Privacy Policy
Last updated 31 August 2026
The short version. Your gym decides what member data is collected and why. We only hold it and process it so the software works. We do not sell it, we do not use it to advertise, and we do not use one gym's data for another gym.
Under the Data Protection Act 2019, your gym is the data controller and Lexville Suppliers Limited is the data processor.
1. Who we are
GymPay is operated by Lexville Suppliers Limited, a company registered in Kenya with its registered office in Nairobi. Where this policy says “we”, “us” or “GymPay”, it means Lexville Suppliers Limited.
Where it says “you” or “your gym”, it means the gym, fitness centre or business that holds an account with us.
2. Our role, and yours
This distinction determines who is answerable for what, so it is worth being precise about it.
Your gym is the data controller. You decide which members to register, what to record about them, and how long to keep them on your books. You are responsible for telling your members that their details are being recorded and for having a lawful basis to do so.
We are the data processor. We process member data only on your instructions — which in practice means: only as the software's features operate. We do not decide what data your gym collects and we do not use it for our own purposes.
3. What we hold
About your members
| Data | Why it exists |
|---|---|
| Name | So an attendant can find the right person at the desk |
| Phone number | To send payment receipts and expiry reminders, and to match an M‑PESA payment to the member who made it |
| Payment records | Amount, date, method, M‑PESA receipt number — the record of what a member paid for |
| Membership dates | To answer whether the member may train today |
| Messages sent | The text of each SMS, kept so you can show a member exactly what they were told |
We do not collect member ID numbers, dates of birth, addresses, health information, photographs or biometrics. The software has no field for them.
About your staff
Name, email address, phone number, role, and a cryptographic hash of the password. We never store the password itself and cannot recover it. We also record sign-in times, the IP address and browser used for each session, and failed sign-in attempts — all of which exist so that an owner can tell who did what on a shared desk phone.
Automatically
Server logs recording requests to the service, kept briefly for diagnosing faults and detecting abuse.
4. Why we process it
- To register members and record their membership periods
- To request and confirm M‑PESA payments
- To send transactional SMS: receipts, balance notices, expiry reminders
- To show your gym who has paid, who owes, and what was collected
- To keep the service secure and to investigate misuse
We do not send marketing messages to your members, and we do not contact them about anything other than their membership at your gym.
5. Who else sees the data
Running this service means using other providers. Each receives only what its function requires.
| Provider | What they receive |
|---|---|
| Safaricom PLC (M‑PESA Daraja) | The member's phone number and the amount, in order to raise the payment prompt and confirm the result |
| Africa's Talking | The member's phone number and the message text, in order to deliver the SMS |
| Our hosting and database provider | Stores the data at rest on our behalf |
We may also disclose data where we are required to by law, a court order, or a lawful request from a regulator. Where we are permitted to tell you that this has happened, we will.
We do not sell data, share it with advertisers, or make it available to other gyms. Each gym's records are separated within the system, and a signed-in user can only ever reach their own gym's data.
6. Where the data is held
Our servers and database are currently hosted outside Kenya. This is a transfer of personal data out of Kenya within the meaning of the Data Protection Act 2019. Data is encrypted in transit, and our providers are bound by their own contractual data protection commitments. If you require data to be held within Kenya, tell us before you onboard members.
7. How long we keep it
- Member and payment records — for as long as your gym holds an account, and for 90 days after it closes, so that records can be restored if the account is closed by mistake.
- Message history — 12 months.
- Sign-in and session records — 12 months.
- Server logs — 30 days.
You may ask us to delete a gym's data sooner, and we will do so within 30 days, except where we are required by law to retain financial records for longer.
8. How we protect it
- All traffic to the service is encrypted (HTTPS).
- Passwords are hashed using scrypt; they are never stored or logged in a readable form.
- Sessions are held server-side and can be revoked immediately, so an owner who loses a phone can end that session.
- Repeated failed sign-ins are rate limited.
- Each gym's data is isolated; access is scoped by the signed-in session, never by anything a user can type.
No system is perfectly secure. If a breach occurs that affects your members' data, we will notify you without undue delay and, where the law requires it, assist you in notifying the Office of the Data Protection Commissioner and the affected members.
9. Members' rights
Your members have the right to be told what data is held about them, to have it corrected, to have it deleted, and to object to its processing.
Because your gym is the controller, those requests belong to you. If a member contacts us directly, we will refer them to their gym. If you need our help to answer a request — an export of a member's records, or a deletion — ask us and we will assist at no charge.
10. What we ask of you
- Tell members, at the point you register them, that their name and phone number are recorded and that they will receive SMS about their membership.
- Only register members whose details you are entitled to hold.
- Keep staff passwords private, and remove staff accounts when people leave.
- Tell us promptly if you believe member data has been exposed.
11. Changes
If we change this policy in a way that materially affects how member data is handled, we will tell account holders by email before the change takes effect.
12. Contact
Questions about this policy, or a request for help with a member's rights: support@gympay.co.ke.
You also have the right to complain to the Office of the Data Protection Commissioner of Kenya.