Privacy
policy
1. Introduction
1.1 Al Mannai Gym W.L.L, a company incorporated under the laws of the Kingdom of Bahrain under Commercial Registration number 191577-1, having its registered address at Flat/Shop 48, Building 2561, Road 66, Block 646, Al Nuwaidrat, Kingdom of Bahrain (the “Club”, “we”, “us” or “our”), is committed to processing Personal Data in accordance with Law No. 30 of 2018 promulgating the Personal Data Protection Law of the Kingdom of Bahrain, and the resolutions and regulations issued thereunder (together, the “Law”).
1.2 This privacy policy (the “Policy”) sets out the categories of Personal Data that the Club processes, the purposes for which it is processed, the legal bases relied upon, the persons to whom it may be disclosed, the periods for which it is retained, and the rights available to Data Subjects under the Law, together with the manner in which those rights may be exercised.
1.3 This Policy applies to the processing of Personal Data of Members, prospective members, guests, visitors to the Club's premises, users of the Club's website at almannaigym.com and users of the Club's mobile application. It does not apply to the processing of the Personal Data of the Club's employees, which is governed by a separate notice.
1.4 By entering into a membership contract with the Club, by attending the Club's premises, or by using the Club's website or mobile application, you acknowledge that you have been informed of the matters set out in this Policy. Nothing in this clause shall be construed as constituting consent to any processing for which consent is required under the Law; such consent is sought and recorded separately in accordance with clause 8.
2. Definitions
2.1 In this Policy, unless the context otherwise requires:
“Authority” means the Personal Data Protection Authority established under the Law, or any body succeeding to its functions;
“Data Manager” has the meaning given to that expression in the Law, and in respect of the processing described in this Policy means the Club;
“Data Processor” has the meaning given to that expression in the Law, and includes the service providers identified in clause 12;
“Data Subject” means the identified or identifiable natural person to whom Personal Data relates;
“Member” means a natural person who has entered into a membership contract with the Club, and includes a former Member in respect of Personal Data retained under clause 14;
“Personal Data” has the meaning given to that expression in the Law;
“Sensitive Personal Data” has the meaning given to that expression in the Law, and includes biometric data;
“processing” has the meaning given to that expression in the Law, and “process”, “processed” and “processes” shall be construed accordingly.
2.2 References to a clause are to a clause of this Policy. Headings are for convenience only and do not affect construction. The singular includes the plural and the masculine includes the feminine.
3. Identity and contact details of the Data Manager
3.1 The Data Manager in respect of the Personal Data described in this Policy is the Club, whose particulars are set out at clause 1.1 and whose VAT registration number is 220027602000002.
3.2 Enquiries, requests and complaints concerning Personal Data may be addressed to the Club by electronic mail to info@almannaigym.com, by WhatsApp to +973 3333 5681, or in person at the Club's reception desk.
3.3 The Club has not appointed a Data Protection Guardian for the purposes of Article 10 of the Law. Where such a person is appointed, that person's particulars shall be published in this clause. Until then, enquiries, requests and complaints are directed as provided at clause 3.2 and are answered by Mr Ahmed Al Mannai.
4. Categories of Personal Data processed
4.1 The Club processes the following categories of Personal Data concerning Members and prospective members:
(a) Identification data: full name; Personal Number (CPR); date of birth; nationality; and, where the membership is procured through an employer or corporate scheme, the name of that employer or scheme;
(b) Contact data: mobile telephone number; electronic mail address; and language of correspondence;
(c) Membership and transactional data: the membership plan subscribed for; the commencement and expiry dates of the membership; particulars of any suspension or freeze; sums paid, the dates of payment, the method of payment and receipt numbers; and particulars of any refund, credit or adjustment;
(d) Attendance data: the date and time of each entry to the Club's premises and the means by which entry was effected. The Club is required to maintain this record — see clause 7.6;
(d-bis) Closed-circuit television images: images of persons attending the premises, recorded in the areas identified by signage. The Club is required to operate closed-circuit television — see clauses 7.6 to 7.10;
(e) Documentary data: a photographic image of the Personal Number (CPR) card, and the particulars it carries, captured at the reception desk by a card reader when a membership is established or renewed;
(f) Administrative annotations: notes recorded by the Club's staff on a Member's record for the purpose of administering the membership. Such notes are confined to matters concerning the membership and to the Member's conduct at the premises, and are not made in respect of a Member's personal affairs unrelated to the membership. A Member is entitled to a copy of them under clause 16.1(a);
(g) Communications data: the Member's elections in respect of the receipt of communications from the Club, and records of communications sent; and
(h) Biometric data: where the Member has consented under clause 7, a mathematical representation of the Member's facial features for the sole purpose of authenticating entry at the Club's entrance.
