Privacy Policy

1. Who we are

RestAura Reformer Pilates (“we”, “us”, “our”) is a reformer Pilates studio based at 1D Cardigan Rd, Winton, Bournemouth, BH9 1BJ. We are the “data controller” responsible for your personal data under the UK GDPR and the Data Protection Act 2018.

For any privacy questions or to exercise your rights, contact us at info@restaurareformerpilates.co.uk.

2. What data we collect

• Identity & contact data — your name, email address and phone number.
• Booking data — the classes you book, attendance, class packs, credits and payment status.
• Communications — messages you send us and emails we send you.
• Health information you choose to share — if you tell us about an injury or condition in the booking notes, we treat this as special-category data and use it only to keep you safe in class.

3. How we use it & our lawful basis

• To provide your bookings (contract) — managing your classes, packs and account.
• Transactional emails (contract / legitimate interests) — confirmations, waitlist updates, cancellations and class reminders.
• Payments (contract / legal obligation) — processing payments and keeping records.
• Marketing emails (consent) — only if you opt in. You can withdraw at any time.
• Safety (vital interests / explicit consent) — any health details you provide.

4. Who we share it with

We do not sell your data. We share it only with trusted service providers who help us run the studio, under contract and only as needed:

• Our booking & database provider (hosting your booking records securely).
• Our payment processor (Stripe) — to take card payments. We never store full card details.
• Our email provider (Resend) — to send the emails listed above.

5. How long we keep it

We keep your account and booking data for as long as you are a customer and for up to 7 years afterwards where needed for tax and accounting records. You can ask us to delete your data sooner (see your rights below) — we will do so unless we are legally required to keep it.

6. Cookies & analytics

We use a small amount of “local storage” in your browser to remember your email on the account page and your cookie choice — these are essential and always on.

With your consent, we also use Google Analytics to understand how the site is used (for example which pages are popular) so we can improve it. These analytics cookies are only set after you click “Accept” on our cookie banner, and never before. You can decline them, and essential features work either way. We do not use advertising cookies or sell your data. You can change your mind any time by clearing your browser data, which will bring the banner back.

7. Your rights

Under UK GDPR you have the right to:

• Access a copy of your data — available instantly from your account page (“Download my data”).
• Rectify inaccurate data — contact us and we’ll correct it.
• Erase your data — use “Delete my account” on your account page, or email us.
• Withdraw consent to marketing — toggle it off in your account at any time.
• Object to or restrict processing, and the right to data portability.

You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

8. How we protect your data

We use industry-standard security measures including encrypted connections (HTTPS) and access controls. Payment card processing is handled entirely by our PCI-compliant payment provider.

9. Changes to this policy

We may update this policy from time to time. The latest version will always be available on this page.