1: Who we are

FloLuxe is a mat Pilates business run by Ruth Gent, operating classes at Aire Content Loft and other 'pop up' locations.

Contact details: Email: floluxepilates@gmail.com

2: What information we collect and why

a) Website analytics

When you visit our Website, we collect some information to help us understand how it's being used, including: Details about your browser, network, and device Pages you visited before arriving at our site Your IP address How you interact with the site - including clicks, internal links followed, pages visited, scrolling behaviour, on-site searches, and timestamps

This information is shared with Squarespace, our website analytics provider, so we can understand site traffic and improve your experience.

Our legal basis for this processing is our legitimate interest in understanding and improving how our Website performs - except for non-essential analytics cookies, which we only use once you've given consent via our cookie banner (see below).

b) Visitor data collected by Squarespace

Our Website is hosted by Squarespace. As our hosting provider, Squarespace also independently collects some personal information when you visit, including: Information about your browser, network, and device Pages you visited before arriving at our site Pages you view while on our site Your IP address

Squarespace uses this data to run, protect, and improve its own hosting platform and services. You can read more in Squarespace's own Privacy Policy.

c) Contact and enquiry forms

If you get in touch with us through a form on our Website (for example, to ask a question about classes), we collect the information you submit so we can respond to you. This is shared with Squarespace, who help us manage our website services and our relationship with you.

Our legal basis for this is our legitimate interest in responding to your enquiry, or - where you're asking about booking a class - the steps necessary to enter into a contract with you.

d) Bookings and class information - GymCatch

All bookings for regular FloLuxe classes are made through our booking platform, GymCatch. When you book a class, GymCatch collects and processes your personal information (such as your name, contact details, and booking history) on our behalf, and also as a data controller in its own right for the running of its platform.

Please read GymCatch's Privacy Policy for full details of how they handle your data.

Health information: Because Pilates is a physical activity, our booking process may ask you to share health-related information (for example, injuries, pregnancy, or medical conditions relevant to your safety in class). This is classed as "special category data" under UK GDPR, and we only collect and use it with your explicit consent, and solely to make sure your classes are safe and suitable for you. We don't use this information for any other purpose, and we don't share it beyond what's needed to keep you safe in class (for example, briefing the instructor).

Payment information: Class payments are handled directly through GymCatch's platform and its payment processor, Stripe. We do not see or store your card details ourselves.

f) Photos and testimonials

With your permission, we may feature photos or written testimonials from clients on our Website or social media to showcase our classes. We'll always ask for your consent before using your image or words in this way, and you can ask us to remove them at any time.

3: Cookies

Our Website uses cookies and similar technologies - small files or pieces of text downloaded to your device when you visit.

Necessary cookies: These are always active, and allow Squarespace, our hosting platform, to serve our Website to you securely. These don't require consent as they're essential to the site functioning.

Analytics and performance cookies: These help us understand site traffic and activity, and are only used if you accept them via our cookie banner. You can change your preferences at any time by clearing your cookies / revisiting the cookie banner settings.

For more detail on the specific cookies Squarespace uses, visit Squarespace's cookie information page.

4: Who we share your data with

We only share your personal data with the following third parties, each for the purposes described above: Squarespace - website hosting and analytics GymCatch - class bookings, scheduling, and payment processing Stripe - payment processing (via GymCatch).

We do not sell your personal data to anyone, and we don't share it with any other third party without telling you first.

5: International data transfers

Some of the third parties we use - including Squarespace, GymCatch, and Stripe - may store or process your data outside the UK, for example in the United States. Where this happens, these providers are required to have appropriate legal safeguards in place, such as Standard Contractual Clauses approved by UK authorities, or reliance on adequacy regulations, to ensure your data continues to be protected to UK standards. You can find more detail on each provider's own privacy policy.

6: How long we keep your data

We keep personal data only for as long as necessary for the purposes set out in this policy:

Booking and health information:

We only retain your personal data, booking history, and health information for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements.

Active Retention Period: If you stop attending our Mat Pilates classes, we will keep your data on our active records for 6 years from the date of your last activity (such as your last class booking or attendance). This 6-year period allows us to maintain accurate records for tax auditing (HMRC) and to defend any potential legal or insurance claims.

Archiving and Technical Constraints: Our booking and client management system is powered by our third-party provider, GymCatch. Due to the technical architecture of the GymCatch platform, customer records cannot be permanently deleted from the business portal by us; they can only be "Archived."

What Archiving Means for Your Privacy: Once you have been inactive for 6 years, your record will be moved to our archived database. This action completely removes you from all active customer, marketing, and communication lists. Your data will be kept strictly restricted, securely stored, and will not be accessed or processed unless required by law, a tax audit, or a legal claim.

Marketing data: retained until you unsubscribe or ask us to delete it.

Website analytics: retained in line with Squarespace's own data retention practices.

7: Your rights

Under UK GDPR, you have the right to: Access the personal data we hold about you Correct any inaccurate or incomplete data Delete your data ("right to be forgotten"), where applicable Restrict or object to our processing of your data Withdraw consent at any time, where we rely on consent (e.g. marketing emails or health data) Data portability - request your data in a portable format Complain to the Information Commissioner's Office (ICO) if you're unhappy with how we've handled your data

How this works in practice: Any data we hold about you directly - such as emails or enquiry records - can be corrected or deleted on request at any time by emailing us. However, because of the technical restrictions described in Section 6, we're not able to permanently delete your booking or health records from GymCatch ourselves; these can only be archived after 6 years of inactivity, or sooner where you request it, subject to any legal or tax obligations we must still meet.

If you'd like your account permanently and completely removed from the GymCatch network entirely, you can do this yourself by logging into your personal profile on the GymCatch App or Website and choosing to delete your account, or by contacting GymCatch directly at hello@gymcatch.com. Please note that even after a GymCatch account deletion, we may still be required to retain limited records (such as payment history) for legal or tax purposes.

To exercise any of these rights, just email us at floluxepilates@gmail.com. We'll respond within one month, as required by law.

You can also contact the ICO at ico.org.uk or on 0303 123 1113.

8: How we keep your data secure

We don't store health information or payment details ourselves - these are held securely by Squarespace, GymCatch, and Stripe, each of whom maintain their own security measures to protect your data. We only access the minimum information needed to run your classes safely (for example, being briefed on relevant health information by GymCatch ahead of a class).

9: Children

Our classes are for adults only, and our Website is not directed at children. We do not knowingly collect personal data from anyone under 18.

10: Changes to this policy

We may update this policy from time to time - for example, if we start using a new tool or service. We'll update the date at the top of this page whenever we do, and we'd encourage you to check back occasionally.

11: Contact us

If you have any questions about this policy or how we handle your data, please get in touch:

Email: floluxepilates@gmail.com