Privacy Notice

I Love Hot Yoga Limited
Version 1.0 — Effective 31 July 2026

1. Who we are

I Love Hot Yoga Limited is responsible for deciding how and why your personal information is used.

Our details are:

Legal name: I Love Hot Yoga Limited
Trading name: I Love Hot Yoga
Company number: 17157332
Registered office: Eastham Hall, 109 Eastham Village Road, Eastham, Wirral, United Kingdom, CH62 0AF
Studio address: 23 Station Road, Little Sutton, CH66 1NT
Email: hello@ilovehotyoga.co.uk
Website: www.ilovehotyoga.co.uk

For data-protection purposes, I Love Hot Yoga Limited is the controller of your personal information.

Questions or requests concerning your personal information should be emailed to:

hello@ilovehotyoga.co.uk

2. What this Privacy Notice covers

This Privacy Notice explains how we collect, use, store and share personal information when you:

• visit our website;

• create an account;

• purchase a membership or pass;

• book or attend a class;

• complete a health declaration or participation agreement;

• contact us;

• receive marketing communications;

• visit our studio; or

• otherwise interact with I Love Hot Yoga.

It also explains your rights under UK data-protection law.

3. Personal information we collect

Depending on how you interact with us, we may collect:

Identity information

This may include:

• your name;

• date of birth;

• age;

• membership or customer number;

• account username; and

• parental or guardian details where relevant.

Contact information

This may include:

• email address;

• postal address;

• mobile telephone number;

• emergency-contact name;

• emergency-contact telephone number; and

• communication preferences.

Account and booking information

This may include:

• your account details;

• booking history;

• attendance history;

• cancellations and no-shows;

• waiting-list activity;

• memberships and passes purchased;

• membership start, pause and cancellation dates;

• promotional offers used;

• class preferences;

• correspondence with us; and

• notes needed to administer your account.

Payment and transaction information

This may include:

• amounts paid;

• transaction dates;

• failed-payment information;

• refunds;

• billing status;

• payment-provider references; and

• limited payment-method information.

We do not normally receive or store your complete payment-card details. Payments are processed by our payment provider.

Health and safety information

Where relevant, we may collect information concerning:

• medical conditions;

• injuries;

• pregnancy or postnatal status;

• allergies;

• medication affecting exercise or heat tolerance;

• accessibility requirements;

• health concerns relevant to participation;

• health declarations;

• risk acknowledgements;

• accidents or incidents; and

• information provided during an emergency.

Health information is treated as special-category personal data and receives additional protection.

Please provide only information that is relevant to safe participation.

Technical and website information

When you use our website or online booking services, we may collect:

• IP address;

• device type;

• browser type;

• operating system;

• pages visited;

• date and time of access;

• website interactions;

• referring website;

• cookie identifiers; and

• security and diagnostic information.

Marketing information

This may include:

• whether you have agreed to receive marketing;

• the type of marketing agreed to;

• when and how consent was given;

• emails or messages opened;

• links selected;

• marketing preferences; and

• when consent was withdrawn.

CCTV information

CCTV may record images of people entering, leaving or moving through designated areas of the premises.

CCTV is not used in toilets or changing areas.

4. How we collect your information

We may collect personal information directly from you when you:

• create an account;

• make a booking;

• purchase a membership or pass;

• make a payment;

• complete a form or declaration;

• contact us by email or through our website;

• speak to a member of staff;

• attend a class;

• enter the studio;

• join a waiting list;

• enter a promotion; or

• agree to receive marketing.

We may also receive information from:

• bsport, our booking and membership platform;

• Stripe, our payment processor;

• Squarespace, our website provider;

• Google services used for business email and administration;

• a parent or guardian;

• an emergency contact;

• an instructor or contractor;

• payment providers;

• website analytics and cookie technologies;

• CCTV systems; or

• emergency services where relevant.

5. Why we use your information

We use personal information for the following purposes.

