Privacy Policy
Last updated: 27 September 2026
1. Who we are
LukeMurray.Fit is a trading name of Luke Murray Enterprises Ltd, a private limited company registered in England and Wales.
- Company number: 16062190
- Registered office and trading address: 50 Aldwick Road, Bognor Regis, PO21 2PN
- Email: info@lukemurray.fit
Luke Murray Enterprises Ltd is the data controller for the personal information described in this Privacy Policy.
We are registered with the Information Commissioner's Office (ICO).
This policy explains how we collect, use, store and share personal information when you visit our website, make an enquiry, become a member, attend our services or otherwise interact with LukeMurray.Fit.
2. Information we collect
The information we collect depends on your relationship with us.
Prospects and enquiries
When you enquire about LukeMurray.Fit, we may collect your:
- Name
- Email address
- Telephone number
- Communication history
- Enquiry details
- Marketing preferences
- Information about how you heard about us
We may receive this information through our website, GoHighLevel forms, Meta lead forms, Google Forms, telephone, WhatsApp, email, social media or directly from you.
Occasionally somebody may provide your contact details as a referral. We expect them to have your permission before doing so.
Members
In addition to basic contact information, we may collect:
- Date of birth
- Address
- Emergency contact details
- Membership information
- Booking and attendance history
- Payment and transaction information
- Communications with us
- Information relating to your training
Members may also record training and progress information through BoxMate, which is connected to their TeamUp account.
Health information
To help us provide appropriate and safe coaching, we may collect information about your health, medical conditions, injuries, pregnancy, medications or anything else relevant to your participation in exercise.
This information may be collected through our PAR-Q or health questionnaire, through conversations with coaches or through information you voluntarily provide to us.
Relevant health information is normally recorded within TeamUp.
Health information is classed as special-category personal data under UK data protection law and receives additional protection.
Our normal lawful basis for processing health information is that it is necessary in connection with providing the service you have requested, and our special-category condition will generally be your explicit consent.
You may withdraw that consent. However, if we do not have information we reasonably need to coach you safely, we may be unable to provide some or all of our services.
In an emergency or safeguarding situation, other lawful bases and special-category conditions may apply where permitted by law.
3. How we use your information
We may use your personal information for the following purposes:
| Purpose | Typical lawful basis |
|---|---|
| Responding to an enquiry or taking steps you have requested before joining | Contract / steps before entering a contract |
| Setting up and managing your membership | Contract |
| Managing bookings, attendance, credits and member communications | Contract |
| Processing payments and maintaining financial records | Contract and legal obligation |
| Providing coaching and adapting training appropriately | Contract |
| Processing relevant health information | Contract plus explicit consent for special-category data |
| Contacting an emergency contact where reasonably necessary | Legitimate interests and, where appropriate, vital interests |
| Providing customer and member support | Contract and legitimate interests |
| Operating our CRM and organising contacts using tags, membership status and engagement information | Legitimate interests |
| Improving our services and understanding how the business is being used | Legitimate interests and, where required, consent |
| Protecting our premises, members and staff using CCTV | Legitimate interests |
| Using photographs, videos, testimonials or identifiable member stories publicly | Consent |
| Sending electronic marketing | Consent or, where legally permitted, the electronic marketing soft opt-in and legitimate interests |
| Complying with legal, tax, accounting, insurance or regulatory obligations | Legal obligation and legitimate interests |
| Establishing, exercising or defending legal claims | Legitimate interests and applicable legal conditions |
Where we rely on legitimate interests, those interests may include operating and improving LukeMurray.Fit, communicating appropriately with customers, maintaining security, keeping accurate business records and protecting the business and its members.
We consider the impact on your privacy before relying on legitimate interests.
4. Marketing
We may occasionally send information about LukeMurray.Fit services, events, programmes or offers by email, SMS or WhatsApp.
Where consent is required, we will ask for it. Where the law permits us to contact existing customers without separate consent, we may do so where the relevant conditions are satisfied.
You can opt out of marketing at any time.
Marketing emails contain an unsubscribe option. Where we send marketing by SMS or WhatsApp, we provide or honour a straightforward method of telling us that you no longer wish to receive marketing.
You can also contact info@lukemurray.fit at any time and ask us to stop.
Stopping marketing does not prevent us from sending necessary service messages such as booking information, payment administration, membership communications or important operational updates.
5. Automated systems and AI
LukeMurray.Fit uses automation to help operate the business, organise enquiries and provide member support.
We also use Elemefy, our AI-assisted member support system, together with Viktor and associated technology providers.
If you communicate with Elemefy, your message and relevant information from our systems may be processed to answer your question, retrieve relevant membership or booking information, provide support or identify something that should be passed to Luke.
AI systems may also assist with internal alerts, summaries and administration.
We do not use solely automated decision-making to make decisions that have a legal or similarly significant effect on you, such as automatically refusing membership, determining your price, cancelling your membership or making significant decisions about your health or eligibility.
Where an issue requires human judgement, it is escalated appropriately.
6. Photographs, videos, testimonials and reviews
We sometimes take photographs or videos during training, events or community activities.
We only intentionally publish identifiable member photographs or videos where permission has been obtained.
Our coaches may occasionally take consented photographs using a personal device. Our policy is for these to be transferred promptly to an approved LukeMurray.Fit business account or storage location and then deleted from the personal device.
Testimonials, reviews and member quotes are only used with appropriate permission. We obtain additional permission before identifying somebody by name where that is not already clear from the original public review or content.
You can withdraw consent for future use by contacting us.
Withdrawal of consent will not make previous lawful use unlawful, and we may not always be able to remove copies subsequently shared by other people or retained by third-party social platforms.
7. Member communities
Members may optionally join LukeMurray.Fit community spaces, including our private Facebook group and WhatsApp Community.
Participation is voluntary.
Other participants may be able to see your profile name, profile picture, telephone number or other information depending on the platform and your privacy settings, as well as information you choose to post.
Those platforms also process information under their own privacy policies and terms.
8. CCTV
We operate a small Eufy security camera system for safety, security and the protection of our premises.
Cameras cover the front entrance, rear entrance and an external area around the outdoor security light.
Our CCTV is configured to record video only, not audio.
Footage is normally retained for only a few days because of limited storage capacity and is then overwritten or deleted.
We may retain particular footage for longer where it is reasonably required in connection with an incident, insurance matter, legal claim or lawful request.
CCTV signage is displayed around the premises.
9. Paper records
We may use limited paper records for Discovery Calls, member check-ins and movement or training assessments where relevant.
These may contain a member's name and brief notes relevant to their coaching, including occasional health or injury information.
Completed paper records are stored securely in a locked cupboard when not in use.
10. Who can access your information
Luke and Amy have full administrative access to the core LukeMurray.Fit systems where required.
Coaches and regular contractors are given access only to information reasonably necessary to perform their roles.
Relevant information may be shared internally between coaches where necessary for safe coaching, continuity of service or member support.
We use Slack for internal staff communication and daily coaching debriefs. Detailed or longer-term health information should be recorded in TeamUp rather than treated as permanent Slack conversation history.
Our accountant has access to relevant accounting and financial information through Xero.
We do not sell or rent personal information to other organisations for their own marketing purposes.
11. Service providers
We use third-party technology and professional service providers to operate LukeMurray.Fit.
These currently include:
- GoHighLevel / HighLevel
- TeamUp
- BoxMate
- Stripe
- PayPal
- Xero
- Google Workspace
- Google Drive
- Gmail
- Google Forms
- Google Analytics
- Meta services including Facebook, Instagram and WhatsApp
- Zapier
- Slack
- Microsoft 365
- Eufy
- Viktor and technology used to operate Elemefy
We may also use Google Maps, YouTube and other embedded services on our website.
Some providers act as processors on our behalf, while others may act as independent controllers for particular activities.
We only provide them with information reasonably required for the service they provide.
Where reasonably necessary, we may also disclose information to professional advisers, insurers, emergency services, law-enforcement bodies, courts, regulators or other authorities in connection with safety, safeguarding, legal claims, insurance obligations or legal requirements.
12. Payments
Payments are primarily processed using TeamUp and Stripe.
When card details are provided over the telephone, a member of staff may enter the details directly into the payment system.
We do not write down, photograph or separately store full card details.
Once processed, LukeMurray.Fit staff normally see only limited payment information, such as the final four digits of the card.
