Your data. Your choice.

Privacy Policy

FAVIAN ANN TATULI 100 FITNESS STUDIOS LTD

trading as F.A.T 100 HEALTH & FITNESS STUDIOS

Company Number: PVT-WQ1PRARE | Incorporated in Kenya on 7 October 2026

Website: https://fat100.club | Effective date: 24 October 2026 | Version 1.1

1. INTRODUCTION AND WHO WE ARE

This Privacy Policy is issued by FAVIAN ANN TATULI 100 FITNESS STUDIOS LTD, a private limited company incorporated in Kenya under the Companies Act, 2015 on 7 October 2026 under company number PVT-WQ1PRARE, trading as F.A.T 100 Health & Fitness Studios (“FAT 100”, “we”, “us” or “our”).

Our registered office is at Shankardass House, Nkrumah Lane / Harambee Avenue, Athi River District, Machakos County, Kenya. Our postal address is P.O. Box 126, 00100 GPO Nairobi, Kenya. Our telephone number is +254 716 859 099 and our email address is info@fat100.club.

We operate the website at https://fat100.club (the “Website”), the F.A.T 100 member application (the “App”) and a health and fitness studio to be located in Athi River, Machakos County, at premises to be announced (the “Studio”). References in this Policy to the “Services” are to the Studio, the Website, the App and all related coaching, access, membership and retail services.

We are committed to processing personal data in accordance with Article 31 of the Constitution of Kenya, 2010, the Data Protection Act, No. 24 of 2019 (the “Act”) and the Data Protection (General) Regulations, 2021.

For the purposes of the Act we are a data controller of the personal data described in this Policy, because we determine the purpose and means of its processing. In the limited circumstances described in section 4 below we also act as a data processor.

We are registered with the Office of the Data Protection Commissioner (“ODPC”) as a data controller and data processor under sections 18 and 19 of the Act. Our registration number is [ODPC registration number — to be inserted].

This Policy is issued in discharge of our duty under section 29 of the Act. Sections 29(a) to (h) of the Act require us to inform you, before or at the time of collection, of: your rights; the fact that personal data is being collected; the purpose of collection; the third parties to whom data is or will be transferred together with the safeguards adopted; our contact details and whether any other entity may receive your data; a description of the technical and organisational security measures we apply; whether the data is collected pursuant to any law and whether provision is voluntary or mandatory; and the consequences of failing to provide the data requested. Each of those matters is addressed below.

2. DEFINITIONS AND INTERPRETATION

2.1 Statutory definitions

The following terms are defined in section 2 of the Act, and those definitions apply throughout this Policy:

2.2 Interpretation

In this Policy, unless the context requires otherwise:

The following rules of interpretation apply to this Policy:

• a reference to a statute or statutory provision includes that statute or provision as amended, re-enacted or extended, and any subordinate legislation made under it;
• a reference to a section is to a section of the Act unless another statute is named;
• the singular includes the plural, and words importing one gender include the other genders;
• the words “including”, “includes” and “in particular” do not limit the words that precede them;
• a reference to writing includes email, WhatsApp and any other legible electronic form;
• a reference to a person includes a body corporate, partnership, trust and unincorporated association;
• a reference to a day is to a calendar day, and a reference to a time is to East Africa Time (UTC+3); and
• headings and the table of contents are for convenience only and do not affect the interpretation of this Policy.

3. SCOPE OF THIS POLICY

This Policy applies to personal data we process in relation to:

• prospective members and persons who join our early-access list or any waiting list;
• members and former members of the Studio;
• visitors, guests, day-pass holders and persons attending trials or events;
• persons who contact us by telephone, email, WhatsApp, social media, web form or in person;
• next of kin and emergency contacts nominated by members;
• employees, trainers, visiting instructors and contractors (in addition to our separate Staff Privacy Notice);
• suppliers, service providers and professional advisers; and
• corporate or institutional clients and their nominated beneficiaries.

This Policy does not apply to third-party websites, applications or platforms that you may reach through links from the Website or the App. We are not responsible for the privacy practices of those third parties, and you should review their own privacy notices.