Providing memberships, passes and classes

We use your information to:

• create and manage your account;

• process purchases;

• take payments;

• administer memberships and passes;

• manage bookings and waiting lists;

• confirm bookings;

• communicate timetable changes;

• manage cancellations and no-shows;

• provide customer support; and

• deliver the services you have requested.

Our lawful basis is that processing is necessary to enter into or perform our contract with you.

Managing payments and financial records

We use information to:

• collect payments;

• manage recurring payments;

• process refunds;

• investigate failed or disputed payments;

• prevent fraud; and

• maintain accounting and tax records.

Our lawful bases are performance of our contract, compliance with legal obligations and our legitimate interest in managing our business and protecting it from fraud.

Health, safety and participation

We use relevant information to:

• assess whether an issue may affect safe participation;

• provide instructors with necessary safety information;

• respond to accidents or emergencies;

• contact an emergency contact;

• document incidents; and

• comply with health-and-safety responsibilities.

Where we process health information provided through a health declaration, we generally rely on your explicit consent.

In an emergency, we may also process or share health information where necessary to protect your vital interests or those of another person.

You may withdraw consent to our use of health information. However, where we cannot safely provide a class without relevant information, withdrawal may affect your ability to participate.

Customer service and communications

We use your information to:

• answer questions;

• respond to complaints;

• resolve booking or account problems;

• provide service notices;

• inform you about important changes; and

• maintain records of our communications.

Our lawful bases are performance of our contract and our legitimate interest in providing effective customer service.

Service communications are not marketing and may still be sent where necessary to administer your account or booking.

Marketing

Where permitted, we may send information about:

• classes;

• memberships;

• studio news;

• events;

• promotions;

• workshops; and

• related services.

We may rely on your consent or, where legally permitted, the existing-customer marketing exception.

Marketing consent is optional and is not a condition of purchasing from us.

You may unsubscribe at any time by:

• using the unsubscribe option in a marketing message;

• changing your account preferences where available; or

• emailing hello@ilovehotyoga.co.uk.

We may keep limited information on a suppression list to ensure we respect your request not to receive further marketing.

Website operation and security

We use technical information to:

• operate the website;

• remember preferences;

• secure accounts;

• prevent misuse;

• diagnose faults;

• understand website performance; and

• improve the customer experience.

Our lawful bases may include our legitimate interests, consent where required for non-essential cookies, and performance of our contract.

CCTV

We use CCTV for:

• the safety of customers, staff and visitors;

• crime prevention and detection;

• protection of the premises and property;

• investigation of incidents; and

• handling legal or insurance claims.

Our lawful basis is our legitimate interest in maintaining a safe and secure studio.

CCTV signs are displayed in monitored areas.

Legal claims and regulatory compliance

We may use information to:

• comply with legal and regulatory obligations;

• respond to lawful requests;

• establish or defend legal claims;

• manage insurance matters;

• investigate complaints; and

• enforce our agreements.

Our lawful bases are compliance with legal obligations and our legitimate interest in protecting our legal and business interests.

6. Health information and explicit consent

Health information is special-category personal data.

Where we ask for health information, we will explain why it is needed and will collect only information reasonably relevant to participation, safety or an emergency.

Where we rely on explicit consent, the consent request should be separate and clearly refer to health information.

A suitable bsport consent statement is:

I explicitly consent to I Love Hot Yoga Limited collecting and using the health information I provide for participation, health and safety, emergency response and studio administration, as described in the Privacy Notice.

This box should be unticked by default.

You may withdraw this consent by emailing hello@ilovehotyoga.co.uk. Withdrawal does not affect processing that took place before consent was withdrawn.

