Privacy Notice

Igloo Wellness Centre Limited

This Privacy Notice explains how Igloo Wellness Centre Limited collects, uses, shares and protects your personal data. It is provided in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

1. Who We Are

We are Igloo Wellness Centre Limited (company number 16562800), a company registered in England and Wales whose registered office is at Unit 13, Tower Court, St Davids Road, Llansamlet, Swansea, SA6 8RU (“we”, “us”, “our”, “Igloo Wellness Centre”).

We are the data controller for the personal data described in this notice.

You can contact us about this notice by email at info@igloowellness.co.uk or by writing to us at the address above.

2. What This Notice Covers

This notice applies to personal data we collect when you:

  • enquire about or book a class, session or membership;
  • complete our Pre-Activity Health Questionnaire (“PAR-Q”);
  • attend our premises, classes or sessions;
  • use our website, booking platform or app;
  • communicate with us by email, phone, social media or in person;
  • consent to take part in marketing, ambassador or content activities;
  • apply for a role with us, or are otherwise engaged by us.

3. The Personal Data We Collect

3.1 Standard Personal Data

  • name, date of birth and contact details, including address, email and phone;
  • emergency contact details;
  • payment and billing information, processed by our payment provider;
  • booking, attendance and usage records;
  • correspondence with you;
  • marketing preferences;
  • records of any incidents, accidents or complaints.

3.2 Special Category Personal Data

Through the PAR-Q and your interactions with us, we also collect special category data, including:

  • health and medical information, including medical conditions, medications, injuries and recent surgery;
  • pregnancy and postnatal information;
  • information about disabilities or accessibility needs.

3.3 Other Categories

  • images and video, where you have given separate consent — see section 6;
  • CCTV footage, where CCTV is in operation on the premises — signage will indicate this;
  • information collected via cookies and similar technologies on our website — see our Cookies Policy.

4. How We Collect Your Personal Data

  • directly from you, when you book, complete the PAR-Q, attend a class or contact us;
  • from our booking and class management platform, currently Mariana Tek;
  • from our payment processor;
  • from CCTV, where in operation;
  • from cookies and analytics on our website.

5. Why We Use Your Personal Data and Our Lawful Basis

We process personal data on the following lawful bases under UK GDPR:

5.1 Performance of a Contract — Article 6(1)(b)

  • managing your bookings, attendance, memberships and payments;
  • communicating with you about your sessions and account;
  • providing the services you have booked.

5.2 Legitimate Interests — Article 6(1)(f)

  • keeping you, our staff and other participants safe on the premises;
  • maintaining records of incidents, accidents and complaints;
  • improving our services and operational efficiency;
  • limited direct marketing of similar services to existing customers, which you may opt out of at any time;
  • CCTV operation for security and safety, where in use;
  • protecting our legal interests, including in any dispute.

5.3 Consent — Article 6(1)(a)

  • email or other marketing where consent is required;
  • use of your identifiable image or video in marketing or content, covered by a separate Marketing & Content Consent Form;
  • any non-essential cookies on our website.

You may withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

5.4 Legal Obligation — Article 6(1)(c)

  • keeping financial and tax records;
  • complying with health and safety, regulatory and other legal obligations.

5.5 Vital Interests — Article 6(1)(d)

  • responding to a medical emergency where you or another person cannot give consent.

5.6 Lawful Basis for Special Category Health Data

We process health information under one or more of the following lawful bases under Article 9 UK GDPR:

  • Article 9(2)(a) — your explicit consent, typically given when you complete the PAR-Q;
  • Article 9(2)(c) — vital interests, where you or another person cannot give consent, for example a medical emergency;
  • Article 9(2)(h) — assessment of working capacity / health and social care, in relation to assessing your fitness to participate;
  • Article 9(2)(f) — establishment, exercise or defence of legal claims, where relevant.

6. Marketing, Photography and Content

We will not use your identifiable image or video for marketing, social media or ambassador content without your separate, written consent given on our Marketing & Content Consent Form. You can withdraw that consent at any time, and we will then take reasonable steps to remove your identifiable content from materials under our control.

We may occasionally take general photographs or video of our facilities, classes or events in which individuals may incidentally appear and which are not directed at any particular person. If you do not wish to appear in any such content, please tell a member of staff before the relevant session.

7. Who We Share Your Personal Data With

We share personal data with the following categories of recipient, only to the extent necessary:

  • our staff and instructors, on a need-to-know basis;
  • our booking and class management platform provider, currently Mariana Tek;
  • our payment processor;
  • our IT, hosting, email, communications and analytics service providers;
  • our public liability insurer and broker, in the event of an incident or claim;
  • emergency services and medical personnel, where necessary to respond to a medical emergency;
  • our professional advisers, including lawyers, accountants and auditors;
  • regulators, public authorities and law enforcement, where we are required to do so by law;
  • a buyer, successor or new operator if we sell, restructure or transfer the business, in which case we will make sure your data continues to be protected.

We do not sell your personal data to third parties.

8. International Transfers

Some of our service providers, for example our booking platform, may process personal data outside the UK, including in the United States and other countries. Where this is the case, we put in place appropriate safeguards required by UK data protection law, including the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or reliance on a UK adequacy decision, as applicable.

9. How Long We Keep Your Personal Data

We keep personal data only for as long as we need it, taking into account legal, regulatory, tax, accounting and reporting requirements. Our standard retention periods are:

  • Booking and account records: 6 years from the end of the relationship.
  • PAR-Q and health information: 6 years from your last interaction with us.
  • Incident and accident records: 6 years from the date of the incident, longer where the incident involves a minor or an ongoing claim.
  • Financial and tax records: 6 years from the end of the relevant accounting period.
  • Marketing consents and preferences: until you withdraw your consent, or until 3 years after your last interaction with us, whichever is sooner.
  • CCTV footage: typically 30 days, unless retained longer in connection with an incident or investigation.
  • Job applicant data: 12 months after the application, unless you ask us to keep it on file.

Where we no longer need your data, we will delete, anonymise or securely destroy it.

10. Your Rights

You have the following rights in relation to your personal data, subject to the conditions and exceptions in UK data protection law:

  • the right to be informed about how we use your data, which this notice does;
  • the right of access to a copy of your personal data;
  • the right to rectification of inaccurate or incomplete data;
  • the right to erasure, also known as the “right to be forgotten”, in certain circumstances;
  • the right to restriction of processing in certain circumstances;
  • the right to data portability for data you have provided to us, in certain circumstances;
  • the right to object to processing based on legitimate interests, and to object to direct marketing at any time;
  • the right to withdraw consent where we rely on consent;
  • the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, which we do not currently carry out;
  • the right to complain to the Information Commissioner’s Office — see section 12.

11. How to Exercise Your Rights

To exercise any of your rights, please email us at [insert email] or write to us at the address in section 1. We will respond within one month, although we may extend this by up to two further months for complex requests and will tell you if we do so.

We may need to ask you for proof of identity before we can act on your request.

12. Complaints

We hope you will speak to us first if you have any concerns about how we handle your personal data so that we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (“ICO”):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113
Website: ico.org.uk

13. Cookies

Our website uses cookies and similar technologies. Please see our separate Cookies Policy for details.

14. Changes to This Notice

We may update this Privacy Notice from time to time. The current version will always be available at our premises and on our website. We will tell you about any material changes before they take effect where required.

15. Contact

Igloo Wellness Centre Limited
Unit 13, Tower Court
St Davids Road
Llansamlet
Swansea
SA6 8RU

Company number: 16562800
Email: info@igloowellness.co.uk