This Policy does not apply to clinical or medical records held by your own doctor, hospital or other health care provider. Those records are governed by that provider's own notices and by section 46 of the Act.

4. OUR ROLES: CONTROLLER AND PROCESSOR

4.1 Where we act as data controller

We act as data controller for all personal data that we collect for our own purposes, including membership administration, access control, coaching, billing, security, marketing and the management of our own staff and suppliers.

4.2 Where we act as data processor

We act as data processor where we provide services on the documented instructions of a corporate or institutional client — for example, where an employer purchases gym access or a wellness programme for its employees and determines the purpose and scope of that processing.

Where we act as a processor:

• we process personal data only on the written instructions of that client, and we do not repurpose it for our own purposes;
• we have entered, or will enter, into a written contract with the client as required by section 42(2)(b) of the Act, under which we act only on instructions and are bound by the client's obligations;
• we provide that client with aggregated usage reporting only, and we do not disclose individualised health or attendance detail unless the individual has separately consented; and
• if we process personal data other than as instructed by that client, we are deemed to be a data controller in respect of that processing under section 42(3) of the Act, and this Policy applies to that processing.

5. THE PERSONAL DATA WE COLLECT

The table below summarises the categories of personal data we collect, grouped by the activity in which you encounter us. The lawful basis for each category is set out in section 12, the retention period in section 15, and the recipients in section 16.

6. BIOMETRIC DATA: FACIAL RECOGNITION AND FINGERPRINT ACCESS

6.1 What we collect and why

Entry to the Studio is controlled at a single doorway using Hikvision DS-K1T671MF terminals that can read a fingerprint and a face. The purpose is to verify that the person entering is a current member or authorised visitor with a valid entitlement, to prevent unauthorised entry and tailgating, and to maintain an accurate attendance record for billing and capacity planning.

We store a mathematical biometric template generated from your fingerprint or face. We do not store a photographic image of your fingerprint, and we do not use biometric data for advertising, for profiling unrelated to access, or for any purpose other than access control and attendance.

6.2 Why biometric data is treated as sensitive personal data

Section 2 of the Act defines biometric data as sensitive personal data. Section 44 of the Act provides that no category of sensitive personal data may be processed unless the principles in section 25 apply to that processing. Section 45 of the Act then sets out the permitted grounds on which sensitive personal data may be processed.

6.3 The basis on which we rely

We rely on:

• your express, specific and informed consent under section 30(1)(a) of the Act, which satisfies the lawfulness principle in section 25(b) as required by section 44; and
• section 45(c)(ii) of the Act, namely processing necessary for the purpose of carrying out the obligations and exercising specific rights of the controller or of the data subject, being the administration of your membership and the operation of lawful access control at our premises.

6.4 Your genuine choice of an alternative

You are not obliged to enrol biometric data. We provide a non-biometric access credential, in the form of a QR code or card together with a personal identification number, and membership and entry are available on that basis at no additional charge and without any reduction in service.

Section 32(4) of the Act requires that, in determining whether consent was freely given, account be taken of whether the performance of a contract, including the provision of a service, is conditional on consent to processing that is not necessary for the performance of that contract. Because we offer the access credential alternative, your biometric consent is genuinely optional and is not a condition of membership.

6.5 Consent is separate and revocable

Biometric consent is obtained on a separate form (Annex A) and is not bundled with your membership application, with acceptance of this Policy, or with any marketing permission. You may withdraw biometric consent at any time under section 32(2) of the Act, at reception or by writing to our DPO. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, in accordance with section 32(3) of the Act. Following withdrawal we will delete your biometric template and issue you with an access credential.

6.6 Deletion across every copy

Biometric templates exist in more than one place in our system: on the door terminals, on a cold spare terminal held as a replacement unit, and on the site appliance that mirrors up to 72 hours of entitlement data so that the door continues to operate during an internet outage. When you withdraw consent, leave, or ask us to erase your data, we delete the template from every one of those locations and record that we have done so. We retain only a record that consent was withdrawn and deletion was performed, because we must be able to demonstrate compliance.

