Privacy Policy

DemiGod Strength & Conditioning is a premium fitness facility operating under Indian law, located at O-87, 88 1st Floor, Outer Ring Road, New Delhi. Our website is www.demigodgym.com and we can be reached at +91 9873442992.

For the purposes of the Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), DemiGod is the Data Fiduciary responsible for your personal data.

We collect data through several touchpoints: our website, membership registration forms, in-person interactions and digital advertising platforms. The categories we may collect include:

We use your personal data only for the following purposes:

• Membership management — processing your registration, scheduling, billing and renewal.
• Service delivery — personal training, class bookings, access control, locker assignment and facility use.
• Health & safety — ensuring your safe participation in fitness activities and accessing emergency information if required.
• Payments — processing membership fees and ancillary charges through secure third-party gateways.
• Communications — appointment reminders, membership updates, renewal notices and promotional offers (with your consent).
• Marketing & advertising — running targeted campaigns on Meta (Facebook / Instagram) and Google using anonymised or hashed data, with your consent.
• Analytics & improvement — understanding how our website is used so we can improve our services.
• Legal compliance — meeting our obligations under applicable Indian law, including lawful requests from courts or regulators.
• Security — monitoring our premises via CCTV to protect members, staff and property.
• Dispute resolution — maintaining records to resolve membership or financial disputes.

Under the DPDPA 2023 and the SPDI Rules 2011, we rely on the following lawful bases:

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Our website uses cookies and similar tracking technologies. By continuing to use the site, you consent to their use in accordance with this policy.

We use Google Analytics 4 with IP anonymisation enabled; we do not use Universal Analytics. For details of Google's processing, see policies.google.com/privacy.

Meta (Facebook & Instagram) advertising

• We use the Meta Pixel to measure ad performance and build custom audiences. It activates only with your explicit consent via our cookie banner.
• When you submit a lead form — on our website or through Meta's Instant Forms — you give explicit consent for us to use your contact data for marketing. That consent is logged with a timestamp.
• We may upload hashed email addresses or phone numbers to Meta's Custom Audience tool to reach existing members or similar prospects. All uploaded data is hashed using SHA-256 and never transferred in plain text.
• We do not upload data without documented consent. Consent records are kept for a minimum of three years.
• You may opt out of Meta Custom Audience targeting at any time at facebook.com/ads/preferences or by emailing us.
• We do not run ads in Meta's Special Ad Categories (housing, employment, credit, financial services, political), so no special category restrictions apply to our campaigns.
• Lookalike audiences are built only from consented seed data, in compliance with Meta's Terms of Service.

Google advertising

• We use Google Ads and Google Analytics 4. Conversion tracking is enabled only after cookie consent is obtained.
• We follow Google's EU User Consent Policy as a best-practice standard even for Indian users, given our website's international reach.
• We do not use Google's restricted ad categories (clinical trials, gambling, alcohol); our fitness content is general wellness advertising.
• Remarketing lists are built only from users who accepted marketing cookies, and never on sensitive data such as health conditions or income.
• We comply with Google Publisher Policies — no misleading claims, no prohibited content, accurate ad descriptions.

We do not sell, rent or trade your personal data to any third party for commercial gain. We may share data with the following trusted service providers, who process it on our behalf under strict contractual obligations:

All third-party processors are required to maintain confidentiality, implement appropriate security measures, and use your data only for the purposes we specify.

When you complete our health intake or Physical Activity Readiness Questionnaire (PAR-Q), you voluntarily disclose health information such as:

• Cardiovascular conditions, joint or musculoskeletal issues, blood pressure
• Surgical history relevant to exercise
• Medications that may affect exercise capacity
• Other conditions you choose to disclose

This data is used exclusively to:

• Ensure your safe participation in gym activities and personal training
• Inform your trainer so your programme can be modified appropriately
• Facilitate emergency medical response on the premises if required

Access to health data is strictly limited to your assigned personal trainer, the gym manager and emergency response personnel. Health data is never used for marketing or advertising, and never shared with third parties except in a genuine medical emergency.

Body metrics — weight, height, BMI, body fat percentage — collected for fitness tracking are stored securely and accessible only to you and your trainer.

We implement industry-standard technical and organisational security measures:

• Encryption — all data in transit is protected using TLS 1.2 or higher (HTTPS). Sensitive stored data is encrypted at rest.
• Access controls — personal data is accessible only to authorised staff on a need-to-know basis, and access is logged and audited.
• Password security — staff accounts use strong passwords and multi-factor authentication on all critical systems.
• Payment security — we do not store full card numbers; all payment processing is handled by PCI-DSS compliant gateways.
• Physical security — on-premises records are stored in locked facilities with restricted access.
• Vendor security — all third-party processors are vetted for security compliance before engagement.
• Incident response — we maintain a data breach response procedure. In the event of a breach affecting your data we will notify you and, where required, the Data Protection Board of India within the timeframes prescribed under DPDPA 2023.

Despite our best efforts, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we commit to taking all reasonable steps to protect your data.