We may also occasionally accept bank transfers or payments through PayPal.
Apple Pay or Google Pay may be offered in future through Stripe.
13. Website analytics, cookies and tracking
Our website may use cookies and similar technologies required for the website to function.
We also have access to tools such as Google Analytics and Meta Pixel, and third-party content such as Google Reviews, Instagram content, Google Maps or YouTube may involve additional technologies.
Where consent is legally required for non-essential analytics, advertising or tracking technologies, we will ask for consent before activating them.
Visitors will be able to manage relevant cookie preferences through our cookie controls.
We will maintain separate cookie information explaining the technologies actually active on the website.
14. Information about children
LukeMurray.Fit does not currently provide its normal membership service to under-18s.
We have previously run youth sessions. Where young people participated, their accounts were established and managed through a parent or guardian.
Some historic youth-session information may remain within TeamUp.
If we offer services to under-18s again, we will take appropriate additional steps around parent or guardian involvement, transparency, consent and data protection.
15. How long we keep information
We do not keep personal information indefinitely simply because it might be useful one day.
Our normal retention approach is:
| Information type | Normal retention period |
|---|---|
| Enquiries that do not become members | Normally up to 24 months after the last meaningful interaction. |
| Marketing records | Until consent is withdrawn, the person opts out, or we determine that the information is no longer appropriate to retain. |
| Suppression and opt-out records | For as long as reasonably necessary to ensure we continue respecting the opt-out. |
| Active member information | For the duration of membership. |
| Membership, contractual and relevant communication records after membership ends | Normally up to six years where reasonably required for contractual, tax or legal purposes. |
| Health questionnaires and relevant health and safety records | For as long as needed to safely provide services and, where justified, for an appropriate period afterwards in connection with legal or insurance matters. |
| Accounting and transaction records | Normally at least six years where required by company or tax law. |
| CCTV | Normally only a few days unless footage is required for a particular incident. |
| Photographs, videos and testimonials | Until no longer needed or consent is withdrawn, subject to existing lawful publication and copies retained by third parties. |
| Internal operational messages | Kept only for the period reasonably required. Important long-term information is transferred to the appropriate core member record. |
Different periods may apply where we are required to preserve evidence, deal with a complaint or dispute, comply with a legal requirement, protect somebody's safety or establish, exercise or defend a legal claim.
Records relating to somebody who participated while under 18 may require a different retention assessment.
16. International data transfers
Some of our technology providers operate internationally and may process personal information outside the United Kingdom, including in the United States or other countries.
Where a restricted international transfer takes place, we require an appropriate mechanism under UK data protection law.
Depending on the provider and destination, this may include UK adequacy regulations, contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to approved Standard Contractual Clauses, or another legally permitted safeguard.
You may contact us if you would like further information about the safeguards relevant to your information.
17. Security
We take reasonable technical and organisational measures to protect personal information.
These include:
- Restricting system access according to role
- Using business systems with authentication controls
- Limiting access to health information
- Securely storing paper records
- Keeping sensitive information out of unnecessary staff communications
- Limiting information shared with service providers
- Moving important member information into appropriate core systems rather than relying on informal messaging
No electronic system can be guaranteed to be completely secure, but we review our working practices and take reasonable steps to reduce the risk of unauthorised access, disclosure, alteration or loss.
18. Your rights
Depending on the circumstances and the lawful basis being used, you may have the right to:
- Access your personal information
- Correct inaccurate or incomplete information
- Request deletion of your information
- Request restriction of particular processing
- Object to certain processing
- Receive certain information in a portable format
- Withdraw consent where processing relies on consent
These rights are not absolute in every situation.
For example, we may need to retain certain records because of legal, tax, insurance or legitimate legal-claim requirements.
You have the right to object to the use of your personal information for direct marketing at any time.
To exercise your rights, contact:
info@lukemurray.fit
We may need to verify your identity before acting on a request.
19. Complaints
If you have concerns about how we use your personal information, please contact us first at:
info@lukemurray.fit
You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection.
You can find information about making a complaint at the ICO website.
20. Changes to this policy
We may update this Privacy Policy when our services, systems, suppliers or legal obligations change.
The most recent version will be published on our website with the date it was last updated.