Privacy policy

Effective date: 17 September 2026

1. Who we are

Hot Yoga with Ella LTD, is the data controller. Contact us at Unit 4, 13 Central Promenade, Newcastle, County Down BT33 0AA, email hotyogawithella@gmail.com, or through this website. Email is our primary contact method for privacy enquiries and consumer communications.

2. Information we collect

• identity and contact details, including name, email address, telephone number and address where needed;

• account, booking, attendance, pass, membership, gift-card and transaction records;

• enquiries, complaints, feedback and communications;

• emergency-contact details and health information you choose or are asked to provide for safe participation;

• marketing preferences, survey responses, competition entries and photography permissions;

• website, device and cookie information where our website or providers collect it; and

• incident, accident, safeguarding, access-control and insurance information where relevant.

We normally collect information directly from you. We may also receive booking and payment status from our service providers, information from a parent or guardian, or information from someone buying a gift or making a booking for you.

3. Why we use information and our lawful bases

Bookings, payments, passes and memberships. Contact, account, booking and transaction data. Lawful basis: Contract; legal obligation.

Class communications and customer support. Contact, booking and communication data. Lawful basis: Contract; legitimate interests.

Safety, incidents and insurance. Contact, attendance, emergency and incident data. Lawful basis: Legitimate interests; legal obligation; legal claims.

Health and participation information. Health conditions, injuries, pregnancy and relevant medication. Lawful basis: Article 6: legitimate interests in participant safety and studio management. Article 9: explicit consent; vital interests in a genuine emergency; or legal claims where applicable.

Business records, tax and fraud prevention. Transaction, account and communication data. Lawful basis: Legal obligation; legitimate interests.

Service improvement and website security. Feedback, usage, device and technical data. Lawful basis: Legitimate interests; consent for non-essential cookies where required.

Email marketing. Contact details and preferences. Lawful basis: Consent; or the PECR soft opt-in only for our own similar services where details were obtained during a sale or genuine sales enquiry and an opt-out was offered at collection and in every message.

Photography or promotional content. Image, video and stated permission. Lawful basis: Consent or another basis explained when collected.

Our legitimate interests are to operate and protect the studio, administer services, communicate with customers, maintain appropriate records, prevent misuse and improve what we offer. We consider the impact on your rights before relying on this basis.

Where we use the electronic-marketing soft opt-in, it applies only to our own similar classes or services, where contact details were obtained during a sale or genuine sales enquiry and a clear opt-out was offered both when the details were collected and in every message. Other marketing requires consent.

4. Health information and explicit consent

Health information is special category data. Our Article 6 basis is normally our legitimate interest in protecting participant safety and managing the studio. Our Article 9 condition is normally your explicit consent, requested separately through an unticked health declaration checkbox. Where applicable, we may instead process information to protect vital interests in a genuine emergency or to establish, exercise or defend legal claims. You may withdraw consent by contacting us. Withdrawal does not affect earlier lawful processing, but we will stop consent-based processing unless another lawful condition applies. We may be unable to permit participation where we cannot reasonably manage an immediate safety risk without relevant information.

5. When information is required

Contact, booking and payment information is normally required to enter and perform the contract. If it is not provided, we may be unable to accept a booking or membership. Health information is generally provided by choice, but we may be unable to permit participation where we reasonably need information to assess immediate safety. Marketing consent is optional.

6. Sharing information

We do not sell personal information. We use Bookwhen to manage bookings, attendance, passes and memberships. Hot Yoga with Ella is the controller for customer information collected through our booking page and Bookwhen processes that information on our behalf. We also share only what is reasonably necessary with payment, website hosting, email, communications, analytics, IT, accounting and business-administration providers. Information may be shared with instructors who need it for safety, professional advisers, insurers, emergency services, regulators, law-enforcement bodies, or another party where required by law or necessary for legal claims. Bookwhen’s own privacy information is available at bookwhen.com/privacy.

Providers acting for us must protect information and use it only for agreed purposes. Payment providers process full card details under their own security arrangements; Hot Yoga with Ella does not store full card numbers.

7. International transfers

Some service providers may process information outside the UK. Where this happens, we use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or an approved UK addendum, together with appropriate safeguards where required. You may contact us for further information about relevant safeguards.

8. How long we keep information

Booking, membership and payment records: Normally up to six years after the relevant service or financial period for tax, contract, insurance and legal purposes.

Health declarations and emergency contacts: Reviewed regularly and normally deleted within three years of last attendance, unless needed for an incident or legal claim.

Accident, incident and claim records: For the period reasonably required by insurance, safeguarding and applicable limitation rules.

Marketing records: Until you unsubscribe or we determine the details are no longer current; suppression records may be kept to respect your choice.

Routine enquiries and complaints: Normally up to three years after resolution, or longer if linked to a contract or legal claim.

Cookie and technical data: For the period stated in the website cookie notice or consent tool.

These are general periods. We may keep information for longer where law, insurance, safeguarding or an actual or potential legal claim requires it, and delete it sooner when it is no longer needed.

9. Security

We use reasonable technical and organisational measures to protect personal information, including access controls, suitable service providers, secure accounts and proportionate record-management procedures. No system is completely secure, but we review risks and respond to suspected breaches in line with legal duties.

10. Your rights

Depending on the circumstances and lawful basis, you may have the right to:

• ask for access to your personal information;

• ask us to correct inaccurate or incomplete information;

• ask for deletion or restriction of use;

• object to processing based on legitimate interests;

• receive certain information in a portable format; and

• withdraw consent at any time where consent is the basis used.

You have an absolute right to object to the use of your personal information for direct marketing.

To exercise a right, email hotyogawithella@gmail.com. We may need to verify your identity. Rights are not always absolute, and we will explain if an exemption applies.

11. Children and young people

Where a participant is under 18, we may collect parent or guardian details and consent information. We use only what is necessary to manage the booking, communicate, protect safety and meet legal obligations. A parent or guardian should contact us if they have questions about a young person’s information.

12. Cookies and automated decisions

Our website and booking page use essential cookies and similar technologies needed for security, payment fraud prevention, session management and requested functions. Bookwhen may use essential session and security cookies, and Stripe may use essential fraud-prevention cookies. Optional analytics or advertising technologies will be used only after you make an affirmative choice where consent is required. The website cookie control identifies the current cookie names, providers, purposes and durations and allows you to accept or reject optional cookies and change your choice later. Rejecting optional cookies must be as easy as accepting them. Further information about Bookwhen cookies is available at bookwhen.com/privacy. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on customers.

13. Complaints about privacy

Please contact us first at hotyogawithella@gmail.com so we can try to resolve the concern. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to ICO, Wycliffe House, Water Lane, Wilmslow SK9 5AF.

14. Updates

We may update this privacy policy when our services, providers or legal obligations change. The latest version and effective date will be made available on our website. Where a change materially affects how we use information, we will take reasonable steps to bring it to the attention of affected people.