4.2 The Club processes the categories of Personal Data described at clauses 4.1(a), 4.1(b) and 4.1(g) in respect of prospective members who make an enquiry of the Club and, in respect of a prospective member who books a free trial on the website, the further particulars described at clause 11.2.
4.3 The Personal Data described at clause 4.1(h) constitutes Sensitive Personal Data for the purposes of the Law and is subject to the additional provisions of clause 7.
5. Purposes of processing and legal bases
5.1 The Club processes Personal Data for the purposes, and on the legal bases, set out below.
(a) Establishment and administration of the membership contract. Categories 4.1(a), 4.1(b), 4.1(c), 4.1(f). The legal basis is the necessity of the processing for the performance of a contract to which the Data Subject is party, and for the taking of steps at the request of the Data Subject prior to entering into that contract.
(b) Verification of identity at the reception desk, and the holding of the Personal Number card image. Categories 4.1(a), 4.1(e). The legal basis for category 4.1(e) is compliance with a legal obligation to which the Club is subject, the Club being required under the terms of its licensing to hold the Personal Number particulars and photograph of each Member, as set out at clause 7.6A. The legal basis for category 4.1(a) is the necessity of the processing for the performance of the membership contract and the Club's legitimate interest in ensuring that the rights conferred by a membership are exercised only by the person entitled to them.
(c) Control of, and record of, entry to the premises, and surveillance of the premises. Categories 4.1(d) and 4.1(d-bis) and, where clause 7 applies, 4.1(h). The legal basis for categories 4.1(d) and 4.1(d-bis) is compliance with a legal obligation to which the Club is subject: the operation of closed-circuit television and the keeping of a record of each person attending the premises are conditions of the Club's licensing and commercial registration, as set out at clause 7.6. The legal basis for category 4.1(h), the facial template, is the express consent of the Data Subject, as provided at clause 7.3.
(d) Accounting, taxation and statutory record-keeping. Categories 4.1(a), 4.1(c). The legal basis is compliance with a legal obligation to which the Club is subject, including under the Value Added Tax Law of the Kingdom of Bahrain and the Commercial Companies Law.
(e) Service communications. Categories 4.1(b), 4.1(c), 4.1(g), being the issue of payment receipts and of notices concerning the expiry, suspension or alteration of a membership. The legal basis is the necessity of the processing for the performance of the membership contract.
(f) Promotional communications. Categories 4.1(b), 4.1(g). The legal basis is the consent of the Data Subject, which may be withdrawn at any time in accordance with clause 19.
(g) Establishment, exercise or defence of legal claims, and the handling of complaints. All categories, to the extent relevant. The legal basis is the Club's legitimate interest in the protection of its legal position.
5.2 Where the Club relies upon its legitimate interests, it has assessed those interests against the interests, rights and freedoms of the Data Subject and has satisfied itself that the former are not overridden by the latter. A Data Subject may object to such processing in accordance with clause 16.1(e).
5.3 The Club does not process Personal Data for any purpose incompatible with the purposes set out in this clause 5, and does not sell Personal Data or otherwise make Personal Data available to any third party for that third party's own purposes.
6. Provision of Personal Data
6.1 The provision of the Personal Data described at clauses 4.1(a), 4.1(b), 4.1(c) and 4.1(e) is a requirement necessary for the conclusion and performance of the membership contract and for compliance with the Club's licensing obligations. A person who declines to provide that Personal Data cannot be admitted to membership.
