Dubai, United Arab Emirates. Effective date: 27 June 2026.
1.1. This Privacy Policy (the "Policy") of RANGE SPACE GYM L.L.C, a limited liability company incorporated in the Emirate of Dubai, United Arab Emirates, holding Commercial License No. 1242915, with registered office at Unit No. SJ003, BUILDING 15-SJ, Marsa Dubai (Bluewaters Island), Dubai, UAE (the "Operator", "we", "us", "our"), is adopted in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and the regulations issued thereunder.
1.2. The Policy describes how the Operator collects, uses, stores, shares and protects Personal Data of visitors and customers of the website https://range.space and the client area https://app.range.space (together, the "Site"), and how it processes Personal Data of members and visitors of the RANGE gym located on Bluewaters Island, Dubai.
1.3. The Policy applies to all Personal Data that the Operator obtains from or about a Data Subject, whether through the Site, in person at the gym, by phone, email, messaging applications, or through booking, payment, training-tracking and access-control systems used at the gym.
1.4. If you do not agree with the Policy, please do not provide your Personal Data to the Operator and discontinue use of the Site and the gym services.
Personal Data — any data relating to an identified natural person, or one who can be identified directly or indirectly by way of linking data, including (without limitation) name, contact details, photographs, video footage, identification number, electronic identifiers, and biometric data.
Processing — any operation or set of operations performed on Personal Data, whether automated or not, including collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, transmission, restriction, erasure or destruction.
Data Subject — the natural person to whom the Personal Data relates, including, in particular, visitors of the Site, leads, members and trial visitors of the gym, and parents or legal guardians of underage members.
Operator (Controller) — RANGE SPACE GYM L.L.C, License No. 1242915.
Site — the websites range.space and app.range.space.
Services — the products and services provided by the Operator, including boxing, kickboxing, MMA, BJJ, wrestling, fitness and other training sessions, personal training, group classes, kids classes, memberships, day-passes, retail of branded merchandise and ancillary services available at the RANGE gym on Bluewaters Island.
Cookies — small data files placed on a user's device by the Site and used to remember preferences, maintain sessions and collect analytics.
3.1. We process only Personal Data that is necessary for the purposes set out in section 4. Depending on how you interact with us, we may process the following categories:
3.2. We do not knowingly collect special categories of Personal Data beyond what is described above and we do not collect Personal Data of children under the age that the applicable law treats as a child without the parent's or legal guardian's consent.
4.1. The Operator processes Personal Data for the following purposes, on the legal bases provided by Article 4 of the PDPL:
| Purpose | Data categories | Legal basis (PDPL) | Retention |
|---|---|---|---|
| Responding to enquiries submitted through forms on the Site, by phone, email or messengers; booking trial classes and tours of the gym | Identification, contact, communication, technical | Consent of the Data Subject; necessity to take pre-contractual steps at the Data Subject's request | Up to 12 months from the date of the last contact, then deleted or anonymised |
| Selling memberships, day-passes and personal-training packages; concluding and performing the membership contract | Identification, contact, customer / membership, payment | Necessity for the performance of a contract to which the Data Subject is a party | For the duration of the membership and 5 years after its expiry, to comply with UAE accounting, tax and consumer-protection requirements |
| Delivering the training service: access control, attendance tracking, planning training programs, recording coach assessments and progress | Identification, customer / membership, communication, health (only if voluntarily provided) | Performance of a contract; legitimate interests of the Operator in providing a safe and high-quality service; explicit consent for health data | For the duration of the membership and 3 years after, then anonymised for statistical purposes |
| Safety and security of the gym premises, prevention and investigation of incidents (including CCTV) | Images and video, identification (incident reports) | Legitimate interests of the Operator and obligations under UAE safety and security regulations | CCTV footage — up to 30 days, longer if needed for an investigation |
| Marketing and content on the Site and on social media: publishing photos and short videos from training and sparring sessions | Images and video, name (only if used in the caption) | Explicit consent of the Data Subject (which can be withdrawn at any time) | Until consent is withdrawn or no longer relevant for current content |
| Sending service notifications about your bookings, schedule changes, billing and membership status | Identification, contact, customer / membership | Performance of a contract | For the duration of the membership |
| Sending marketing communications (news, promotions, new classes) by email, SMS, WhatsApp or Telegram | Identification, contact | Consent of the Data Subject (opt-in); for existing customers — legitimate interests subject to the right to object at any time | Until consent is withdrawn or the Data Subject opts out |
| Maintaining and improving the Site, analytics, anti-fraud, security of IT systems | Technical, Cookies | Legitimate interests of the Operator | Cookies — see section 8; logs — up to 12 months |
| Compliance with mandatory legal obligations of the Operator (tax, anti-money-laundering, regulatory enquiries, court orders) | Any data category, to the extent required | Compliance with a legal obligation under UAE law | For the statutory period (typically 5 years for accounting records) |
4.2. The Operator does not use Personal Data for automated decision-making that produces legal effects concerning the Data Subject without prior human review.
5.1. We collect Personal Data:
6.1. The Operator does not sell Personal Data. We share Personal Data only with the following categories of recipients, and only to the extent necessary:
6.2. We do not disclose your Personal Data to any other third party for that party's own purposes without your prior consent.
7.1. Some of our processors (in particular cloud hosting, analytics and messaging providers) may be located outside the United Arab Emirates. Cross-border transfer of Personal Data is carried out only in accordance with Articles 22 and 23 of the PDPL, namely:
7.2. On request, we will provide a Data Subject with a general description of the safeguards used for a particular cross-border transfer.
8.1. The Site uses Cookies and similar technologies to ensure the Site functions correctly, remember your preferences (such as language), collect anonymous usage statistics and measure the effectiveness of our content.
8.2. We use the following categories of Cookies:
8.3. You can configure your browser to refuse all or some Cookies, or to alert you when Cookies are being set. If you disable Cookies, some sections of the Site may not work correctly.
9.1. We retain Personal Data only for as long as necessary to fulfil the purpose for which it was collected, unless a longer retention period is required by UAE law (for example, accounting records — 5 years).
9.2. Specific retention periods are listed in the table in section 4. Once the relevant period has expired, Personal Data is deleted or irreversibly anonymised.
10.1. The Operator implements appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, including:
10.2. In the event of a personal-data breach that is likely to result in a risk to the rights of Data Subjects, the Operator will notify the UAE Data Office and, where required, affected Data Subjects, in accordance with Article 9 of the PDPL.
11.1. Subject to the conditions and exceptions set out in the PDPL, you have the right to:
11.2. To exercise any of these rights, please contact us at office@range.space. We will respond within the period required by the PDPL (and, in any case, without undue delay). We may need to verify your identity before acting on the request.
12.1. Training of minors is offered at the gym only with the written consent of the parent or legal guardian. The parent or guardian provides the Personal Data of the child, declares any relevant medical information and consents to the Processing of such data for the purpose of training.
12.2. We do not knowingly collect Personal Data of a child via the Site without parental consent. If you believe a child has provided us with Personal Data without parental consent, please contact us and we will delete it.
13.1. The Operator may update this Policy from time to time. The current version is always available on this page, with the "Effective date" updated. We recommend reviewing the Policy periodically. Continued use of the Site or of the gym services after the new version takes effect constitutes acceptance of the updated Policy.
For any privacy-related enquiry, including the exercise of your rights or the withdrawal of consent, please contact the Operator at office@range.space or in writing at the registered address below.