7. Who we share information with

We may share personal information where reasonably necessary with:

• bsport, which provides our booking, membership and customer-management system;

• Stripe, which processes payments;

• Squarespace, which hosts and supports our website;

• Google service providers used for business email, storage and administration;

• instructors, employees and contractors who need information to provide services safely;

• website, IT and technical-support providers;

• professional advisers, including accountants, insurers, solicitors and consultants;

• banks and payment providers;

• emergency services and medical professionals;

• law-enforcement or regulatory authorities;

• fraud-prevention providers;

• a parent or guardian where the customer is under 18 and sharing is appropriate;

• an emergency contact where necessary; and

• a potential purchaser, investor or adviser if the business is restructured or sold.

Instructors will only receive health or contact information where it is reasonably necessary for safety or service delivery.

We do not sell personal information to third parties.

8. Payment information

Payments may be processed through Stripe or another authorised payment provider.

The payment provider processes payment information under its own privacy terms and security standards.

We normally receive information such as:

• payment status;

• amount;

• transaction date;

• payment reference;

• limited card information, such as card type and final digits; and

• information about failed or disputed payments.

We do not normally store complete payment-card numbers or security codes.

9. International transfers

Some of our service providers may process or store personal information outside the United Kingdom.

Where information is transferred internationally, we require appropriate safeguards to be used where required by law. These may include:

• a UK adequacy regulation;

• approved contractual protections;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved standard contractual clauses; or

• another legally recognised safeguard.

You may contact us for further information about safeguards relevant to your personal information.

10. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, insurance and accounting requirements.

Our usual retention periods are:

• customer account, booking and transaction records: up to 6 years after the last transaction or end of the customer relationship;

• financial and accounting records: normally 6 years after the relevant financial period;

• health declarations, participation agreements and acceptance records: normally up to 6 years after the last attendance;

• accident, injury and incident records: normally at least 6 years, and potentially longer where the incident involves someone under 18 or where a legal or insurance matter remains open;

• general enquiries that do not result in a customer relationship: normally up to 12 months;

• complaints and related correspondence: normally up to 6 years after the matter is closed;

• marketing consent records: for as long as we send marketing and for a reasonable period afterwards;

• marketing suppression records: for as long as necessary to ensure we respect an opt-out;

• CCTV footage: normally up to 14 days, unless required for an incident, investigation, insurance matter or legal claim; and

• cookie and website information: according to the type of cookie and the period described in our cookie settings or cookie notice.

We may keep information for longer where:

• required by law;

• needed for an actual or potential legal claim;

• required by an insurer;

• connected to an unresolved complaint or incident; or

• necessary to protect someone’s vital interests.

When information is no longer required, we will delete, anonymise or securely dispose of it.

11. CCTV

CCTV is used in designated areas for safety, security and crime prevention.

CCTV is not installed in toilets or changing areas.

Access to footage is restricted to authorised persons.

Footage may be shared with:

• the police;

• emergency services;

• insurers;

• legal advisers;

• building-management representatives; or

• other parties where disclosure is lawful and necessary.

CCTV footage is normally retained for up to 14 days unless it is required in connection with an incident, investigation, complaint, insurance matter or legal claim.

You may request access to CCTV footage containing your image. We may need information such as the date, approximate time and location to identify relevant footage.

We may be unable to provide footage where doing so would disclose another person’s information and it is not reasonably possible to protect their identity.

12. Cookies and similar technologies

Our website and third-party services may use cookies and similar technologies.

Some cookies are necessary for:

• website operation;

• security;

• account access;

• booking functionality;

• payment processing; and

• remembering essential preferences.

Other cookies may be used, with consent where required, for:

• analytics;

• measuring website performance;

• personalisation; and

• marketing.

You can manage non-essential cookies through our cookie banner or your browser settings.

Blocking essential cookies may prevent parts of the website, booking system or payment process from functioning correctly.

13. Marketing preferences

We will not require you to accept marketing as a condition of purchasing a membership, pass or class.

Where consent is required:

• marketing boxes will not be pre-ticked;

• email and text-message preferences should be requested separately;

• we will keep a record of your choice; and

• you may withdraw consent at any time.

