Privacy Policy

1. Introduction & Overview

Welcome to Centre: Pilates (“we”, “our”, or “us”). We are committed to protecting and respecting your personal privacy in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains what personal data we collect from you when you visit our website, communicate with us, or book Pilates sessions, and how that information is handled securely.

2. Data Controller

The Data Controller responsible for your personal information is the owner/operator of Centre: Pilates, based at 30 Plus Health & Performance, Hockley.

If you have any questions or wish to exercise your data rights, you can contact us directly at: hello@centrepilates.co.uk.

3. Information We Collect

We may collect and process the following categories of information:

• Contact Details: Your full name, email address, and phone number when you enquire or create a booking.
• Health & Physical Readiness Data: Relevant health conditions, injuries, physical limitations, or pregnancy status that you disclose to ensure safe movement coaching.
• Appointment & Transaction History: Session types, booking dates, and purchase confirmations processed via our booking provider.
• Technical & Analytics Data: IP address, device information, browser type, and interaction metrics to maintain site security and performance.

4. Third-Party Booking: Square (Squareup International Ltd)

All online bookings, appointment scheduling, card payments, and customer accounts are processed securely through Square (Squareup International Ltd / Block, Inc.).

When booking sessions, you provide your information directly to Square’s encrypted platform. We do not store or process your full credit or debit card numbers on our servers. Square acts as an independent or joint data processor adhering to PCI-DSS Level 1 compliance.

For complete details on how Square protects and manages your transactional data, please review the Square Privacy Notice.

5. Legal Basis for Processing

We process your data under the following legal bases under UK GDPR:

• Contractual Performance: To arrange, deliver, and manage your private and group Pilates appointments.
• Explicit Consent & Vital Interests: For sensitive health screening (PAR-Q / Physical Readiness Questionnaire) to ensure exercise safety.
• Legal Obligation: To comply with financial accounting, taxation, and insurance regulations.
• Legitimate Interests: To respond to your enquiries, maintain our booking schedules, and improve our services.

6. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and professional insurance requirements (typically 7 years following the cessation of client training for adult clients).

7. Your Legal Rights

Under UK data protection laws, you hold the right to:

• Request access to copies of your personal data.
• Request correction of inaccurate or incomplete information.
• Request erasure of your data (“right to be forgotten”), subject to legal retention obligations.
• Object to or restrict the processing of your data.
• Withdraw consent where processing was based on consent.

To exercise any of these rights, contact us at hello@centrepilates.co.uk. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.