Website Privacy Policy

Carbon Gym (JB Fitness (VIC) Pty Ltd, ABN 59 650 279 824, trading as Carbon Gym) is committed to protecting the privacy of everyone who interacts with our facility and website. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights in relation to it.

This policy applies to all personal information collected by Carbon Gym — including information collected from members, prospective members, website visitors, and guests. It covers our gym facility at U3/21-31 The Boulevard, Norlane VIC 3214, our website at carbongym.com.au, and our ClubFit member management system.

Carbon Gym is bound by the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Privacy and Data Protection Act 2014 (Vic). By becoming a member or using our website, you acknowledge this policy.

1. What Personal Information We Collect

1.1 Website Visitors

When you visit carbongym.com.au, we may automatically collect:

• Your internet protocol (IP) address and internet service provider
• Browser type and operating system
• Pages visited and time of visit
• The website from which you arrived
• Cookie data (see Section 13)

This information is used only to administer and improve our website. It is not linked to your personal identity.

1.2 Enquiry & Contact Form Submissions

If you submit an enquiry through our website, we collect your name and email address (and any other information you voluntarily provide). This is used solely to respond to your enquiry.

1.3 Members — Sign-Up & Ongoing Membership

When you join Carbon Gym, we collect:

• Full name, date of birth, home address, phone number, and email address
• Emergency contact name and phone number
• A member profile photo (used for identity verification and facility access via ClubFit)
• Health information — your completed Pre-Exercise Questionnaire (PAR-Q), including any medical conditions, injuries, medications, or pregnancy status you disclose
• Membership type, start date, and transaction history
• Payment information — direct debit or credit card details, processed via ClubFit / MyClubFitness
• Class bookings, attendance records, and access logs

1.4 CCTV Footage

Carbon Gym operates CCTV cameras throughout the facility. See Section 4 for full details.

1.5 Social Media Images

With your consent (given in your Membership Agreement), Carbon Gym may photograph or film members during training and publish images on our social media platforms. See Section 8 for details and how to opt out.

2. How We Use Your Information

We use the personal information we collect to:

• Process your membership application and manage your membership account
• Verify your identity and control access to the facility via FOB and ClubFit
• Assess your fitness to participate in activities safely (PAR-Q / health information)
• Process payments and manage billing via ClubFit
• Communicate with you about your membership, class bookings, timetable changes, and promotions
• Manage class bookings and attendance
• Maintain safety and security of the facility and its members (including via CCTV)
• Comply with our legal obligations under Australian law
• Improve our services and website

We will not use your personal information for any purpose that is inconsistent with this policy without your prior consent.

3. Health Information

Health information is classified as sensitive information under the Privacy Act 1988 (Cth) and is afforded the highest level of protection.

Carbon Gym collects health information through the Pre-Exercise Questionnaire (PAR-Q) completed at sign-up and at membership renewal. This includes information about cardiovascular conditions, musculoskeletal injuries, pregnancy, chronic conditions, and current medications.

We collect this information only with your explicit consent, and only for the purpose of ensuring you can safely participate in gym activities and use our recovery facilities (sauna, ice bath). Your health information is:

• Stored securely within the ClubFit member management system
• Accessible only to Carbon Gym management and coaching staff who need it to ensure your safety
• Never shared with any third party except where required by law or in a genuine medical emergency
• Used solely for safety purposes — it is not used for marketing or any other purpose

You may update your health information at any time by contacting us at hello@carbongym.com.au or in person at the front desk.

4. CCTV & Surveillance

Legal basis: Surveillance Devices Act 1999 (Vic) s7; Privacy Act 1988 (Cth) APP 3 and APP 5.

Carbon Gym operates CCTV cameras throughout the facility for the purposes of member and staff safety, asset protection, and security monitoring. CCTV operates in the following areas:

• Gym floor and equipment zones
• Common areas, corridors, and facility entry/exit points
• The main Recovery room (sauna and ice bath) — members are notified of this at sign-up and may elect to use Studio 3 (CCTV-free) as an equivalent alternative

CCTV does NOT operate in:

• Bathrooms or changerooms
• Studio 3 (the CCTV-free recovery room option)
• Any area where a reasonable expectation of privacy would apply

Retention & Access

CCTV footage is retained for 30 days and is then automatically overwritten. Footage is accessible only by Carbon Gym management and authorised personnel. It will not be shared with any third party except where required by law, or where requested by Victoria Police or another law enforcement agency in relation to a specific incident.

If you have concerns about CCTV in the facility or wish to understand your rights in relation to recorded footage, please contact us at hello@carbongym.com.au.

5. Third-Party Disclosure

Privacy Act 1988 (Cth) APP 5(2)(d) requires disclosure of third parties to whom personal information is likely to be disclosed.

Carbon Gym uses ClubFit (MyClubFitness) as its membership management and payment processing platform. When you join Carbon Gym, your personal information — including your name, contact details, membership status, profile photo, booking history, and payment information — is stored and processed within the ClubFit system.

ClubFit operates its own Privacy Policy, which governs how it handles your data on its systems. We encourage you to review ClubFit’s Privacy Policy at myaccount.clubfit.net.au.

