The Lead Generation option in the app is very GDPR-friendly already:
It asks your members to recommend their friend with a personal message from member to friend
Only if the friend responds are they asked to provide their details to you, the gym
This is in contrast to most refer-a-friend programs where the member is asked to give their friend's details to the gym -- violating the friend's privacy and the GDPR.
So we've made only a small change to the Lead Generation in the app to make it fully GDPR compliant. We've:
added a specific opt-in to the friend journey in the contact form and
made the link to your Privacy Notice*
*Note that you should ensure that your Privacy Notice explains to prospects why you're collecting this data and how you'll process it.
The opt-in has to be clicked before the friends details are communicated to you and processed in the cockpit.
The Privacy Notice link shows the Privacy Notice that you have set in the app -- details on how to so this here.