1. Who we are
Figure Artist Fitness Club (“we”, “us”) operates the gym at Mawithara Junction, Piliyandala, and this website. We are the controller of the personal data described here and process it in line with Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 (“PDPA”).
2. What we collect
| When | Data |
|---|---|
| Creating an account | Name, email, optional mobile number, password (stored hashed by our authentication provider), your age group, and — for under-16s — a parent or guardian’s name, email and consent. |
| Buying a membership, gear or tickets | Name, email, mobile, delivery address (only if you choose delivery), what you ordered, membership start date and member names, payment method and status. We never see or store full card numbers — card payments happen on the payment provider’s page. |
| Booking a class | Your account, the class and whether you are booked or waitlisted. |
| Contacting us / data requests | Name, email, optional phone, your message. |
| Newsletter | Email address, the date you gave consent, and where you signed up. |
| Browsing (only with your consent) | Anonymous usage events such as pages viewed and items added to the bag, linked to a random session ID — not to your name. |
We do not collect your date of birth, ID numbers or health data through this website.
3. How and why we use it
- To provide what you ask for (contract): activating memberships, fulfilling orders, issuing tickets, managing bookings and waitlists, and answering messages.
- To meet legal obligations: keeping sales and accounting records.
- To keep the site safe (legitimate interest): preventing fraud, spam and abuse, for example with bot checks and rate limits.
- With your consent: newsletters, analytics and on-device recommendations. You can withdraw consent at any time.
4. Who we share it with
We share personal data only with service providers that help us run the club, under contracts that require them to protect it:
- Supabase — hosting of our database, authentication and image storage.
- Cloudflare — content delivery, security and bot protection (Turnstile).
- Payment providers (PayHere and/or Cybersource) — only when you pay by card, to process the payment.
- Google — Maps (only after you click “Load map”), Analytics (only with analytics consent) and reCAPTCHA if enabled.
- WhatsApp (Meta) — only if you choose to send us an order or message via WhatsApp.
- Couriers — your name, phone and address when you choose delivery.
We never sell or rent your personal data. We may disclose information where required by law.
5. Cookies & similar technologies
On your first visit we ask which optional cookies you allow. You can change your choice any time with “Cookie settings” in the footer. Optional technologies never run before you opt in.
| Name | Category | Purpose | Duration |
|---|---|---|---|
| fa_consent | Necessary | Remembers your cookie choices | 6 months |
| sb-*-auth-token | Necessary | Keeps you signed in (secure, HTTP-only) | Session / up to 1 week |
| fa-cart-v2, fa-prefs-v1 (local storage) | Necessary | Your bag and wishlist on this device. Browsing history inside fa-prefs is only recorded with analytics consent. | Until cleared |
| fa-theme, fa-newsletter (local storage) | Necessary | Colour theme and whether you dismissed the newsletter invite | Until cleared |
| Cloudflare (__cf_bm, cf_clearance) | Necessary | Bot protection and security | Up to 30 minutes / 1 year |
| _ga, _ga_* | Analytics | Google Analytics visit statistics (IP anonymised) | Up to 2 years |
6. Children under 16
If you are under 16, we need consent from your parent or guardian before using your personal data. Our forms ask for your age group and, for under-16s, your parent or guardian’s name, email and consent. Under-16s cannot join the newsletter. If you believe we hold a child’s data without consent, contact us and we will delete it.
7. How long we keep data
- Account data: while your account is open, and deleted within 30 days of a verified deletion request.
- Orders and payment records: 7 years, to meet tax and accounting obligations (anonymised if you delete your account).
- Contact messages: up to 2 years.
- Newsletter: until you unsubscribe; we keep a record of the opt-out so we don’t email you again.
- Analytics events: up to 14 months.
8. Security
The site is served only over HTTPS. Passwords are hashed by our authentication provider, session cookies are secure and HTTP-only, forms are protected against bots and cross-site request forgery, and access to our admin tools is restricted by role. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.
9. Your rights
Under the PDPA you can ask us to:
- access the personal data we hold about you, and receive a copy;
- correct inaccurate or incomplete data;
- delete your data, or restrict how we use it;
- withdraw consent at any time (this doesn’t affect anything done before you withdrew it).
Signed-in members can download their data and request deletion from Account → Privacy & data. Anyone can use our data request form. We confirm your identity before acting on a request. If you’re unhappy with how we handle your data, you may complain to Sri Lanka’s Data Protection Authority.
10. International transfers
Some of our providers store or process data outside Sri Lanka. Where that happens we rely on providers that offer appropriate safeguards for personal data, as permitted under the PDPA.
11. Marketing & unsubscribing
We only send marketing emails if you opt in — the box is never pre-ticked. Every email includes a one-click unsubscribe link, and you can also switch emails off in your account profile.
12. Changes to this policy
If we make significant changes we’ll update the date above and, where appropriate, tell you by email or on the site.
Contact us
Figure Artist Fitness Club
Mawithara Junction, Piliyandala, Sri Lanka
Phone: +94 76 463 5985 · WhatsApp: +94 71 764 0479
Email: figureartist@gmail.com