Privacy Policy

Last updated: 21 July 2026

1. Who we are

Old Ironworks Gym ("we", "us", "our") runs this website and is the data controller for the information described in this policy. That means we decide what information is collected and why.

• Address: Old Ironworks Gym, Fullbridge Road, Maldon, Essex CM9 4LE
• Email: info@oldironworksgym.com
• Phone: 01621 840098

We are not required to appoint a Data Protection Officer, so if you have a question about privacy it goes straight to the gym's management at the email address above.

2. What this policy covers

This policy covers information collected through this website, at oldironworksgym.com and any page on it.

It does not cover information you give us in person when you join the gym, sign up for classes or speak to our team, and it does not cover other companies' websites that we link to. See section 14 for more on that.

3. Information we collect when you visit

3.1 Information you give us directly

None, through this website. There is no contact form, no sign-up form, no newsletter box and no online payment on this site. Nothing on these pages asks you to type in personal details.

If you choose to phone or email us using the details we publish, we will of course have whatever you tell us in that call or message. We use it to answer you, and we keep it only as long as we need to. That is covered by our legitimate interest in responding to enquiries about our business.

3.2 Visitor measurement (our analytics)

We want to know roughly how many people use the site and which pages are useful, so we can improve it. Nearly every website does this with a service like Google Analytics, which tracks people across the internet. We deliberately do not. Instead we built a small counter that runs on our own server, and it works like this:

• When you open a page, your browser quietly tells our own server which page it was, and later roughly how long you were on it. It also records when someone clicks a key button, such as "Join Now" or "Get directions", as an anonymous count.
• To avoid counting the same person five times in one visit, our server needs some way of telling one visitor from another. It takes your IP address and browser type, mixes them with a secret random value that we regenerate every single day, and runs the result through a one-way cryptographic hash. It keeps only the first part of that hash.
• That short hash is the only thing kept, and only until the end of the day. It cannot be reversed to recover your IP address. Because the secret value changes at midnight, the same visitor produces a completely different hash tomorrow, so we cannot follow anyone from one day to the next.
• At the end of each day the hashes are deleted. What survives is a set of plain numbers: how many views, how many visitors, how many for each page, how many clicks on each button, and total time on site.

We never write your IP address to disk. It exists in memory for the instant it takes to compute the hash, and is then discarded. No cookie is set, nothing is stored on your device, and none of this is shared with anybody.

Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR). Our interest is in understanding whether our website works. Because the data is aggregated and cannot be traced back to you, the impact on your privacy is minimal, which is why we are satisfied this is fair. Because we store nothing on your device, this does not require your consent under the Privacy and Electronic Communications Regulations.

3.3 Technical and hosting records

Like any website, ours runs on a server, and the software that delivers pages to you keeps short-lived operational records. These can include your IP address, the page requested, the time, and your browser's user agent string. They exist so that the site can be operated securely, so that faults can be diagnosed, and so that abuse and attacks can be spotted.

We do not use these records for analytics or marketing, and we do not build profiles from them.

Lawful basis: legitimate interests, specifically keeping our website available and secure.

3.4 Sign-in protection

Our staff admin area limits how many times a password can be tried from the same internet connection. That requires holding an IP address and a counter briefly in memory. It is never written to disk and disappears when the counter resets or the server restarts. Its only purpose is to stop password guessing.

3.5 The staff admin area

There is a password-protected area of this site that our own team uses to update opening hours, prices and photos. When a member of staff signs in, one cookie is placed on their device to keep them signed in. It is described in full in our Cookie Policy.

This cookie is never set for ordinary visitors. If you have not signed into the admin area, you do not have it.

3.6 The embedded map

Our Find Us page can show an interactive Google map. A map embed of this kind is served by Google, and when it loads, Google receives your IP address and can set its own cookies on your device. That is Google's processing, not ours, and we have no control over it.

Because that is not something we can do without your agreement, the map does not load unless you allow it. Until then you see a placeholder, along with our address in plain text and an ordinary link you can follow if you would rather go to Google Maps yourself.

Lawful basis: your consent (Article 6(1)(a) UK GDPR), which you can withdraw at any time from our Cookie Policy page.

What Google does with the data it receives is governed by Google's own privacy policy, at policies.google.com/privacy.

4. What we deliberately do not do

It is often more useful to know what is not happening. On this website there is:

• No Google Analytics, Meta Pixel, TikTok pixel or any other third-party tracker.
• No advertising network, no retargeting and no "people who visited this page" audiences.
• No selling, renting or sharing of personal data. We have never done it and do not intend to.
• No profiling and no automated decision-making of any kind.
• No fonts, scripts or images loaded from someone else's servers. We host every file ourselves, so that browsing our site does not quietly tell another company you were here.
• No cookie banner nagging you on every visit, because there is almost nothing to consent to.

