PRIVACY POLICY

This Privacy Policy explains how GymDirector (operated by Star Group Enterprise, Kottayam, Kerala 686001, India) collects, uses, stores, shares and protects digital personal data in connection with our gym and health club management website, mobile application and related services.

We process personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian laws. Under the DPDP Act, GymDirector acts as a Data Fiduciary for personal data we determine the purpose and means of processing. Gym owners and club administrators who enter or manage member data in GymDirector may also act as Data Fiduciaries for their members. Individuals to whom personal data relates are Data Principals. Service providers who process data on our behalf are Data Processors.

Last updated: July 2026

SECTION 1 – WHAT PERSONAL DATA DO WE COLLECT?

GymDirector is a gym and health club management service. When you create an account, register your club, use our website or mobile application, or allow your members to use our services, we may collect personal data needed to provide the service for a lawful purpose.

Club owner and administrator data may include name, mobile number, email address, club name, club logo, login credentials, subscription and billing details.

Gym member data may include information entered by the club or by the member, such as name, phone number, email address, profile photo, gender, age, height, weight, blood group, membership plan, trainer assignment, payment records, attendance records, workout logs, emergency contact details and notes added by the club.

Technical data may include IP address, browser type, device information, operating system and usage information, collected to help us provide, secure and improve the service.

We process only such personal data as is necessary for the specified purpose. We do not sell personal data.

SECTION 2 – NOTICE AND PURPOSE OF PROCESSING

In line with Section 5 of the DPDP Act, before or at the time we request consent, we inform you of:

the personal data we propose to process and the purpose of processing;
how you may exercise your rights as a Data Principal (including withdrawal of consent, access, correction and erasure); and
how you may make a complaint to the Data Protection Board of India after exhausting our grievance redressal process.

We use personal data to create and manage gym accounts, maintain member profiles, mark attendance, manage membership plans, record payments, generate reports, support QR-based attendance, send service reminders, provide customer support, protect the service from misuse and improve the GymDirector platform.

You may access the substance of this notice in English. We will endeavour to provide access in other languages specified in the Eighth Schedule to the Constitution of India where required under applicable rules.

Under Section 6 of the DPDP Act, where consent is the basis of processing, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to personal data necessary for the specified purpose.

When you register a club, create an account, add a member, mark attendance, process a payment, contact support or otherwise use our services, you consent to our collecting and using that personal data for those service-related purposes.

If we ask for personal data for a secondary purpose (for example, marketing), we will seek separate consent or provide a clear option to decline. Consent that attempts to waive your right to complain to the Data Protection Board of India is invalid.

Certain legitimate uses

Where permitted under Section 7 of the DPDP Act, we may process personal data without fresh consent for certain legitimate uses, including where you have voluntarily provided data for a specified purpose and have not indicated that you do not consent; for complying with law or court orders; for responding to a medical emergency involving a threat to life or health; or for employment-related purposes where applicable.

You may withdraw consent at any time with ease comparable to the ease with which consent was given, by contacting us at contactus@gymdirector.com or by mail at Star Group Enterprise, Kottayam, Kerala 686001, India.

Withdrawal does not affect the legality of processing done before withdrawal. After withdrawal, we will cease processing (and cause our Data Processors to cease processing) within a reasonable time, except where continued processing is required or authorised under the DPDP Act or any other law in force in India. Some information may still be required to maintain an active account, complete ongoing transactions, or meet legal retention duties.

SECTION 4 – YOUR RIGHTS AS A DATA PRINCIPAL

Under Chapter III of the DPDP Act, you have the following rights:

Right to access information (Section 11)

You may request a summary of your personal data being processed by us, the processing activities undertaken, and the identities of other Data Fiduciaries or Data Processors with whom your personal data has been shared (except where sharing is with a Data Fiduciary authorised by law for prevention, detection, investigation or prosecution of offences).

Right to correction, completion, updating and erasure (Section 12)

You may request correction of inaccurate or misleading data, completion of incomplete data, updating of personal data, and erasure of personal data, unless retention is necessary for the specified purpose or for compliance with any law for the time being in force.

Right of grievance redressal (Section 13)

You have the right to readily available means of grievance redressal regarding our obligations or your rights under the DPDP Act. We will respond to grievances within a reasonable period as may be prescribed. You must exhaust our grievance redressal process before approaching the Data Protection Board of India.

Right to nominate (Section 14)

You may nominate another individual who, in the event of your death or incapacity, may exercise your rights under the DPDP Act on your behalf. To register a nominee, contact us at contactus@gymdirector.com.

To exercise any of these rights, email contactus@gymdirector.com with sufficient details for us to verify your identity and locate your records. Gym members should also contact their club administrator, who may control the member data entered in GymDirector.

SECTION 5 – DUTIES OF THE DATA PRINCIPAL

Under Section 15 of the DPDP Act, while exercising your rights you must:

comply with all applicable laws;
not impersonate another person when providing personal data;
not suppress material information when providing data for identity or address proofs issued by the State;
not register a false or frivolous grievance or complaint with us or the Board; and
furnish only verifiably authentic information when requesting correction or erasure.

SECTION 6 – CHILDREN AND PERSONS WITH DISABILITY

Under the DPDP Act, a child is an individual who has not completed the age of eighteen years. Before processing personal data of a child, or of a person with disability who has a lawful guardian, we (and club administrators using GymDirector) must obtain verifiable consent of the parent or lawful guardian, as applicable.

