Website & studio terms

How we keep your data safe

1. Who we are

SMK Pilates Studio is run by Sarah McKenna as a sole trader. Sarah is the data controller, which means she decides how your personal information is used and is responsible for looking after it.

If you have any questions about this policy or your information, contact us:

Email: info@smkpilatesstudio.com
Post: The Studio, Unit 4c, Shannon Commercial Centre, Beverley Way, New Malden, KT3 4PT

This policy was last updated on 23 October 2026.

2. What we collect and why

We only collect what we need to run your classes, take payment and keep in touch if you've asked us to. The law requires us to have a reason (a "lawful basis") for each use, shown below.

What	Why we use it	Lawful basis
Your name, email, phone number and booking history	To create your booking account, manage your classes and passes, and contact you about bookings (for example, if a class is cancelled)	Contract: we need it to provide the classes you've booked
Emergency contact details	So we can reach someone if you're unwell or injured in the studio	Legitimate interest: your safety during classes
Health information you give us, such as injuries, medical conditions or pregnancy	So your instructor can adapt exercises and teach you safely	Your explicit consent, which you can withdraw at any time
Your name and email address, if you join our mailing list	To send you news, class updates and offers	Your consent
Anything you send us by email, phone or message	To reply to your enquiry	Legitimate interest: answering your questions
How you use our website (pages visited, device type, rough location)	To understand which pages are useful and improve the site	Your consent, given through our cookie banner

We don't sell your information, and we don't use it for automated decision-making or profiling.

3. Payments and card security

We never see or store your full card details. Bookings and payments are handled by Punchpass, our booking system, and card payments are processed by Stripe.

When you pay, your card details go directly to Stripe over an encrypted connection. Stripe is certified to PCI DSS Level 1, the highest security standard in the card payment industry. We receive only what we need to manage your account, such as the amount paid, the pass you bought, and the last four digits and expiry date of your card.

If you choose to save a card for faster checkout or a recurring membership, it is stored securely by Stripe, not by us. You can remove a saved card from your Punchpass account at any time.

4. Our mailing list

If you sign up to our mailing list on the website, we'll use your email address to send studio news, timetable updates and occasional offers. We'll only do this with your consent.

Our mailing list is run by Mailchimp. Every email we send includes an unsubscribe link, or you can email us and we'll remove you.

Mailchimp may record whether you open our emails or click links in them. We use this only to see which updates are useful to you.

5. Who we share your information with

We use a small number of trusted services to run the studio. They only handle your information on our instructions and must keep it secure.

Service	What they do for us
Punchpass	Class bookings, passes and your customer account
Stripe	Card payment processing
Mailchimp	Our mailing list
Google (Analytics and Maps)	Website statistics and the map on our site
Framer	Hosts our website
Google Workspace	Our studio email

Our instructors can see the booking details and any health information needed to teach you safely.

We may also share information if the law requires it, or with professional advisers such as an accountant.

6. Transfers, storage and security

Outside the UK. Some of these services, including Punchpass, Mailchimp, Stripe and Google, store data in the United States. When your information leaves the UK, it's protected by approved safeguards, such as the UK-US data bridge or UK-approved contract terms.

How long we keep it.

Information	How long
Booking and payment records	6 years after your last booking, for tax and accounting
Health information	Until you stop attending, then deleted within 12 months
Mailing list details	Until you unsubscribe
Enquiries	Up to 12 months after we've replied
Website statistics	14 months

Keeping it safe. Your information is stored in password-protected accounts that only Sarah and our instructors can access, and we only use services with strong security.

7. Cookies

Cookies are small files stored on your device when you visit a website. We keep them to a minimum.

Cookie	Set by	What it's for	Needs your consent?
_ga, ga[ID]	Google Analytics	Counts visits and shows which pages are used, so we can improve the site. Kept for up to 2 years.	Yes, only set if you accept
Booking cookies	Punchpass	Keep you logged in and make booking and payment work	No, essential for booking
Map cookies	Google Maps	Display the map of our studio location	No

When you first visit, our cookie banner asks whether you're happy for us to use analytics cookies. You can change your mind at any time using the cookie settings link at the bottom of every page, or by clearing cookies in your browser.

8. Your rights and how to complain

Under UK data protection law, you have the right to:

ask for a copy of the information we hold about you
ask us to correct anything that's wrong
ask us to delete your information
ask us to limit how we use it, or object to us using it
ask for your information in a format you can take elsewhere
withdraw your consent at any time, where we rely on it

To use any of these rights, contact us using the details in section 1. We'll reply within one month. There's usually no charge.

If you're unhappy with how we've handled your information, please tell us first and we'll try to put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.