Privacy
policy
1. Introduction
1.1 Al Mannai Gym W.L.L, a company incorporated under the laws of the Kingdom of Bahrain under Commercial Registration number 191577-1, having its registered address at Flat/Shop 48, Building 2561, Road 66, Block 646, Al Nuwaidrat, Kingdom of Bahrain (the “Club”, “we”, “us” or “our”), is committed to processing Personal Data in accordance with Law No. 30 of 2018 promulgating the Personal Data Protection Law of the Kingdom of Bahrain, and the resolutions and regulations issued thereunder (together, the “Law”).
1.2 This privacy policy (the “Policy”) sets out the categories of Personal Data that the Club processes, the purposes for which it is processed, the legal bases relied upon, the persons to whom it may be disclosed, the periods for which it is retained, and the rights available to Data Subjects under the Law, together with the manner in which those rights may be exercised.
1.3 This Policy applies to the processing of Personal Data of Members, prospective members, guests, visitors to the Club's premises, users of the Club's website at almannaigym.com and users of the Club's mobile application. It does not apply to the processing of the Personal Data of the Club's employees, which is governed by a separate notice.
1.4 By entering into a membership contract with the Club, by attending the Club's premises, or by using the Club's website or mobile application, you acknowledge that you have been informed of the matters set out in this Policy. Nothing in this clause shall be construed as constituting consent to any processing for which consent is required under the Law; such consent is sought and recorded separately in accordance with clause 8.
2. Definitions
2.1 In this Policy, unless the context otherwise requires:
“Authority” means the Personal Data Protection Authority established under the Law, or any body succeeding to its functions;
“Data Manager” has the meaning given to that expression in the Law, and in respect of the processing described in this Policy means the Club;
“Data Processor” has the meaning given to that expression in the Law, and includes the service providers identified in clause 12;
“Data Subject” means the identified or identifiable natural person to whom Personal Data relates;
“Member” means a natural person who has entered into a membership contract with the Club, and includes a former Member in respect of Personal Data retained under clause 14;
“Personal Data” has the meaning given to that expression in the Law;
“Sensitive Personal Data” has the meaning given to that expression in the Law, and includes biometric data;
“processing” has the meaning given to that expression in the Law, and “process”, “processed” and “processes” shall be construed accordingly.
2.2 References to a clause are to a clause of this Policy. Headings are for convenience only and do not affect construction. The singular includes the plural and the masculine includes the feminine.
3. Identity and contact details of the Data Manager
3.1 The Data Manager in respect of the Personal Data described in this Policy is the Club, whose particulars are set out at clause 1.1 and whose VAT registration number is 220027602000002.
3.2 Enquiries, requests and complaints concerning Personal Data may be addressed to the Club by electronic mail to info@almannaigym.com, by WhatsApp to +973 3333 5681, or in person at the Club's reception desk.
3.3 The Club has not appointed a Data Protection Guardian for the purposes of Article 10 of the Law. Where such a person is appointed, that person's particulars shall be published in this clause. Until then, enquiries, requests and complaints are directed as provided at clause 3.2 and are answered by Mr Ahmed Al Mannai.
