Privacy policy

Privacy policy

Last updated Sun 9th Aug 26

SarvaSync Privacy Policy

Effective date: 12 May 2026
Last updated: 9 August 2026

This privacy policy explains how Studio Martial Arts, using the SarvaSync platform, collects and uses personal information.

SarvaSync is provided by SoraSync LTD which processes information on our behalf when operating the platform. Where SarvaSync uses information for its own purposes, its separate privacy notice should explain that processing.

1. Information we collect

Depending on how you use SarvaSync, we may collect:

• Your name, email address, phone number, address, date of birth and profile photograph.

• Login, account-security and profile-preference information.

• Information about household or family profiles, including whether someone is the main account holder.

• Emergency-contact details.

• Optional medical conditions, injuries or other health and accessibility information you choose to provide.

• Memberships, subscriptions, freezes, cancellations, waivers and consent records.

• Class, event and personal-training bookings, attendance and check-in history.

• Belt grades, achievements, competition information and training records.

• Shop orders, passes, account credits and transaction history.

• Payment-customer references, payment-method tokens, card type and last four digits. Full card details are collected directly by the configured payment provider and are not stored by SarvaSync.

• Messages, staff notes, support requests and notification preferences.

• Push-notification tokens and information about notifications sent or opened.

• Technical information such as IP address, device type, operating system, app version, browser information and security logs.

• Information supplied by gym staff, a parent or guardian, another authorised household manager, or a payment provider.

Please do not include unnecessary medical or confidential information in messages or free-text fields.

2. How we use your information

We use personal information to:

• Create and manage accounts and household profiles.

• Provide memberships and administer recurring billing.

• Process bookings, attendance, personal training, events and waiting lists.

• Process shop purchases, credits, passes, payments and refunds.

• Provide staff with information needed to run classes safely.

• Record waivers, injuries, emergency contacts and relevant medical notes.

• Send booking confirmations, reminders, payment notices and service messages.

• Send optional email or push notifications according to your preferences.

• Operate leaderboards, social features or profile-photo displays where enabled.

• Prevent fraud, protect accounts and investigate misuse.

• Provide support, troubleshoot faults and improve the service.

• Maintain financial, operational and legal records.

• Respond to legal requests and enforce our agreements.

3. Our lawful bases

We normally rely on:

• Contract: to provide your membership, bookings, purchases and other requested services.

• Legal obligation: to keep required financial records and comply with applicable law.

• Legitimate interests: to operate the gym, maintain accurate attendance and transaction records, secure the platform, prevent fraud and improve our services. We consider whether these interests are proportionate and respect your rights.

• Consent: for optional marketing, certain profile-photo uses and other optional features where consent is required. You can withdraw consent at any time.

• Vital interests: where information must be used in a genuine emergency to protect someone’s life or safety.

Medical and injury information is health data and receives additional protection. Where we collect optional medical notes, our intended special-category condition is explicit consent. In an emergency, another condition such as vital interests may apply.

Withdrawing consent does not affect processing that occurred before withdrawal. Depending on the circumstances, not providing relevant safety information may affect whether we can safely provide a particular activity.

4. Children and household profiles

SarvaSync supports family accounts and profiles belonging to children.

A parent, guardian or authorised main account holder may provide and manage information for a child. We use children’s information only where necessary to provide gym services, administer the household account and protect the child’s safety.

Children have data-protection rights in their own information. We will consider the child’s age, understanding and circumstances when responding to a request.

We do not knowingly use children’s information for behavioural advertising or sell it to third parties.

5. Payments

Payments may be processed through Stripe, SumUp or another provider configured by the gym.

Payment forms are supplied by the payment provider. We normally receive a payment token or customer reference, payment status, transaction reference, card brand and last four digits rather than the complete card number or security code.

The payment provider processes information under its own privacy terms. Its identity should be shown during payment or in the app’s billing settings.

If you enable biometric login, fingerprint or facial-recognition matching is performed by your device’s operating system. We do not receive or store your biometric template.

6. Who receives your information

We may share relevant information with:

• Authorised gym administrators, coaches and reception staff.

• SarvaSync and its hosting, database and storage providers.

• Payment providers such as Stripe or SumUp.

• Email and push-notification providers.

• Identity-verification, anti-spam or security providers.

• Professional advisers, insurers, auditors or debt-recovery providers where necessary.

• Police, regulators, courts or public authorities where legally required.

• A purchaser or successor if the gym or platform business is reorganised or sold.

Staff access is limited according to their role and active profile. We require service providers acting on our behalf to protect personal information and use it only for authorised purposes.

We do not sell personal information.

7. Maps and external services

The website or app may display content from services such as Google Maps or OpenStreetMap. Opening embedded maps or following an external link may allow that provider to receive technical information under its own privacy policy.

SarvaSync does not use continuous precise location tracking unless this is separately disclosed and enabled.

8. International transfers

Some service providers may process information outside the United Kingdom.

Where required, we use an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another legally recognised safeguard.

For details of the countries and safeguards currently involved, contact us at info@sarvasync.app.

9. How long we keep information

We keep information only as long as needed for its purpose, including legal, accounting, safety and dispute-resolution requirements.

Our intended retention periods are:

• Account and membership records: Immediately

• Financial and transaction records: 12 months.

• Booking, attendance and achievement records: Immediately

• Waivers and consent records: Immediately.

• Medical and injury information: Immediately.

• Messages and support records: Immediately.

• Security logs and push-notification records: 12 months.

• Backups: removed through the normal backup-rotation cycle within 12 months.

When information is no longer required, we delete or anonymise it. Some information may be retained after an account-deletion request where required by law or needed to establish, exercise or defend legal claims.

10. Security

We use reasonable technical and organisational safeguards intended to protect personal information. These include access controls, role-based permissions, encrypted connections, protected storage and operational logging.

No internet service can guarantee absolute security. Please use a strong, unique password and contact us immediately if you believe your account has been compromised.

11. Notifications and marketing

Essential messages—such as payment receipts, security alerts, booking changes or important membership notices—may still be sent where necessary to provide the service.

Optional email and push categories can be managed in notification settings or by contacting us. You may withdraw marketing consent at any time.

Disabling notifications on your device does not automatically change every communication preference stored in your account.

12. Automated decisions

We do not currently make solely automated decisions that produce legal or similarly significant effects.

The platform may apply automatic operational rules, such as checking membership eligibility, available credits, booking capacity, age limits or payment status. Staff can review relevant decisions where appropriate.

13. Your rights

Subject to applicable exceptions, you may have the right to:

• Request a copy of your personal information.

• Correct inaccurate or incomplete information.

• Request deletion of your information.

• Restrict how your information is used.

• Object to processing based on legitimate interests or direct marketing.

• Withdraw consent.

• Receive certain information in a portable format.

• Complain about how your information is handled.

An account manager can submit an account-deletion request through SarvaSync’s account settings, or you can contact info@sarvasync.app.

We may need to verify your identity before completing a request. For a household account, we will also consider the rights of every person represented by that account.

If you are unhappy with our response, you may complain to the UK Information Commissioner’s Office at ico.org.uk.

14. Changes to this policy

We may update this policy when the service, our providers or legal requirements change. We will publish the updated version and revise the “Last updated” date. Where a change materially affects your rights, we will provide an additional notice where appropriate.

15. Contact us

For privacy questions or requests, contact:

Studio Martial arts
info@studioma.uk