1. Important information about this privacy notice and who the controller is

This privacy notice contains important information on who we are and how and why we collect, store, use and share information relating to an identified or identifiable individual (“Personal Data”). It also explains your rights in relation to your Personal Data and how to contact us or supervisory authorities if you have a complaint.

This privacy notice should be read together with our Cookie Notice, our Club Etiquette and our Terms and Conditions of use for our Clubs and our Website Terms and Conditions.

Third Space Holdings Limited (company number 05538574) (Third Space) is the controller for your Personal Data. When we use the term “we”, “us” or “our” we are referring to Third Space. We collect, use and are responsible for certain Personal Data about you.

Third Space Medical is not part of the Third Space. Third Space Medical services are provided by Black Swan Osteopathic Clinics Limited (t/a Ultrasports) (company number 7842684) and London Integrated Medicine Ltd (company number 10832430), who have separate privacy policies.

2. When does this privacy notice apply?

This privacy notice applies to our use of your Personal Data in the following situations:

• when you use our website thirdspace.london (the “Website”);
• when you contact us through our Website, telephone call, email, the Third Space App or our social media accounts;
• when you enquire about Third Space membership and/or visit any club operated by Third Space (a “Club”);
• when you are person over the age of 18 who is a paying member of the Club (including a corporate member) (and “Member”) and after your membership of Third Space ends;
• when you use any of our membership add ons or membership benefits;
• when you make a booking at or attend our spa;
• when you enquire about, sign-up to and/or take part in any Third Space events or retreats;
• when you provide feedback to us via surveys and/or market research;
• the use of your posts and messages on social media when these are directed at Third Space;
• the use of supplier data for business operations when you are the named contact for a supplier; and
• the use of Personal Data for our commercial and legal purposes when you interact with us in any way.

This privacy notice does not override other notices on our Website or those provided to you during our interactions

3. Personal Data we collect about you and how and why we use your Personal Data

The Personal Data we collect and use about you depends on the services we provide to you when we interact with you. Under UK data protection law, we can only use your Personal Data if we have a proper reason to do so, including where you have given consent, to comply with our legal and regulatory obligations, for the performance of a contract with you or to take steps at your request before entering into a contract, or for our legitimate interests or those of a third party. A legitimate interest is when we or a third party have a business or commercial reason to use your Personal Data, provided you rights and interests do not override this. We will carry out an assessment when relying on legitimate interests.

The table below explains what we use your Personal Data for and why and our reason for using your Personal Data under data protection (and other laws where appropriate).

---

---

We also use, collect and share aggregated data. This data may be derived from your Personal Data but is not considered Personal Data, as it does not reveal your identity directly or indirectly. However, if we combine or connect aggregated data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this privacy notice.

4. What happens if you fail to provide us with Personal Data

Where we need to collect Personal Data by law, or under the terms of a contract we have with you and you fail to provide the Personal Data when requested, we may not be able to perform the contract we have or are trying to enter into with you, for example, to provide you with our products or services. In this case, we may have to cancel a service you have with us but we will notify you if this is the case at the time.

5. How your Personal Data is collected
We have partnered with various technologies:  MyZone, InBody, ForceDecks, DynaMo, VentriJect, VO2 Master Manager, MX3 Diagnostics,

We collect Personal Data from you:

• directly, when you enter or send us information, for example, when you contact us via any channels, send us feedback, purchase products or membership add-ons via our Website, post material to our Website or social media channels and complete feedback surveys; and
• indirectly, such as your browsing activity, technical and profile data based on your equipment, site interactions and usage patterns while on our Website; we will usually collect this information indirectly using the technologies explained in our Cookie Notice.

We also collect Personal Data directly from you when you:

• request information about becoming a Member or arrange a Club visit;
• request information about a Third Space event;
• sign in to a Club as a non-member;
• use the Third Space app;
• contact us via our social media channels;
• subscribe to our marketing; or
• make a direct enquiry through our Website.

We may also collect information from the following sources:

• from publicly accessible sources;
• directly from a third party;
• credit reference agencies;
• from cookies on our Website as set out in please see our Cookie Notice through monitoring the use of CCTV cameras; and
• financial and transaction data from our payment providers.

6. How we collect and use Special Category Data

During the course of providing services to you, we may collect  Personal Data revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership, genetic data, biometric data (where used for identification purposes), data concerning health, sex life or sexual orientation (“Special Category Data”), for example, we collect information about your health or medical conditions which are required when you complete a health questionnaire prior to a spa treatment, when you attend any of our Clubs or events we run. When you provide your Special Category Data it will only be used for the purposes you have provided this to us at the time the Special Category Data is collected.

7. Children’s data

We do not collect children’s Personal Data through the provision of our products and services and do not offer services to children. If you held a Little Space membership which was associated to an adult Third Space membership the Personal Data will be held in accordance with the periods set out in our retention policies and will be deleted when it is no longer necessary for the purposes of processing.

