Version 2
Data controller: Xtasia Limited
Xtasia Limited operates Xtasia and Flirts and is the data controller responsible for the personal information described in this notice.
We recognise that membership, attendance and use of our services can be particularly private matters. This notice explains what information we collect, why we use it, who can receive it, how long we keep it and your rights.
It covers applications, memberships, visits, events, accommodation, spa and leisure bookings, purchases, our website and online member services, communications, electronic signing and CCTV. Employment and recruitment information is covered separately, although the CCTV section also applies to staff and contractors captured by the system.
Privacy contact: privacy@xtasia.co.uk
Postal address: Privacy Contact, Xtasia Limited, 140 High Street, West Bromwich, B70 6JJ, United Kingdom
Please use the email subject “Privacy request” or “Data protection complaint”. We may request proportionate information to verify your identity. Do not send identity-document copies by ordinary email unless we have agreed an appropriate way to provide them.
Depending on the services you use, we may collect:
Information comes from you, your use of our services, authorised staff, and relevant third parties such as booking companions, organisers, service providers, people reporting incidents or authorities acting lawfully. If you supply someone else’s information, please make sure they know and direct them to this notice.
We retain a local archive of historical membership information imported from Club Manager. Authorised staff can consult it and use relevant information to create or complete a current membership record. Our membership system no longer performs live Club Manager lookups or refreshes. Archived information remains subject to accuracy checks, retention decisions and your rights.
Please avoid supplying unnecessary sensitive information about yourself or other people in notes, messages or uploads.
We use personal information for the following purposes:
Assessing an application at your request and administering membership, bookings and purchases
Steps before a contract, or performance of a contract, where necessary for that service
Identity matching, prevention of misuse, venue safety and incident investigation
Legitimate interests in safe, reliable services, subject to necessity and balancing your rights
Operating accounts and protecting the website and systems
Contract where necessary to provide the requested service; legitimate interests for security and fraud prevention
Meeting applicable accounting, tax or other statutory requirements
Compliance with the relevant legal obligation
Resolving complaints, disputes and legal claims
Legitimate interests in resolving disputes and protecting legal rights; legal obligations where applicable
Understanding service use and improving operations
Legitimate interests, using anonymous or aggregated information where reasonably possible
Where we require information to provide a service, we explain why and the consequences of not providing it. A club rule is not automatically a statutory requirement.
We do not ask members to provide their sexual orientation or record details of their sexual activities. Membership or attendance alone does not necessarily reveal either. Particular information supplied in connection with an incident or welfare concern may, however, contain health information or reveal other special-category personal data. Where this occurs, we must have an applicable additional legal condition as well as a normal lawful basis, and apply appropriate safeguards.
An ordinary photograph used for a visual identity check is not automatically biometric identification data. Our membership-photo workflow does not use automated facial recognition or create facial-matching templates. This does not remove the sensitivity of the wider membership record.
Where we rely on explicit consent, we must explain the specific processing and obtain a separate, clear indication of agreement. Reading this notice, visiting the website or accepting general terms is not a substitute. You may withdraw consent by contacting us; withdrawal does not retrospectively invalidate processing that was lawful before withdrawal.
Staff inspect identity documents at signup and record the document type and number. We use these details to check duplicate applications, help identify banned members and respond to lawful police requests concerning particular incidents. We do not currently retain photographs or scans of identity documents.
A membership photograph is mandatory for security, safety and membership recognition. Photographs are stored securely and can be viewed only by staff with the required access permission. Photographs may be disclosed to law enforcement in response to a lawful request concerning a particular incident. They are not routinely shared with law enforcement.
The technical ability to upload a document does not mean we routinely collect document copies. Any future proposal to retain them would require a defined purpose, appropriate safeguards and an updated explanation before collection.
The signing service can capture a photograph and signature through the browser and submit them to the server. This workflow does not instruct the browser to save the photograph to a device gallery. The images and associated evidence may be retained in the system and in signed documents.
