1) Who We Are

Jack City Fitness (“Jack City Fitness,” “JCF,” “we,” “us,” or “our”) provides gym and fitness services, including coaching, classes, events, and related products, as well as online content. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website(s), use our online services, engage with us on social media, participate in promotions or giveaways, or become a partner or customer. This Policy applies to website visitors, prospects, and partners. Additional terms may apply to specific services, promotions, or locations.
Controller/Contact: Jack City Fitness, 21 N. Allumbaugh St., Boise, ID 83704, USA · info@jackcityfitness.com · 208-999-1111

2) Information We Collect

Depending on your interactions with us, we collect:

• Identifiers & contact info: name, email, phone, postal address, date of birth, username, social handle, emergency contact.
• Account & partnership details: partnership type, enrollment status, check-ins, class registrations, communication preferences, access-control device ID.
• Fitness & wellness info (sensitive): goals, preferences, training history, body measurements, injuries, and health-related notes you choose to share with a coach or in forms. JCF is not a HIPAA-covered entity, but we treat health-related information as sensitive.
• Transactions & payments: payment method, billing address, tokenized/partial card details, and transaction history. Payments are processed by third-party processors; we do not store full card numbers.
• Communications: emails, SMS/MMS messages, call recordings/voicemails (if applicable), survey responses, customer-support communications.
• Marketing & lead data: form submissions, landing-page/funnel interactions, campaign responses, contest entries, referrals.
• Device & usage data: IP address, device type, browser, pages viewed, links clicked, time on page, and coarse location via IP—via cookies, pixels, and similar tech.
• CCTV/video & in-facility data: security camera footage in common areas/front desk; access-control logs for 24/7 entry.
• Social media content: UGC you tag us in or submit, comments/messages, and public profile info (per your platform settings).
• Job applicant data (if applicable): resume/CV, work history, references, and lawful screening results.

3) How We Collect Information

• Directly from you: website forms, partnership agreements/waivers, check-ins, bookings, communications, giveaways, or UGC submissions.
• Through platforms/service providers: Mindbody (scheduling/partnership management/payments); GoHighLevel (CRM, funnels, email/SMS); payment processors; email/SMS/telephony providers; analytics/ads partners; cloud hosting; IT/security vendors.
• Automatically: cookies, SDKs, pixels, and similar technologies on our sites, pages, and emails.
• From social media: interactions with our profiles or promotions (Facebook/Instagram, TikTok, YouTube, etc.).
• From third parties: referrals, advertising partners, and (where permitted) data-enrichment/analytics providers.

4) Notice at Collection (Categories → Purposes → Typical Retention)

• Identifiers & contact → accounts, bookings, support, safety, legal compliance → partnership + up to 7 years
• Commercial info (purchases, bookings, partnership status) → billing, service delivery, reporting → partnership + up to 7 years
• Internet/activity data (IP, device, interactions) → security, analytics/performance; limited advertising/retargeting if enabled → 90 days–2 years (tool-dependent)
• Sensitive data (gov’t ID for access; wellness notes you choose to share) → identity/age checks; providing requested coaching → partnership + legal hold if needed
• Audio/visual (CCTV; photos/video per release) → security/incident documentation; marketing if consented → CCTV ~30–90 days unless incident; marketing per release/consent
  Retention may extend to meet legal, tax, insurance, or litigation-hold needs.

5) How We Use Information

• Provide & manage services: create/manage accounts, schedule classes, process payments, verify identity, deliver coaching, and support you.
• Operate facilities: check-ins, attendance, access control, and safety/security.
• Communications: respond to inquiries; send service notices, account updates, and transactional messages.
• Marketing & promotions: newsletters, SMS, offers, event invitations, and administering contests/giveaways (with consent where required). You may opt out at any time.
• Personalization: tailor content, offers, and recommendations.
• Analytics & improvements: usage monitoring, campaign measurement, product/service development.
• Compliance & protection: legal obligations; agreement enforcement; fraud/misuse prevention; and safety of partners, staff, and property.
• Legal bases (EEA/UK, where applicable): contract performance; legitimate interests (security, analytics, partner marketing); consent (certain cookies, SMS marketing, processing wellness data you choose to provide); legal obligations (tax, accounting, safety).

6) Marketing, SMS, & Social Media

• Email & SMS/MMS: If you opt in, we may send marketing communications. Message frequency varies; message/data rates may apply. Reply STOP to cancel, HELP for help. Consent is not a condition of purchase.
• GoHighLevel: lead capture, forms, funnels, email/SMS, and marketing automation under its privacy/security practices.
• Social media & ads: pixels/audience tools (Meta, Google, TikTok) to measure performance and show relevant ads. We obtain consent where required and honor Global Privacy Control (GPC) signals for California residents.
• UGC: If you tag or submit content to us, you grant permission to repost or feature it (subject to platform terms and any separate release we may request). Contact us to request removal.

7) Promotions, Giveaways, & Contests

We collect the data you submit (e.g., name, email, handle) to administer the promotion, verify entries, contact winners, and fulfill prizes, and—if permitted—send marketing. Some laws/platforms require limited winner disclosures. Each promotion will include official rules. Unless stated, promotions are not sponsored or administered by the platform.

8) Cookies, Analytics, & Tracking

We use cookies, web beacons, pixels, SDKs, and similar tech for essential functionality, analytics, performance, and advertising (e.g., Google Analytics, Meta Pixel, TikTok Pixel, GoHighLevel tracking, and Mindbody cookies for booking).
Your choices: manage cookies via our banner or your browser; use Google’s opt-out tools and industry opt-outs such as DAA WebChoices and NAI Opt-Out. We honor GPC signals for California “sale/share” opt-outs. Disabling certain cookies may impact features (e.g., Mindbody booking).

