Last updated: 11 November 2026
This policy explains how BMS Warehouse Gym uses personal information when you visit our website, enquire, join, book, train, receive coaching or use a body-composition service. It covers BMS’s activities at Bundoran and Killybegs and our related online services.
1 Who is responsible and how to contact us
BMS Warehouse Gym Ltd is responsible for the personal information it controls. Contact our management team about privacy at [email protected], or write to Unit 2, Bundoran Retail Park, Drumacrin, Bundoran, Co. Donegal, F94 P230. Please mark your message “Privacy”.
BMS is responsible for its gym services, local access and CCTV, enquiries and the coaching services it provides. Ashbourne administers membership registration, payments and related systems and has its own data-protection responsibilities. Its service privacy notice describes joint control for some membership activities. You can contact BMS about your rights, including where Ashbourne is involved, or contact Ashbourne at [email protected].
Read Ashbourne’s service privacy notice for its member-data processing, contact details and rights arrangements. BMS remains responsible for the processing it controls; a supplier’s notice does not replace your rights against BMS.
2 Information we use and where it comes from
We collect information you provide through signup, enquiries, bookings, forms, conversations and the services you choose. This can include your name, contact details, date of birth, membership reference, chosen location and product, payments and billing records, booking and attendance history, communications and consent choices.
For members under 18, we also use the parent or guardian details, permissions and emergency information needed for safe participation. If you nominate an emergency contact, please let that person know and direct them to this policy. We may receive information from that contact or your guardian when necessary.
Access systems generate entry records, such as the member or credential reference, location, date, time and entry result. Where used, membership photographs help staff check that access is personal. Security cameras can capture identifiable images in areas covered by the gym’s CCTV signage.
If you choose coaching, BMS Journeys or body scans, relevant information may include goals, programme records, feedback, measurements, scan results, progress photographs and health information you choose or need to provide for that service. Incident reports can also contain health information. We limit what is requested to the purpose involved.
We receive relevant administration updates from Ashbourne and payment providers. Website and security providers process technical information such as IP addresses, browser and device information, requested pages and security events. Optional tracking is covered separately below.
Information needed to identify you, administer payment and check safe, authorised access is necessary to provide the relevant membership or booking. If it is missing, we may be unable to activate that service. Marketing choices and optional services are separate. Please do not send full payment-card details or unnecessary medical records in a general enquiry.
3 Why we use information and our legal bases
Membership and bookings: we use the necessary identity, contact, product, payment and attendance information to take steps you request before a contract and to deliver and administer your contract, under GDPR Article 6(1)(b).
Enquiries and service messages: we respond to your request on the same pre-contract or contract basis where applicable. For other enquiries, our legitimate interest under Article 6(1)(f) is to respond appropriately and maintain an accurate record. Service messages include booking confirmations, payment queries and material operational changes; they are separate from promotional messages.
Safety, access security and incident management: our legitimate interests are to protect people and property, prevent misuse and investigate incidents. We assess necessity, proportionality and the effect on your rights. We use a legal obligation under Article 6(1)(c) where a specific duty requires a record or disclosure. Emergency use may rely on vital interests under Article 6(1)(d) where its conditions apply.
Accounting and legal compliance: we keep the records required by tax, accounting and other applicable law under Article 6(1)(c). Establishing, exercising or defending legal claims may involve our legitimate interests. These bases are applied to the relevant record and purpose, rather than used as a general justification for everything we collect.
Optional marketing, identifiable promotional media and optional website tracking: we use consent under Article 6(1)(a), with the additional electronic-communications rules where applicable. You can withdraw consent. Refusal does not remove ordinary gym membership access.
For optional coaching or body-scan health information, we require your specific, explicit consent under Articles 6(1)(a) and 9(2)(a). Ordinary programme and appointment administration may separately be necessary for the service contract. We explain the purpose and request the relevant consent at collection.
4 Health information and body scans
Health information is specially protected. A membership contract or generic waiver is not sufficient permission for every use of it. Before collecting health screening, scan results or related coaching information, we explain what is required, why, who will see it and the applicable consent or other lawful condition.
