Privacy and Data Protection Policy
Catford Pilates is committed to protecting your personal information and respecting your privacy.

We only collect and process information needed to provide you with services you request and for the smooth running of our business as outlined in this policy. The data you provide is always treated as confidential.

We will never share your personal information with any other person or organisation without your consent. Your personal data will only ever be shared:

• with other therapists and health professionals with your prior agreement and written consent.
• with substitute teachers so they can provide an appropriate service if your usual teacher is unavailable.

When you complete a Physical Activity Questionnaire or book and pay for classes online you will be submitting your personal data to one of our third party providers (data processors). Read on to find out what this means for you.

Your information
This section outlines what information we collect, why we collect it and how it is stored.

We use a small number of third party providers (data processors) so that we can offer you services such as online booking and payment. This means that you are consenting to some personal data being transferred outside of the European Union.

We have selected third party providers who have agreed to protect your information in the same way as if it were being used in the European Economic Area. However we cannot guarantee the security of data sent over the internet.
Information about each provider and links to further information are provided below.

All our third party providers use cookies. You can change your browser settings to reject some or all cookies. However blocking all cookies will have a negative impact on the usability of many websites.

1. Catford Pilates Website

1.1 Information collected and why

• We use Google Analytics to understand who visits the website and to improve the information we provide online.
• Google analytics uses cookies to collect information about your computer and about your visits to www.catfordpilates.co.uk (including your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation). This information is not used to identify individual people.
• If you sign up for a membership your personal details, health questionnaire and membership information will be collected.  This is so that you can access member content and manage your own subscription.

1.2 How your information is stored

• The Catford Pilates website is hosted on secure servers outside of the European Union The website hosting provider does not collect or store information about website users.
• Website usage data collected via Google Analytics is stored on Google’s secure servers.

1.3 Further information

•  You can find out more about Google’s privacy policy here: http://www.google.com/privacypolicy.html

2. Physical Activity & Covid-19 Questionnaires

2.1 Information collected and why

• Your contact details – so we can provide you with the services you have requested and contact you in the event of service disruption.
• Information about your occupation, health and physical activity – to do our jobs we need to ask you for information about health conditions and injuries, this is for your safety.
•  Your age group, the area you in live in and how you found out about Catford Pilates – to understand more about our customers and which forms of marketing are most cost effective
• Your data consent response – by law we need to obtain your consent before sending you newsletters or details of offers and discounts.
• Your acceptance of our policies, terms and conditions – for the smooth running of our business. 
• For 121 and private clients we also collect next of kin contact details, this is in case of emergency

2.2 How your information is stored

• If you completed a questionnaire before January 2018 these are stored in hard copy in a locked filing cabinet.
• If you completed an online questionnaire, these are stored by Jotform on secure servers in the European Union. Or, if downloaded from Jotform, stored within a password protected cloud environment or in a locked filing cabinet.

2.3 Further information

• You can read Jotform’s privacy policy and security statement here: https://www.jotform.com/privacy/

3. Mailing lists

3.1 Information collected and why

• If you consent to receiving emails your first name, last name and email address will be added to mailing lists held on Mailchimp.com – this is so we can keep you informed of changes to classes, policies, terms and bookings.
• We also use Mailchimp so that you can easily unsubscribe from the Catford Pilates mailing list if you change your mind about receiving emails from us.

3.2 How your information is stored

• Your name and email address are stored securely by Mailchimp on servers outside of the European Union.

3.3 Further information

• For details of Mailchimp’s Privacy Policy as well as their compliance with the EU-US Privacy Shield visit: https://mailchimp.com/legal/privacy/

4. Business records and accounting

4.1 Information collected and why

• Your first name, last name and a record of your attendance is used to maintain a register of each class or private session, the register is used only for confirmation of your attendance, to maintain records of business activity and for health and safety requirements.
• If you pay in cash or by bank transfer your first name, last name and email address will be added to our online accounting system. This in order to maintain accurate business records.

4.2 How your information is stored

• Business records are stored in a secure, password protected cloud environment. Access to this information is via password protected devices on a secure network accessible only to Rebecca Trowbridge. Devices are stored in a locked safe when not in use.
• For cash and bank transfer transactions your name and email address are stored securely by Quickbooks.com on servers located outside of the European Union.

4.3 Further information

• You can view Quickbooks’ Privacy Policy here: https://quickbooks.intuit.com/uk/privacy-policy/.
• You can also visit: https://quickbooks.intuit.com/eu/privacy-shield/ for further information about their compliance with the EU-US Privacy Shield.

5. Online booking and payment

5.1 Information collected and why

• Your contact details – so we can provide you with the services you have requested and contact you in the event of service disruption
• Your acceptance of our policies, terms and conditions – for the smooth running of our business. 
• Next of kin/emergency contact details – in case of emergency
• Health status – for your safety

5.2 How your information is stored

• Information you provide when you book and pay online is stored securely by providers Acuity.com (online booking) and Stripe.com (online payment). Some data may be transferred to servers outside the European Union.

5.3 Further information

• The online booking provider is a company called Acuity. They have an updated privacy policy here: https://bookwhen.com/privacy detailing when data may be transferred outside of the European Union.
• You can view online payment provider Stripe’s Privacy Policy here: https://stripe.com/privacy-center/legal#privacy-faqs You can also visit: https://support.stripe.com/questions/stripe-and-european-data-transfers for further information about their compliance with the EU-US Privacy Shield.

Your rights
Unless subject to an exemption under the General Data Protection Regulation, you have the right to:

• see copies of all personal data held by us
• ask us to amend, delete or correct your personal data
• withdraw your consent to use your data e.g. removing your name from our mailing list 
• object to our use of your data where we rely on our ‘legitimate interests’ to do so. ‘Legitimate interests’ are the reasons why we collect data e.g next of kin contact details in case of emergency.

How long we hold your data
Data you provide may be stored in hard or electronic copy for as long as you remain a client of Catford Pilates and for a period of seven years after. It will be accessible only to staff directly involved in data entry and client records.

We will ensure your personal data is deleted from systems that we no longer use e.g. if we change third party providers.

Changes to this policy
Changes and updates to this policy will be published on the website.

Concerns and complaints
To raise any objections or to exercise any of your rights, you can send an email to Rebecca Trowbridge at [email protected]. When you get in touch, we will come back to you as soon as possible and where possible within one month. We may also ask you to verify your identity before we provide any information to you.

If this does not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioners Office on 03031231113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, England.