Legal
Privacy policy
How we collect, use and protect your personal data, in plain language. This policy covers the website www.crossfitironsky.com, our membership systems and the ways you get in touch with us.
1. Who we are
CrossFit IRONSKY is run by S&C IRON SKY LTD, a company registered in Cyprus (registration number HE 396690), registered office 3 Costi Palama, Aradippou, Larnaca 7102, Cyprus. The gym is at Ayiou Lazarou 83, Larnaka 6020. We are the data controller for the personal data described here.
For anything about your data, write to info@ironskyfitness.com or post to the registered office above.
2. What we collect, and why
When you contact us or ask to join
Through the forms on this site, WhatsApp or email we receive what you give us: your name, email address, phone number, what you are interested in and your message. We use it to answer you, to book your free consultation or trial, and to follow up on your enquiry. Legal basis: taking steps at your request before a contract, and our legitimate interest in answering people who write to us.
When you become a member or book a session
Your membership, class bookings, attendance, drop-ins and recovery sessions are managed in Wodify, our gym management software. Wodify holds your contact details, your membership and invoices, your bookings and attendance, the results you choose to log, and the waiver you sign when you join. Payments are processed by Stripe through Wodify; we never see or store your full card number. Legal basis: performing our contract with you, and our legal duty to keep accounting records.
Health information
When you join, and when you tell a coach about an injury or a condition, we use that information only to coach you safely and to scale your training. We ask for it with your consent and we do not share it outside the coaching team. You can ask us to delete it at any time, with the understanding that we will then coach you without it.
Children
Children aged 5 to 17 join our Kids, Pre-Teens and Teens classes through a registration form completed by a parent or guardian, hosted on Google Forms. We collect the child's name, date of birth and gender, and the parent or guardian's name, email and phone. We use it to place the child in the right group, to contact the parent or guardian, and to keep the child safe in class. We only process a child's data with a parent or guardian's consent, and we never market to children.
Job applications
If you apply through the Work with us form, we receive your name, email, phone, the position and employment type you want, your message and your CV. We use it to consider your application and to contact you about it. We keep applications for six months after the position is filled or the application is closed, unless you ask us to keep it for future openings. Legal basis: taking steps at your request before a possible employment contract.
IRON83, our member email
If you sign up for IRON83, or join as a member, we add your email address to our mailing list, which is managed in MailerLite. Every email has an unsubscribe link, and unsubscribing takes effect immediately. Legal basis: your consent, or our legitimate interest in writing to current members about the gym.
When you message our WhatsApp Business number, your phone number, name and messages are processed by WhatsApp (Meta) under its own privacy policy. We use the conversation to help you with what you asked. We do not add you to broadcast lists without asking.
3. The website itself
This site is hosted by Netlify, which processes the technical data every website needs to work, such as your IP address and browser type, in its server logs. Form submissions are received and stored by Netlify and emailed to us.
We do not run analytics or advertising trackers on this site, and we set no cookies of our own. Some pages embed content from other services, and those services may set their own cookies when the embed loads: the class schedule and booking pages from Wodify, videos from YouTube, and fonts from Google Fonts. Each operates under its own privacy policy.
4. Who we share data with
We share personal data only with the service providers that help us run the gym, each bound by its own data-processing terms: Wodify (membership and bookings), Stripe (payments), Netlify (website and forms), Google (kids registration form, maps, fonts, YouTube), MailerLite (email), Meta (WhatsApp and our social pages), and our accountant for invoicing and tax records. Some of these providers process data outside the European Economic Area under the safeguards the GDPR allows, such as the EU standard contractual clauses or an adequacy decision.
We do not sell personal data, and we do not share it with anyone else unless the law requires it.
5. How long we keep it
- Enquiries that do not lead to a membership: up to 12 months, then deleted.
- Membership records and invoices: for the life of your membership, then as long as Cyprus accounting and tax law requires, currently six years.
- Health information: for as long as you train with us, deleted on request or when your membership ends.
- Children's registrations: for as long as the child trains with us, deleted on request or when they leave.
- Job applications: six months after the position is closed.
- Email list: until you unsubscribe.
6. Your rights
Under the GDPR you can ask us at any time to see the personal data we hold about you, to correct it, to delete it, to limit how we use it, to give it to you in a portable form, or to stop using it for a particular purpose. Where we rely on your consent, you can withdraw it at any time. Write to info@ironskyfitness.com and we reply within one month.
If you are not happy with how we handle your data, you can complain to the Cyprus Commissioner for Personal Data Protection at www.dataprotection.gov.cy.
7. Security
Access to member data is limited to the coaches and staff who need it to do their job. Our systems are protected by passwords and, where available, two-factor authentication. Card payments are handled by Stripe, a PCI DSS certified processor, and never stored by us.
8. Changes
If we change this policy we update the date at the top and, for changes that matter to you, we tell members by email.