaccurate or incomplete information to be corrected.
• Ask for deletion where there is no overriding reason to keep the information.
• Ask us to restrict use of information in certain circumstances.
• Object to processing based on legitimate interests or direct marketing.
• Receive certain information in a portable format.
• Withdraw consent at any time where consent is the basis used.
• Request safeguards or human review in relation to qualifying automated decisions.

Requests and complaints should be sent to [email protected] and marked “Data Protection”. We may need to verify identity and clarify the request. We will make reasonable and proportionate searches and respond within the applicable legal timeframe.

FITPRO-X will acknowledge a data protection complaint within 30 days and respond without undue delay. We will explain the outcome and any action taken. You may complain to the Information Commissioner’s Office if you remain dissatisfied, although we encourage you to contact us first so we can try to resolve the issue.

Some education services may be available to people under 18. Where children are likely to use a service, FITPRO-X will take their needs and understanding into account, use clear information, minimise data and apply appropriate safeguarding and design measures. Parental or guardian involvement will be used where required by law, funding or programme rules, but a child’s own rights and welfare remain important.

The Cookie Policy explains the storage and access technologies used on the website, the purposes, providers, lifetimes and available controls. Where those technologies involve personal information, this Privacy Policy also applies.

We may update this policy where services, suppliers, law or guidance change. The effective date will be revised and material changes may be communicated through the website, learner platform or direct notice where appropriate.

References are included for governance and review. The policy should be updated where legislation, guidance or contractual requirements change.

• UK GDPR guidance and resources – Information Commissioner’s Office
• ICO: What privacy information should we provide?
• Data Protection Act 2018
• Data (Use and Access) Act 2025
• ICO guidance: Data (Use and Access) Act 2025 for organisations