6.2 The provision of the Personal Data described at clause 4.1(h) is voluntary. The consequences of declining to provide it are set out at clauses 7.3 and 7.4.
7. Entry and security at the premises
7.1 Entry to the Club's premises may be effected by means of a facial recognition terminal installed at the entrance. Where a Member consents, the terminal creates and retains a mathematical representation of that Member's facial features (a “facial template”) for the sole purpose of authenticating the Member at the point of entry.
7.2 The facial template is retained upon the entrance terminal situated at the Club's premises in Al Nuwaidrat, Kingdom of Bahrain. It is not stored in the Club's database, is not transferred outside the Kingdom of Bahrain, and is not disclosed to any third party.
7.3 Consent to the processing described in this clause 7 is voluntary, is sought separately from, and is not a condition of, membership. A Member who does not consent shall be admitted to the premises at the reception desk, where a member of the Club's staff verifies the membership before admitting the Member. Admission by that route takes longer than admission at the terminal. The rights conferred by the membership are not otherwise affected and no additional charge is made.
7.4 A Member may withdraw consent at any time by notifying the reception desk or by writing to the address at clause 3.2. Upon withdrawal, the facial template shall be deleted from the entrance terminal. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
7.5 The facial template shall be deleted upon the withdrawal of consent under clause 7.4. A Member may withdraw consent under that clause at any time.
7.6 The recording of entry to the premises, and the retention of closed-circuit television recordings, are conditions of the Club's licensing and commercial registration in the Kingdom of Bahrain. The Club is required to operate closed-circuit television and to maintain a record of each person attending the premises, so that those records are available to a competent authority in the event of an investigation. Accordingly the legal basis for the processing described at clauses 4.1(d) and 7.7 is compliance with a legal obligation to which the Club is subject, and not the consent of the Data Subject.
7.6A The Club is further required, under the terms of its licensing, to hold the Personal Number particulars and photograph of each Member, so that those particulars are available to a competent authority in the event of an incident or investigation. Accordingly the legal basis for the processing described at clause 4.1(e) is compliance with a legal obligation to which the Club is subject, and not the consent of the Data Subject.
7.7 Closed-circuit television. The Club operates closed-circuit television at its premises. Recordings are made continuously in the areas under surveillance and are retained for the period at clause 14.6. Signage at the premises identifies the areas covered.
7.8 Recordings are viewed only where there is a specific reason to do so — an incident, a complaint, a suspected offence, or a request from a competent authority — and only by the Club's management. They are not used to monitor the performance or attendance of employees, and they are not published or shared for any purpose other than those stated in this clause.
7.9 Consent under clause 7.3 concerns the facial template only. A Member who declines it is admitted by alternative means, and the fact of that entry is still recorded, because the obligation at clause 7.6 attaches to the record of attendance and not to the method by which a Member is identified. Closed-circuit television is likewise not a matter of consent and cannot be declined.
7.10 Recordings are held on the recording equipment at the Club's premises in Al Nuwaidrat, Kingdom of Bahrain. They are not transmitted to any cloud recording service and are not transferred outside the Kingdom of Bahrain.
8. Consent
8.1 Where the Law requires the consent of a Data Subject, that consent shall be obtained in a form that is specific, informed and freely given, shall be recorded by the Club, and shall be capable of being evidenced.
8.2 Consent may be withdrawn at any time by the means described at clause 3.2 or, in respect of the matters to which they relate, by the means described at clauses 7.4, 11.4 and 19.3. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.
8.3 Where consent is withdrawn and no other legal basis applies to the processing concerned, the Club shall cease that processing and shall erase the relevant Personal Data, save where its retention is required under clause 14.
9. Age of membership and legal capacity
9.1 The Club admits to membership natural persons who have attained the age of fifteen years.
9.2 Where a Member does not have the legal capacity to enter into the membership contract on his own behalf, the membership is established in that Member's own name and his parent, legal guardian, custodian or conservator signs on his behalf. That person gives, on the Member's behalf, any consent required under this Policy, including in respect of (i) the membership contract, (ii) the biometric processing described at clause 7, and (iii) the promotional communications described at clause 5.1(f), in accordance with Article 24(2) of the Law. The Club records the identity of the person signing and the capacity in which that person signs.