9) Disclosing & Sharing Information

We do not sell personal information for money. We may “share” personal information for cross-context behavioral advertising as defined under some state laws (e.g., CPRA). Opt out at /privacy-choices.We disclose information to service providers/processors (Mindbody, GoHighLevel, payment processors/fraud prevention, email/SMS/telephony, analytics/ads partners such as Google/Meta/TikTok, cloud hosting, IT/security), business partners for co-hosted services (with notice/consent), legal/safety recipients, corporate transaction participants, and others at your direction/consent.

10) Media Capture, Marketing & Facility Recording — Consent by Entry/Participation (Strong)

• Consent by entry/participation. By entering any JCF facility, attending a JCF event, or partaking in JCF services (including classes, training sessions, seminars, or community events), you affirmatively acknowledge and agree that JCF and its designees may photograph, film, and record audio of you in public or group areas and may use, reproduce, publish, display, perform, distribute, adapt, edit, create derivative works from, and otherwise exploit your image, likeness, and voice—together with your first name and/or biographical details you provide—for advertising, marketing, publicity, education, and any other lawful business purpose, in any and all media now known or later developed, worldwide, in perpetuity, without additional notice, review, approval, or compensation, to the maximum extent permitted by law, and consistent with JCF Waiver(s).
• License & waiver of claims. You grant JCF an irrevocable, perpetual, worldwide, transferable, and sublicensable, royalty-free license to the above uses and waive and release JCF from any and all claims arising out of such uses, including invasion of privacy, misappropriation of likeness/right of publicity, false light, defamation, and moral rights, to the fullest extent permitted by law.
• No expectation of privacy in public areas. You understand that JCF facilities include group spaces where there is no reasonable expectation of privacy. JCF may post signage giving notice of photo/video/audio capture.
• Minors. If a minor is present, you represent that you are the parent/legal guardian or have authority to grant consent on the minor’s behalf.
• Opt-out mechanics for marketing use (prospective only). If you do not wish to appear in future marketing content, notify the front desk before your session or email info@jackcityfitness.com. JCF will use reasonable efforts to accommodate (e.g., placement adjustments, no-camera zones, identifiers/wristbands). This does not require removal or recall of content already created, published, or in production; archival and operational copies may be retained.
• Security/operations not optional. This opt-out does not apply to CCTV/security recordings, access logs, or incident documentation used for safety, loss prevention, rule enforcement, insurance, or legal compliance.

11) How This Policy Works with Your Waiver & Gym Rules

• Waiver records: We retain signed Waiver(s), risk acknowledgments, incident reports, and related forms as part of your partner file to operate safely and defend legal claims.
• Access control & CCTV: For 24/7 access and security, we log fob activity and maintain CCTV in common areas. Logs/recordings may be reviewed for rule enforcement, safety, and investigations.
• Disputes/chargebacks: We may share relevant records (e.g., check-ins, signed agreements) with our processor/bank to resolve payment disputes.
• Which document controls? Your Waiver governs risk-of-injury/assumption-of-risk/liability release. This Policy governs data practices. Each controls its subject matter.

12) Data Retention

• Partnership records: duration of your partnership and up to 7 years thereafter.
• Transaction records: at least 7 years for tax/accounting.
• Marketing leads: typically 24 months from last interaction or until you opt out.
• CCTV footage: typically 30–90 days, unless needed for investigations.
• Promotion records: for the duration of the promotion and required recordkeeping.
• We may retain data longer where required by law or to establish, exercise, or defend legal claims.

13) Data Security

We maintain administrative, technical, and physical safeguards appropriate to the nature of the data (e.g., TLS encryption in transit, access controls, least-privilege practices, staff training, vendor diligence with Mindbody and GoHighLevel). No method of transmission or storage is 100% secure. If required by Idaho law, we will notify you of certain data breaches.

14) Children’s & Teens’ Privacy

Our online services are not directed to children under 13, and we do not knowingly collect personal information from them. If we learn we collected such information, we will delete it. For teen/minor partnerships, a parent/guardian must complete enrollment and Waiver paperwork; we collect only what is necessary to provide services. Parents/guardians may exercise rights on behalf of minors by contacting us.

15) Your Privacy Rights & Choices

Everyday choices: unsubscribe from emails; reply STOP to SMS (HELP for help); manage cookies via our banner/browser; use DAA WebChoices and NAI Opt-Out.
State privacy rights (e.g., CA, CO, CT, UT, VA): request access, portability, correction, or deletion; opt out of “sale,” “sharing,” or targeted advertising. Submit at /privacy-choices, email info@jackcityfitness.com, or call 208-999-1111. We verify identity before responding. Authorized agents may submit requests with proof of authority. We will not discriminate for exercising rights.
California (CCPA/CPRA): categories include identifiers, commercial info, internet/activity data, coarse geolocation, inferences, and—where provided—sensitive data (wellness notes). We may “share” identifiers and internet/activity data with ads partners; opt out at /privacy-choices or via GPC. Limit use of sensitive personal information: we use sensitive wellness data only to provide requested services; Californians may request limitation at /privacy-choices.
EEA/UK GDPR notice: Controller—Jack City Fitness (address above). Legal bases—see Section 5. International transfers—appropriate safeguards (e.g., SCCs). EU/UK representative—[insert if appointed; otherwise “not applicable”]. You may lodge a complaint with your supervisory authority.