Privacy Policy

01Who we are

KRS Club (Pty) Ltd (“KRS Club”, “we”, “us”) operates the Itensity Online membership management platform. We are registered in South Africa (registration number 2016/438793/07), with our registered office at 49 Bell Crescent, Westlake Business Park, Westlake, Cape Town 7945, South Africa.

This policy explains how we handle personal data for our website (www.itensityonline.com), for our customers, and for the members and staff whose data is processed through the Platform. It is written to comply with the UK GDPR and the EU GDPR (together, “GDPR”) as applicable.

02Our different roles

It is important to distinguish the capacities in which we act, because our responsibilities differ:

• Website visitors and our own customers: we are the controller. We decide how your data (for example, enquiry details and billing contact information) is used.
• Members and staff of our customers: where a customer (for example, a gym or club) uploads its members’ or employees’ personal data to the Platform, that customer is the controller and we act as its processor, handling the data only on the customer’s instructions to provide the service.

03Data we process and why

3.1 Website visitors

• Contact and enquiry details you submit (name, email, message) — to respond to you and provide information you request. Lawful basis: legitimate interests / steps prior to entering a contract.
• Technical and usage data (IP address, browser, cookie identifiers) — to operate, secure and improve the Website. Lawful basis: legitimate interests and, for non-essential cookies, your consent.

3.2 Customers (billing and account data)

• Business contact and billing details, including a named contact person’s name, email and role, VAT/registration numbers and payment information — to administer your account, invoice you and collect payment. Lawful basis: performance of a contract and our legitimate interests.

3.3 Members and staff (processed on behalf of our customers)

• Membership, attendance, contact and payment-related data entered into the Platform by our customers — processed solely to deliver the Platform to that customer. The customer determines this data and is the controller for it.

04Where your data is stored and international transfers

We host personal data according to a two-tier model:

• Member and staff data (processed for our customers) is stored on servers located within the United Kingdom or the European Union. This data does not leave the UK/EU in the ordinary course of providing the service.
• Limited business and billing data (relating to our customers) is processed in South Africa, because our own accounting and payment systems — including our Sage/Xero accounting records and Wise/GoCardless payment facilities — are operated from South Africa, where KRS Club is established.

05Cookies

The Website uses cookies. Essential cookies are necessary for the site to function. Non-essential cookies (for analytics and preferences) are only set with your consent, which you can manage or withdraw at any time. Full detail is set out in our Cookie Notice.

06How long we keep data

We retain personal data only for as long as necessary for the purposes described above, or as required by law (for example, tax and accounting records). Member and staff data processed on behalf of a customer is retained in line with our agreement with that customer and deleted or returned on termination, subject to any legal retention obligations.

07Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to data portability. Where processing is based on consent, you may withdraw consent at any time. If we act as processor for a customer, we will refer your request to that customer as the controller and assist them in responding.

• To exercise your rights, contact us using the details in section 9.
• You may lodge a complaint with a supervisory authority — in the UK, the Information Commissioner’s Office (ICO); in the EU, your local data protection authority — or complain to us directly via our complaints route (see section 9).

08Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure. We will notify affected parties and the relevant authority of a personal data breach where required by law.

09Contact, complaints and our representative

To complain directly, email our monitored complaints inbox complaints@itensityonline.com. We acknowledge complaints within 30 days.

UK Representative (Article 27 UK GDPR): Prighter (powered by iuro Attorneys at Law) — Vishal Gera, vishal.gera@prighter.com.

10Changes to this policy

We may update this policy from time to time. The current version is always available on the Website, and material changes will be notified where appropriate.