We do not undertake processing of children’s personal data that is likely to cause a detrimental effect on the well-being of a child. We do not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children, through GymDirector.

By using this service, club administrators represent that where they enrol members under eighteen years of age, they have obtained appropriate parental or guardian consent as required by law.

SECTION 7 – DISCLOSURE AND DATA PROCESSORS

We may disclose personal data if required by law, court order, government request, legal process, to protect our rights and users, or if you violate our Terms of Service.

We may engage Data Processors (such as hosting providers, payment processors, email/SMS/WhatsApp communication providers, analytics tools and support services) only under a valid contract, and only to the extent necessary to provide their services to us. We remain responsible for processing undertaken on our behalf.

Club administrators are responsible for the member information they enter and manage in GymDirector. Members should contact their club administrator or GymDirector for access, correction or deletion requests related to their information.

SECTION 8 – PAYMENT

We use Razorpay for processing payments. We do not store your card details on our servers. Payment information is processed by Razorpay using security standards such as the Payment Card Industry Data Security Standard (PCI-DSS).

Your payment transaction data is used only as long as necessary to complete the transaction and maintain required billing records. Razorpay and other payment processors may have their own privacy policies that apply to the payment information processed by them. For more information, see https://razorpay.com.

SECTION 9 – TRANSFER OF PERSONAL DATA OUTSIDE INDIA

Under Section 16 of the DPDP Act, the Central Government may restrict transfer of personal data for processing to certain countries or territories outside India. We will not transfer personal data to any country or territory so restricted.

Some third-party providers we use may process data outside India where permitted. Where that occurs, such processing remains subject to the DPDP Act and any higher protection or restriction under other applicable Indian law.

SECTION 10 – DATA RETENTION AND ERASURE

In line with Section 8(7) of the DPDP Act, unless retention is necessary for compliance with any law for the time being in force, we erase personal data upon withdrawal of consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, and we cause our Data Processors to erase such data.

We retain personal information for as long as your account and active monthly subscription remain in effect so that we can provide GymDirector services. Information including names, contact details, attendance records, payment records and membership details is stored for the duration of your subscription.

If you cancel your monthly subscription, your account and associated user data will be deleted from our active systems within 30 days of the cancellation taking effect. After this period, your data is permanently removed and cannot be recovered, except where we are required to retain certain transaction, billing, tax, accounting, security or legal records for a limited period under applicable law.

You may also request erasure at any time by contacting contactus@gymdirector.com. Upon a verified request, we will erase your data within 30 days, subject to the legal retention exceptions noted above.

SECTION 11 – SECURITY AND PERSONAL DATA BREACH

Under Section 8 of the DPDP Act, we implement appropriate technical and organisational measures and take reasonable security safeguards to protect personal data in our possession or under our control (including processing by Data Processors) and to prevent personal data breach.

A personal data breach means any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.

In the event of a personal data breach, we will intimate the Data Protection Board of India and each affected Data Principal in the form and manner as may be prescribed under the DPDP Act and rules.

No internet-based service can guarantee absolute security. You are responsible for keeping your login credentials confidential and for limiting access to authorised club staff only.

SECTION 12 – COOKIES AND LOCAL STORAGE

We use cookies and similar technologies to maintain user sessions, remember preferences, support authentication and improve the service. These technologies are not used to personally identify you on unrelated websites.

Some app features may use browser local storage, for example to remember a mobile number on the QR attendance scanner for convenience. Users may clear this stored information from the app option or browser settings.

SECTION 13 – ACCURACY OF PERSONAL DATA

Where personal data we process is likely to be used to make a decision that affects you, or disclosed to another Data Fiduciary, we take steps to ensure its completeness, accuracy and consistency, as required under the DPDP Act. Club administrators should keep member records up to date.

SECTION 14 – GRIEVANCE REDRESSAL AND COMPLAINTS

We maintain an effective mechanism to redress grievances of Data Principals. For questions, access, correction, erasure, withdrawal of consent, nomination, or complaints about processing of your personal data, contact our Privacy Compliance contact:

Email: contactus@gymdirector.com
Postal address: Star Group Enterprise, Kottayam, Kerala 686001, India

If you are not satisfied with our response after exhausting this grievance redressal process, you may make a complaint to the Data Protection Board of India in accordance with the DPDP Act and rules made thereunder. Appeals from orders of the Board lie before the Appellate Tribunal as provided under the Act.

SECTION 15 – CHANGES TO THIS PRIVACY POLICY

We may modify this Privacy Policy at any time. Changes take effect when posted on this page. If we make material changes, we will update this page so users are aware of what information we collect, how we use it and under what circumstances we disclose it.

If GymDirector or Star Group Enterprise is acquired or merged with another company, your information may be transferred to the new owner so that we may continue providing the service, subject to applicable law.

QUESTIONS AND CONTACT INFORMATION

If you would like to access, correct, amend or erase personal information we have about you, register a grievance, nominate a person to exercise your rights, or request more information about this Privacy Policy or our processing under the Digital Personal Data Protection Act, 2023, contact us at contactus@gymdirector.com or by mail at Star Group Enterprise, Kottayam, Kerala 686001, India.