4. Categories of Personal Data processed
4.1 The Club processes the following categories of Personal Data concerning Members and prospective members:
(a) Identification data: full name; Personal Number (CPR); date of birth; nationality; and, where the membership is procured through an employer or corporate scheme, the name of that employer or scheme;
(b) Contact data: mobile telephone number; electronic mail address; and language of correspondence;
(c) Membership and transactional data: the membership plan subscribed for; the commencement and expiry dates of the membership; particulars of any suspension or freeze; sums paid, the dates of payment, the method of payment and receipt numbers; and particulars of any refund, credit or adjustment;
(d) Attendance data: the date and time of each entry to the Club's premises and the means by which entry was effected. The Club is required to maintain this record — see clause 7.6;
(d-bis) Closed-circuit television images: images of persons attending the premises, recorded in the areas identified by signage. The Club is required to operate closed-circuit television — see clauses 7.6 to 7.10;
(e) Documentary data: a photographic image of the Personal Number (CPR) card, and the particulars it carries, captured at the reception desk by a card reader when a membership is established or renewed;
(f) Administrative annotations: notes recorded by the Club's staff on a Member's record for the purpose of administering the membership. Such notes are confined to matters concerning the membership and to the Member's conduct at the premises, and are not made in respect of a Member's personal affairs unrelated to the membership. A Member is entitled to a copy of them under clause 16.1(a);
(g) Communications data: the Member's elections in respect of the receipt of communications from the Club, and records of communications sent; and
(h) Biometric data: where the Member has consented under clause 7, a mathematical representation of the Member's facial features for the sole purpose of authenticating entry at the Club's entrance.
4.2 The Club processes the categories of Personal Data described at clauses 4.1(a), 4.1(b) and 4.1(g) in respect of prospective members who make an enquiry of the Club.
4.3 The Personal Data described at clause 4.1(h) constitutes Sensitive Personal Data for the purposes of the Law and is subject to the additional provisions of clause 7.
5. Purposes of processing and legal bases
5.1 The Club processes Personal Data for the purposes, and on the legal bases, set out below.
(a) Establishment and administration of the membership contract. Categories 4.1(a), 4.1(b), 4.1(c), 4.1(f). The legal basis is the necessity of the processing for the performance of a contract to which the Data Subject is party, and for the taking of steps at the request of the Data Subject prior to entering into that contract.
(b) Verification of identity at the reception desk, and the holding of the Personal Number card image. Categories 4.1(a), 4.1(e). The legal basis for category 4.1(e) is compliance with a legal obligation to which the Club is subject, the Club being required under the terms of its licensing to hold the Personal Number particulars and photograph of each Member, as set out at clause 7.6A. The legal basis for category 4.1(a) is the necessity of the processing for the performance of the membership contract and the Club's legitimate interest in ensuring that the rights conferred by a membership are exercised only by the person entitled to them.
(c) Control of, and record of, entry to the premises, and surveillance of the premises. Categories 4.1(d) and 4.1(d-bis) and, where clause 7 applies, 4.1(h). The legal basis for categories 4.1(d) and 4.1(d-bis) is compliance with a legal obligation to which the Club is subject: the operation of closed-circuit television and the keeping of a record of each person attending the premises are conditions of the Club's licensing and commercial registration, as set out at clause 7.6. The legal basis for category 4.1(h), the facial template, is the express consent of the Data Subject, as provided at clause 7.3.
(d) Accounting, taxation and statutory record-keeping. Categories 4.1(a), 4.1(c). The legal basis is compliance with a legal obligation to which the Club is subject, including under the Value Added Tax Law of the Kingdom of Bahrain and the Commercial Companies Law.
(e) Service communications. Categories 4.1(b), 4.1(c), 4.1(g), being the issue of payment receipts and of notices concerning the expiry, suspension or alteration of a membership. The legal basis is the necessity of the processing for the performance of the membership contract.
(f) Promotional communications. Categories 4.1(b), 4.1(g). The legal basis is the consent of the Data Subject, which may be withdrawn at any time in accordance with clause 19.
(g) Establishment, exercise or defence of legal claims, and the handling of complaints. All categories, to the extent relevant. The legal basis is the Club's legitimate interest in the protection of its legal position.
5.2 Where the Club relies upon its legitimate interests, it has assessed those interests against the interests, rights and freedoms of the Data Subject and has satisfied itself that the former are not overridden by the latter. A Data Subject may object to such processing in accordance with clause 16.1(e).
5.3 The Club does not process Personal Data for any purpose incompatible with the purposes set out in this clause 5, and does not sell Personal Data or otherwise make Personal Data available to any third party for that third party's own purposes.