7. HEALTH DATA AND SECTION 46 OF THE ACT

7.1 The statutory restriction

Section 46(1) of the Act provides that personal data relating to the health of a data subject may only be processed by or under the responsibility of a health care provider, or by a person subject to the obligation of professional secrecy under any law. Section 46(2) provides that the condition in subsection (1) is met if the processing is necessary for reasons of public interest in the area of public health, or is carried out by another person who in the circumstances owes a duty of confidentiality under any law.

7.2 Our position, stated plainly

FAT 100 is a health and fitness studio. We are not a health care provider. We cannot and do not rely on section 46(1)(a) of the Act. We do not diagnose, treat, prescribe or manage any medical condition, and nothing we do is a substitute for medical advice.

To the limited extent that we process health-related information at all, we rely on section 46(1)(b) and section 46(2)(b) of the Act — that is, on processing carried out by persons who in the circumstances owe a duty of confidentiality under the law. We give effect to that restriction through each of the following controls, all of which are mandatory and none of which may be waived for convenience:

• the only health-related information we collect is the outcome of the fitness-readiness declaration described in section 7.3, and nothing more;
• access to readiness data is restricted to a single named role, being the Studio Manager acting as our designated health-data custodian, together with the DPO; access by any other member of staff requires a specific, recorded, time-limited authorisation from that custodian;
• every person who has access to readiness data signs a written confidentiality undertaking, and that obligation is also incorporated into their contract of employment or engagement, and it survives the end of their engagement;
• readiness data is stored in a segregated store with its own access log, separate from the general member record, so that it is not exposed by routine access to the member database;
• readiness data never appears in the shared communications inbox, in group chat, in class lists or on any screen visible to other members; and
• any person engaged by us to provide individual nutrition or dietary advice is either a qualified professional bound by a professional obligation of secrecy, or works under the direct responsibility of such a professional.

7.3 The fitness-readiness declaration

In place of a health questionnaire, we use a fitness-readiness declaration. It consists only of a fixed set of yes/no statements. It does not invite, and we do not record, the name of any condition, any diagnosis, any medication, any symptom history, any surgical history, any pregnancy detail, or any free-text description of your health. The declaration asks you to answer yes or no to statements of the following kind, each of which is designed to identify only whether you need to speak to a doctor before you begin:

• Has a doctor ever told you that you have a heart condition, or that you should only exercise under medical supervision?
• Do you experience chest pain, or unexplained breathlessness, dizziness or fainting during physical activity?
• Have you had surgery, or been hospitalised, in the last twelve months?
• Are you currently taking prescribed medication for a heart, blood pressure or respiratory condition?
• Do you have a bone, joint, muscle or back problem that could be made worse by exercise?
• Are you pregnant, or have you given birth within the last six months?
• Is there any other reason, known to you, why you should not take part in physical activity?

The consequences of your answers are as follows:

• if you answer “no” to every statement, you are cleared to begin training;
• if you answer “yes” to any statement, you will be asked to consult a doctor before training, and we will record that clearance was requested and whether clearance was produced; you may not use the Studio until we have recorded your clearance;
• we record only the outcome of the declaration — a pass, a referral to a doctor, or a clearance received — together with the date and the version of the declaration used. We do not retain your individual answers once the outcome has been recorded;
• we do not interpret, assess or advise on any answer you give, and we do not make any clinical judgment about your fitness; and
• if your circumstances change, you must complete a fresh declaration before continuing to train.

7.4 Injury and incident records

We keep records of injuries and incidents occurring at the Studio for safety, insurance and legal purposes. These records may reveal health status and are therefore handled as sensitive personal data. Access is restricted to the Studio Manager and the DPO, and the records are retained for the period stated in section 15.

7.5 Body measurements and progress records

Any body measurement, weight or progress photograph is recorded only where you elect to provide it and only with your separate consent. You may decline to provide any such information without any effect on your membership. Progress images are stored in a segregated, access-controlled location and are never used in marketing without a further, specific and revocable written consent.

