BeatCycle Ltd (“we,” “us,” “our”) is the controller and responsible for your personal data and we are committed to protecting your privacy and ensuring the safety and wellbeing of all our clients and staff. This policy outlines how we collect, process, and safeguard personal data and how we uphold the highest standards of health and safety.
1. Privacy Policy
1.1 Our Commitment to Privacy
We are committed to full compliance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. We ensure that all personal data is handled securely, transparently, and for legitimate purposes.
1.2 Principles of Data Protection
We adhere to the following principles when processing personal data:
- Lawfulness & Fairness: Data is obtained and processed legally and fairly.
- Purpose Limitation: Data is collected for specified and lawful purposes.
- Data Minimisation: We only collect necessary and relevant data.
- Accuracy: We keep personal data up to date as notified and correct inaccuracies.
- Storage Limitation: Data is retained only for as long as necessary.
- Confidentiality & Security: Data is stored securely and protected against breaches.
- Accountability: We are responsible for ensuring compliance with these principles.
1.3 Personal Data We Collect
We collect the following personal data from our clients:
- Full name
- Date of birth
- Postal and email addresses
- Telephone number
- Emergency contact details
- Health screening information
- Attendance and booking records
- Payment details (processed via secure third-party providers)
- Cookies and tracking data (see Cookie Policy)
1.4 Why We Process Personal Data
We process your data for the following legitimate purposes:
- Account Management: To create and manage user accounts.
- Class Bookings & Payments: To process transactions and manage class reservations.
- Health & Safety: To assess health risks and ensure safe participation.
- Marketing & Promotions: To inform clients about offers and services (only with explicit consent).
- Service Improvement: To monitor and enhance customer experience.
- Fraud Prevention & Compliance: To protect against fraudulent activities and comply with legal obligations.
- Performance of agreed services with clients: Where we need to perform the agreed services with a client.
- Legitimate interests: We may use personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on clients and client rights (both positive and negative) before we process personal data for our legitimate interests. We do not use personal data for activities where our interests are overridden by the impact on the client (unless we have client consent or are otherwise required or permitted to by law).
- Legal obligation: We may use personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.
- Consent: We rely on consent only where we have obtained active agreement to use personal data for a specified purpose, for example if you subscribe to an email newsletter.
1.5 Data Retention & Security
- Personal data is stored securely with access limited to authorised personnel.
- We retain data only as long as necessary (no longer than 10 years after last client activity, unless legally required).
- Once data is no longer needed, it is securely deleted.
- Strong security measures are in place, including encryption and access controls.
- We have put in place appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process personal data on our instructions and they are subject to a duty of confidentiality.
1.6 Data Sharing & Third Parties
We do not sell personal data. However, we may share data with:
- Service Providers: Payment processors, booking system providers, and email marketing platforms.
- Regulatory Authorities: When legally required for compliance or audit purposes.
- Emergency Services: If necessary for health and safety reasons.
- Marketing Partners: Only with explicit consent.
- Third-Party Analytics Providers: For website and service improvements.
Data transfers outside the UK/EEA (if any) are only conducted with appropriate safeguards in place (e.g., UK GDPR-approved standard contractual clauses). Whenever we transfer your personal data out of the UK/EEA to countries which have laws that do not provide the same level of data protection as the UK law, we always ensure that a similar degree of protection is afforded to it by ensuring that the following safeguards are implemented.
1.7 Your Data Privacy Rights
You have the following rights under data protection laws:
- Access: Request access to your personal data.
- Correction: Request corrections to inaccurate data.
- Erasure: Request deletion of personal data.
- Restriction: Request limited processing under certain conditions.
- Objection: Object to processing in specific cases.
- Data Portability: Request transfer of data to another provider.
- Withdraw Consent: Withdraw marketing consent at any time.
To exercise these rights, contact us at hello@beatcycle.co.uk.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
1.8 Cookies & Tracking Technologies
We use cookies and similar tracking technologies to improve user experience and analyse website traffic. Users can manage cookie preferences via browser settings. See our Cookie Policy for more details.
1.9 Complaints
You have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). However, before doing so please make sure you have first made your complaint to us or asked us for clarification if there is something you do not understand.
1.10 Changes to the Privacy Policy and your duty to inform us of changes.
We keep our privacy policy under regular review. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.