Last updated: 11 September 2026

1. About this policy

Flourish and Flow respects your privacy and is committed to protecting your personal information. This policy explains what information I collect, why I collect it, how I use and protect it, and the rights you have under UK data protection law.

For the purposes of UK data protection law, Flourish and Flow is the data controller for the personal information described in this policy.

If you have a question about this policy or how your information is handled, please email fandfyoga@gmail.com.

2. Information I may collect

Depending on how you contact or book with Flourish and Flow, I may collect:

• your name, email address, telephone number and other contact details;

• booking, attendance and payment information;

• messages, enquiries, feedback and correspondence;

• emergency contact details;

• relevant health, accessibility, injury or wellbeing information that you choose to provide so I can offer yoga services safely;

• marketing preferences;

• technical information provided when you use my website or online services, such as your IP address, device information and cookie data; and

• any other information you choose to give me.

Please only provide health information that is relevant to your participation. Health information is treated as special category personal data and receives additional protection.

3. How I collect information

I may collect information:

• directly from you when you enquire, book, complete a form, attend a class or event, make a payment, join a mailing list or contact me;

• through booking, payment, email, website or video-call services used by Flourish and Flow; and

• from another person who makes a booking for you, where appropriate.

4. How and why I use your information

I may use your personal information to:

• respond to enquiries and communicate with you;

• manage bookings, classes, events, payments, cancellations and attendance;

• provide yoga services and make reasonable adjustments;

• protect your health and safety during a class, event or session;

• maintain financial, tax and business records;

• manage complaints, disputes or legal claims;

• prevent fraud, misuse or security incidents;

• improve my services; and

• send news or marketing where you have consented, or where another lawful basis permits it.

5. Lawful bases

I rely on one or more of the following lawful bases, depending on the circumstances:

• Contract: processing is needed to take steps at your request before a booking or to provide a service you have booked.

• Legal obligation: processing is needed to meet legal, tax, accounting or regulatory requirements.

• Legitimate interests: processing is reasonably needed to run and protect Flourish and Flow, respond to enquiries, improve services or manage legal claims, provided your rights do not override those interests.

• Consent: you have given clear permission, for example to receive marketing or for relevant health information to be used to support your safe participation.

• Vital interests: in a genuine emergency, information may be used or shared to protect someone's life.

Where I process health information, I will normally rely on your explicit consent in addition to an ordinary lawful basis. In an emergency, another condition permitted by law may apply.

You can withdraw consent at any time by emailing fandfyoga@gmail.com. Withdrawal does not affect processing that took place before consent was withdrawn.

6. Marketing

I will only send electronic marketing where I have a lawful basis to do so. You can unsubscribe at any time by using the link in a marketing email, where provided, or by emailing fandfyoga@gmail.com.

Service messages about an existing booking are not marketing and may still be sent when needed.

7. Sharing your information

I do not sell your personal information.

I may share information only where necessary with:

• booking, payment, email, website, document storage, accounting or video-call service providers;

• professional advisers, such as an accountant, insurer or legal adviser;

• venues, teachers or contractors involved in providing a service, where relevant;

• emergency services or healthcare professionals where needed to protect health or safety; and

• public authorities, regulators, courts or law-enforcement bodies where required or permitted by law.

Service providers may only use the information for the agreed purpose and must protect it appropriately.

8. International transfers

Some service providers may store or process information outside the UK. Where this happens, I will take reasonable steps to ensure an appropriate legal safeguard is in place, such as UK adequacy regulations or approved contractual protections.

9. How long I keep information

I keep personal information only for as long as it is needed for the purpose for which it was collected, including legal, tax, accounting, insurance and dispute-resolution requirements.

As a general guide:

• unsuccessful enquiries are normally kept for up to 12 months after the last contact;

• booking, attendance and routine correspondence may be kept for up to six years after the relevant service;

• financial and transaction records are kept for the period required by tax and accounting law;

• health and safety information is reviewed regularly and removed when it is no longer needed, subject to insurance or legal requirements; and

• marketing information is kept until you unsubscribe or it is no longer needed.

These periods may be extended where information is needed for a complaint, legal claim, safeguarding matter or other legal requirement.

10. Security

I use reasonable organisational and technical measures to protect personal information from loss, misuse, unauthorised access, alteration or disclosure. Access is limited to people and service providers who need the information for a legitimate purpose.

No method of electronic transmission or storage is completely secure, but I take proportionate steps to reduce the risk.

11. Your rights

Depending on the circumstances, you may have the right to:

• ask for access to your personal information;

• ask for inaccurate or incomplete information to be corrected;

• ask for your information to be erased;

• ask for processing to be restricted;

• object to certain processing, including direct marketing;

• receive certain information in a portable format or have it transferred to another organisation;

• withdraw consent; and

• object to a decision made solely by automated means where it has a legal or similarly significant effect.

These rights are not absolute and exemptions may apply. I may need to confirm your identity before responding. I will normally respond within one month and will not usually charge a fee.

To exercise a right, email fandfyoga@gmail.com.

12. Complaints

Please contact me first at fandfyoga@gmail.com if you have a concern about how your information has been handled.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator. Current contact details and guidance are available at www.ico.org.uk.

13. Children's information

If Flourish and Flow provides a service to a child, I may need information from a parent or guardian and may ask for their consent where required. I will only collect information reasonably needed to provide the service safely and meet legal or safeguarding responsibilities.

14. Cookies and third-party links

If the Flourish and Flow website uses non-essential cookies or similar technologies, information about them and any available choices will be provided through an appropriate cookie notice or consent tool.

My website or messages may link to third-party websites or services. Their privacy practices are governed by their own policies.

15. Changes to this policy

I may update this policy from time to time. The latest version will be made available through the Flourish and Flow website or on request. Significant changes will be brought to your attention where appropriate.