Private membership uploads and paperwork require authenticated access and the appropriate staff permission in Admin. They are not publicly accessible through the website’s media routes. Taking a membership photograph does not authorise its use in publicity; that requires a separate appropriate permission and explanation.
We use CCTV for safety, security, incident investigation and the protection of people and property. Monitoring must be proportionate, with clear notices explaining its use.
The camera views displayed on the entrance screen are listed below.
There are no CCTV cameras in the playrooms, bathrooms or changing areas. CCTV does not record audio.
Access to recorded footage is restricted to the owners. The entrance live-view screen is described separately below. Disclosure must have a lawful basis and be limited to relevant material. This may include police or other authorities, insurers or legal advisers where necessary and lawful. A request or allegation does not remove the need to assess whether disclosure is appropriate.
Routine recordings are retained for up to 60 days, then overwritten or deleted. Footage relevant to an incident can be saved separately from routine recordings. These incident copies are deleted when the incident is resolved, subject to any specific legal requirement to preserve them.
Recordings are stored on-site. The owners can access them remotely.
You may request footage containing your personal information. Providing an approximate date, time and location helps us find it before routine overwriting. We may need to protect other people’s identities or apply a lawful restriction when responding.
A single screen displays live CCTV images and is visible to reception staff, security staff and members of the public entering the building. This visibility is separate from the owners’ restricted access to recorded footage.
The visible feeds cover:
Staff access is based on responsibilities and assigned permissions. Information should be used only for authorised work. An event-host role does not automatically justify access to the full membership database.
Our website and Admin system are developed, hosted and supported by Finakee Limited, acting as our data processor for those services. Xtasia Limited remains the data controller, responsible for deciding why and how membership information is used. Finakee processes information on our behalf under a signed data-processing agreement and our instructions, with access limited to what is necessary for its agreed services.
Access by Xtasia employees is governed by their Xtasia role, assigned permissions and confidentiality obligations, including non-disclosure agreements. Where a person also has a role at a supplier, their authorised access as a Xtasia employee does not grant the supplier permission to use membership information for its own purposes.
The system's data is stored on a dedicated server provided by Heart Internet in Leeds, United Kingdom. We use a separately contracted email hosting provider to send, receive and store emails. This provider handles email addresses, message contents and attachments as needed to deliver that service.
Other specialist providers support hosting, communications, payments and booking administration. Current integrations include Rapyd for payments and Beds24 for accommodation-related services where used. We share the information needed for the relevant service. Some providers have their own responsibilities as independent controllers and publish their own notices.
We may also disclose relevant information to professional advisers, insurers, authorities or a successor operator where lawful and necessary. A business transfer does not authorise unrelated use of historical information.
We never sell membership information and will not do so. Event organisers receive no privileged access to private membership or contact details. In member discussions, they have access only on the same basis as other logged-in members. Discussion identities show your alias if you have provided one, otherwise your first name. These identities are visible only to logged-in members as part of discussions, never to the general public. We do not disclose someone’s private attendance or membership details merely because a caller, another member or an organiser claims to know them.
When you choose to participate in a discussion, shared member feature or message exchange, your content and displayed identity are visible to its intended audience. That does not give that audience access to your private membership record. Shared memberships and bookings also do not give one participant unrestricted access to another’s information.
Payment providers and card terminals handle payment credentials. Our records retain transaction information needed for reconciliation and administration, such as amounts, dates, status, payment method, provider references and refunds.
Do not put payment-card numbers or security codes into application notes, emails or member messages.
We use contact details to respond to enquiries and administer applications, memberships, bookings, payments and account security. These service messages are separate from optional promotions. Accepting membership terms or acknowledging this Privacy Policy is not agreement to receive marketing.
Cookies and related browser storage support member sign-in, form security, access to private enquiry conversations and the pairing of signing tablets. Blocking essential storage may prevent those functions from working.