6. Provision of Personal Data
6.1 The provision of the Personal Data described at clauses 4.1(a), 4.1(b), 4.1(c) and 4.1(e) is a requirement necessary for the conclusion and performance of the membership contract and for compliance with the Club's licensing obligations. A person who declines to provide that Personal Data cannot be admitted to membership.
6.2 The provision of the Personal Data described at clause 4.1(h) is voluntary. The consequences of declining to provide it are set out at clauses 7.3 and 7.4.
7. Entry and security at the premises
7.1 Entry to the Club's premises may be effected by means of a facial recognition terminal installed at the entrance. Where a Member consents, the terminal creates and retains a mathematical representation of that Member's facial features (a “facial template”) for the sole purpose of authenticating the Member at the point of entry.
7.2 The facial template is retained upon the entrance terminal situated at the Club's premises in Al Nuwaidrat, Kingdom of Bahrain. It is not stored in the Club's database, is not transferred outside the Kingdom of Bahrain, and is not disclosed to any third party.
7.3 Consent to the processing described in this clause 7 is voluntary, is sought separately from, and is not a condition of, membership. A Member who does not consent shall be admitted to the premises at the reception desk, where a member of the Club's staff verifies the membership before admitting the Member. Admission by that route takes longer than admission at the terminal. The rights conferred by the membership are not otherwise affected and no additional charge is made.
7.4 A Member may withdraw consent at any time by notifying the reception desk or by writing to the address at clause 3.2. Upon withdrawal, the facial template shall be deleted from the entrance terminal. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
7.5 The facial template shall be deleted upon the withdrawal of consent under clause 7.4. A Member may withdraw consent under that clause at any time.
7.6 The recording of entry to the premises, and the retention of closed-circuit television recordings, are conditions of the Club's licensing and commercial registration in the Kingdom of Bahrain. The Club is required to operate closed-circuit television and to maintain a record of each person attending the premises, so that those records are available to a competent authority in the event of an investigation. Accordingly the legal basis for the processing described at clauses 4.1(d) and 7.7 is compliance with a legal obligation to which the Club is subject, and not the consent of the Data Subject.
7.6A The Club is further required, under the terms of its licensing, to hold the Personal Number particulars and photograph of each Member, so that those particulars are available to a competent authority in the event of an incident or investigation. Accordingly the legal basis for the processing described at clause 4.1(e) is compliance with a legal obligation to which the Club is subject, and not the consent of the Data Subject.
7.7 Closed-circuit television. The Club operates closed-circuit television at its premises. Recordings are made continuously in the areas under surveillance and are retained for the period at clause 14.6. Signage at the premises identifies the areas covered.
7.8 Recordings are viewed only where there is a specific reason to do so — an incident, a complaint, a suspected offence, or a request from a competent authority — and only by the Club's management. They are not used to monitor the performance or attendance of employees, and they are not published or shared for any purpose other than those stated in this clause.
7.9 Consent under clause 7.3 concerns the facial template only. A Member who declines it is admitted by alternative means, and the fact of that entry is still recorded, because the obligation at clause 7.6 attaches to the record of attendance and not to the method by which a Member is identified. Closed-circuit television is likewise not a matter of consent and cannot be declined.
7.10 Recordings are held on the recording equipment at the Club's premises in Al Nuwaidrat, Kingdom of Bahrain. They are not transmitted to any cloud recording service and are not transferred outside the Kingdom of Bahrain.
8. Consent
8.1 Where the Law requires the consent of a Data Subject, that consent shall be obtained in a form that is specific, informed and freely given, shall be recorded by the Club, and shall be capable of being evidenced.
8.2 Consent may be withdrawn at any time by the means described at clause 3.2 or, in respect of the matters to which they relate, by the means described at clauses 7.4, 11.4 and 19.3. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.
8.3 Where consent is withdrawn and no other legal basis applies to the processing concerned, the Club shall cease that processing and shall erase the relevant Personal Data, save where its retention is required under clause 14.
