Nguvu Fit provides gym management software to Gyms across Kenya. Each Gym operates its own isolated account — your Gym is the data controller; Nguvu Fit is the data processor, in line with Kenya's Data Protection Act, 2019.
- Account & profile data — name, phone, email, date of birth, gender, emergency contact, and fitness goals provided when your Gym onboards you.
- Authentication data — your member portal PIN (stored securely hashed, never in plain text) and login activity.
- Attendance data — check-in and check-out timestamps recorded via biometric devices, RFID cards, or manual check-in by Gym staff.
- Payment data — transaction references, amounts, and status from M-Pesa, bank, or other methods. We never store your M-Pesa PIN or full card numbers.
- Communications — feedback you submit, and SMS/email notifications sent regarding subscriptions, attendance, or events.
- Technical data — IP address, browser type, and device info collected when you use the member portal (see our Cookie Policy).
- To operate your Gym membership: manage subscriptions, process renewals, and verify attendance.
- To process payments and issue invoices and receipts.
- To send service notifications — renewal reminders, payment confirmations, and event updates — via SMS or email.
- To maintain the security, integrity, and performance of the platform.
- To comply with applicable legal and regulatory obligations.
Biometric templates are stored on ZKTeco devices and/or within your Gym's isolated database, used solely for attendance check-in. Enrollment is controlled by your Gym — contact them directly if you have concerns.
Gyms may enroll members on ZKTeco biometric devices for attendance. Alternative check-in methods (RFID card, manual) may be available — speak to your Gym about what they offer.
Payments are processed via M-Pesa and supported banking partners, each subject to the provider's own privacy practices in addition to this policy.
We retain transaction references and status for accounting, invoicing, and dispute resolution. We do not have access to your mobile money PIN, banking password, or full card details at any point.
We do not sell personal data. Information may be shared only with:
- Your Gym's staff, to the extent necessary to manage your membership.
- Payment processors (M-Pesa, supported banks) solely to complete transactions you initiate.
- SMS and communication providers, solely to deliver notifications you are entitled to receive.
- Law enforcement or regulators, where required by Kenyan law.
We retain membership, attendance, and payment records for as long as your Gym account remains active, and for a reasonable period afterward to meet accounting and legal obligations.
If a Gym closes its account, its tenant database — including member data — is archived or deleted in accordance with our data retention schedule and applicable law.
Under the Data Protection Act, 2019, you have the right to:
Access
Request access to the personal data your Gym holds about you.
Correction
Request correction of inaccurate or incomplete data.
Deletion
Request deletion of your data, subject to legal retention requirements.
Object
Object to or restrict processing, including marketing.
Contact your Gym directly, or email hello@nguvu.co.ke. You may also lodge a complaint with the Office of the Data Protection Commissioner, Kenya.
Each Gym's data is stored in an isolated, dedicated database — completely separate from every other Gym on the platform. This is enforced at the infrastructure level, not just the application level.
We use industry-standard safeguards: encrypted connections, access controls, and regular security review. Use a unique PIN and report any suspicious activity to your Gym immediately.
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of Nguvu Fit after changes take effect constitutes acceptance of the revised policy.