7.6 Coaching notes

Coaches record objective facts only — for example, attendance, the exercises performed and the loads used. Coaches are instructed not to record any observation, inference or comment about a member's health, body, pregnancy, disability, religion or any other sensitive characteristic in free-text notes. We audit notes periodically and delete any sensitive content discovered.

8. CLOSED-CIRCUIT TELEVISION

We operate six AcuSense cameras and an eight-channel recorder covering the Studio threshold and entrance area. CCTV is operated for the legitimate interests of premises security, prevention of theft and unauthorised entry, member and staff safety, verification of insurance claims, and the establishment, exercise or defence of legal claims, in accordance with section 30(1)(b)(vii) and section 45(c)(i) of the Act.

• Notices are displayed at each entrance and at reception before the point at which recording begins.
• Cameras are positioned to cover the entrance, threshold and public areas only. They are not installed in changing rooms, toilets, showers, saunas or any area where a person expects privacy.
• Footage is retained for 30 days on a rolling basis and is then automatically overwritten, except where a clip has been preserved for an incident, an insurance claim or a legal claim.
• Preserved footage is held under a litigation hold, is accessible only to the Studio Manager and the DPO, and is retained until the claim or limitation period expires.
• We do not carry out covert monitoring of members or staff. Any monitoring of staff performance is disclosed in the Staff Privacy Notice.
• Where you request a copy of footage in which you appear, we will provide it subject to redaction of the images of any other identifiable person, because the rights and freedoms of those other persons must also be respected.
• The recorder is physically secured, access is password-protected and logged, and recordings are not copied to personal devices.

9. NEXT OF KIN AND EMERGENCY CONTACTS

You may nominate a next of kin or emergency contact. We collect that person's name, telephone number and relationship to you. Family details may constitute sensitive personal data under section 2 of the Act, and section 25(e) requires that we provide a valid explanation where information relating to family or private affairs is required. Our explanation is that we need to be able to reach someone quickly if you are injured or become unwell at the Studio.

Your nominated contact has not consented to our holding their data. Accordingly:

• we use their details only to contact them in an emergency, or where you have asked us to;
• we notify them the first time we use their details, explaining why we hold them and how to ask us to remove them;
• we honour any objection they raise, and we will ask you to nominate a different contact;
• we disclose to them only the minimum necessary — normally that you require assistance and where you are; and
• we do not link their record to their own membership record if they are also a member, and we do not merge the two identities.

10. AGE: OUR SERVICES ARE FOR PERSONS AGED 18 AND OVER

Our Services are available only to persons aged 18 years and over. We do not knowingly collect or process the personal data of any person under the age of 18.

Section 33(1) of the Act restricts the processing of personal data relating to a child and requires parental or guardian consent together with processing that protects and advances the child's best interests. Section 33(2) requires appropriate mechanisms for age verification. We have therefore adopted a policy of not serving minors at all, which is the most protective option available to us and avoids any reliance on section 33.

We verify age at the point of membership application by requiring a declaration of date of birth together with presentation of a national identity card, passport or alien identity document, and by matching the date of birth recorded against that document. We repeat this verification where a date of birth is later corrected.

If we discover that we have inadvertently collected the personal data of a person under 18, we will delete that data without undue delay and will cancel any associated membership, list registration or access credential. If you believe we hold data relating to a minor, please contact our DPO immediately and we will act on your report.

Children are not permitted in the training areas of the Studio. Any incidental capture of a minor by CCTV is deleted on the ordinary 30-day cycle except where preserved for an incident.

11. PAYMENTS AND FINANCIAL DATA

We accept payment by M-Pesa and by card through a third-party payment gateway. We do not receive or store your M-Pesa personal identification number, and we do not store full card numbers. Card details are captured directly by the gateway and returned to us only as a token together with the last four digits of the card.

Where we collect your KRA PIN, we do so only where it is necessary for the issue of a valid tax invoice through KRA eTIMS or for another statutory requirement. Collection of the PIN for that purpose is mandatory, and the consequence of not providing it is that we are unable to issue a compliant tax invoice. We do not use your KRA PIN for any other purpose.