8. CCTV

For the safety and security of all individuals who attend our clubs, and for the prevention  of crime, we operate CCTV in public areas of our Clubs. CCTV is not installed in any of our changing areas. We hold CCTV recordings on a secure server for approximately 14 days after which time these are automatically deleted, unless these are held for longer for legal and/or regulatory purposes.

For the safety and security and to protect the vital interests of those who use the swimming pool, sauna, steam room, cold plunge, hydrotherapy pool any similar facilities included in adjacent area, including pool loungers in our Clubs, we operate underwater imaging cameras in our swimming pools. Our underwater imaging cameras operate by sounding an alarm if lack of movement is detected. We hold these images on a secure server for approximately 14 days after which time these are automatically deleted, unless these are held for longer for legal and/or regulatory purposes.

9. Marketing and profiling

We will use your Personal Data to send you updates by email or telephone about our products, including exclusive offers, promotions or new services. If we rely on consent to use your Personal Data for marketing purposes, we will ask for this separately and clearly. You have the right to opt out of receiving marketing communications at any time by using the “unsubscribe” link in emails or by contacting us by email to data@thirdspace.london. Where you opt out of receiving marketing messages, opting out will not apply to other communications which we are required to send by law or in connection with the provision of our services. We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

We collect information on how you use our Website, which pages of our Website you visit most, which classes you book and/or attend and what services you purchase, to understand your preference. We use this information to tailor the content and offers you see on our Website and to send you relevant information that we think you might like based on your preferences. You have the right to object at any time to your Personal Data being used for direct marketing (including profiling). For details of how to exercise this right, see section “Your rights” below.

We may contact you up to 24 months after your membership end date using Personal Data we hold about you, if we have a re-joining offer exclusive to previous members. We will not contact you for this purpose if you have asked us not to contact you or if you have clicked on any “unsubscribe” link in our emails.

10. Who we share your Personal Data with

Your Personal Data may be shared with other companies within the Third Space group. It may also be disclosed to a third party who acquires us, acquires a member of the Third Space group or substantially all of our assets.

We may also share some of your Personal Data with, or obtain your Personal Data from, the following categories of third parties:

• your employer or health club benefits provider, if your membership is via a corporate scheme and Third Space invoice them for your membership subscription;
• an individual who pays for your membership on your behalf, to administer your membership on an ongoing basis;
• digital mailing company/app, to send out communication to you on our behalf;
• Specialist survey company/app, to send out surveys to you on our behalf, which you are not obliged to respond;
• independent service providers, for example, spa therapist, Third Space Medical or our events and retreats partners, so they can provide services to you upon request;
• bank/credit or debit card companies, in order to process your payments for services;
• credit control company, with prior notification, should contracted membership subscriptions or payment for goods or services become overdue (as per our T&C’s);
• web servers/website providers, hosting/storing some Personal Data;
• IT support companies may be able to access some information to assist with IT issues;
• social media sites, with hashed email matched to account to create custom audience file; and
• till and booking apps.

In addition to the categories of recipient listed above, we may disclose your Personal Data when this is required by the law of any jurisdiction to which Third Space may be subject.

We only allow those organisations to handle your Personal Data if we are satisfied that they take appropriate measures to protect your Personal Data. Where appropriate, we also impose contractual obligations on them to ensure they can only use your Personal Data to provide products and services to us and to you.

We or the third parties mentioned above occasionally also share Personal Data with:

• our and their external auditors, for example, in relation to the audit of our or their accounts, in which case the recipient of the information will be bound by confidentiality obligations;
• our and their professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations;
• law enforcement agencies, courts, tribunals and regulatory bodies to comply with our legal and regulatory obligations; and
• other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. Where possible, information will be anonymised but this may not always be possible. The recipient of any of your Personal Data will be bound by confidentiality obligations

We have partnered with various technologies: MyZone, InBody, ForceDecks, DynaMo, VentriJect, VO2 Master Manager, MX3 Diagnostics, Technogym, Wattbike Hub and MyWellness to offer members the opportunity to enhance their training experience. Use of these services is optional and you are in control of your Personal Data via use of the  relevant app (see the service provider’s privacy notice for more information). Third Space can only view the data you give us permission to and communicate with you via the app if permission is given.

11. Where your Personal Data is held

Personal Data may be held at our offices and those of our group companies, third party agencies, service providers, representatives and agents as described above, see section “Who we share your Personal Data with” above. Some of these third parties may be based outside the UK/EEA. For more information, including on how we safeguard your Personal Data when this happens, see section “Transferring your Personal Data out of the UK and EEA” below.

12. How long your Personal Data will be kept

We will not keep your Personal Data for longer than we need it for the purpose for which it was collected. If you do not have a Third Space membership, we will usually delete or anonymise your account data after two years. Following the end of the of the relevant retention period, we will delete or anonymise your Personal Data.

13. Transferring your Personal Data out of the UK and EEA

We may transfer your Personal Data to countries outside the UK and EEA. In those cases we will comply with applicable UK and EEA laws designed to ensure the privacy of your Personal Data. We may also transfer your Personal Data from the EEA to the UK.

We may transfer your Personal Data to:

• our service providers located outside the UK; and
• our investors in the United States of America.