9. Age of membership and legal capacity
9.1 The Club admits to membership natural persons who have attained the age of fifteen years.
9.2 Where a Member does not have the legal capacity to enter into the membership contract on his own behalf, the membership is established in that Member's own name and his parent, legal guardian, custodian or conservator signs on his behalf. That person gives, on the Member's behalf, any consent required under this Policy, including in respect of (i) the membership contract, (ii) the biometric processing described at clause 7, and (iii) the promotional communications described at clause 5.1(f), in accordance with Article 24(2) of the Law. The Club records the identity of the person signing and the capacity in which that person signs.
9.3 The Club does not knowingly process the Personal Data of a person under the age of fifteen years.
10. The mobile application
10.1 The Club publishes a mobile application (the “App”). This clause 10 supplements, and does not limit, the remainder of this Policy.
10.2 The App may be used to browse the Club's facilities, classes, programmes and content without the provision of any Personal Data. In that state the App establishes an anonymous session identifier upon the user's device which carries no name, no telephone number and no other identifier by which the Club is able to identify the user.
10.3 Where a user elects to link a membership to the App, the App requests the user's mobile telephone number, transmits a one-time verification code to that number, and requests the final four digits of the Personal Number (CPR) associated with the membership. Those four digits are compared against the Club's record and are not retained. That information is processed for the purpose of authenticating the user as the Member concerned and of preventing access to a membership record by a person who has subsequently acquired the telephone number. The legal basis is the necessity of the processing for the performance of the membership contract.
10.3A The Club records the date, the telephone number and the outcome of each attempt to link a membership, and limits the number of unsuccessful attempts that may be made from a telephone number within a period of twenty-four hours. The legal basis is the Club's legitimate interest in preventing unauthorised access to membership records.
10.4 Where a user enables notifications, the App registers a device token with the notification service identified at clause 12.1(d). That token identifies the device and not the user. The legal basis is the consent of the Data Subject, which may be withdrawn within the App or within the settings of the device.
10.5 A user may delete the App account at any time from within the App. Deletion of the App account extinguishes the user's credentials and terminates the Club's ability to deliver notifications to the device. It does not erase the Club's records of the membership, payments and attendance, which are retained in accordance with clause 14.
11. The website
11.1 The Club's website at almannaigym.com is served as static content. It does not set cookies, does not employ analytics, advertising or tracking technologies, and does not transmit Personal Data to the Club upon a visitor's mere use of it.
11.2 The enquiry forms published upon the website do not transmit their contents to the Club. Upon submission, the particulars entered by the visitor are composed into a message within the visitor's own WhatsApp application, which the visitor may then elect to send to the Club. No Personal Data is received by the Club unless and until the visitor sends that message.
11.3 Where a visitor sends such a message, the Club processes the Personal Data contained in it for the purpose of responding to the enquiry and, where the enquiry results in a membership, for the purposes set out at clause 5.1(a). The legal basis is the taking of steps at the request of the Data Subject prior to entering into a contract.
11.4 The Club's WhatsApp correspondence is delivered by the service provider identified at clause 12.1(c). A Data Subject may cease to receive WhatsApp messages by the means described at clause 19.3.
11.5 If at any time the website comes to employ cookies or analytics, this clause shall be amended and a separate cookie notice published before that use commences.
12. Disclosure of Personal Data
12.1 The Club engages the following service providers. Each of them that acts as a Data Processor processes Personal Data solely upon the Club's documented instructions and in accordance with a contract that imposes obligations of confidentiality and security, subject to the independent-controller capacity described at sub-paragraph (f):
(a) Supabase, Inc. — provision of the database and file storage underlying the Club's systems;
(b) Twilio Inc. — transmission of the one-time verification code referred to at clause 10.3;
(c) Meta Platforms, Inc. — delivery of WhatsApp correspondence;
(d) Google LLC (Firebase) — delivery of notifications to the App;
(e) Vercel Inc. — hosting of the Club's website and of the Club's administrative system; and
(f) Apple Inc. and Google LLC — distribution of the App through their respective application marketplaces, in which capacity each acts as an independent controller in respect of the data it collects under its own terms.
