• Order history

When you book or enquire about a class:

• Name, email address, and phone number

• Any access or health requirements you choose to share with us

• Your responses to any booking questions

When you sign up to our mailing list:

• Name and email address

When you contact us:

• Name, email address, and the content of your message

Automatically collected data:

• IP address and browser type

• Pages visited and time spent on the site

• Referring website

• Cookie data (see Section 9)

We do not knowingly collect data from children under the age of 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

4. Why We Use Your Data and Our Legal Basis

Under UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out what we use your data for and the legal basis we rely on.

Purpose

Legal Basis

Processing your order and arranging delivery

Contract — necessary to fulfil your purchase

Sending order confirmation and updates

Contract

Processing class bookings and sending joining information

Contract

Responding to your enquiries

Legitimate interests — to communicate with prospective customers

Sending marketing emails (if you have opted in)

Consent

Improving our website and understanding how visitors use it

Legitimate interests

Complying with legal and financial obligations (e.g. VAT records)

Legal obligation

Accommodating accessibility or health requirements for classes

Consent — you choose to share this with us

 

Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of any processing already carried out.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and we believe they are not.

5. Marketing

We will only send you marketing emails if you have explicitly opted in to receive them. You can unsubscribe at any time by clicking the unsubscribe link in any email we send, or by contacting us directly.

We do not share your details with third parties for their own marketing purposes.

6. Who We Share Your Data With

We do not sell your personal data. We may share it with trusted third parties who help us run our business, but only to the extent necessary and under appropriate data protection agreements. These may include:

• Payment processors (e.g. Stripe, PayPal) — to handle transactions securely

• Delivery and courier services — to dispatch your order

• Email marketing platforms (e.g. Mailchimp) — to send newsletters if you have opted in

• Website hosting and analytics providers — to operate and improve the site

• Accountants or legal advisers — where required for our legal or financial obligations

All third-party processors are required to handle your data securely and only for the purposes we specify.

If we are required to disclose your data by law — for example, to HMRC or law enforcement — we will do so.

7. International Transfers

Some of our third-party service providers (such as email or analytics platforms) may process data outside the UK. Where this is the case, we ensure that appropriate safeguards are in place, such as the UK’s International Data Transfer Agreement (IDTA) or adequacy decisions, in line with UK GDPR requirements.

8. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by law.

Data Type

Retention Period

Order records

7 years (to comply with HMRC requirements)

Class booking records

2 years after the class date

Marketing preferences and email list

Until you unsubscribe or withdraw consent

Enquiry and contact messages

2 years

Website analytics data

26 months (standard analytics retention)

 

After the relevant retention period, your data is securely deleted or anonymised.

9. Cookies

Our website uses cookies — small text files stored on your device — to help the site function and to understand how it is used.

Essential cookies are necessary for the website to work (e.g. keeping items in your shopping basket) and cannot be turned off.

Analytics cookies help us understand how visitors use the site. These are only set with your consent.

Marketing cookies, if used, help us show relevant content. These are also only set with your consent.

You can manage or withdraw your cookie preferences at any time using the cookie settings banner on our website, or through your browser settings. Please note that disabling certain cookies may affect the functionality of the site.

For more information on managing cookies, visit www.aboutcookies.org.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.

• Right to rectification — you can ask us to correct inaccurate or incomplete data.

• Right to erasure — you can ask us to delete your data in certain circumstances (sometimes called the “right to be forgotten”).

• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.

• Right to data portability — you can ask us to provide your data in a structured, machine-readable format.

• Right to object — you can object to processing based on legitimate interests or for direct marketing.

• Rights relating to automated decision-making — we do not make automated decisions about you that have legal or significant effects.

To exercise any of these rights, please contact us at [email address]. We will respond within one month. We may need to verify your identity before processing your request.

There is no charge for making a request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

11. How We Keep Your Data Secure

We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. These include secure (HTTPS) connections, restricted access to personal data within our business, and using reputable, security-accredited third-party providers.

No method of transmission over the internet is entirely secure. If you have reason to believe your data has been compromised, please contact us immediately.

12. Complaints

If you are unhappy with how we have handled your personal data, please contact us in the first instance and we will do our best to resolve the matter.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator:

• Website: ico.org.uk

• Helpline: 0303 123 1113

13. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will post the updated policy on this page with a revised “Last updated” date. We encourage you to review this policy periodically.

14. Further Information

For more detail on UK data protection law, including your rights, visit the ICO’s website at ico.org.uk.