Privacy & GDPR | Bambusa Pilates

1. Who we are (Data Controller)

Karen Jones t/a Bambusa Pilates, Hatch End, Pinner HA5, United Kingdom

We are the data controller responsible for the personal information collected through this website and through our studio bookings, enquiries, and communications.

2. What personal information we collect

We collect the following categories of personal data:

Information you provide directly

· Name

· Email address

· Phone number

· Booking details (classes, appointments, cancellations)

· Medical or physical‑health information you choose to provide when booking (e.g., injuries or conditions relevant to safe participation)

· Payment information (processed securely by Wix Payments or other payment processors — we do not store card details)

· Messages, enquiries, feedback, reviews

Information collected automatically

· IP address

· Device type, browser type, operating system

· Pages visited, session duration, interaction data

· Cookies and similar technologies (see Cookie Policy)

Information from third‑party services

· Booking platform data (Wix Bookings)

· Payment processors (Wix Payments, Stripe, PayPal — depending on your setup)

· Email marketing platforms (Wix Email Marketing)

We do not collect or store special category data unless you voluntarily provide health‑related information relevant to your participation in Pilates sessions.

3. How we collect your information

We collect personal data when you:

· Book a class or appointment

· Create an account

· Complete a form

· Contact us

· Subscribe to updates

· Interact with our website

· Make a payment

We also collect technical data automatically through cookies, analytics tools, and Wix’s built‑in website technology.

4. Our lawful bases for processing

Under UK GDPR, we rely on the following lawful bases:

Contract

To:

· Manage bookings

· Provide classes and services

· Process payments

· Communicate essential service information

Consent

To:

· Send marketing emails

· Use optional cookies

· Collect health‑related information you choose to provide

You can withdraw consent at any time.

Legitimate Interests

To:

· Improve our website and services

· Prevent fraud

· Maintain studio safety and operational efficiency

We always balance legitimate interests against your rights.

Legal Obligation

To:

· Maintain financial records

· Comply with UK tax and accounting rules

· Respond to lawful requests from authorities

5. Why we use your personal information

We use your information to:

· Provide and manage Pilates classes, sessions, and memberships

· Process payments and bookings

· Communicate updates, confirmations, and service notices

· Send marketing communications (only with consent)

· Improve our website, services, and customer experience

· Maintain safety and comply with legal requirements

6. Sharing your information

We only share your data with trusted service providers who help us operate Bambusa Pilates:

· Wix.com (website hosting, bookings, CRM, email marketing)

· Wix Payments / Stripe / PayPal (payment processing)

· Analytics providers (Wix Analytics, Google / Bing Analytics if enabled)

· Email delivery services (Wix Email Marketing)

· Exe Creative (Our Website Developer)

· Gymcatch (Booking engine providers)

These providers act as data processors and only process data on our behalf.

We do not sell your personal data.

7. International transfers

Wix may store data in the EU, UK, USA, or Israel.

Where data is transferred outside the UK, Wix uses:

· Standard Contractual Clauses (SCCs)

· Adequacy decisions (Israel is recognised as adequate)

· Additional safeguards required under UK GDPR

8. How we store and protect your data

Your data is stored securely within Wix’s protected infrastructure.

Security measures include:

· Encrypted data transmission (HTTPS)

· Secure payment processing (PCI‑DSS compliant)

· Access controls

· Firewall protection

· Regular security monitoring

We retain personal data only for as long as necessary:

· Booking records: 6 years (legal obligation)

· Marketing data: until you unsubscribe

· Account data: until you close your account

· Health information: only as long as needed for safe participation

9. Cookies and tracking technologies

We use essential cookies to make the site work. Optional cookies (analytics, performance, marketing) are only used with your consent.

You can manage cookie preferences at any time through our cookie banner or browser settings.

See our Cookie Policy for full details.

10. Marketing communications

We send marketing emails only if:

· You have given explicit consent, or

· You are an existing customer, and we rely on the “soft opt‑in” allowed under PECR

You can unsubscribe at any time by clicking the link in any marketing email or contacting us directly.

11. Your data protection rights

You have the following rights under UK GDPR:

· Access – request copies of your data

· Rectification – correct inaccurate data

· Erasure – request deletion in certain circumstances

· Restriction – limit how we use your data

· Objection – object to certain processing

· Data portability – request transfer of your data

To exercise any of these rights, contact us at: info@bambusapilates.com

We respond within one month.

12. How to withdraw consent

If you wish to withdraw consent for marketing, cookies, or any other processing, contact us at: info@bambusapilates.com

13. Complaints

If you have concerns about how we use your data, please contact us first.

You also have the right to complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Helpline: 0303 123 1113 Website: www.ico.org.uk

14. Updates to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website.