9.3 The Club does not knowingly process the Personal Data of a person under the age of fifteen years.
10. The mobile application
10.1 The Club publishes a mobile application (the “App”). This clause 10 supplements, and does not limit, the remainder of this Policy.
10.2 The App may be used to browse the Club's facilities, classes, programmes and content without the provision of any Personal Data. In that state the App establishes an anonymous session identifier upon the user's device which carries no name, no telephone number and no other identifier by which the Club is able to identify the user.
10.3 Where a user elects to link a membership to the App, the App requests the user's mobile telephone number, transmits a one-time verification code to that number, and requests the final four digits of the Personal Number (CPR) associated with the membership. Those four digits are compared against the Club's record and are not retained. That information is processed for the purpose of authenticating the user as the Member concerned and of preventing access to a membership record by a person who has subsequently acquired the telephone number. The legal basis is the necessity of the processing for the performance of the membership contract.
10.3A The Club records the date, the telephone number and the outcome of each attempt to link a membership, and limits the number of unsuccessful attempts that may be made from a telephone number within a period of twenty-four hours. The legal basis is the Club's legitimate interest in preventing unauthorised access to membership records.
10.4 Where a user enables notifications, the App registers a device token with the notification service identified at clause 12.1(d). That token identifies the device and not the user. The legal basis is the consent of the Data Subject, which may be withdrawn within the App or within the settings of the device.
10.5 A user may delete the App account at any time from within the App. Deletion of the App account extinguishes the user's credentials and terminates the Club's ability to deliver notifications to the device. It does not erase the Club's records of the membership, payments and attendance, which are retained in accordance with clause 14.
10.6 A Member who has linked a membership to the App may also write to the Club from within the App. That conversation is answered in the same way as the WhatsApp conversation described at clause 11.8, by the same automated assistant and the Club's staff, and what clause 11.8 says about the assistant, the Member's own record, the payment details and payment screenshots, the photographs, voice notes and documents a person sends, the service providers, the legal bases and retention applies to it, save that the Member is identified by the membership linked to the App rather than by a telephone number and the replies are shown within the App. Where the Member has enabled notifications, the Club may notify the Member's device when its staff reply in that conversation or when a renewal the Member requested is confirmed. The App also shows the Member's own receipts, each of which the Member may download as a document.
11. The website
11.1 The Club's website at almannaigym.com is served as static content. Apart from the advertising technology described at clause 11.6 and the count of visits described at clause 11.6A, it does not set cookies, does not employ analytics, advertising or tracking technologies, and does not transmit Personal Data to the Club upon a visitor's mere use of it.
11.2 The free-trial booking form published upon the website transmits to the Club's administrative system, when the visitor presses the booking button, the particulars the visitor enters (name and mobile telephone number), together with the day and time chosen for the trial, the language of the page and, where the visitor arrived by way of an advertisement, a reference identifying that advertisement. The other enquiry forms published upon the website do not transmit their contents to the Club: upon submission, the particulars entered are composed into a message within the visitor's own WhatsApp application, which the visitor may then elect to send to the Club, and no Personal Data is received by the Club through those forms unless and until the visitor sends that message.
11.2A The free-trial booking form states, immediately above the booking button, that the Club will send messages by WhatsApp concerning the booking, together with occasional offers, and that the visitor may stop them at any time. By submitting the form, the visitor agrees to receive those messages. Messages concerning the booking, such as reminders and invitations to choose another time, are sent for the purpose and on the legal basis stated at clause 11.3; offers are sent on the basis of the consent given by submitting the form, and only where the notice shown stated it. The Club records the wording of the notice shown and the time at which the form was submitted. The visitor may stop those messages at any time and without giving reasons, in accordance with clause 16.1(e), by the means described at clause 19.3.
11.3 Where a visitor submits the free-trial booking form, or sends a message under clause 11.2, the Club processes the Personal Data received for the purpose of arranging the trial or responding to the enquiry and, where it results in a membership, for the purposes set out at clause 5.1(a). The legal basis is the taking of steps at the request of the Data Subject prior to entering into a contract. The advertisement reference is processed for the Club's legitimate interest in knowing which of its advertising brings visitors to the Club.