You may withdraw health-data consent through our privacy contact. We will stop the processing that depends on that consent. If particular information is genuinely necessary to deliver an optional scan or coaching service safely, we may be unable to continue that specific service without it; we will explain the options. We do not treat this as automatic cancellation of all gym access.
Some health information may be retained where necessary for legal claims under Article 9(2)(f), together with an appropriate Article 6 basis. In a genuine emergency, Article 9(2)(c) can apply where a person is physically or legally unable to consent. We do not use those exceptions for routine marketing or general programme development.
Scan results and health notes are not made available to other members, independent room users or unrelated coaches merely because they work in the same gym. We do not publish results, progress photographs or testimonials without separate appropriate permission.
5 Children and young people
Members under 18 have their own privacy rights. We use age-appropriate explanations and collect only what is needed for membership, safeguarding and the chosen service. A parent’s involvement does not give them an automatic right to every item of a young person’s information.
BMS’s minimum joining age and access restrictions are set out in the Membership Terms. They are separate from Ireland’s age of digital consent. Where an online service offered directly to a child relies on consent and the child is under 16, the applicable parental-authorisation requirements must be met. Other lawful bases still require appropriate protections for children.
We use separate permissions for a child’s promotional images and respect their wishes. A membership consent form is not a general release to use a child’s image or health information for advertising.
6 CCTV and access security
Security CCTV is used to protect people and property, help control unauthorised entry and investigate relevant incidents. The lawful basis is our legitimate interest in those purposes, subject to necessity, proportionality and your rights. Signage identifies camera use.
Routine CCTV footage at Bundoran and Killybegs is retained for 30 days before being overwritten. A relevant recording may be kept longer where needed for an identified incident, complaint, legal claim, preservation request or lawful disclosure. Such recordings are restricted to the relevant matter and retained only for as long as that purpose requires.
Cameras must not record inside toilets, showers or changing areas. Only authorised people may review relevant recordings. Footage may be shared with insurers, professional advisers or An Garda Síochána where there is a lawful, necessary reason. It is not used for ordinary promotional content.
Entry credentials and logs are used to check access permissions and investigate misuse. Contact BMS if access is refused incorrectly so a person can review the issue. A turnstile or CCTV system does not mean BMS continuously supervises exercise or guarantees an immediate response.
7 Who receives information
Information is available to authorised BMS staff according to their duties. Relevant service providers may handle it to deliver the services you use: Ashbourne for membership administration, app services, bookings and payment administration; payment providers for collections or transactions; Microsoft 365 for business communications and records; and GymRite and the relevant scan system for the coaching or body-scan service you choose.
Our website hosting, maintenance and security providers process the information necessary to operate and protect the website. The current website arrangements include WordPress, Hosting Ireland, Cloudflare and Complianz. Google receives technical connection information when the consent-controlled Tag Manager service loads, as explained in the Cookie Policy.
Providers acting on our instructions are subject to appropriate data-processing arrangements. A provider that determines its own purposes has separate controller responsibilities and its own privacy information. We do not assume every supplier is simply a processor.
We may disclose relevant information to professional advisers, insurers, regulators, emergency services or law enforcement where necessary and lawful. An independent coach or therapist is not automatically entitled to your BMS record. Their separate service should identify its provider and privacy arrangements before you share information.
We do not sell your personal information. We do not use health information or children’s information to create advertising audiences under this policy.
8 International processing
Some providers operate outside the European Economic Area or use international support and infrastructure. Ashbourne’s service notice states that its member data is stored in the United Kingdom. Other international processing depends on the service used.
Where a restricted transfer is involved, we require a valid transfer mechanism, such as an applicable adequacy decision or appropriate contractual safeguards, with additional measures where needed. You can ask us which recipients, destinations and safeguards apply to your information and how to obtain a copy, subject to appropriate redactions.
9 How long we keep information
We keep identifiable information only for as long as needed for the stated purpose, taking account of legal duties and justified legal-claim periods. Different records have different needs. A reason to keep an invoice does not automatically justify keeping all health notes or CCTV for the same period.
