Privacy Policy

Contact Details

• Business Owner: Candice Luwes trading as Bendy Bodies
• Website: www.bendybodies.co.uk
• Email: info@bendybodies.co.uk
• Telephone: +44 778 691 6950

1. What Information We Collect, Use and Why

Enquiries and Initial Consultations

When you contact Bendy Bodies, complete an enquiry form or arrange an initial consultation, we may collect:

• Your name and contact details, such as email address and telephone number.
• The service you are interested in, your preferred area, availability and other practical information you choose to provide.
• For children's or family yoga enquiries, the age or age group of the child or children and information about the type of session you are looking for.
• For school, nursery or organisational enquiries, the setting name, your role or relationship to the setting, location, approximate group size, age or year groups and the type of sessions being considered.
• Your enquiry form responses, correspondence and notes from conversations needed to understand and respond to your request.
• Limited health, accessibility or safety information if you choose to provide it and it is relevant to the service. Our initial website enquiry forms ask you not to include detailed medical or other sensitive information at the enquiry stage.

We use this information to respond to you, arrange an initial conversation, understand what you are looking for, assess practical suitability and, if you choose to proceed, take steps to arrange the requested service.

Providing Yoga Classes and Services

If you book or attend a Bendy Bodies service, we may collect or use:

• Names and contact details.
• Address or location details where a session is arranged at your home or another private location.
• Date of birth, age or age group where this is relevant to the service.
• Booking, class-pass, attendance, purchase and account history.
• Payment and transaction information. Card payments are processed securely by Stripe and Bendy Bodies does not store full payment-card details.
• Health, injury, accessibility and safety information that is relevant to safe participation or reasonable adjustments.
• Client waiver, informed-consent and other health-and-safety records.
• Photographs or video recordings where separate appropriate consent has been provided.
• Information relating to incidents, accidents, safeguarding matters, compliments, complaints or claims.

Customer Accounts and Booking Administration

• Names and contact details.
• Booking and attendance records.
• Payment and transaction information.
• Class-pass or credit information.
• Registration and account information.
• Service communication history and relevant preferences.

We use this information to operate bookings, administer payments and credits, maintain accurate attendance records, communicate essential service information and provide the services you have requested.

Marketing and Service Updates

Where you have chosen to receive marketing, we may collect or use:

• Your name and contact details.
• Marketing preferences and areas of interest.
• Records of marketing consent, including the source and date of consent.
• Subscription, unsubscribe and suppression status.
• Email delivery and bounce information.
• Aggregate email campaign statistics, including overall opens and link clicks where anonymous tracking is enabled.
• Campaign-source information contained in UTM parameters.

Essential communications about an enquiry, booking, payment, cancellation, class change, safety matter or service you requested are service communications and may still be sent even if you do not consent to marketing.

Website, Analytics and Security

• Technical website information such as IP address, browser, device, operating system, pages requested and security or server-log information.
• Website analytics information, such as pages visited, approximate location, browser and device information, referring source and general website interactions.
• Cookie and consent choices.
• Information used to protect website forms from spam, bots, misuse or fraudulent submissions.

Legal, Safeguarding, Complaints and Claims

• Names and contact details.
• Financial and transaction records.
• Health-and-safety, incident and accident information.
• Safeguarding information where necessary.
• Correspondence, witness information and other records relevant to a query, complaint, dispute, insurance matter or legal claim.

2. Lawful Bases for Using Personal Information

Bendy Bodies will only use personal information where there is a lawful basis for doing so. The basis depends on the purpose and the information involved.

Contract and Steps Before a Contract

We may process personal information where it is necessary to take steps at your request before entering into a contract, or to enter into and perform a contract with you. This includes responding to an enquiry, arranging a service, managing bookings, taking payment and delivering the service.

Legitimate Interests

We may process limited personal information where it is necessary for our legitimate interests and those interests are not overridden by your rights and freedoms. Our legitimate interests include:

• Responding to enquiries and providing customer service.
• Managing bookings, attendance, credits, class administration and essential service communications.
• Maintaining safe, consistent and professionally run services.
• Protecting the website and forms from misuse and maintaining appropriate business records.
• Handling queries, complaints, incidents, insurance matters and potential claims.
• Understanding and improving our services using proportionate, privacy-conscious information.

Where we rely on legitimate interests, we consider the nature of the information, what you would reasonably expect, the benefit of the processing and any potential impact on you. We collect only what is necessary and use proportionate safeguards.

Consent

We rely on consent where appropriate, including for optional marketing, non-essential analytics cookies, photographs or video used for promotional purposes and, in many circumstances, health information that you provide for safe participation. You can withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Legal Obligation

We may process information where necessary to comply with a legal obligation, including accounting and tax requirements, responding to lawful requests and meeting applicable safety or safeguarding obligations.