We keep records of arrears, failed payments and suspended entitlements because they are necessary for the administration of your contract and for the establishment, exercise or defence of legal claims. Where a failed payment results in automated suspension of your access, section 21 below applies.

12. LAWFUL BASIS FOR PROCESSING

Section 30(1) of the Act prohibits processing unless one or more of the following grounds applies. Section 30(2) requires that any further processing be in accordance with the purpose of collection. The table below sets out the ground we rely on for each activity.

13. CONSENT, AND HOW TO WITHDRAW IT

Where we rely on consent, that consent must be express, unequivocal, free, specific and informed, as required by section 2 of the Act. We obtain consent by a clear affirmative action — normally a tick box that you must actively select. We do not use pre-ticked boxes, and we do not treat your acceptance of this Policy, or your agreement to our membership terms, as consent to marketing.

Section 32(1) of the Act places the burden of proving consent on us. We therefore record, for every consent, the exact wording you were shown, the date and time, the channel through which you gave it, and the version of this Policy then in force.

Section 32(2) of the Act gives you the right to withdraw consent at any time. Section 32(3) provides that withdrawal does not affect the lawfulness of processing carried out before withdrawal. You may withdraw consent by contacting our DPO, by replying STOP to any marketing message, or by using the unsubscribe link in any marketing email. Withdrawal is free of charge and is actioned within seven days.

Consent is requested separately for each of the following, and each may be given or refused independently of the others:

• biometric access control (Annex A);
• provision of optional body measurement or progress data;
• marketing communications by SMS;
• marketing communications by email;
• marketing communications by WhatsApp;
• use of your image in our marketing or on social media; and
• disclosure of your name and membership status to another member for a referral or buddy programme.

Refusing any of the consents listed above does not affect your ability to become or remain a member, except where the consent relates to a feature you have asked to use.

14. MARKETING, COMMERCIAL USE AND YOUR CHOICES

Section 37(1) of the Act prohibits the use of personal data for commercial purposes unless we have sought and obtained your express consent, or we are authorised to do so under a written law and you were informed of that use when the data was collected. Section 37(2) requires that, where possible, we anonymise personal data used for commercial purposes so that you are no longer identifiable.

Accordingly: marketing messages, promotional offers, retail and supplement promotions, apparel launches, referral campaigns and any other commercial communication are sent only to persons who have given express consent for that channel. Transactional messages — such as payment receipts, access confirmations, session reminders and service notices — are not marketing, are sent on the basis of your contract, and do not carry promotional content.

We do not sell your personal data, and we do not license member lists to any third party. Any affiliate or referral arrangement we operate uses a link or a code that you choose to use, and does not involve the transfer of your identity or contact details to the affiliate brand.

We may create and use aggregated and anonymised statistics — for example total attendance, average session occupancy or footfall trends — for planning and reporting. Such statistics contain no information from which any individual can be identified and are not personal data. We will not treat pseudonymised data that can be re-linked to you as anonymous.

15. HOW LONG WE KEEP YOUR DATA

Section 39(1) of the Act permits us to retain personal data only for as long as is reasonably necessary to satisfy the purpose for which it is processed, unless retention is required or authorised by law, reasonably necessary for a lawful purpose, authorised or consented to by you, or for historical, statistical, journalistic, literary, artistic or research purposes. Section 39(2) requires that we delete, erase, anonymise or pseudonymise personal data that need not be retained once the retention period expires.

We apply the following periods. Where two periods apply, the longer governs only to the extent required by the stated reason.

Where a statutory retention obligation requires us to keep data that you have asked us to erase, we will restrict the processing of that data rather than erase it, and we will tell you that we have done so, in accordance with section 40(3) of the Act.

16. WHO WE SHARE YOUR DATA WITH

Section 29(d) of the Act requires us to tell you the third parties to whom personal data is or will be transferred, including the safeguards adopted. Section 42(2) of the Act requires us to use processors who provide sufficient guarantees and to have a written contract in place with each of them. We share personal data only as set out below, and only to the extent necessary.

