Privacy notice
Last updated 10 October 2026
This notice explains how Pain & Gain Fitness (SA0545156-W) ("we", "us") collects and uses your personal data when you join the gym, use this website and member portal, buy from us or check in at the front desk. We follow the Personal Data Protection Act 2010 (PDPA).
The personal data we collect
- Your details: your name, email address, phone number and date of birth (or age).
- Your account: your password (stored scrambled, so nobody, including us, can read it) and when you agreed to this notice and the waiver.
- Your membership: the plans you buy, when they start and end, their status, and any freezes with the reason you choose (travel, work, health or other).
- Your visits: the date and time each time you check in, and which staff member checked you in.
- Your purchases: what you buy at the counter or order online, what you paid and how (for example cash, bank transfer or card).
- Online payments: a reference to each payment. Card and online banking details go straight to our payment provider, Stripe. We never see or store them.
- Technical data: our server logs record your IP address and the pages you request. This website uses cookies to keep you signed in, remember your shopping cart and remember whether you picked the light or dark theme. We don't use advertising or tracking cookies.
Most of this comes from you, when you sign up online or at the front desk. Some is recorded as you use the gym, such as check-ins and purchases.
Why we use it
- To set up and run your membership, including your member card and checking you in.
- To sell you memberships and products, take payment and give you receipts.
- To prepare your online orders for collection at the counter.
- To contact you about your account, for example to confirm your email address, reset your password or tell you that your membership is about to end.
- To keep our accounts and meet our legal obligations, such as tax record-keeping.
- To keep the gym and this website safe, and to prevent fraud and misuse.
We don't sell your personal data, and we don't use it for marketing by other businesses.
Do you have to give it to us?
Your name, email address, phone number and date of birth are needed to create a membership. Without them we can't sign you up or let you use the member portal. You can still visit as a walk-in and pay at the front desk.
Who we share it with
Only our staff, and these service providers when they need it to do their job for us:
- Stripe processes online card and FPX payments. It receives your email address and payment details.
- Our email provider (Zoho) sends account and membership emails to you.
- Our hosting provider runs the servers this website and its database are on.
Some of these providers store data outside Malaysia. When that happens, we only use providers that protect personal data to a standard comparable to the PDPA.
We may also disclose your data where the law requires it, for example to the authorities.
How long we keep it
- We keep your details while you're a member. If you have no membership, visit or purchase for two years, we erase them automatically.
- Check-in and freeze records are kept for 12 months.
- Online sign-ups that are never confirmed are deleted after 30 days.
- Records of what you bought and paid are kept for seven years, as Malaysian tax law requires. After that, they no longer name you.
If you ask us to close your account, we delete or anonymise everything we don't need to keep by law. Deleted data can stay in our backups for up to 30 days, until those backups are replaced.
How we protect it
The website uses an encrypted (HTTPS) connection. Passwords are stored scrambled. Only staff who need your data can see it, and each staff member has their own sign-in. If a data breach is likely to harm you, we'll tell you and the Personal Data Protection Commissioner as the law requires.
Your rights
- Access: ask for a copy of the personal data we hold about you.
- Correction: ask us to correct data that is wrong or out of date. You can change your name and phone number yourself in your account.
- Withdraw consent: ask us to stop using your data. We may then need to end your membership, because we can't run it without your details.
- Portability: ask us to send your data to you or to someone else in a commonly used format.
You can download your data, or ask us to delete your account, from your account page in the member portal. To use any of these rights, or if you have a question or complaint about your personal data, contact us below. We'll reply within 21 days. We may ask you to prove who you are first.
Contact us
Pain & Gain Fitness (SA0545156-W)
1, Jalan Tengku Ampuan Zabedah B 9/B, Seksyen 9, 40100 Shah Alam, Selangor
Phone: 012-919 1741
Email: painandgainfitnesssek9@gmail.com
Changes to this notice
If we change this notice, we'll update the date at the top. If the change affects how we use data you've already given us, we'll tell you by email first.