12.2 The Club may further disclose Personal Data:
(a) to its professional advisers, auditors and insurers, under obligations of confidentiality;
(b) to a competent authority, court or regulator, where the Club is required to do so by law or by an order having the force of law; and
(c) to a purchaser or prospective purchaser of the whole or part of the Club's business, subject to obligations of confidentiality and to the Law.
12.3 The Club does not disclose Personal Data to any other person, and does not disclose Personal Data to any person for the purposes of that person's own marketing.
13. Transfer of Personal Data outside the Kingdom of Bahrain
13.1 The database and file storage referred to at clause 12.1(a) are hosted in Mumbai, Republic of India. Accordingly, the Personal Data described at clauses 4.1(a) to 4.1(g) inclusive, other than the closed-circuit television recordings described at clause 4.1(d-bis), is processed outside the Kingdom of Bahrain. Those recordings remain at the Club's premises as provided at clause 7.10.
13.2 The biometric data described at clause 4.1(h) is not transferred outside the Kingdom of Bahrain and is retained as provided at clause 7.2.
13.3 The Law restricts the transfer of Personal Data to a jurisdiction outside the Kingdom of Bahrain, and permits such transfer only where the receiving jurisdiction has been determined by the Authority to afford an adequate level of protection, where the prior written authorisation of the Authority has been obtained, where the Data Subject has given express consent to the transfer, or where one of the further exceptions provided by the Law applies.
13.4 The transfer described at clause 13.1 is made to the Republic of India, which is listed in the record of countries and territories providing an adequate level of protection for personal data annexed to Order No. 42 of 2022 of the Minister of Justice, Islamic Affairs and Waqf. Accordingly the transfer is permitted without the prior authorisation of the Authority.
13.5 The Club has satisfied itself that each person acting as a Data Processor under clause 12.1 is bound to process Personal Data only upon the Club's instructions, to maintain appropriate technical and organisational security measures, and not to process Personal Data for any purpose of its own.
14. Retention
14.1 The Club retains Personal Data for so long as the purpose for which it was collected subsists, and no longer. In particular:
(a) the particulars described at clauses 4.1(a) and 4.1(e) are retained for so long as the licensing obligations described at clause 7.6A require them to be available to a competent authority;
(b) the membership and transactional data described at clause 4.1(c) is retained for the period prescribed by the applicable accounting and taxation law;
(c) the attendance data described at clause 4.1(d), the administrative annotations described at clause 4.1(f) and the communications data described at clause 4.1(g) are retained for the same period as the particulars at sub-paragraph (a) above.
14.1A Personal Data relating to a membership that has ended is segregated from the Club's operational records and is thereafter accessed only where one of the purposes described at clause 14.1 requires it.
14.2 The biometric data described at clause 4.1(h) is deleted in accordance with clause 7.5.
14.3 Personal Data of a prospective member who does not proceed to membership is retained for a period of twelve (12) months from the date of the enquiry.
14.4 An App account deleted under clause 10.5 is extinguished immediately.
14.5 Personal Data relevant to a legal claim, actual or reasonably anticipated, may be retained until that claim is finally determined or becomes time-barred, notwithstanding the periods stated above.
14.6 Closed-circuit television recordings are retained for a period of one (1) year, after which they are archived. They are not overwritten and are not erased.
14.7 The record of attendance at clause 4.1(d) is retained for the period at clause 14.1. It is not erased on the withdrawal of consent to the facial template, because it is kept under the obligation at clause 7.6 and not under that consent.
15. Security
15.1 The Club implements appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, and against all other unlawful forms of processing. Those measures include access control by reference to staff role, the encryption of data in transit, the restriction of administrative access to authorised personnel, and the maintenance of backups.