11.4 The Club's WhatsApp correspondence is delivered by the service provider identified at clause 12.1(c). A Data Subject may cease to receive WhatsApp messages by the means described at clause 19.3.
11.5 If at any time the website comes to employ cookies or analytics beyond the advertising technology described at clause 11.6 and the count of visits described at clause 11.6A, this clause shall be amended and a separate cookie notice published before that use commences.
11.6 The free-trial page loads the advertising technology of the service provider identified at clause 12.1(c), which records the visit and whether a booking was made, and states this in a notice at the foot of the page. The Club uses that record for two purposes only: to measure the results of its advertising, and to show its advertisements again, on that service provider's platforms, to people who have visited the page, for up to 180 days after the visit. The Club cannot see who is included in that audience of past visitors. The legal basis is the Club's legitimate interest in measuring the results of its advertising and promoting its services, assessed as described at clause 5.2. A visitor may object at any time and without giving reasons, in accordance with clause 16.1(e), by the opt-out link in that notice, after which that technology is no longer used in that visitor's browser. The visitor's choice is stored in the visitor's own browser. In respect of the data collected by that technology, the service provider also acts under its own terms and privacy policy.
11.6A Each time the free-trial page is opened, it informs the Club's administrative system of that fact, together with the language of the page and, where the visitor arrived by way of a link or an advertisement, a reference identifying it. When a WhatsApp button on that page is pressed, the page likewise informs the Club's administrative system of that fact, with the language of the page and that reference, so that a WhatsApp conversation that follows shortly afterwards may be attributed to the same link or advertisement; that record contains no identifier and is kept only briefly. So that repeated visits from the same browser are counted once, the page stores a random identifier in the visitor's browser and sends it with that information. The identifier is not combined with the visitor's name, telephone number or booking, and the Club uses the count for one purpose only: to measure how many people open the links it sends and its advertisements. The page states this in the notice at its foot. The legal basis is the Club's legitimate interest in measuring the results of its advertising, assessed as described at clause 5.2. Where a visitor uses the opt-out link described at clause 11.6, the identifier is removed from that visitor's browser and the visit is thereafter counted without it. The count is held with the service provider identified at clause 12.1(a) and is deleted twelve (12) months after the visit.
11.7 Where a person, having responded to one of the Club's advertisements, sends a WhatsApp message to the number to which those advertisements direct (+973 3310 1009), that message is also delivered to the Club's administrative system by the service provider identified at clause 12.1(c-bis), through the WhatsApp service of the service provider identified at clause 12.1(c). From such a conversation the Club records only the person's mobile telephone number, the name shown on the person's WhatsApp profile, the time of the first message and the advertisement concerned. The content of the conversation is not retained in the Club's administrative system, and messages that do not arise from the Club's advertising are not recorded. The Club uses that record to follow up the enquiry and to measure which of its advertisements bring members to the Club. The legal bases are those stated at clause 11.3, and the record is retained in accordance with clause 14.
