Privacy & cookies

Who is responsible for your data

The data controller is Blood Sweat and Tears S.L. (CIF B06962971), trading as Marbella Combat Club (the gym: Polígono Nueva Campana, nave 41, Nueva Andalucía, 29660 Marbella, Málaga). Registered office: Polígono Industrial La Campana, nave 41, 29670 San Pedro Alcántara, Marbella (Málaga). Registered in the Registro Mercantil de Málaga, tomo 6050, folio 190, hoja MA-161988, inscripción 1ª. Contact: marbellacombatclub@gmail.com, +34 951 66 27 71.

What data we collect

When you use our contact form we collect your first and last name, email address, phone number (if you give it), the service you’re interested in and your message. If you email, call or message us, we receive the details you choose to share.

When you become a member or buy a day pass we collect your name, email address and phone number (if you give it), the membership you choose and its payment status (active, renewal date, failed or cancelled payments), and the dates you accepted our terms and this policy. If you agree, we also keep a photo of you, which is shown to our staff on the check-in screen at the entrance so they can see it’s really you. Each time you check in we record the date and time, whether entry was allowed and why not if it wasn’t. Your card or bank details are entered on Stripe’s secure page and are never seen or stored by us.

Before you train, we record that you accepted our risk acknowledgement, health declaration and gym rules: the version you accepted, and the date and time. If you choose to, you can also tell us about injuries or health conditions the coaches should know about. This is health information, a special category of personal data, so we only keep it with your explicit consent.

When you buy from us (online shop, desk, 1-to-1 sessions and packs, camps or fight-night tickets) we keep what you bought, the price, the VAT, how you paid and, for shop orders, the pick-up status. For 1-to-1 training we keep each session’s coach, date and time, how it was paid and the sessions left in your pack, and your coach sees your booking. Every sale gets an invoice with your name; if you ask for a full invoice, also your company name, tax ID (NIF/CIF) and address. If you send a 1-to-1 enquiry, we keep what you tell us (discipline, goals, preferred days and times, message).

Why we use it, and on what legal basis

• To reply to your enquiry and arrange classes, memberships, personal training or events. Legal basis: your consent and steps taken at your request before entering into a contract (Art. 6.1.a and 6.1.b GDPR).
• To send you news about events and camps, only if you tick the optional box. Legal basis: your consent (Art. 6.1.a GDPR). You can withdraw it at any time.
• To run your membership: taking payments, showing your QR code, checking you in and letting our staff manage memberships. Legal basis: performance of your membership contract (Art. 6.1.b GDPR).
• To keep a check-in log so we know who is in the gym, can resolve payment questions and keep the gym secure. Legal basis: our legitimate interest in running a safe gym (Art. 6.1.f GDPR).
• To show your photo at check-in, only if you agree. Legal basis: your consent (Art. 6.1.a GDPR). You can remove your photo at any time from your account; staff will then check your identity at the desk.
• To keep a record that you accepted our risk acknowledgement, health declaration and gym rules. Legal basis: our legitimate interest in running a safe gym and being able to show what was agreed (Art. 6.1.f GDPR).
• To keep you safe in training, using any health information you choose to give us. Legal basis: your explicit consent (Art. 9.2.a GDPR). Only our staff can see it, it is never shown on the check-in screen at the entrance, and you can change or delete it at any time from your account, which withdraws your consent for the future.
• To keep payment and invoice records for as long as tax law requires. Legal basis: legal obligation (Art. 6.1.c GDPR).
• To issue invoices and register them with the Spanish tax agency (AEAT) under the VeriFactu system, as Spanish law requires. Legal basis: legal obligation (Art. 6.1.c GDPR).

How long we keep it

Enquiry data is kept for as long as needed to deal with your request and any resulting relationship, and then for the periods required by law. Newsletter data is kept until you withdraw consent.

Check-in records are deleted automatically after 12 months. Health information is deleted when you delete it from your account, when you withdraw your consent, or together with your member details. If you start a day pass purchase but don’t complete the payment, the details and health information you entered are deleted automatically after 2 days. Your member details and photo are deleted when you ask us to, or 12 months after your membership ends. Payment and invoice records are kept by us and by Stripe for the periods required by Spanish tax and accounting law. Invoices and accounting records, including the name, tax ID and address on them, are kept for as long as Spanish tax and accounting law requires, even if you ask us to delete your account; everything else is then deleted. Our daily backups keep deleted data for up to 30 days, after which it’s gone for good.

Children’s data

Children can only become members through a parent or legal guardian, who signs up, pays and gives consent for the child’s data on their behalf. For a child we keep their name, date of birth, membership, check-in log, the parent’s acceptance of our risk acknowledgement, health declaration and gym rules on the child’s behalf, any health information the parent chooses to give with their explicit consent and, only if the parent agrees separately, a photo for check-in. The child’s QR code is shown on the parent’s phone, or on the child’s own phone if the parent sends them a login link. Our staff see the parent’s name and phone number at check-in so they can contact them if needed. Parents can ask us to see, correct or delete their child’s data at any time, and can remove the child’s photo from their account.

Who we share it with

We do not sell your data. We use these service providers, acting as data processors on our behalf: our website host, Netlify, Inc., which processes form submissions and runs our membership system; Supabase, Inc., which stores member accounts, photos and check-in records on servers in the European Union (Frankfurt, Germany); Stripe Payments Europe, Ltd., which processes our online payments (memberships, day passes, camps, tickets, 1-to-1 sessions and shop orders) and sends payment receipts; Resend, which sends our emails (login links, confirmations, receipts and invoices); and Verifacti, which registers our invoices with the Spanish tax agency (AEAT); and Anthropic, PBC, whose AI model (Claude) reads the supplier invoices, delivery notes and expense receipts that our staff upload, so they can be entered into our accounts. We do not send member data to Anthropic for this, and Anthropic does not use this data to train its models. We do not use AI to make decisions about you; door access and memberships follow fixed rules. Your invoice records also go to the AEAT and to our accountant (gestor) because the law requires it. Netlify, Stripe, Resend and Anthropic may process some data in the United States under appropriate safeguards, such as the EU–US Data Privacy Framework or Standard Contractual Clauses. If you choose to contact us on WhatsApp, your messages are processed by WhatsApp (Meta) under its own privacy policy. For the Marbella Boxing Camp, reservation details are shared with the camp host, Jon Durrant, so he can confirm your place. We only share data with others where the law requires it.

Your rights

You can request access to, correction or deletion of your data, restriction of or objection to its processing, and data portability, and you can withdraw consent at any time. Email marbellacombatclub@gmail.com. If you are unhappy with how we handle your data, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Cookies

This website does not use cookies for analytics, advertising or tracking, and loads its fonts, images and videos from our own server. If we add analytics or other non-essential cookies in future, we will update this policy and ask for your consent first.

When you log in to your member account, we store your login session on your device (in your browser’s storage) so you stay logged in and can show your QR code even without a signal. This is strictly necessary for the service you asked for and is removed when you log out.

Links to Instagram and Google Maps take you to those services, which apply their own cookie and privacy policies.

Last updated: October 2026.