The member sign-in cookie is called Xtasia.Auth. Form-security cookies use names beginning .AspNetCore.Antiforgery.. Private enquiry access uses a conversation-specific cookie beginning xtasia-contact-, configured for up to 180 days. Paired signing tablets use Xtasia.Web.Signing.Device, configured for up to 365 days, and local browser storage to resume pairing. Signing-tablet storage is separate from ordinary browsing of the public website.
The website also loads external resources, including Google Fonts, Font Awesome, Google-hosted JavaScript and jsDelivr. The membership application can also load an Ideal Postcodes address finder. Such requests can disclose technical information, including an IP address and browser information, to the provider even without a cookie.
Where storage or access technology requires consent, it must not operate before consent is obtained. You should be able to change your choice as easily as you make it.
We use measures appropriate to the sensitivity of the information, including HTTPS, staff authentication and permissions, and protected delivery of private uploads. No system can guarantee absolute security.
Staff handle email on-site, but email providers also process data on their own infrastructure. The location of staff access is not necessarily the location where a provider stores or processes information.
The dedicated server and its on-server backups are located in Leeds, United Kingdom. Server backups are taken daily at 7am and retained for 14 days.
Where an arrangement involves a restricted international transfer, an appropriate mechanism is required, such as applicable UK adequacy regulations or suitable contractual safeguards and the required assessment. You can contact us for information about relevant safeguards.
Identifiable information must be kept only while there is a justified purpose. At the end of the applicable retention period, we anonymise identifying content while preserving non-identifying business records and reporting information. Anonymisation must prevent reasonable re-identification; simply hiding a name is not sufficient. Specific financial, incident or restriction records may remain identifiable where separately justified. Closing a membership or removing information from a screen does not necessarily anonymise every related record.
Full (Single Male) and Flirts memberships run for 12 months. All other membership types are lifetime memberships, with members paying when they attend. A period without visits does not itself mean that a lifetime membership has expired.
For memberships that expire, we retain the core membership record for seven years after expiry. ID records, including document type and number, and membership photographs are removed 12 months after membership expiry. These shorter periods apply separately from the retention of the core membership record and remain subject to the specific legal holds described below.
For continuing lifetime memberships, necessary membership information is retained to administer the membership and reviewed annually by ownership. If a lifetime membership is cancelled, the cancellation date starts the same retention periods: seven years for the core membership record and 12 months for ID records and membership photographs. Requests for erasure are assessed separately under your rights described below.
Core membership details, excluding ID records and photographs
Seven years after membership expiry; continuing lifetime memberships remain subject to necessity reviews as described above
ID records and membership photographs
Removed 12 months after membership expiry, including document type and number; continuing lifetime memberships remain subject to necessity reviews as described above
Historical ID images, if any
No new ID scans or photographs are currently collected; the 12-month post-expiry ID anonymisation rule also covers any retained historical copies
Eligible unpaid applications awaiting completion
Three months awaiting completion, subject to checks for payments, related activity and justified holds; identifying content is subject to anonymisation across linked records, files and documents
Other incomplete, rejected or withdrawn applications
12 months without further activity, unless linked to a completed membership or retained for a separately justified incident purpose
Signed agreements and evidence
Seven years after membership expiry or cancellation; embedded photographs and ID information are removed after 12 months, subject to separately justified retention exceptions
Member visit history
Event attendance, hotel stays and spa visits follow the core membership retention rule: retained while membership continues, including lifetime membership, and for seven years after expiry or cancellation. At the end of that period, identifying links and separately stored personal details are removed or anonymised, subject to separately justified financial or incident retention. Anonymous reporting records may remain
Financial records and supporting booking details
Transactions, invoices, refunds and booking details necessary to support the accounts are retained for six years after the end of the relevant company financial year, or longer where a legal requirement or unresolved enquiry applies. This does not automatically extend retention to every guest detail or attendance record
Event discussions
Eligible discussions are archived once the event start is at least four days old, then removed from active discussion storage. Identifying content in archive copies is anonymised 12 months after the event, except relevant reported-message evidence retained separately as described below
Routine enquiries
Two years after resolution; complaints and incidents follow their separate retention rules
Private member conversations
Identifying content is anonymised after 12 months without activity, except relevant reported-message evidence retained separately as described below
Reported messages
Relevant evidence is retained separately while needed for the incident or ban, with annual review of continued necessity
Routine CCTV
Up to 60 days; incident extracts may be retained separately as described above
Ban and suspension records
Necessary identifying details, recognition photographs and relevant restriction evidence may be retained beyond normal membership expiry periods while needed to enforce the restriction; see below
Other incident and warning records
Reviewed annually and anonymised when no longer needed for safety, an ongoing restriction or a legal claim
Routine technical security logs
90 days for records such as sign-in attempts, authentication failures and system-access events; relevant incident evidence may be retained separately where necessary. This period does not apply to event attendance, hotel stays or spa bookings
Backups
On-server backups in Leeds are taken daily at 7am and retained for 14 days.
