Privacy notice
This explains what personal data IronTeller holds, why, who can see it, how long it is kept, and the rights you have over it. If you are a gym member, the short version: your gym controls your record, uses it to run your membership, and can show you, correct or delete it when you ask.
1. Who is responsible for your data
IronTeller is software that gyms use to run memberships. Two different organisations are responsible for personal data in it, depending on whose data it is:
- If you are a gym member (or you joined through a gym's join page), your gym is the data controller. Your gym decides what it records about you and why. IronTeller processes that data on the gym's behalf and only on its instructions, as a data processor.
- If you are a gym owner or staff member with an IronTeller login, IronTeller is the data controller for your account details.
IronTeller is operated by RepSuite Technologies Ltd (registration number [registrationNumber not set]), [address not set]. You can reach us about privacy at [privacyEmail not set]. Our Data Protection Officer is [dpoName not set].
This notice is written to meet the Nigeria Data Protection Act 2023 ("NDPA") and applies to everyone whose data is held in IronTeller.
2. What we collect
About gym members
- Identity and contact: name, phone number, email (optional), and an emergency contact's name and number (optional).
- Membership: member ID, plan, start and end dates, freezes, cancellations and the reasons given, home branch.
- Payments: amount, date, method (cash, POS card, transfer), the name on a bank transfer, a terminal reference, who took the payment, and any refund. We do not store card numbers.
- Attendance: each check-in (time, branch, whether entry was allowed), class bookings and attendance.
- Notes and contact history: notes staff write on your record, and a log of when the gym called or messaged you about renewing.
- Consent: the date and way you gave consent (on the join page, or verbally at the desk).
About gym owners and staff
- Name, email, phone number (owners), password (stored only as a one-way Argon2 hash), role and branch.
- What you do in IronTeller: an audit log records actions such as payments taken, refunds, check-in overrides and changes to members, with your name and the time.
- Sign-in information: IP address, browser type, and when you were last active.
Collected automatically
- IP address and browser details, used to keep accounts secure and to limit repeated attempts (for example, too many sign-in or join attempts).
- Cookies and device storage — see section 5.
We do not collect health information, biometrics or ID documents, and we do not ask for them. Please do not put sensitive details such as medical conditions in member notes unless the member has explicitly agreed.
3. Why we use it, and the lawful basis
| Purpose | Lawful basis (NDPA s.25) |
|---|---|
| Running a membership: registering you, recording payments, checking you in, booking classes | Performance of a contract between you and your gym |
| Contacting you about your membership, including renewal reminders on WhatsApp or SMS | Your consent, given when you join; and the gym's legitimate interest in keeping members informed about a membership they hold |
| Keeping payment and accounting records | Legal obligation (tax and accounting record-keeping) |
| Staff accounts, roles and the audit log | Contract with the gym; legitimate interest in preventing fraud and resolving cash or refund disputes |
| Security, preventing abuse, fixing faults | Legitimate interest in keeping the service safe and working |
| Emergency contact details | Your consent; and vital interests if you are hurt at the gym |
We do not use member data for advertising, we do not sell it, and we do not use one gym's data for another gym.
Automated decisions: when you check in, IronTeller works out from your plan and expiry date whether entry is allowed. Staff can always override that decision, and nothing about you is decided by the system alone without a person able to review it.
6. Where the data is stored
IronTeller's servers and database are located in the European Union (Frankfurt). Where that is outside Nigeria, we transfer data only as Part VIII of the NDPA allows — to countries with adequate protection, or under contractual safeguards with our providers — and the same protections in this notice continue to apply.
7. How long we keep it
| Data | Kept for |
|---|---|
| Member record | While the gym holds your membership, and afterwards until the gym deletes it or you ask for it to be erased |
| Payment records | 6 years, because tax and accounting law requires it. If a member is erased, the payment is kept without anything that identifies them. |
| Message log (what was sent, when) | 12 months, then deleted automatically |
| Member app sign-in codes | 10 minutes; each works once |
| Staff and member sessions | 30 and 90 days respectively, or until sign-out |
| Staff accounts and audit log | While the gym uses IronTeller, then deleted when the gym closes its account, except where we must keep records by law |
8. How we protect it
- Everything travels over HTTPS. Passwords are stored only as Argon2 hashes, never in readable form.
- Each gym's data is kept separate, and every request checks which gym and which role the person belongs to.
- Staff permissions are limited by role, and sensitive actions are recorded in an audit log. A refund needs two different people.
- Repeated sign-in, sign-up and code attempts are rate-limited.
If a personal data breach is likely to put people at risk, we will tell the affected gyms straight away, notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it as the NDPA requires, and help gyms tell the members affected where the risk is high.
9. Your rights
Under the NDPA you have the right to:
- Know what we hold and how it is used (this notice);
- Get a copy of your data, in a commonly used electronic format;
- Correct anything that is wrong or incomplete;
- Have it erased where there is no longer a lawful reason to keep it;
- Restrict or object to how it is used, including objecting to renewal reminders;
- Withdraw consent at any time, without affecting what was done before;
- Not be subject to a decision based solely on automated processing that significantly affects you.
Members: ask your gym first — they hold your record and can export, correct or erase it from IronTeller directly. To stop renewal messages, reply to the gym on WhatsApp or tell the front desk. If your gym does not respond, contact us at [privacyEmail not set] and we will help.
Staff and owners: contact us at [privacyEmail not set].
We respond within one month. We may need to confirm who you are before acting on a request.
10. Complaints
If you are unhappy with how your data has been handled, please tell us first at [privacyEmail not set]. You also have the right to complain to the Nigeria Data Protection Commission.
11. Children
The join page is meant for adults. If a gym registers someone under 18, the gym is responsible for getting consent from the child's parent or guardian, as the NDPA requires, and for keeping only what is needed.
12. Changes to this notice
When we change this notice we update the date at the top. If a change materially affects how your data is used, we will tell gyms in IronTeller before it takes effect. See also our Terms of service.