Privacy Notice

Last updated: 6 June 2026

1. Who we are

Fortis-Solutions Ltd ("we", "us", "Fortis") is a company registered in England & Wales, company number 16934389, registered office 167-169 Great Portland Street, London W1W 5PF. We are the data controller of the personal data described in this notice. We are registered with the Information Commissioner's Office under registration number ZC139102.

2. Contact

For any data-protection query, email support@fortis-solutions.net with the subject line "Data request".

3. What personal data we process

• Audit enquiry data: when you submit our audit form we collect your name, business name, email, phone number, studio type and approximate member count. We use this to contact you, book and run your platform audit, and prepare your report.
• Customer account data: name, business name, email, phone, address, billing details, and business registration data publicly available on Companies House.
• End-member data: for clients whose platform we build, names, email, phone, payment details, attendance and any health notes. For this category our gym client is the data controller and Fortis is the data processor, acting on their documented instructions. Member access, rectification and erasure requests should go to the gym first; we support the gym in fulfilling them.
• Usage data: server logs, IP address, browser, device type, pages visited.
• Communications: emails, support messages, call notes.

4. Why we process it (lawful bases)

• Consent: when you submit the audit form, you consent to us contacting you about your audit. You can withdraw at any time by emailing us.
• Contract: to deliver the audit and any platform build to paying customers.
• Legitimate interest: to respond to enquiries and run our own business. You may object at any time.
• Legal obligation: tax, accounting, anti-fraud and regulatory reporting.
• Explicit consent (UK GDPR Art. 9(2)(a)): where health-related member notes are recorded on a client's platform, our gym client is responsible for obtaining the member's explicit consent before entering that data.

5. Sub-processors

We use the following sub-processors, each contractually bound under a Data Processing Addendum:

• Stripe Payments UK Ltd — card and subscription processing (UK / EEA).
• Resend, Inc. — transactional email delivery.
• Digital Ocean Holdings Inc. — server hosting (UK / EU regions).
• Zoho Corporation (Bigin) — our customer-relationship management system, used to manage enquiries.

A current list of sub-processors, and our Data Processing Addendum for clients, is available on request to support@fortis-solutions.net.

6. Where your data is stored

We host on infrastructure within the UK and EEA. Where any sub-processor transfers data outside the UK, we rely on the UK Government's Adequacy Regulations or appropriate Standard Contractual Clauses.

7. Retention

• Audit enquiry data: up to 12 months from your last contact with us, then deleted, unless you become a customer.
• Customer account data: while you have an active engagement, then 6 years for tax and accounting.
• End-member data: while our client instructs us to hold it; deleted on written instruction or 90 days after the engagement ends, whichever is sooner.
• Server logs: 90 days.

8. Your rights

Under UK GDPR you have the right to access your data, rectify inaccuracies, request erasure, restrict processing, data portability, object to processing, and object to automated decision-making. To exercise any of these, email support@fortis-solutions.net. We will respond within 30 days.

You also have the right to complain to the Information Commissioner's Office if you believe we have not handled your data correctly.

9. Cookies

See our Cookie Policy for details on the cookies this site uses.

10. Changes to this notice

If we make material changes, we will update the "Last updated" date above and, where required, notify customers by email.