11.8 Where a person sends a WhatsApp message to the Club's own number (+973 3333 5687), the conversation may be answered on the Club's behalf by an automated assistant, which composes its replies using an artificial-intelligence model supplied by the service provider identified at clause 12.1(c-ter). The assistant answers questions about the Club, its facilities and its memberships and may arrange a visit, and a member of the Club's staff takes over the conversation where the person asks for one or the assistant cannot answer. Where the person is a member and writes from the mobile telephone number recorded in the member's file, the assistant may also read that member's own membership and payment record (the dates and status of the member's memberships, freeze days, payments with their receipt numbers, and the prices that apply to the member) in order to answer the member, and may, at the member's request, submit a request on the member's behalf, such as a request to freeze the membership, which the Club's staff decide. Those details are passed to the service provider identified at clause 12.1(c-ter) only to compose the reply. Where the member asks to renew the member's current plan, the assistant may send the member the Club's payment details and the amount due and, when the member sends a screenshot or photograph of the payment, may read from it the amount, the date, the payee and the bank's reference for the payment in order to check them against the renewal; that image is passed to the service provider identified at clause 12.1(c-ter) only for that purpose. The renewal is recorded only after the Club's management has confirmed that the payment was received in the Club's bank account, and the bank's reference is then kept with the record of the payment, which is retained in accordance with clause 14. The legal basis for that processing is the performance of the membership contract at the member's request. The assistant does not otherwise change the record, and any other payment the member reports, and any request to change plan, correct or refund, is passed to the Club's staff. The Club retains the messages of that conversation in its administrative system, together with the person's mobile telephone number, the name shown on the person's WhatsApp profile, the advertisement or page concerned, where known, and any photograph, voice note, video or document that the person chooses to send, including an identity card, to answer the enquiry, arrange any visit and measure which of its advertisements bring members to the Club. The assistant does not ask for an identity document, and the files a person sends are accessible only to the Club's staff. So that the assistant can answer them, a voice note is converted to text by the service provider identified at clause 12.1(c-quater), and a photograph is described in text by the service provider identified at clause 12.1(c-ter). The messages and files are passed to those service providers only for that purpose and to compose each reply, and are not used by them to train their models. The legal bases are those stated at clause 11.3. The messages and files are deleted twelve (12) months after the last message of the conversation or, where the person becomes a member, are retained in accordance with clause 14.
12. Disclosure of Personal Data
12.1 The Club engages service providers in the following categories. Each of them that acts as a Data Processor processes Personal Data solely upon the Club's documented instructions and in accordance with a contract that imposes obligations of confidentiality and security, subject to the independent-controller capacity described at sub-paragraph (f):
(a) a provider of database and file-storage services, established in the United States of America, whose hosting for the Club is described at clause 13.1 — the database and file storage underlying the Club's systems;
(b) a provider of text-messaging services, established in the United States of America — transmission of the one-time verification code referred to at clause 10.3;
(c) the operator of the WhatsApp messaging service, established in the United States of America — delivery of WhatsApp correspondence and, where clause 11.6 applies, the measurement of advertising on the free-trial page and the showing of the Club's advertisements to visitors of that page;
(c-bis) a provider of WhatsApp business-messaging connections, established in the Federal Republic of Germany — the connection through which WhatsApp messages sent to the number stated at clause 11.7 are delivered to the Club's administrative system;
(c-ter) a provider of artificial-intelligence services, established in the United States of America — the artificial-intelligence model with which the automated assistant described at clause 11.8 composes its replies, describes photographs and reads the payment screenshots described in that clause;
(c-quater) a provider of speech-to-text services, established in the United States of America — the conversion of voice notes to text for the automated assistant described at clause 11.8;
(d) a provider of mobile notification services, established in the United States of America — delivery of notifications to the App;
(e) a provider of website and application hosting, established in the United States of America — hosting of the Club's website and of the Club's administrative system; and
(f) the operators of the application marketplaces through which the App is distributed — distribution of the App, in which capacity each acts as an independent controller in respect of the data it collects under its own terms.
12.1A For the security of its systems, the Club describes its service providers by category and does not publish their names. A Data Subject may ask the Club for the name of any service provider described at clause 12.1 that processes Personal Data relating to that Data Subject, and the Club will provide it as part of the particulars of processing under clause 16.1(a).
12.2 The Club may further disclose Personal Data:
(a) to its professional advisers, auditors and insurers, under obligations of confidentiality;
(b) to a competent authority, court or regulator, where the Club is required to do so by law or by an order having the force of law; and
(c) to a purchaser or prospective purchaser of the whole or part of the Club's business, subject to obligations of confidentiality and to the Law.
12.3 The Club does not disclose Personal Data to any other person, and does not disclose Personal Data to any person for the purposes of that person's own marketing.
13. Transfer of Personal Data outside the Kingdom of Bahrain
13.1 The database and file storage referred to at clause 12.1(a) are hosted in Mumbai, Republic of India. Accordingly, the Personal Data described at clauses 4.1(a) to 4.1(g) inclusive, other than the closed-circuit television recordings described at clause 4.1(d-bis), is processed outside the Kingdom of Bahrain. Those recordings remain at the Club's premises as provided at clause 7.10.