We do not transfer your personal data to any other third party, and we do not disclose member data to another member. If you ask us to confirm your membership to a third party — for example for a corporate discount — we will ask for your written instruction first.

17. TRANSFERS OF PERSONAL DATA OUTSIDE KENYA

Section 25(h) of the Act requires that personal data not be transferred outside Kenya unless there is proof of adequate data protection safeguards or consent from the data subject. Section 48 of the Act permits a transfer to another country only where we have given proof to the ODPC of appropriate safeguards for the security and protection of the personal data, including where appropriate a jurisdiction with commensurate data protection laws, or where the transfer is necessary for one of the purposes listed in section 48(c). Section 49(1) of the Act provides that the processing of sensitive personal data out of Kenya shall only be effected upon obtaining the consent of the data subject and on obtaining confirmation of appropriate safeguards.

Our primary platform and member database are hosted on a server located at the Studio, and our primary systems are designed to keep personal data in Kenya. However, some of our service providers, including cloud backup, communications and payment providers, may store or process data outside Kenya.

Where any transfer of personal data outside Kenya occurs, we will:

• satisfy ourselves, and be able to demonstrate to the ODPC, that appropriate safeguards are in place, as required by section 48(a) and (b);
• in the case of sensitive personal data, obtain your explicit consent for the transfer in addition to confirming the safeguards, as required by section 49(1);
• record the safeguards relied on for each transfer; and
• not transfer sensitive personal data outside Kenya where you have refused consent for that transfer.

18. HOW WE PROTECT YOUR DATA

Sections 41 and 42 of the Act require us to implement appropriate technical and organisational measures to implement the data protection principles and to integrate the necessary safeguards into our processing, both by design and by default. We apply the following measures:

• access to personal data is granted on a least-privilege basis, by named individual, and is reviewed quarterly;
• readiness data, biometric data and payment data are held in segregated stores with their own access logs;
• personal data is encrypted at rest and in transit, and passwords are stored only as salted hashes;
• the access control network is isolated from the general network, terminals are patched, and default credentials are changed before installation;
• the server, recorder and terminals are physically secured in locked locations, and the site appliance runs on a protected power supply;
• backups are taken regularly, stored encrypted, and restoration is tested at least twice a year, as required by section 41(4)(d);
• every person who handles personal data signs a confidentiality undertaking, and we take all reasonable steps to ensure compliance by persons acting under our authority, as required by section 42(4);
• we keep written processor contracts with every processor, as required by section 42(2);
• we log access to sensitive stores and review the logs; and
• we train all staff on data protection at induction and annually, and we re-train on any material change.

19. PERSONAL DATA BREACHES

Section 43(1) of the Act requires that, where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the data subject, we notify the Data Commissioner without delay and in any event within 72 hours of becoming aware of the breach, and we communicate the breach to the affected data subject in writing within a reasonably practical period, unless the identity of the data subject cannot be established.

Our breach procedure provides that:

• any member of staff who suspects a breach must report it immediately to the DPO, and must not attempt to investigate or remediate it alone;
• the DPO decides within 24 hours whether the threshold in section 43(1) is met, and records the decision and the reasons;
• if the threshold is met, the DPO notifies the ODPC within 72 hours, and where notification is not made within 72 hours the notification is accompanied by the reasons for the delay, as required by section 43(2);
• the notification to the ODPC and to affected data subjects contains the information required by section 43(5) — the nature of the breach, the measures taken or proposed, the recommended measures for the data subject to mitigate adverse effects, the identity of any unauthorised person where known, and the contact details of the DPO;
• where all of that information is not available at the same time, it may be provided in phases without undue delay, as permitted by section 43(7);
• where we have already applied appropriate security safeguards, including encryption of the affected data, communication to the data subject may not be required, in accordance with section 43(6);
• our processors are required by contract, and by section 43(3) of the Act, to notify us without delay and where reasonably practicable within 48 hours of becoming aware of a breach affecting our data; and
• the DPO keeps a register recording the facts of every breach, its effects and the remedial action taken, as required by section 43(8).