Under data protection laws, we can only transfer your Personal Data to a country outside the UK/EEA where:

• the UK government has decided the particular country ensures an adequate level of protection of Personal Data (an “adequacy regulation”) further to Article 45 of the UK General Data Protection Regulation (“UK GDPR”);
• there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; or
• a specific exception applies under relevant data protection law.

If we transfer your Personal Data outside the UK, we will only do so on the basis of an adequacy regulation or where this is not available, legally-approved standard data protection clauses recognised or issued further to Article 46(2) of the UK GDPR. In the event we cannot or choose not to continue to rely on either of those mechanisms at any time, we will not transfer your Personal Data outside the UK unless we can do so on the basis of an alternative mechanism or exception provided by UK data protection law and reflected in an update to this notice.

Any changes to the destinations to which we send Personal Data or in the transfer mechanisms we rely on to transfer Personal Data internationally will be notified to you in accordance with the section on “Changes to this privacy notice” below.

14. Your rights

You have the following rights in relation to your Personal Data which we hold:

• Access: to be provided with a copy of your Personal Data;
• Rectification: you to require us to correct any mistakes in your Personal Data;
• Erasure (the right to be forgotten): in certain situations, to require us to delete your Personal Data;
• Restriction of processing: in certain situations, to require us to restrict processing of your Personal Data, such as if you contest the accuracy of the data;
• Data portability: In certain situations, to receive the Personal Data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party;
• To object: to object at any time to your Personal Data being processed for direct marketing (including profiling). Personal Data and to object to our continued processing of your Personal Data in certain situations, including when we process your data based on our legitimate interests. However, we may continue processing if we have compelling legitimate grounds to do so or if the processing is necessary for the establishment, exercise, or defence of legal claims
• Not to be subject to automated individual decision making: not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.
• The right to withdraw consent: If you have provided us with a consent to use your Personal Data you can withdraw that consent at any time by clicking on any unsubscribe links in communications we send to you or contacting us at data@thirdspace.london to request that your details are removed from our mailing lists. Withdrawing consent will not affect the lawfulness of our use of your Personal Data in reliance on that consent before it was withdrawn.

Where you are based in the UK, you also have the right to complain to us where you believe that we have not complied with data protection law when processing your personal data.

For more information on each of those rights, including the circumstances in which they apply, please contact us using the details in the section “How to contact us” below. To exercise any of your rights, please contact  data@thirdspace.london and provide enough information to identify yourself (such as your full name, address and membership number). We will need you to tell us what  personal information  your request relates to and what rights you want to exercise. We may request additional identity information from you that we consider reasonable in order to verify your identity.

15. Keeping your Personal Data secure

We have appropriate security measures to prevent Personal Data from being lost accidentally, used or accessed unlawfully. We limit access to your Personal Data to those who have a genuine business need to access it. Those processing your Personal Data will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

16. Use of cookies on our Website

A cookie is a small text file which is placed onto your device, for example, your computer, smartphone or other electronic device when you use our Website. We use cookies on our Website. These help us recognise you and your device and store some information about your preferences or past actions. For details of how we use cookies on our Website and how you can control these, please see our Cookie Notice.

17. Third-party links website, the Third Space app and emails

Our Website, the Third Space app and certain emails that we send to you contains links to third-party websites, plugins and applications. Clicking on those links and enabling those connections may allow third parties to collect or share Personal Data about you. We do not control these third-party websites and we are not responsible for their privacy policies or the use of your Personal Data. When you leave our Website, we encourage you to read the privacy notice of every website you visit.

18. How to Complain

Please contact us if you have any queries or concerns about our use of your Personal Data using the contact details in the section “How to contact us” below, so we can try to resolve any issues you may have. You can also make a complaint to the UK Information Commissioner’s Office – this can be done here.

19. Changes to this Privacy Notice

We may change this privacy notice from time to time, when we do make changes, we will inform you by posting an updated copy of this privacy notice on our website.

20. Updating your Personal Data

We take reasonable steps to ensure your Personal Data remains accurate and up to date. If any of the Personal Data you have provided to us has changed, please contact us using the contact details in the section “How to contact us” below.  Members can also update their Personal Data yourself via the Third Space member app.

21. How to contact us

You can contact us and/or our Data Protection Officer by email via data@thirdspace.london if you have any questions about this privacy notice or the information we hold about you, to exercise a right under data protection law or to make a complaint.

Responsible Disclosure

We take the security of our systems and those using our Clubs data seriously. If you believe you have discovered a security vulnerability in our website, applications or systems, we encourage you to report it responsibly.

Please report vulnerabilities by emailing security@thirdspace.london with sufficient detail uploaded to our security portal https://www.sendsafely.com/u/security@thirdspace.london.

We ask that you do not exploit the vulnerability beyond what is necessary to demonstrate it, do not access data belonging to others, and do not publicly disclose the issue before we have had a reasonable opportunity to investigate and address it.

We do not operate a bug bounty or offer financial rewards, but we appreciate responsible disclosure made in good faith.

This notice was last updated on 17 May 2026.

Version 1.0