13.2 The biometric data described at clause 4.1(h) is not transferred outside the Kingdom of Bahrain and is retained as provided at clause 7.2.
13.3 The Law restricts the transfer of Personal Data to a jurisdiction outside the Kingdom of Bahrain, and permits such transfer only where the receiving jurisdiction has been determined by the Authority to afford an adequate level of protection, where the prior written authorisation of the Authority has been obtained, where the Data Subject has given express consent to the transfer, or where one of the further exceptions provided by the Law applies.
13.4 The transfer described at clause 13.1 is made to the Republic of India, which is listed in the record of countries and territories providing an adequate level of protection for personal data annexed to Order No. 42 of 2022 of the Minister of Justice, Islamic Affairs and Waqf. Accordingly the transfer is permitted without the prior authorisation of the Authority.
13.5 The Club has satisfied itself that each person acting as a Data Processor under clause 12.1 is bound to process Personal Data only upon the Club's instructions, to maintain appropriate technical and organisational security measures, and not to process Personal Data for any purpose of its own.
13.6 The processing described at clause 11.6 is carried out by its service provider outside the Kingdom of Bahrain, in the United States of America, which is listed in the record of countries and territories providing an adequate level of protection for personal data annexed to Order No. 42 of 2022 of the Minister of Justice, Islamic Affairs and Waqf. Accordingly the transfer is permitted without the prior authorisation of the Authority.
13.7 The delivery described at clause 11.7 takes place outside the Kingdom of Bahrain. The service provider identified at clause 12.1(c) holds the content of those messages in the United States of America, and the service provider identified at clause 12.1(c-bis) is established in the Federal Republic of Germany; each of those countries is listed in the record of countries and territories providing an adequate level of protection for personal data annexed to Order No. 42 of 2022 of the Minister of Justice, Islamic Affairs and Waqf. While a message is being delivered, those service providers may process it in their data centres in other countries. The record that the Club keeps under clause 11.7 is held as described at clause 13.1.
13.8 The processing described at clause 11.8 by the service providers identified at clauses 12.1(c-ter) and 12.1(c-quater) takes place outside the Kingdom of Bahrain, in the United States of America, which is listed in the record of countries and territories providing an adequate level of protection for personal data annexed to Order No. 42 of 2022 of the Minister of Justice, Islamic Affairs and Waqf. Accordingly the transfer is permitted without the prior authorisation of the Authority.
14. Retention
14.1 The Club retains Personal Data for so long as the purpose for which it was collected subsists, and no longer. In particular:
(a) the particulars described at clauses 4.1(a) and 4.1(e) are retained for so long as the licensing obligations described at clause 7.6A require them to be available to a competent authority;
(b) the membership and transactional data described at clause 4.1(c) is retained for the period prescribed by the applicable accounting and taxation law;
(c) the attendance data described at clause 4.1(d), the administrative annotations described at clause 4.1(f) and the communications data described at clause 4.1(g) are retained for the same period as the particulars at sub-paragraph (a) above.
14.1A Personal Data relating to a membership that has ended is segregated from the Club's operational records and is thereafter accessed only where one of the purposes described at clause 14.1 requires it.
14.2 The biometric data described at clause 4.1(h) is deleted in accordance with clause 7.5.
14.3 Personal Data of a prospective member who does not proceed to membership is retained for a period of twelve (12) months from the date of the enquiry.
14.4 An App account deleted under clause 10.5 is extinguished immediately.
14.5 Personal Data relevant to a legal claim, actual or reasonably anticipated, may be retained until that claim is finally determined or becomes time-barred, notwithstanding the periods stated above.
14.6 Closed-circuit television recordings are retained for a period of one (1) year, after which they are archived. They are not overwritten and are not erased.
14.7 The record of attendance at clause 4.1(d) is retained for the period at clause 14.1. It is not erased on the withdrawal of consent to the facial template, because it is kept under the obligation at clause 7.6 and not under that consent.