Because our access control system holds biometric templates on the terminals and the recorder holds video footage of identifiable persons, the loss or theft of a terminal, the cold spare or the recorder is treated as a reportable breach unless the DPO determines, and records, that no real risk of harm arises.

20. YOUR RIGHTS

Section 26 of the Act gives you the following rights, each of which we honour free of charge:

We will ask you to verify your identity before acting on a request, so that we do not disclose or erase data on the instruction of someone who is not you. We do not charge a fee for handling a request, except where section 38(6) permits a reasonable cost for a portability request.

If you believe we have handled your request incorrectly, you may complain to the ODPC as described in section 24.

21. AUTOMATED DECISION-MAKING

Section 35(1) of the Act gives you the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you.

Two of our processes could engage this right: automatic denial of entry at the door where an entitlement has lapsed, and automatic suspension of access where a payment fails. Our position is as follows:

• automatic denial at the door is limited to verification of whether a valid entitlement exists at the moment of entry, and it does not involve profiling or any assessment of you as a person;
• automatic suspension following a failed payment is treated as a decision that significantly affects you, and we notify you in writing that the decision has been taken, as required by section 35(3)(a);
• you may, under section 35(3)(b), request us to reconsider the decision or to take a new decision that is not based solely on automated processing;
• we will consider your request, comply with it, and inform you in writing of the steps taken and the outcome, within a reasonable period, as required by section 35(4); and
• no decision about your membership, access or service is made by artificial intelligence alone. Any automated output is reviewed by a member of staff before it takes effect.

22. DATA PROTECTION IMPACT ASSESSMENT

Section 31(1) of the Act requires that, where a processing operation is likely to result in a high risk to the rights and freedoms of a data subject by virtue of its nature, scope, context and purposes, we carry out a data protection impact assessment before the processing begins.

Our use of biometric access control and our operation of CCTV are both operations that are likely to result in high risk, and we have therefore carried out a data protection impact assessment covering each, addressing the matters required by section 31(2): a systematic description of the processing and its purposes; an assessment of the necessity and proportionality of the processing; an assessment of the risks to the rights and freedoms of data subjects; and the measures, safeguards and security mechanisms adopted to address those risks.

Section 31(5) of the Act requires that data protection impact assessment reports be submitted sixty days prior to the processing of data. We will not enable biometric access control, and will not commence a new CCTV deployment, until the assessment has been completed and, where section 31(3) applies because the assessment indicates high risk, until we have consulted the Data Commissioner.

23. REGISTRATION, RECORDS AND OUR DATA PROTECTION OFFICER

Section 18(1) of the Act provides that no person shall act as a data controller or data processor unless registered with the Data Commissioner. We are registered, and our registration number is [ODPC registration number — to be inserted]. We will notify the ODPC of any change in the particulars of our registration, as required by section 19(5).

We maintain records of our processing activities as required for accountability, and we retain the evidence of every consent we rely on, because section 32(1) of the Act places the burden of proving consent on us.

Section 24 of the Act provides for the designation of a Data Protection Officer. Because our core activities involve the regular and systematic monitoring of data subjects through access control and CCTV, and the processing of sensitive categories of personal data, we have designated a Data Protection Officer. Our DPO's contact details are published below and will be communicated to the Data Commissioner for publication, as required by section 24(6).

Our DPO's functions are those set out in section 24(7) of the Act: advising us and our staff on data processing requirements; ensuring on our behalf that the Act is complied with; facilitating capacity building of staff involved in data processing operations; providing advice on data protection impact assessments; and cooperating with the Data Commissioner and any other authority on matters relating to data protection.

24. HOW TO COMPLAIN

If you are unhappy with how we have handled your personal data, please contact our DPO first, using the details in section 26. We will investigate and respond within 30 days.

If you remain dissatisfied, you have the right under the Act to complain to the Office of the Data Protection Commissioner, which has the power under section 8(1)(f) of the Act to receive and investigate complaints about infringements of the rights under the Act. Complaints may be lodged through the ODPC's official channels published at https://www.odpc.go.ke, and the current complaint form and contact details are available there.

