Privacy Policy
Last updated: 16 June 2025
1. Introduction
("we", "us", "our") operates the website ivorenthavessia.com and provides yoga studio services in London. We are committed to protecting the personal data of everyone who visits our website or contacts us. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have in relation to it.
This policy applies to all personal data processed by us in connection with our website and our studio services. It is written in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data Controller
The data controller responsible for your personal data is:
| Legal entity | |
|---|---|
| Registered address | |
| Company registration number | 16853942 |
| VAT number | GB 493728615 |
| Privacy contact email | privacy@ivorenthavessia.com |
| Website | ivorenthavessia.com |
If you have any questions about this policy or about how we handle your personal data, please contact us at the privacy email address above.
3. Personal Data We Collect
We collect and process the following categories of personal data:
3.1 Contact and Enquiry Data
When you submit an enquiry through our website contact form, send us an email, or communicate with us in any other way, we may collect:
- Your full name
- Your email address
- Any other information you choose to include in your message
3.2 Booking and Class Registration Data
When you register for a class, workshop, or other studio service, we may collect:
- Your full name
- Your email address
- Billing and payment details (processed securely through our payment provider)
- Class attendance records
- Your preferred class times or instructor preferences, where provided
3.3 Device and Technical Data
When you visit our website, we automatically collect certain technical information from your device and browser, including:
- Your IP address
- Browser type and version
- Operating system
- Pages viewed on our website and the time spent on each page
- The URL of the page you visited before arriving on our website
- Date and time of your visit
3.4 Consent and Cookie Data
Where we ask for your consent before placing non-essential cookies or using your data for optional purposes, we record your consent choices and the date and time those choices were made. This allows us to demonstrate compliance with our legal obligations.
3.5 Newsletter and Marketing Data
If you sign up to receive our newsletter or marketing communications, we collect your name and email address for that purpose, together with a record of your subscription consent.
4. Purposes and Legal Bases for Processing
The table below sets out each purpose for which we process personal data together with the UK GDPR legal basis on which we rely.
| Purpose | Legal Basis |
|---|---|
| Responding to enquiries and providing information about our studio and services | Legitimate interests (Article 6(1)(f) UK GDPR): it is in our mutual interest to communicate effectively with prospective and existing clients. |
| Processing class bookings and managing your studio account | Performance of a contract (Article 6(1)(b) UK GDPR): processing is necessary to fulfil your booking or to take steps at your request prior to entering into a contract. |
| Processing payments for classes and services | Performance of a contract (Article 6(1)(b) UK GDPR) and, where required, compliance with a legal obligation (Article 6(1)(c) UK GDPR). |
| Maintaining accounting, tax and financial records | Compliance with a legal obligation (Article 6(1)(c) UK GDPR): we are required by law to retain certain financial records. |
| Sending newsletters and promotional communications | Consent (Article 6(1)(a) UK GDPR): we will only send marketing emails where you have opted in. You may withdraw consent at any time. |
| Operating and improving our website, and understanding how visitors use it | Legitimate interests (Article 6(1)(f) UK GDPR): we have a legitimate interest in understanding website performance and improving the user experience. |
| Recording and managing cookie and marketing consent preferences | Compliance with a legal obligation (Article 6(1)(c) UK GDPR): we must be able to demonstrate the consent you have provided or declined. |
| Protecting our rights, property, or safety, and that of our clients or others | Legitimate interests (Article 6(1)(f) UK GDPR). |
4.1 Legitimate Interests Assessment
Where we rely on legitimate interests as our legal basis, we have assessed those interests against your rights and freedoms. We are satisfied that our processing does not override your interests, particularly because we collect only the minimum data necessary, we use appropriate security measures, and you retain the right to object at any time (see Section 9).
6. Sharing and Recipients of Personal Data
We do not sell your personal data to third parties. We may share your data with the following categories of recipients only where necessary and on appropriate terms:
- Payment processors: To handle payments for bookings and services securely on our behalf.
- IT and hosting providers: Companies that provide website hosting, data storage, and related technical infrastructure.
- Email service providers: Platforms we use to send booking confirmations, newsletters, and other communications.
- Booking and class management software providers: Platforms that support scheduling and studio administration.
- Professional advisers: Including accountants, auditors, and legal advisers, where required.