15. Security
15.1 The Club implements appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, and against all other unlawful forms of processing. Those measures include access control by reference to staff role, the encryption of data in transit, the restriction of administrative access to authorised personnel, and the maintenance of backups.
15.2 The Club keeps its security measures under review and revises them as appropriate having regard to the state of the art, the cost of implementation, and the nature, scope and purposes of the processing.
16. Rights of the Data Subject
16.1 Subject to the conditions and exceptions provided by the Law, a Data Subject has the right:
(a) to be informed of whether the Club processes Personal Data relating to that Data Subject and, where it does, to be provided with the particulars of that processing and with a copy of the Personal Data;
(b) to require the rectification of Personal Data that is inaccurate, incomplete or out of date;
(c) to require the erasure of Personal Data where it is no longer necessary for the purposes for which it was collected, or where its processing is otherwise contrary to the Law;
(d) to require the blocking of Personal Data in the circumstances provided by the Law;
(e) to object to processing carried out on the basis of the Club's legitimate interests, and to object at any time and without giving reasons to processing for the purposes of direct marketing;
(f) to withdraw a consent previously given, in accordance with clause 8.2; and
(g) to lodge a complaint with the Authority.
16.2 The exercise of the rights at clause 16.1 is without charge, save that the Club may levy a reasonable fee, or decline to act, in respect of a request that is manifestly unfounded or excessive, in which event the Club shall state its reasons.
17. Exercising rights, and complaints
17.1 A request under clause 16.1 may be made by electronic mail to info@almannaigym.com, by WhatsApp to +973 3333 5681, or in person at the Club's reception desk.
17.2 The Club may require such information as is reasonably necessary to satisfy itself of the identity of the person making the request before acting upon it.
17.3 The Club shall respond to a request within thirty (30) days of its receipt, or within such other period as the Law may prescribe. Where the Club declines a request in whole or in part, it shall state its reasons and shall inform the Data Subject of the right to complain to the Authority.
17.4 A Data Subject who is dissatisfied with the Club's response may lodge a complaint with the Personal Data Protection Authority of the Kingdom of Bahrain.
18. Automated decision-making
18.1 The facial recognition terminal described at clause 7 performs an automated comparison for the purpose of authenticating a Member at the point of entry. A Member whom the terminal does not authenticate is admitted, or refused admission, by a member of the Club's staff, and no decision producing legal effects concerning a Data Subject is taken by automated means alone.
18.2 The Club does not carry out profiling of Data Subjects.
19. Communications
19.1 The Club may send to a Member payment receipts, notices concerning the expiry or alteration of a membership, and other communications necessary to the administration of the membership. Such communications are sent on the basis stated at clause 5.1(e) and are not promotional.
19.2 The Club may send promotional communications on the basis stated at clause 5.1(f), and keeps them occasional. Communications falling within clause 19.1 are not promotional communications.
19.3 A Data Subject may cease to receive WhatsApp communications at any time by replying with the word “STOP” (or, in Arabic, “إيقاف”) to any such communication, by amending the relevant setting within the App, or by notifying the reception desk. Notifications delivered to the App may be disabled within the App or within the settings of the device.
20. Amendment of this Policy
20.1 The Club may amend this Policy from time to time. The amended Policy shall be published at almannaigym.com and the effective date at the head of it shall be revised.
20.2 Where an amendment materially affects the rights of Data Subjects or the purposes of processing, the Club shall give notice of it by the means by which it ordinarily communicates with Members.
21. Governing law and jurisdiction
21.1 This Policy and any dispute or claim arising out of or in connection with it or its subject matter shall be governed by, and construed in accordance with, the laws of the Kingdom of Bahrain.
21.2 The courts of the Kingdom of Bahrain shall have jurisdiction in respect of any such dispute or claim, without prejudice to the right of a Data Subject to complain to the Authority.
22. Contact
Al Mannai Gym W.L.L Commercial Registration 191577-1 · VAT 220027602000002 Flat/Shop 48, Building 2561, Road 66, Block 646, Al Nuwaidrat, Kingdom of Bahrain info@almannaigym.com · WhatsApp +973 3333 5681