Apart from ClubFit, Carbon Gym does not sell, rent, or share your personal information with any other third party, except:

• Where required or authorised by Australian law (e.g., responding to a court order or law enforcement request)
• In a medical emergency, where disclosure to emergency services or medical personnel is necessary to protect your health or safety
• With your explicit consent

6. Payment Information

Direct debit and credit or debit card payments are processed by ClubFit on Carbon Gym’s behalf. Carbon Gym does not store, process, or have direct access to your full card number or bank account details. Payment processing is handled by ClubFit’s payment systems.

If you have questions about how your payment data is stored or secured, please refer to ClubFit’s Privacy Policy or contact their support team directly.

7. Overseas Disclosure

Privacy Act 1988 (Cth) APP 8 — cross-border disclosure obligations.

Carbon Gym’s primary operations are based in Australia, and we take reasonable steps to ensure that personal information is stored within Australia wherever possible. ClubFit may store or process certain data using cloud infrastructure that could be located overseas. We take reasonable steps to ensure that any overseas handling of data by our service providers is consistent with the Australian Privacy Principles.

By providing your personal information to Carbon Gym, you acknowledge that it may be transferred to and stored on servers located outside Australia by our third-party service providers, subject to protections consistent with the APPs.

8. Social Media & Photography

By signing your Carbon Gym Membership Agreement, you consent to Carbon Gym photographing or filming you during training sessions or gym events, and publishing those images on our social media platforms (including Instagram and Facebook) and website for promotional purposes.

If you do not wish to be photographed or filmed, or if you wish to withdraw your consent at any time, please notify us in writing at hello@carbongym.com.au or in person at the front desk. We will remove any existing images of you from our platforms on request, subject to any technical limitations of third-party platforms.

9. Data Security

Carbon Gym takes reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These steps include:

• Member records stored in the ClubFit system, which uses industry-standard security practices
• Access to member data restricted to authorised Carbon Gym staff and management only
• Physical security of the facility including CCTV and access-controlled entry
• Staff training on privacy obligations and appropriate handling of member data

No data transmission over the internet or storage system can be guaranteed as completely secure. If you have reason to believe your personal information held by Carbon Gym has been compromised, please contact us immediately at hello@carbongym.com.au.

10. Data Retention & Destruction

Privacy Act 1988 (Cth) APP 11(2) — must take reasonable steps to destroy or de-identify personal information that is no longer needed.

Carbon Gym retains personal information only for as long as it is needed for the purposes for which it was collected, or as required by law. Our standard retention periods are:

Data Type	Retention Period
CCTV footage	30 days — automatically overwritten unless required for an active incident or legal matter
Member records (personal & contact details, health, payment history)	Duration of membership + 7 years after cancellation (to satisfy potential legal claims and statutory obligations)
Member profile photo	Duration of membership; deleted within 30 days of membership cancellation on request
Enquiry form submissions (non-members)	12 months, or until the enquiry is resolved
Website analytics data	Aggregated and anonymised; retained indefinitely in non-identifiable form

11. Your Rights

Privacy Act 1988 (Cth) APP 12 (right of access), APP 13 (right of correction), s36 (right to complain to the OAIC).

11.1 Access

You have the right to request access to the personal information Carbon Gym holds about you. To make an access request, contact us in writing at hello@carbongym.com.au or in person at U3/21-31 The Boulevard, Norlane VIC 3214. We will respond within 30 days. We may ask you to verify your identity before providing access.

11.2 Correction

If you believe that any personal information we hold about you is inaccurate, incomplete, or out of date, you may request that we correct it. We will take reasonable steps to correct the information or, if we disagree that a correction is warranted, we will note your request alongside the information.

11.3 Complaints

If you believe that Carbon Gym has mishandled your personal information or breached the Australian Privacy Principles, you are encouraged to contact us first at hello@carbongym.com.au so that we can attempt to resolve your concern.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

12. Notifiable Data Breaches

Privacy Act 1988 (Cth) Part IIIC — Notifiable Data Breaches (NDB) scheme.

Carbon Gym is subject to the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). If we become aware of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will:

• Take immediate steps to contain the breach and assess the risk of harm
• Notify affected individuals as soon as practicable
• Notify the Office of the Australian Information Commissioner (OAIC) as required by law

If you suspect that a data breach involving your information has occurred, please contact us immediately at hello@carbongym.com.au.

13. Cookies & Website Analytics

Our website uses cookies — small data files stored on your device — to remember your preferences and improve your browsing experience. Carbon Gym uses cookies primarily for login convenience and website analytics (including Google Analytics). Cookies do not contain personally identifiable information and are not linked to your member profile.

You can disable cookies in your browser settings, though doing so may affect the functionality of parts of our website. By continuing to use our website, you consent to our use of cookies in accordance with this policy.

14. Links to External Websites

Our website may contain links to external websites (such as ClubFit, social media platforms, or partner organisations). This Privacy Policy applies solely to Carbon Gym. We are not responsible for the privacy practices of external websites and encourage you to review their privacy policies independently.

15. Changes to This Policy

Carbon Gym may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or services. When we make material changes, we will update the ‘Last updated’ date at the top of this policy and, where appropriate, notify current members by email.

Continued use of our website or facility after any changes constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

16. Contact Us

For any privacy-related enquiries, access or correction requests, or complaints, please contact:

Business name	JB Fitness (VIC) Pty Ltd t/as Carbon Gym
ABN	59 650 279 824
Address	U3/21-31 The Boulevard, Norlane VIC 3214
Phone	(03) 5278 3551
Mobile	0412 216 179
Email	hello@carbongym.com.au
Website	carbongym.com.au/privacy