Privacy Policy — Derry, NH — CrossFit

Breathe CrossFIt (“we”, “us”, “our”) operates this website. This policy explains what we collect when you use it, why we collect it, who we share it with, and what you can ask us to do about it.

What we collect

What you tell us. When you book an intro, ask a question, or sign up through a form on this site, we collect what you type into it — typically your name, email address, phone number, and anything you write in the message. If you go on to join, we collect what our membership and billing systems need, which is set out in the agreement you sign with us.

What your device tells us. Like most websites, ours records basic technical information automatically: IP address, browser and device type, the pages you visited, and the site or search that sent you. We use privacy-respecting analytics to understand which pages are useful, not to identify you personally.

What we do not collect here. We do not ask for payment card numbers through this website, and anything you share with a coach in person is handled in our gym systems under the agreement you sign — not through this site.

Cookies and analytics

We use a small number of cookies and similar technologies:

Necessary — to keep the site working, to remember choices you make, and to protect our forms from automated abuse. These cannot be switched off.
Analytics — Google Analytics 4, loaded only after you interact with the page, to count visits and see which pages people read. It sets its own cookies and processes data under Google’s own terms.

You can block or delete cookies in your browser settings. Blocking the necessary ones may stop parts of the site working. You can opt out of Google Analytics entirely with Google’s browser add-on.

Advertising. If we run advertising that uses tracking pixels, third-party vendors — including Google, Meta (Facebook and Instagram) and X — use cookies and similar technologies on this website to measure our ads and to show you ads elsewhere on the internet based on your visit here. Those companies set their own cookies and process that data under their own privacy policies. You can control this through Google Ads Settings, Facebook ad preferences, and X’s ad preferences under Settings and privacy → Privacy and safety, and you can opt out of interest-based advertising from participating companies at optout.aboutads.info and optout.networkadvertising.org.

Why we use it, and our lawful basis

We use what we collect to answer your enquiry, book and run your session, keep our records, improve the site, and — where you have asked for it — send you news about the gym. Where the GDPR applies, our lawful bases are: your consent (marketing email, optional cookies), the performance of a contract (running your booking or membership), our legitimate interests (replying to enquiries, keeping the site secure and useful), and legal obligation (tax and accounting records).

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only with the services that run this gym and this website, and only so far as they need it:

our gym management and booking platform, which receives form submissions and holds member records;
our website host and security provider, which serves the site and screens forms for automated abuse;
our analytics provider, as described above;
map and review services, where those sections appear on the site;
professional advisers, and anyone we are legally required to tell.

Each of these handles data under its own terms, and we ask them to protect it to the standard this policy describes.

How long we keep it

Enquiries and intro bookings are kept for up to two years from your last contact with us, so we can pick up where we left off. Member records are kept for as long as you are a member and for up to seven years afterwards, where tax and accounting rules require it. Analytics data is kept on our provider’s default retention period. When a period ends, we delete the data or anonymise it.

Your rights

Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it, and you can tell us to stop sending you marketing at any time — every marketing email has an unsubscribe link, and you can simply reply and ask.

If you are in the EU or UK, you also have the right to restrict or object to processing, to receive your data in a portable format, to withdraw consent at any time, and to complain to your data protection authority.

If you are in California, you have the right to know what categories of personal information we collect, use and disclose, the right to request a copy or deletion, the right to correct it, and the right not to be treated differently for exercising any of them. We do not sell or share personal information as those terms are defined by California law, so there is nothing to opt out of — but if that ever changes we will say so here first.

If you are in Virginia, Colorado, Connecticut, Utah, or another state with its own privacy law, you have broadly the same rights: to confirm whether we process your data and access it, to correct it, to delete it, to get a portable copy, and to opt out of targeted advertising, sale, and profiling that has a legal or similarly significant effect. Most of these states also require your consent before we process sensitive data, which we ask for at the point we collect it. If we refuse a request, you may appeal: reply to our decision and we will review it and respond within the time your state allows, and if we deny the appeal we will tell you how to complain to your state’s Attorney General.

We do not sell or share the personal information of anyone under 16.

To exercise any of these, email info@breathecrossfit.com or call +16036650699. We will confirm your request, may ask for enough information to be sure it is really you, and will respond within the time your law allows — 30 days under the GDPR, 45 days under the California and other state laws, and we will tell you if we need longer.

Browser privacy signals

If your browser or an extension sends a Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of any sale or sharing of your personal information for that browser.

Children

This site is not directed at children under 13, and we do not knowingly collect their personal information. If your child trains with us, we collect what a parent or guardian gives us for that programme under the agreement they sign. If you believe a child has given us information through this website, email us and we will delete it.

Photographs and video in the gym

We sometimes photograph or film classes and events for our website and social media. If you would rather not appear, tell a coach or email us and we will keep you out of the shot and remove anything already published on request.

Security

We use encrypted connections, keep access to member records limited to staff who need it, and rely on established providers for hosting, forms and payments. No system is perfectly secure, and we cannot guarantee absolute security — but if a breach affects your personal information we will tell you and the relevant authority as the law requires.

Where your information is held

We are based in the United States and our providers may hold or process your information there. If you contact us from outside the United States, you understand your information will be transferred there, and where the GDPR applies we rely on the appropriate safeguards our providers have in place for that transfer.

Changes

We may update this policy. The date at the top of this page is when we last did. If a change materially affects how we use your information, we will make that clear here.

Contact

Questions, requests, or complaints about this policy go to info@breathecrossfit.com, or write to Breathe CrossFIt, 8E Tinkham Ave, Derry, NH, 03038.