15.2 The Club keeps its security measures under review and revises them as appropriate having regard to the state of the art, the cost of implementation, and the nature, scope and purposes of the processing.
16. Rights of the Data Subject
16.1 Subject to the conditions and exceptions provided by the Law, a Data Subject has the right:
(a) to be informed of whether the Club processes Personal Data relating to that Data Subject and, where it does, to be provided with the particulars of that processing and with a copy of the Personal Data;
(b) to require the rectification of Personal Data that is inaccurate, incomplete or out of date;
(c) to require the erasure of Personal Data where it is no longer necessary for the purposes for which it was collected, or where its processing is otherwise contrary to the Law;
(d) to require the blocking of Personal Data in the circumstances provided by the Law;
(e) to object to processing carried out on the basis of the Club's legitimate interests, and to object at any time and without giving reasons to processing for the purposes of direct marketing;
(f) to withdraw a consent previously given, in accordance with clause 8.2; and
(g) to lodge a complaint with the Authority.
16.2 The exercise of the rights at clause 16.1 is without charge, save that the Club may levy a reasonable fee, or decline to act, in respect of a request that is manifestly unfounded or excessive, in which event the Club shall state its reasons.
17. Exercising rights, and complaints
17.1 A request under clause 16.1 may be made by electronic mail to info@almannaigym.com, by WhatsApp to +973 3333 5681, or in person at the Club's reception desk.
17.2 The Club may require such information as is reasonably necessary to satisfy itself of the identity of the person making the request before acting upon it.
17.3 The Club shall respond to a request within thirty (30) days of its receipt, or within such other period as the Law may prescribe. Where the Club declines a request in whole or in part, it shall state its reasons and shall inform the Data Subject of the right to complain to the Authority.
17.4 A Data Subject who is dissatisfied with the Club's response may lodge a complaint with the Personal Data Protection Authority of the Kingdom of Bahrain.
18. Automated decision-making
18.1 The facial recognition terminal described at clause 7 performs an automated comparison for the purpose of authenticating a Member at the point of entry. A Member whom the terminal does not authenticate is admitted, or refused admission, by a member of the Club's staff, and no decision producing legal effects concerning a Data Subject is taken by automated means alone.
18.2 The Club does not carry out profiling of Data Subjects.
19. Communications
19.1 The Club may send to a Member payment receipts, notices concerning the expiry or alteration of a membership, and other communications necessary to the administration of the membership. Such communications are sent on the basis stated at clause 5.1(e) and are not promotional.
19.2 The Club may send promotional communications on the basis stated at clause 5.1(f). The Club limits promotional communications to two (2) in any calendar month. Communications falling within clause 19.1 are not counted against that limit.
19.3 A Data Subject may cease to receive WhatsApp communications at any time by replying with the word “STOP” (or, in Arabic, “إيقاف”) to any such communication, by amending the relevant setting within the App, or by notifying the reception desk. Notifications delivered to the App may be disabled within the App or within the settings of the device.
20. Amendment of this Policy
20.1 The Club may amend this Policy from time to time. The amended Policy shall be published at almannaigym.com and the effective date at the head of it shall be revised.
20.2 Where an amendment materially affects the rights of Data Subjects or the purposes of processing, the Club shall give notice of it by the means by which it ordinarily communicates with Members.
21. Governing law and jurisdiction
21.1 This Policy and any dispute or claim arising out of or in connection with it or its subject matter shall be governed by, and construed in accordance with, the laws of the Kingdom of Bahrain.
21.2 The courts of the Kingdom of Bahrain shall have jurisdiction in respect of any such dispute or claim, without prejudice to the right of a Data Subject to complain to the Authority.
22. Contact
Al Mannai Gym W.L.L Commercial Registration 191577-1 · VAT 220027602000002 Flat/Shop 48, Building 2561, Road 66, Block 646, Al Nuwaidrat, Kingdom of Bahrain info@almannaigym.com · WhatsApp +973 3333 5681