Legal
Privacy Notice
Last updated: 20 October 2026
1. Who controls your data
Colossal Fitness Gym, Legazpi City, Albay, Philippines, is the personal information controller for the member portal. Contact colossalfitnessgym@gmail.com or +63 966 802 0949 for privacy requests.
2. What we collect
Account details (name, email, password hash), member profile details, membership and payment records, refund requests, support messages, and technical logs needed to secure the service. We do not collect or store raw card numbers, CVCs, or wallet credentials; those are handled by PayMongo.
3. Why we use it
To create and secure accounts, process membership requests, record payments and refunds, provide member features, prevent fraud, meet legal and accounting obligations, and answer support requests.
4. Lawful basis
We process data to perform our contract with you, comply with legal obligations, and pursue legitimate interests such as security, fraud prevention, and service improvement. Where consent is required, we ask for it separately.
5. Payment providers
PayMongo processes online payments as a payment service provider and may process your payment details under its own privacy notice. We receive payment status, method, amount, fee, and provider references needed to reconcile your membership. PayMongo email receipts are not BIR official receipts unless expressly stated.
6. Sharing and subprocessors
We share data only with service providers that help us run the gym (hosting, database, email delivery, object storage, payment processing), when required by law, or with your consent. We do not sell personal data.
7. Retention
We keep account and membership data while your account is active and for the period needed for accounting, tax, dispute, and legal requirements. Webhook payloads are retained for up to 90 days unless needed longer for an investigation. Payment and refund records are kept for the period required by applicable law.
8. Security
We use access controls, hashed passwords, server-only payment keys, signature-verified webhooks, rate limits, and audit logs. No system is perfectly secure; report suspected incidents immediately.
9. Your rights (RA 10173)
Subject to the Data Privacy Act of 2012 (Republic Act No. 10173), you may request access, correction, erasure or blocking, portability, and information about how your data is processed. You may also object to processing, withdraw consent where applicable, and file a complaint with the National Privacy Commission. We may need to verify your identity before acting.
10. Cookies and sessions
The portal uses an HTTP-only session cookie to keep you signed in. It is not used for advertising. Clearing it signs you out.
Questions about this page? Call +63 966 802 0949 or email colossalfitnessgym@gmail.com.