Privacy Policy

1. What Information We Collect

We may collect personal information from members, membership applicants, contractors, employees, suppliers and other business contacts, including:

• Identification details such as name, address, contact details, date of birth and driver’s licence.
• Health information such as pre-exercise questionnaires, fitness assessments and health status updates, collected with consent.
• Financial details such as bank account or credit card details, encrypted, with no full bank details retained and only the last four digits potentially displayed.
• Next-of-kin details for emergencies.
• Website/online information including enquiry forms, exercise-screening tools, cookies and web-log data such as browser type, operating system and similar information.
• Business contact information from landlords, suppliers and partners.

Information may also be collected from third parties such as referrals or CRM updates, with reasonable steps taken to notify the person.

2. How We Collect Information

• Directly from the person through membership applications, website forms, email communications and pre-exercise questionnaires.
• Via the website, Xplor Technologies CRM and Outlook 365 email system.
• Through cookies used to customise the website experience. Cookies identify the computer rather than the person and can be disabled, although some site functions may not work correctly.

3. Why We Collect Information

• To provide personalised health and fitness services.
• To process memberships, charge fees and administer accounts.
• To communicate with members and respond to enquiries.
• To conduct business operations including IT, billing, HR, landlord and supplier relationships.
• To distribute newsletters, promotions and marketing materials unless the person opts out.

4. Use and Disclosure of Information

Information may be disclosed to:

• Contractors and service providers such as IT providers, CRM providers, virtual assistants and email services, subject to confidentiality obligations.
• Overseas service providers, noting that the Xplor CRM and Microsoft Outlook email provider involve international data handling and that personal information may sometimes be accessed by a virtual assistant in the Philippines. The Philippines has data-protection laws substantially similar to the Australian Privacy Principles, but overseas recipients may not be bound by Australian law and Totally Pumped is not liable for breaches outside its control.
• Law enforcement or regulators where required by law, such as under court order.
• Other parties with consent.

Full banking details are not disclosed and are encrypted within the systems.

5. Direct Marketing

With consent, information about services, promotions and events may be sent by email, SMS or mail. A person may opt out at any time by contacting Totally Pumped or using the unsubscribe link in marketing emails. Sensitive information is not used for marketing.

6. Security and Retention

Reasonable steps are taken to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Health and membership data is stored securely in CRM and IT systems. Banking details are encrypted and never stored in plain form. Data no longer required will be anonymised, de-identified or securely destroyed. Most personal information is retained for up to seven years to meet record-keeping obligations.

7. Access and Correction

Under the Australian Privacy Principles, people may request access to personal information held about them and request corrections if it is inaccurate, incomplete or out of date. Requests must be made in writing and will be answered within a reasonable time, usually one month.

8. Complaints

Privacy concerns or complaints should first be made directly using the contact details below. Complaints will be reviewed by Michelle Johnson and investigated promptly.

If unresolved, the matter may be referred to the Office of the Australian Information Commissioner at https://www.oaic.gov.au/.

9. Website and Online Privacy

Cookies are used for site navigation and security. Email and SMS marketing complies with the Spam Act 2003 and marketing messages are sent only with consent. The website and CRM use up-to-date technology to secure data.

10. Anonymity

Totally Pumped 24/7 offers services to members only. Membership requires personal and health information, so anonymity is generally not possible.

11. Contact Details

For privacy enquiries, access/correction requests or complaints, use these details. This updated Privacy Policy applies to all members, staff, contractors and contacts of Totally Pumped 24/7 and consolidates and replaces all previous versions.