Privacy policy

1. Who is responsible for your data

Fort Fitness is run by Mad Fitness Ltd, registered in Malta (company C69852, VAT MT23293122). Registered office: c/o MVB Ltd, Central Business Centre, Level 0, Mdina Road, Żebbuġ ZBG 9015, Malta. Contact: info@fortfitness.com.mt · +356 7986 5351.

Mad Fitness Ltd is the controller of the personal data handled through our clubs, this website and the Fort Fitness app. We follow the GDPR (Regulation (EU) 2016/679) and Malta's Data Protection Act.

2. What we hold

• You and your account: name, date of birth, gender, photo (if added), language, email, phone, address, emergency contact.
• Your membership and payments: plans, dates, freezes, receipts and refunds. Card payments are handled by Stripe; we never hold card numbers.
• Visits: every door entry and refused entry (who, which club and door, when, how). When you open a door with the app, your phone's location at that moment is checked and recorded with the entry.
• Classes: bookings, attendance, credits and waitlists.
• The app: which phones you use the app on (a random number the app makes), your settings, notification choices and sign-in records (time, device and internet (IP) address).
• Friend invites and member perks: who invited whom, rewards, and perk claims (with a receipt photo if you add one).
• Messages to us: what you send through the website's contact form, or your email when you ask to be told when a club opens.
• This website: a count of visits (page, where the visit came from, phone or computer) with no cookies and nothing that identifies you; Google Analytics only if you accept it (see the Cookie policy).
• CCTV: images recorded at our clubs (section 8).

3. Why we use it

• To run your membership — entry, bookings, payments, receipts, the app. Legal basis: our contract with you.
• To keep accounting and VAT records. Legal basis: legal obligation.
• To keep members, staff and the clubs safe, and to prevent fraud — entry records, location at the door, sign-in records, CCTV. Legal basis: legitimate interests.
• To answer your messages. Legal basis: legitimate interests, or steps before a contract.
• To send you offers and news, and for Google Analytics — only with your consent, which you can withdraw at any time.

4. Who we share it with

Only service providers working for us, each under contract:

• Stripe — card payments.
• Twilio SendGrid — emails.
• Kisi — the electronic door system.
• Render (servers in Frankfurt, Germany), Neon (database) and Cloudflare (photo storage) — hosting.
• Google — Google Analytics, only if you accept it.

If we connect another service to the platform (for example through its secure links for other systems), we add it to this list first, under contract.

Where a provider handles data outside the European Economic Area, the transfer is protected by the EU's Standard Contractual Clauses or another approved safeguard. We do not sell your data, and we do not use AI services on member data.

5. How long we keep it

• Account: while you are a member and for a reasonable time after, in case you return. You can ask us to delete it sooner.
• Payment and accounting records: 10 years, as Maltese tax law requires; after an erase they are kept without your name.
• Website messages: 2 years. "Tell me when it opens": deleted 30 days after we have told you, and within a year at most.
• A join that was never paid: its details are deleted after 30 days.
• Sign-in records: 12 months.
• Website visit counts: 25 months.
• CCTV: 2 weeks, then recorded over.
• Marketing: until you withdraw consent.

6. Your rights

You can ask to see your data (the app has "Download my data"), correct it, delete it, limit or object to its use, take a copy in a machine-readable form, and withdraw consent at any time (in the app's settings, the cookie settings on this website, or the unsubscribe link in any marketing email). Write to info@fortfitness.com.mt; we answer within one month. If you are not satisfied you may complain to the Information and Data Protection Commissioner (idpc.org.mt).

When we erase your account, your personal details are deleted; the records the law makes us keep (payments) stay without your name.

7. Security

Data is encrypted when sent. Staff see only what their role needs, and every change staff make is logged. Door access is personal to each member.

8. CCTV

Our clubs have CCTV cameras for the safety and security of members and staff and to investigate incidents (legal basis: legitimate interests). Footage is kept for 2 weeks and then recorded over. Only the club manager and the company director may view it. Signs at each club entrance tell you about the cameras. To ask for footage that may show you, or for it to be deleted sooner, write to info@fortfitness.com.mt; we may need to confirm who you are and hide other people.

9. Cookies

See our Cookie policy.

10. Changes

We post updates here with a new date, and tell you about important changes by email or in the app.

Terms · Refunds · Privacy · Cookies