Enquiries: until the request and any agreed follow-up are complete. If the enquiry becomes a membership or booking, the information needed for that service becomes part of the relevant service record. An unresolved complaint or legal claim may require a limited record to be kept longer.
Membership and payment records: throughout the relationship and while any outstanding payment, refund or dispute is being resolved. Records needed for tax, accounting or legal claims are then retained for the period applicable to that record, measured from the relevant transaction, accounting period or event. We do not keep unrelated information merely because a financial record must be retained.
Coaching, scans and health records: for the chosen service and agreed progress reviews or follow-up. Once those purposes end, the information should be deleted or anonymised unless a specific legal obligation or claim requires retention. Consent withdrawal ends processing based on that consent; any necessary retained record is restricted to its separate lawful purpose.
Access logs: for the period needed to check authorised entry and resolve a reported access or security issue. Relevant entries connected with an incident or claim may be retained until that matter and any applicable legal-claim period have ended. Routine CCTV follows the 30-day period in section 6; it is not kept for the whole membership simply because you remain a member.
Consent and marketing preferences: while needed to evidence a choice and honour it. A limited suppression record may be kept to ensure that someone who has opted out is not added back to marketing.
Retention reviews also cover incident files, supplier-held copies and backups. An incident record may be required until the matter, any insurer involvement and applicable legal-claim period have ended. A backup is not a reason to use deleted information again or retain it indefinitely. Contact our privacy address for the retention period and criteria applying to a particular record.
10 Marketing and your choices
We ask for a separate choice before sending promotional emails, texts or other consent-based electronic marketing. You can unsubscribe through the message or contact [email protected]. We will stop marketing when you object. Essential membership and booking messages may continue where needed to provide the service.
Irish law permits limited existing-customer marketing in defined circumstances. We will rely on that exception only where all conditions are met, including appropriate collection-time and message-level opt-outs. An enquiry, abandoned signup or general acceptance of terms is not automatically marketing permission.
Permission for a photograph, video, testimonial or progress story is separate from general marketing preferences. You can withdraw it for future use. We will explain any practical limits on recalling material already printed or independently shared, and address removal from channels we control where applicable.
11 Website cookies and external services
Our separate Cookie Policy explains the technologies in use and the consent controls. Necessary technologies support requested website functions; optional analytics, advertising and similar tracking require the relevant permission before activation. Use “Cookie settings” to change or withdraw your choice.
Google Tag Manager is configured to load after Statistics consent. Tag Manager manages tags; installing it does not by itself mean that Analytics or advertising tracking is active. See the current Cookie Policy for the enabled services and their durations. Additional optional tracking requires the relevant information and consent before activation.
Following a link to Ashbourne, a payment service, Google Maps, Instagram or Facebook brings you to that provider’s service and privacy information. Embedded feeds or other optional third-party features, if enabled, must be described and controlled appropriately; a link and an embedded connection do not have the same privacy effect.
12 Your rights
Depending on the circumstances, you can request access to your information, correction, erasure, restriction of use or a portable copy. You can object to processing based on legitimate interests, and you have an unconditional right to object to direct marketing. You may withdraw consent without affecting the lawfulness of earlier processing.
Contact our privacy address to exercise a right. We may ask for proportionate information to verify identity and locate the records. We normally respond within one month. Where a permitted extension is needed because of complexity or the number of requests, we will explain it within that first month; the extension can be up to two further months.
Rights have lawful limits, including protection of other people and records genuinely needed for legal obligations or claims. We will explain any refusal or limitation and the options available to you. You may complain directly to Ireland’s Data Protection Commission at dataprotection.ie without first completing our complaints process.
13 Security and changes
We use appropriate technical and organisational measures, including access restrictions, staff responsibilities and supplier controls, to protect personal information. No internet service is completely risk-free. Please do not send full payment-card information or unnecessary medical records through general enquiries or social messages.
If we introduce processing that materially changes this notice, we will update the information and obtain any additional permission required before that processing begins. Updating a policy does not itself create consent or retrospectively authorise a new purpose.
Related policies
Membership Terms & Conditions · Code of Conduct · Privacy Policy · Cookie Policy