Special Category Information

Health information is special category data and receives additional protection. In addition to an Article 6 lawful basis, Bendy Bodies must have an Article 9 condition before processing it.

• For health information provided so that we can adapt or support safe participation, we normally rely on your explicit consent under Article 9(2)(a) UK GDPR. If you withdraw consent to our use of health information that is reasonably necessary for safe participation, we may be unable to continue providing the relevant service safely.
• In a genuine emergency, relevant health information may be processed where necessary to protect vital interests under Article 6(1)(d) and Article 9(2)(c) UK GDPR, where the requirements of those provisions are met, including where the individual is physically or legally incapable of giving consent where required.
• Where health or other special category information is necessary for the establishment, exercise or defence of legal claims, we may rely on Article 9(2)(f).
• Where safeguarding information must be processed without consent to protect a child or an individual at risk, Bendy Bodies may rely on Article 9(2)(g) UK GDPR together with the safeguarding condition in Schedule 1, Part 2 of the Data Protection Act 2018, where the legal requirements for that condition are met. Where an appropriate policy document is required for that processing, Bendy Bodies will maintain one in accordance with the Data Protection Act 2018.

3. Your Data Protection Rights

Depending on the lawful basis and the circumstances, you may have the following rights:

• Access - to ask for a copy of your personal information and certain information about how it is used.
• Rectification - to ask us to correct inaccurate personal information or complete information that is incomplete.
• Erasure - to ask us to delete personal information in circumstances where the law gives you that right.
• Restriction - to ask us to limit how we use your personal information in certain circumstances.
• Object - to object to certain processing, including processing based on legitimate interests.
• Data portability - to ask us to provide or transfer information you gave us in a structured, commonly used and machine-readable format where the right applies.
• Withdraw consent - where we rely on consent, to withdraw it at any time.
• Object to direct marketing - to object at any time to the use of your personal information for direct marketing. If you unsubscribe or object, we will stop using your information for direct marketing.

Your Right to Object

Where we rely on legitimate interests, you have the right to object to that processing based on your particular situation. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for the establishment, exercise or defence of legal claims. You have an absolute right to object to the use of your personal information for direct marketing at any time, and we will stop using it for that purpose.

To exercise a right, contact us using the details at the beginning of this notice. We may need to confirm your identity or clarify the scope of a request where it is reasonable and permitted by law. We will respond within the applicable legal timescale, usually within one month.

4. Data Protection Complaints

You can complain to Bendy Bodies if you are concerned about how we have collected, used, stored, shared or otherwise handled your personal information. You can make a complaint by email, telephone or using another reasonable contact method. If emailing, you may use the subject line "Data protection complaint".

• We will acknowledge a data protection complaint within 30 days of receiving it.
• We will take appropriate steps to investigate it without undue delay.
• We will keep you informed of progress where appropriate.
• We will tell you the outcome of our investigation without undue delay.

If you remain unhappy after raising the matter with us, you also have the right to complain to the Information Commissioner's Office (ICO). ICO contact details are provided at the end of this notice.

5. Where We Get Personal Information From

• Directly from you, including through the website, enquiry forms, consultations, bookings and correspondence.
• A parent, legal guardian or responsible adult where the information relates to a child.
• Schools, nurseries or other organisations where they arrange a service and provide information that is reasonably necessary for participation, safety or safeguarding.
• Booking, payment, email, website, analytics and other service providers acting in connection with the services described in this notice.
• Insurance companies, professional advisers, emergency services or other relevant organisations where necessary in connection with an incident, claim, safeguarding matter or legal obligation.

6. If You Do Not Provide Personal Information

Some personal information is needed so that we can respond to an enquiry, manage a booking, take payment, communicate essential service information and support safe participation. If you do not provide information that is reasonably necessary, we may be unable to accept or manage a booking or provide the service safely.

Providing information for marketing is optional. Choosing not to receive marketing will not affect your ability to enquire, book or attend Bendy Bodies services.

7. Children's Personal Information

Bendy Bodies provides and plans services for children, including private children's yoga, family yoga, school or nursery sessions and public group classes. We take particular care when handling children's information.

• The public Bendy Bodies website may be viewed by adults or children. However, online enquiry and booking forms relating to children's services are intended to be completed by a parent, legal guardian, responsible adult, or an authorised school or nursery representative rather than by a child acting alone.
• For private, family or public children's yoga, a parent or legal guardian will normally provide the child's information and any required participation or health consent.
• For school or nursery services, relevant information may be supplied by the setting where appropriate. The school or nursery remains responsible for its own data-protection obligations and should only share information that is necessary and lawful to share.
• We collect only information that is reasonably needed for the particular service, such as age or age group, session interests, practical arrangements and, where necessary, relevant health, accessibility, safety or safeguarding information.
• We do not use children's personal information to send direct marketing to children.