Once retention periods expire, data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

Under the Digital Personal Data Protection Act 2023, you have the following rights over your personal data:

We respond to all valid requests within 30 days. Complex requests may take up to 45 days, with notice to you. We do not charge a fee for routine requests.

Our services are intended for individuals aged 16 years and above. Members under 18 require written consent from a parent or legal guardian before enrolling.

• We do not knowingly collect personal data from children under 16 without verifiable parental consent.
• Our website is not directed at children under 16, and we do not display targeted advertising to users identified as minors.
• For members aged 16 to 17, all communications regarding health data and marketing are directed to the consenting parent or guardian.
• If we discover we have inadvertently collected data from a child under 16 without parental consent, we will delete it immediately.

Parents or guardians who believe their child's data has been collected without consent should contact our Grievance Officer immediately using the details in section 18.

DemiGod operates CCTV cameras across its premises for the safety and security of members, staff and property. By entering our premises you acknowledge and consent to being recorded.

• Cameras are not installed in changing rooms, shower areas or restrooms.
• Footage is stored for a maximum of 30 days and then automatically overwritten, unless retained for investigation of an incident.
• Access to footage is restricted to senior management and authorised security personnel.
• Footage is shared with law enforcement only on receipt of a valid legal order or in response to a security incident.
• Signage notifying members of CCTV operation is displayed at all entry points.

DemiGod may photograph or film members, classes or events for marketing and social media purposes — Instagram, Facebook, YouTube and our website.

• If you have opted in, you grant DemiGod a non-exclusive, royalty-free licence to use your image or likeness in marketing materials for the duration of your consent.
• You may withdraw consent at any time in writing. Withdrawal applies to future use; material already published in print may not be immediately removable.
• We will never use your image in a context that is demeaning, discriminatory or misleading.
• Members who have not opted in should not be incidentally captured in shared content. If you appear without consent, tell us and we will remove the content promptly.
• Transformation photographs (before / after) require separate written consent specifying the intended platforms and duration of use.

Physical exercise involves inherent risks including, but not limited to, muscular strain, joint injury, cardiovascular stress and, in rare cases, serious injury. By using DemiGod's facilities and services you acknowledge and accept these risks.

• You confirm that you are physically capable of participating in the activities you choose to undertake at DemiGod.
• You are responsible for consulting a qualified medical practitioner before beginning any new exercise programme, particularly if you have a pre-existing health condition.
• Any health information you disclose is used to help us provide safer training guidance — it does not constitute medical advice from DemiGod.
• DemiGod, its owners, directors, employees and trainers shall not be liable for any injury, illness, loss or damage arising from your voluntary participation in gym activities, except in cases of proven gross negligence on our part.
• DemiGod is not responsible for loss or theft of personal belongings on or from the premises, except where directly caused by our negligence.
• Information on our website and social media channels is for general fitness awareness only and does not constitute medical, nutritional or clinical advice.

Some of our third-party service providers — Google LLC and Meta Platforms Inc. — are headquartered outside India and may process your data on servers in the United States or other countries.

• These transfers are protected by the respective companies' standard contractual clauses, adequacy decisions or other approved transfer mechanisms.
• We only transfer data to countries or entities providing data protection standards comparable to those required under DPDPA 2023.
• We rely on Google's and Meta's commitments under their respective Data Processing Addenda and privacy policies for the protection of transferred data.
• Where possible, data is anonymised or pseudonymised before transfer to minimise risk.

We may update this Privacy Policy periodically to reflect changes in law, our services or our data practices. We will notify you of material changes by:

• Posting a prominent notice on our website with the updated effective date
• Sending an email or WhatsApp notification to active members
• Displaying an on-premises notice where appropriate

Your continued use of our services after the effective date of a revised policy constitutes acceptance of the updated terms. Previous versions are archived and available on request.

Current version effective 17 August 2026. Policy version 1.0.

In compliance with Rule 5(9) of the IT (SPDI) Rules 2011 and Section 13 of the DPDPA 2023, we have appointed a Grievance Officer to address data protection concerns and complaints.

If you are unsatisfied with the resolution provided by our Grievance Officer, you have the right to approach:

• The Data Protection Board of India, once constituted under DPDPA 2023
• The Adjudicating Officer under the Information Technology Act 2000
• The Consumer Disputes Redressal Commission under the Consumer Protection Act 2019
• A court of competent jurisdiction in India

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of India, including but not limited to:

• Digital Personal Data Protection Act, 2023 (DPDPA)
• Digital Personal Data Protection Rules, 2025
• Information Technology Act, 2000 and IT (Amendment) Act, 2008
• IT (Reasonable Security Practices and Procedures and SPDI) Rules, 2011
• Consumer Protection Act, 2019 and Consumer Protection (E-Commerce) Rules, 2020
• Indian Contract Act, 1872

Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of New Delhi, India. Both parties agree to attempt resolution through good-faith negotiation before initiating formal legal proceedings.

For any query, request or concern regarding this Privacy Policy or your personal data, contact us through any of the following channels: