Privacy Policy

Information we collect

We only collect what we need to sell, deliver and support the GymEXA gym management system.

• Account and enquiry details you give us: name, gym name, email address, phone number and city.
• Order details: the package and add-ons you select, billing cycle and any optional hardware.
• Payment details are entered on our payment gateway's secure page. We receive a payment status, reference number and amount — we never see or store your full card number, CVV or bank credentials.
• Support messages you send us through the contact form, email, phone or WhatsApp.
• Basic technical data when you browse this website: pages viewed, referring page, approximate location, browser and device type.

How we use your information

Your information is used for the purposes below and nothing else. We do not sell or rent personal data.

• Processing your order, payment and subscription.
• Setting up, delivering and supporting your GymEXA account and any door-access hardware.
• Sending service messages such as receipts, renewal reminders and important system notices.
• Answering enquiries and providing technical support.
• Improving the website and our packages using aggregated, non-identifying statistics.
• Meeting legal, tax and accounting obligations in Sri Lanka.

Data your gym stores in GymEXA

If you subscribe, your gym remains the owner of the member records, attendance, payment and access logs you enter into the GymEXA application. We process that data only to run the service for you, to provide support you request, and to keep backups. We do not use your gym's member data for marketing, and we do not share it with other gyms.

How data is stored and protected

• Data is transmitted over encrypted HTTPS connections.
• Databases are hosted with reputable cloud providers and protected by access rules, so records are only reachable by authorised accounts.
• Administrative access is limited to staff who need it for support, and is protected by individual logins.
• Regular backups are taken so data can be restored after a technical failure.
• We keep records only as long as needed for the service and for the retention periods required by law, then delete or anonymise them.
• No online system can be guaranteed to be completely secure, so we also ask you to keep your passwords private and to tell us immediately if you suspect misuse of your account.

Cookies and analytics

This website uses a small number of cookies and similar storage to keep the site working (for example remembering your session in the admin panel) and to count page views so we can see which pages are useful. Analytics data is aggregated and is not used to identify individual visitors. You can block or delete cookies in your browser settings; essential parts of the site may then behave differently.

Third-party services

We use a limited number of trusted service providers, and share only the data each one needs to do its job.

• Payment gateway — to take card and online payments securely and to confirm payment status.
• Cloud hosting and database provider — to host the website, application and backups.
• Email, SMS and WhatsApp providers — to deliver receipts, reminders and notifications you have enabled.
• Each provider is bound by its own terms and privacy policy, and is not permitted to use your data for its own marketing.

Your rights

• Ask for a copy of the personal information we hold about you.
• Ask us to correct information that is wrong or out of date.
• Ask us to delete information we no longer need to keep.
• Withdraw consent for marketing messages at any time — service and billing messages continue while your subscription is active.
• Ask a question or raise a complaint about how we handle your data.
• We respond to these requests within a reasonable time and may need to verify your identity first.

Children and minors

This website and our checkout are intended for gym owners and staff aged 18 or over. If a gym registers a member under 18 in the GymEXA application, the gym is responsible for obtaining the consent required by law from a parent or guardian.

Changes to this policy

We may update this policy as the service changes or as the law requires. The date at the top of this page shows when it was last revised, and continued use of the website or service after an update means you accept the revised policy.