You also have the right under section 65 of the Act to seek compensation from us for damage caused by a contravention of a requirement of the Act. Under section 65(4), “damage” includes financial loss, damage not involving financial loss, and distress.

25. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in the law, guidance issued by the ODPC, or changes in our processing. The current version is always published on the Website with its effective date and version number, and previous versions are retained.

Where a change materially affects your rights or the purposes of processing, we will bring it to your attention by email or by a prominent notice on the Website before it takes effect, and where the change relies on consent we will obtain fresh consent rather than treating your continued use of the Services as agreement.

26. CONTACT US

Data Protection Officer, FAVIAN ANN TATULI 100 FITNESS STUDIOS LTD, trading as F.A.T 100 Health & Fitness Studios.

Registered office: Shankardass House, Nkrumah Lane / Harambee Avenue, Athi River District, Machakos County, Kenya. Studio address: to be announced. Postal address: P.O. Box 126, 00100 GPO Nairobi, Kenya.

Telephone: +254 716 859 099.

Email: privacy@fat100.club | General enquiries: info@fat100.club

Governing law: This Policy is governed by the laws of Kenya. Statutory references are to the Data Protection Act, No. 24 of 2019 (Laws of Kenya) and, where applicable, the Data Protection (General) Regulations, 2021.

Annex A. BIOMETRIC ACCESS CONSENT FORM

To be completed separately from the membership application

Member name: ______________________________________ Member number: ______________

I understand that:

• FAT 100 can verify my entry to the Studio using a fingerprint or a facial scan, and that the data generated is a mathematical template, not a photograph of my finger or face.
• Fingerprint and facial data are treated as sensitive personal data under section 2 of the Data Protection Act, No. 24 of 2019, and as biometric data.
• FAT 100 is not a health care provider and does not use this data for any medical, health, profiling or marketing purpose. It is used only to verify my entitlement to enter, to prevent unauthorised entry, and to keep an attendance record.
• My template may be held on the door terminal, on a spare terminal kept as a replacement unit, and on a site appliance that continues to operate during an internet outage, and that if I withdraw consent it will be deleted from all of those locations.
• I do not have to consent. FAT 100 provides a QR code or card with a personal identification number as an alternative, at no additional charge and with no reduction in service, and my membership is not conditional on this consent.
• I may withdraw this consent at any time, free of charge, at reception or by writing to the Data Protection Officer, and withdrawal will not affect processing carried out before withdrawal.

Please indicate your choice by initialling ONE box only:

[ ] I CONSENT to biometric access control by fingerprint and/or facial recognition.

[ ] I DO NOT CONSENT to biometric access control. Please issue me a QR code or card credential with a personal identification number.

If consenting, please indicate which method you prefer: [ ] Fingerprint [ ] Face

Signature: ______________________________ Date: ____________________

Witnessed by (FAT 100 staff): ______________________ Version of Privacy Policy in force: 1.1

Annex B. FITNESS-READINESS DECLARATION

Yes/no statements only. Do not write details of any condition, diagnosis or medication on this form.

This is not a medical questionnaire and it does not ask about any condition, diagnosis, medication or symptom history. It asks only whether you should speak to a doctor before you begin training. Please answer every statement yes or no.

If you answered NO to every statement: you may begin training. FAT 100 has recorded that you are cleared to begin.

If you answered YES to any statement: please consult a doctor before training. Take this form with you. You may not use the Studio until we have recorded that your doctor has cleared you to exercise. FAT 100 will record only that clearance was requested and whether it was produced. We will not keep your individual answers once this outcome has been recorded, and we will not interpret or assess them.

I confirm that I am 18 years of age or over, that the information above is accurate to the best of my knowledge, and that I will complete a new declaration if my circumstances change.

Signature: ______________________________ Date: ____________________

Outcome recorded by (FAT 100): [ ] Cleared [ ] Doctor referral required [ ] Doctor clearance received on ____________