Express Fitness UrbanPrivacy Policy

Express Fitness Urban Reg. No. 2015/116445/07 is a South African business and the responsible party as defined under POPIA. We operate an online presence at expressfitness.co.za and supply gym and fitness equipment to customers across South Africa, including delivery and installation through our own in-house team.

We have appointed an Information Officer as required by POPIA, responsible for overseeing our compliance with this Act.

When you interact with our website or submit a quote request, we may collect the following categories of personal information:

We do not collect payment card details. All pricing and payment arrangements are handled directly and securely outside of our website.

We do not knowingly collect special personal information (e.g. health, race, religion, or political views) as defined in Section 26 of POPIA.

We use your personal information only for the purposes for which it was collected, including:

• Responding to your quote requests and product enquiries
• Preparing and sending quotations for gym and fitness equipment
• Coordinating delivery and installation through our in-house team
• Communicating with you via email, phone, or WhatsApp regarding your order or enquiry
• Sending marketing communications via email (Mailchimp) or WhatsApp broadcast where you have consented or have an existing relationship with us
• Providing customer support through our Chatway live chat service
• Analysing how visitors use our website to improve performance (Google Analytics GA4, Microsoft Clarity, Adobe Analytics)
• Recording anonymised session behaviour and heatmaps via Microsoft Clarity to improve our website
• Delivering and measuring advertising campaigns via Google Ads, DoubleClick, Facebook/Meta Pixel, and Microsoft Bing Ads
• Tracking how visitors arrive at our site via WooCommerce Source Buster for campaign attribution
• Preventing bot submissions and fraud via Google reCAPTCHA
• Complying with our legal obligations under South African law
• Detecting and preventing fraudulent or unauthorised activity

We will never sell, rent, or trade your personal information to third parties for their own marketing purposes.

Under POPIA, we are required to have a lawful ground for processing your personal information. We rely on the following:

• Contract performance — to process your quote request, fulfil your order, and coordinate delivery and installation
• Legal obligation — to comply with applicable South African laws including tax and consumer protection legislation
• Legitimate interest — for fraud prevention, bot protection (reCAPTCHA), website security, session analysis (Clarity), and improving our services
• Consent — for marketing emails, WhatsApp broadcasts, and non-essential cookies including analytics, session recording, and advertising (you may withdraw consent at any time)

We share your personal information only where necessary, with the following categories of recipients. All third-party service providers are contractually required to process your data only as instructed and to maintain appropriate security measures, in accordance with Section 21 of POPIA.

Several of our service providers are based outside South Africa and may store or process your data on servers located abroad. These include Google, Microsoft, Meta/Facebook, Adobe, Mailchimp (Intuit), Chatway, and Trustindex. Where we transfer personal information outside the Republic, we ensure the recipient provides an adequate level of protection as required by Section 72 of POPIA, through contractual safeguards or transfers to jurisdictions with comparable privacy legislation.

In particular, Microsoft Clarity may process anonymised session recording data on Microsoft's global server infrastructure. This data does not contain your name or contact details, but does include behavioural data about your visit to our website.

We retain your personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by South African law:

• Quote and order records: 5 years (in line with SARS and Consumer Protection Act requirements)
• Marketing communication records: Until you withdraw consent, plus 1 year
• Live chat transcripts: Up to 12 months
• Google Analytics data: Up to 14 months (per GA4 default retention settings)
• Microsoft Clarity session recordings: Up to 30 days (per Clarity's default settings)
• Advertising cookie data: As per each provider's retention schedule (typically 30–90 days)
• WhatsApp communications: As retained within WhatsApp Business, or until you request deletion

Once the retention period expires, your data is securely deleted or anonymised.

As a data subject under South African law, you have specific protections under POPIA, alongside the right to request access to official company records under the Promotion of Access to Information Act 2 of 2000 (PAIA):

To exercise any of these rights under POPIA or to file a formal record request under PAIA, please contact John Frayne at john@expressfitness.co.za or 082 800 5533. We will evaluate and respond to your request within 30 days as required by law.

We implement reasonable technical and organisational security measures to protect your personal information against loss, theft, unauthorised access, disclosure, use, or destruction, in accordance with Section 19 of POPIA. These include:

• SSL/TLS encryption on our website (expressfitness.co.za)
• Google reCAPTCHA to protect our forms against automated bot submissions
• Access controls for staff who handle customer data
• Use of reputable, established third-party platforms with their own security certifications
• Regular review of our data handling practices and installed tools

In the event of a data breach likely to result in serious harm, we will notify both the Information Regulator and affected individuals without unreasonable delay, as required by Section 22 of POPIA.

Our website and services are directed at businesses and adult consumers purchasing gym and fitness equipment. We do not knowingly collect personal information from children under the age of 18 without verifiable parental consent, as required by Section 35 of POPIA. If you believe a minor has submitted their information through our website, please contact us immediately.

For any questions or requests regarding this Privacy Policy or your personal information, please contact our Information Officer:

If you are not satisfied with our response, you may lodge a formal complaint with the Information Regulator of South Africa:

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on our website with a revised effective date, and where appropriate, by email. Your continued use of our website after any changes constitutes acceptance of the updated policy.