5. How long we keep things

What	How long
Daily visitor hashes (analytics)	Deleted at the end of each day
Aggregate counts (views, visitors, clicks)	Up to around 13 months, then automatically discarded
Technical and hosting records	A short rolling period, then overwritten
Rate-limiting counters	Minutes, in memory only
Staff admin sign-in cookie	7 days, or until sign-out
Emails and enquiries you send us	As long as needed to deal with your enquiry and keep a reasonable business record

6. Who we share information with

We do not sell or trade your information, and we do not share it for anyone else's marketing.

The only parties who could come into contact with information from this website are:

• Our hosting provider, who runs the server the website sits on. They process data on our instructions under a contract.
• Google, but only if you have agreed to load the map, and only for that map.
• Anyone we are legally required to tell, such as a court, the police or a regulator acting within their powers. This has not happened, and we would not hand anything over without checking we had to.

7. Sending information outside the UK

Our website and its data stay on servers in the United Kingdom or the European Economic Area.

The single exception is the Google map, if you allow it to load. Google is a US company and may process the request outside the UK. Where that happens, transfers are covered by the UK's international data transfer arrangements and Google's own safeguards. If you would rather that did not happen, simply decline the map. Everything else on the site works normally.

8. Keeping information secure

We take reasonable and proportionate steps for a business of our size:

• The whole site is served over an encrypted HTTPS connection.
• The staff admin area is password protected, its sign-in cookie is marked HttpOnly and Secure so it cannot be read by scripts or sent unencrypted, and repeated failed sign-ins are throttled.
• We collect as little as possible in the first place, which is the most effective protection there is. Data we never hold cannot be lost or stolen.

No website can promise perfect security, but if a breach ever occurred that put anyone at risk, we would report it to the Information Commissioner's Office within 72 hours and tell the people affected where required.

9. Your rights

Under UK data protection law you have the right to:

• Be informed about how your data is used, which is what this policy is for.
• Access a copy of the personal data we hold about you.
• Rectification, meaning correction of anything inaccurate.
• Erasure, often called the right to be forgotten.
• Restrict processing while a concern is being sorted out.
• Data portability, meaning a copy in a reusable electronic format.
• Object to processing carried out under legitimate interests.
• Withdraw consent at any time, where we relied on consent.

To exercise any of these, email info@oldironworksgym.com. It is free, and we will respond within one calendar month. We may ask you to confirm who you are, so that we do not hand your information to somebody else.

One honest caveat: because our analytics deliberately keeps nothing that can identify you, we normally have no way of finding "your" data in it, and no way of proving a given record is yours. That is a feature of the design rather than an evasion. If you ask us for a copy and there is genuinely nothing linked to you, we will explain that.

10. Complaints

If you are unhappy with how we have handled your information, please tell us first and we will try to put it right.

You also have the right to complain to the UK's data protection regulator:

• Information Commissioner's Office
• Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• ico.org.uk/make-a-complaint

11. Children

This website is aimed at adults considering gym membership and is not directed at children. We do not knowingly collect personal information from children through it. Because the site has no forms and our analytics identifies nobody, there is very little scope for a child's data to reach us here. Membership rules for under-18s are handled in person at the gym.

12. Other websites we link to

Where we link out, for example to Google Maps for directions or to our reviews, you are leaving our site and that company's own privacy policy takes over. We are not responsible for how other websites handle your data, and we would encourage you to read their policies.

13. Cookies

Cookies get their own page, with a full table of every cookie involved and instructions for changing your mind. See our Cookie Policy.

14. Joining the gym and visiting in person

This policy is about the website. When you join Old Ironworks Gym, speak to our team or attend a class, we may need information such as your name, contact details, emergency contact and payment arrangements, which is handled separately from this website.

If you would like to know what we hold about you as a member, or would like a copy of the information we give members when they join, contact us at info@oldironworksgym.com and we will provide it.

15. Changes to this policy

If we change how the site handles information, we will update this page and change the date at the top. If a change is significant, for example if we ever added a form or a new third-party service, we will make that obvious rather than burying it.

16. Contact us

Questions about this policy, or about privacy generally, are welcome:

• Email: info@oldironworksgym.com
• Phone: 01621 840098
• Post: Old Ironworks Gym, Fullbridge Road, Maldon, Essex CM9 4LE