Data protection rights belong to the child. Depending on the child's age and understanding, the child may be able to exercise those rights themselves, or a parent, guardian or other authorised person may exercise them on the child's behalf where appropriate and in the child's best interests.

8. How Long We Keep Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, accounting, insurance, safeguarding and dispute-resolution requirements.

• General enquiries and initial consultation records where no booking follows: normally up to 12 months, unless further action is required.
• Adult participant records, including relevant waivers, attendance and health information: up to 10 years from the date of last attendance where reasonably necessary for insurance, safety or potential legal claims.
• Children's participant records: normally until the child reaches age 21 where the records are reasonably required for insurance, safeguarding or potential legal claims.
• Financial and transaction records: normally at least 6 years, or for the period required by applicable tax and accounting rules.
• Incident and accident reports: retained for the period reasonably required for insurance and potential legal claims, taking account of whether the participant is an adult or child.
• Safeguarding records: retained for as long as reasonably necessary in light of the nature of the concern and any applicable safeguarding, insurance or legal requirements.
• Marketing contact details and preferences: while the relevant marketing permission remains valid, or until you unsubscribe, object or the information is no longer required.
• Consent, withdrawal, unsubscribe and suppression records: retained where reasonably necessary to demonstrate compliance and prevent further marketing to someone who has opted out.
• Photographs and video used with consent: retained while they remain relevant to the agreed purpose and reviewed periodically. If consent is withdrawn, we will stop future use where reasonably possible; material already printed, distributed or published may not always be capable of being fully retrieved.

At the end of the applicable retention period, information is securely deleted, anonymised or otherwise disposed of appropriately.

9. Who We Share Information With

We use reputable service providers to run the business and website. They may process personal information only to the extent needed for the relevant service and subject to their contractual and legal obligations.

Other Recipients

• Insurance companies.
• Schools, nurseries, venues or partner organisations where reasonably necessary to arrange or safely provide the relevant service.
• Organisations or individuals with whom information must be shared for safeguarding reasons.
• Professional, legal or accounting advisers and consultants.
• Emergency services, regulators, courts, law-enforcement bodies or other organisations where disclosure is required or permitted by law.

10. Sharing Information Outside the UK

Some service providers operate internationally. Where personal information is transferred outside the UK, we use an appropriate transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, the UK Extension to the EU-US Data Privacy Framework where applicable, or another lawful safeguard.

You can contact Bendy Bodies if you would like more information about the safeguards relevant to a particular provider or transfer.

11. Data Security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or misuse. These measures include access controls, reputable cloud-based systems, secure payment processing, account protections and limiting access to information to what is reasonably necessary.

12. Cookies, Analytics and Email Campaign Links

Essential Technologies

Some cookies or similar technologies are necessary for website or requested services to function, for example website security, booking sessions, payment processing and fraud prevention. Where the law permits an exception for a necessary technology, consent is not required for that specific use.

Google Analytics

Google Analytics is used only after analytics consent has been provided through the website cookie-consent mechanism. If analytics consent is declined, Google Analytics will not be activated through that mechanism. You can change or withdraw cookie choices using the website cookie settings and can also manage cookies through your browser.

Vercel Web Analytics and Speed Insights

Vercel Web Analytics provides cookie-free, anonymous and aggregated website statistics. Vercel Speed Insights collects anonymous website-performance data. These tools are used to understand general traffic and technical performance rather than to identify individual visitors.

Email Campaign Links and Reporting

Marketing-email links may contain UTM parameters that identify a campaign, source or channel but do not contain the recipient's name or email address. If you follow a campaign link and have consented to website analytics, Google Analytics may record that the visit came from a Bendy Bodies email campaign.

Where anonymous campaign tracking is enabled in Brevo, tracking pixels or tracked links may be used to produce aggregate information about delivery, overall opens and link clicks. Bendy Bodies does not use these anonymous statistics to make decisions about named individuals.

Bendy Bodies does not currently use advertising cookies, Facebook Pixel, remarketing tools or behavioural advertising.

When you follow a link to, or use, a third-party booking or payment service such as Bookwhen or Stripe, that provider may use its own cookies or similar technologies under its own privacy notice or cookie information.

13. Automated Decision-Making and Profiling

Bendy Bodies does not currently use personal information to make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on individuals.

14. How to Complain to the ICO

If you remain unhappy after giving Bendy Bodies an opportunity to consider your data protection complaint, you can complain to the Information Commissioner's Office (ICO).

For the most current ICO contact details, please use the ICO website.

15. Changes to This Privacy Notice

We may update this privacy notice from time to time. The 'Last updated' date will be changed when we do. If a change materially affects how we use personal information already collected, we will bring the change to your attention where appropriate before the new use begins.