Withdrawing from marketing will not stop essential communications about:

• bookings;

• payments;

• membership administration;

• timetable changes;

• safety;

• account security; or

• changes to our services or terms.

14. Information about customers aged 16 or 17

Customers aged 16 or 17 may attend only in accordance with our Terms and Conditions.

We may collect:

• the young person’s contact and booking information;

• relevant health and safety information;

• parental or guardian contact details;

• parental or guardian consent; and

• emergency-contact information.

We use this information to manage the booking, verify permission, provide services and protect the young person’s safety.

Where appropriate, we may communicate with the parent or guardian about participation, payment, safety, an incident or an emergency.

15. Emergency contacts

Emergency-contact information is used only where reasonably necessary, including when:

• you become unwell or injured;

• there is a serious safety concern;

• emergency services are involved; or

• we cannot communicate with you during an urgent situation.

Please ensure your emergency contact knows that you have provided their details to us.

16. Photography and recording

The studio operates a phone-free policy in the practice area.

Customers must not photograph, film or record other people without permission.

We will not use identifiable photographs, videos or recordings of you for marketing without appropriate permission.

Where you provide consent for promotional photography or recording, you may withdraw consent for future use. Withdrawal will not necessarily require us to recall printed material or content already lawfully published, but we will consider reasonable requests concerning online content.

17. Security

We take reasonable organisational and technical measures to protect personal information against:

• unauthorised access;

• accidental loss;

• misuse;

• alteration;

• disclosure; and

• destruction.

Measures may include:

• password-protected systems;

• access restrictions;

• staff and contractor confidentiality requirements;

• secure payment processing;

• software updates;

• account controls;

• secure disposal procedures; and

• incident-management processes.

No internet-based service is completely secure. Customers should use strong passwords, keep login information confidential and contact us if they suspect unauthorised account access.

18. Automated decision-making

We do not currently make decisions about you solely by automated means where those decisions produce legal effects or similarly significant effects.

Our systems may automatically:

• send booking confirmations;

• manage waiting lists;

• apply membership or pass rules;

• record late cancellations or no-shows;

• send payment reminders; or

• identify account or payment issues.

Where appropriate, you may contact us and ask for a staff member to review an automated outcome.

19. Your rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;

• request access to your personal information;

• ask for inaccurate information to be corrected;

• ask for incomplete information to be completed;

• request deletion of information;

• request restriction of processing;

• object to processing based on legitimate interests;

• receive certain information in a portable format;

• withdraw consent;

• object to direct marketing;

• request human review of certain automated decisions; and

• complain to the Information Commissioner’s Office.

These rights are not absolute and may be subject to legal conditions or exemptions.

We may need to verify your identity before acting on a request.

We will normally respond within one month. More time may be permitted where a request is complex or where multiple requests are made.

20. Withdrawing consent

Where we rely on consent, you may withdraw it at any time by emailing:

hello@ilovehotyoga.co.uk

You can also unsubscribe from marketing using the unsubscribe option in a message.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Where information is required to provide a service safely or fulfil a contract, withdrawal may affect our ability to continue providing that service.

21. Complaints

Please contact us first if you have a concern about how we use your personal information.

Email:

hello@ilovehotyoga.co.uk

We will investigate the concern and aim to respond within a reasonable period.

You also have the right to complain to the UK data-protection regulator, the Information Commissioner’s Office.

22. Changes to this Privacy Notice

We may update this Privacy Notice to reflect:

• changes to our services;

• changes to the providers we use;

• new legal requirements;

• new technology;

• changes to how we collect or use information; or

• changes to our studio operations.

The latest version will be published on our website with a revised effective date.

Where a change materially affects how we use existing customer information, we will take reasonable steps to bring the change to customers’ attention.

23. Contact us

For questions, requests or complaints relating to personal information, contact:

I Love Hot Yoga Limited
Email: hello@ilovehotyoga.co.uk
Website: www.ilovehotyoga.co.uk
Studio: 23 Station Road, Little Sutton, CH66 1NT