- Public authorities: Where we are required by law to disclose data, for example to HM Revenue and Customs or law enforcement agencies.
All third-party service providers acting on our behalf are required to process your data only on our instructions and to maintain appropriate security measures. We enter into data processing agreements with them as required under UK GDPR.
6.1 International Transfers
Where any of our service providers are based outside the United Kingdom, we ensure that your data is protected by appropriate safeguards. This includes transfers made to countries recognised by the UK as providing an adequate level of data protection, or transfers subject to UK-approved standard contractual clauses or the UK International Data Transfer Agreement. If you would like further information about the safeguards in place for international transfers, please contact us at privacy@ivorenthavessia.com.
7. How Long We Keep Your Data
We retain personal data only for as long as is necessary for the purposes for which it was collected, taking into account legal, accounting, and reporting requirements.
| Category of Data | Retention Period |
|---|---|
| Enquiry and contact messages | Up to 2 years from the date of the enquiry, unless an ongoing relationship is established. |
| Booking and transaction records | 6 years from the end of the financial year in which the transaction occurred, to comply with HMRC requirements. |
| Marketing and newsletter subscription data | For as long as you remain subscribed. Upon unsubscription, we will suppress your details to avoid future contact and retain a minimal record of your opt-out for compliance purposes. |
| Cookie and consent records | Up to 3 years from the date consent was recorded, to allow us to demonstrate compliance. |
| Website technical and access logs | Up to 12 months from the date of collection. |
At the end of the applicable retention period, data is securely deleted or anonymised. In some circumstances we may retain data for longer where required by law or where we need to do so to establish, exercise, or defend legal claims.
8. Security of Your Personal Data
We take the security of your personal data seriously and have implemented technical and organisational measures appropriate to the nature of the data we hold and the risks involved. These measures include:
- Encrypted transmission of data between your browser and our website (TLS/HTTPS)
- Access controls limiting who within our organisation can access personal data
- Secure storage of data with our hosting and software providers
- Regular review of our data protection practices
While we take all reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) and, where required, you as an affected individual, in accordance with our legal obligations.
9. Your Rights
Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
- Right of access: You have the right to request a copy of the personal data we hold about you.
- Right to rectification: You have the right to ask us to correct inaccurate or incomplete personal data.
- Right to erasure: You have the right to ask us to delete your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected.
- Right to restriction of processing: You have the right to ask us to restrict the processing of your personal data in certain circumstances, for example while you contest the accuracy of the data.
- Right to data portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to ask us to transmit it to another controller where technically feasible.
- Right to object: You have the right to object at any time to the processing of your personal data where we rely on legitimate interests as our legal basis. You also have the absolute right to object to the processing of your data for direct marketing purposes.
- Right to withdraw consent: Where we process your data on the basis of your consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.
- Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. We do not carry out automated decision-making of this kind.
9.1 How to Exercise Your Rights
To exercise any of the rights listed above, please contact us by email at privacy@ivorenthavessia.com, clearly stating your request. We will respond within one calendar month of receiving your request. We may ask you to verify your identity before we process your request. In most cases there is no charge for exercising your rights, although we may charge a reasonable fee or decline to act if a request is manifestly unfounded or excessive.
10. Complaints
If you are unhappy with how we have handled your personal data, please contact us in the first instance at privacy@ivorenthavessia.com so that we have the opportunity to address your concerns.
If you remain dissatisfied after contacting us, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the supervisory authority for data protection in the United Kingdom:
- Website: ico.org.uk
- Postal address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline: 0303 123 1113
11. Links to Third-Party Websites
Our website may contain links to external websites. This Privacy Policy applies only to ivorenthavessia.com. We are not responsible for the privacy practices of any third-party websites and we encourage you to read the privacy policies of any external sites you visit.
12. Changes to This Privacy Policy
We review this Privacy Policy periodically and may update it from time to time to reflect changes in our practices, technology, or legal requirements. The date at the top of this page indicates when the policy was last updated. Where changes are significant, we will take reasonable steps to bring them to your attention.
We encourage you to review this policy whenever you visit our website to stay informed about how we protect your personal data.
13. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or the way we process your personal data, please contact us:
| privacy@ivorenthavessia.com | |
| Postal address |
|