Bans are permanent unless lifted at the sole discretion of ownership. There is no guarantee that a ban will be lifted. A request for reconsideration, the passage of time or a review of retained information does not create an entitlement to reinstatement. Suspensions are temporary. We retain the information reasonably necessary to enforce these restrictions and protect members and staff. This may include identifying details, a recognition photograph, the reason for the restriction and relevant incident evidence. Access is limited to authorised staff according to their responsibilities.
These specific records may be retained beyond the normal membership and photograph anonymisation periods while the restriction remains necessary. A ban or suspension does not automatically justify retaining the entire membership record or an ID-document number. We review the continued need for the retained information annually through an ownership review. A review does not itself lift a permanent ban; only ownership can do that.
When ownership lifts a ban or a suspension ends, the restriction alone no longer justifies extended retention. Any continued retention must have a separate documented purpose, such as an unresolved incident or legal claim. Erasure requests involving restrictions are assessed individually rather than automatically refused.
Legal holds may require particular records to be retained longer, with use limited to the relevant purpose. Genuinely anonymous statistics may be retained longer. Removing a name while keeping information that can still identify someone is not anonymisation.
Depending on the circumstances, you can ask to access, correct or erase information, restrict or object to processing, or receive portable information. You can withdraw consent where we rely on it and object to direct marketing.
We normally respond to rights requests within one calendar month, subject to applicable identity-check, clarification, extension and exemption rules. Where a lawful extension is needed, we explain why within the initial response period.
Erasure is not an unconditional right to remove every record. Particular information may need to be retained for a legal obligation, claim or another applicable exception. We explain any refusal or partial response.
A request must be assessed across relevant records, files, photographs, signing evidence, archives, communications and provider-held copies. Redacting a database field does not erase the underlying file. Shared records require care to protect other people’s information.
If erasure or withdrawal means we cannot lawfully provide a service, we explain the specific consequence and consider workable alternatives. We do not treat every optional use as compulsory merely because someone is a member.
You can ask us to explain or review a decision affecting your membership or services.
Send privacy complaints to privacy@xtasia.co.uk with the subject “Data protection complaint”. We will acknowledge a complaint within 30 days, investigate appropriately, keep you informed as appropriate and explain the outcome and any action.
You also have the right to complain to the Information Commissioner’s Office. See how to complain to the ICO.
If a personal-data breach occurs, we assess the risk, take steps to contain it and make legally required notifications. Reportable breaches must be notified to the ICO without undue delay and, where feasible, within 72 hours of awareness. Affected people must be informed without undue delay where there is likely to be a high risk, unless a legal exception applies.
We keep this notice under review and publish updated versions when our practices change. Material changes will be communicated appropriately. Publishing a revised notice does not itself create consent for a new use; where fresh consent is required, we will ask separately.