Privacy Policy
PILATES PEAKS — PRIVACY POLICY
Last updated: May 2026
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. WHO WE ARE AND HOW TO CONTACT US
Pilates Peaks is operated by Hannah Sharman trading as Pilates Peaks, Flat 2 Harbour Lights, Arwenack Street, Falmouth, Cornwall, TR11 3LH, United Kingdom ("we", "us", "our").
We are the data controller for personal data collected through this website and through our booking process. Because we operate in both the United Kingdom and France, we are subject to both the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR / Regulation 2016/679), as implemented in France by the Loi Informatique et Libertés.
If you have any questions about this Privacy Policy or how we handle your data, please contact us:
Email: contactpilatespeaks@gmail.com
Phone: +44 7557 352761
2. WHAT THIS POLICY COVERS
This policy explains:
— what personal data we collect about you
— why we collect it and the legal basis for doing so
— how we use and store it
— who we share it with
— your rights under both UK GDPR and EU GDPR
— how to contact us or raise a complaint with a supervisory authority
This policy applies to visitors to our website and to clients who make bookings with us, whether in France, the United Kingdom, or elsewhere.
3. THE PERSONAL DATA WE COLLECT
We may collect the following categories of personal data:
CONTACT AND IDENTITY INFORMATION
— Full name
— Email address
— Telephone number
— Accommodation address (e.g. your chalet address in Les Trois Vallées)
— Country of residence
BOOKING AND PAYMENT INFORMATION
— Session type, date, and time
— Number of participants
— Payment reference (we do not store full card details — see clause 7)
— Correspondence relating to your booking
HEALTH INFORMATION
— Injuries, medical conditions, or physical limitations relevant to your ability to participate in Pilates
— Pregnancy status (where relevant)
Note: Health data is a special category of personal data under both UK and EU data protection law. We collect it only where you provide it voluntarily to help us deliver a safe and appropriate session. We will never share this information with third parties except as required by law or with your explicit consent
WEBSITE USAGE DATA
— Pages visited and time spent on the site (via cookies — see clause 8)
— Browser type and device type
— IP address (anonymised where possible)
COMMUNICATIONS
— Emails, messages, or enquiries you send to us
We do not knowingly collect personal data from children under the age of 16. If you are booking on behalf of a minor, please do not include the minor's personal details unless strictly necessary for their safety.
4. HOW WE COLLECT YOUR DATA
We collect personal data in the following ways:
— Directly from you when you make a booking via our website or contact us by phone or email
— Via our booking platform, Acuity Scheduling, when you complete the booking form
— Via our payment processor, Stripe, when you make a payment
— Automatically via cookies and analytics tools when you browse our website (see clause 8)
5. WHY WE USE YOUR DATA — LAWFUL BASES
Under both UK GDPR and EU GDPR, we must have a lawful basis for each use of your personal data. The bases we rely on are:
CONTRACT PERFORMANCE (Art. 6(1)(b) UK GDPR / EU GDPR)
We process your contact, booking, and payment details because this is necessary to fulfil the contract between us — to arrange, confirm, and deliver your Pilates session.
LEGITIMATE INTERESTS (Art. 6(1)(f) UK GDPR / EU GDPR)
We may use your contact details and booking history to:
— Respond to enquiries and follow up after your session
— Improve our services and website
— Handle complaints or disputes
We have assessed that these interests do not override your rights and freedoms.
LEGAL OBLIGATION (Art. 6(1)(c) UK GDPR / EU GDPR)
We may be required to retain certain records (e.g. financial records) to comply with UK or French tax and legal obligations.
EXPLICIT CONSENT (Art. 6(1)(a) and Art. 9(2)(a) UK GDPR / EU GDPR)
Where you provide health information, we rely on your explicit consent. You can withdraw this consent at any time, though doing so may affect our ability to safely deliver your session.
MARKETING
We will only contact you with news, offers, or updates about Pilates Peaks if you have opted in to receive such communications. You can unsubscribe at any time via the link in any email or by contacting us directly.
6. HOW LONG WE KEEP YOUR DATA
We retain your personal data only for as long as is necessary for the purpose it was collected. Our standard retention periods are:
— Booking and client records: 3 years from your last booking
— Financial / payment records: 6 years (required by HMRC in the UK; 10 years for French accounting obligations under French law — the longer period applies where we have a legal obligation in France)
— Health information: Deleted within 12 months of your last session unless you are an active repeat client
— Marketing contact: Until you unsubscribe or ask us to remove you
— Website analytics data: As set by third-party providers (typically up to 26 months)
After the applicable retention period, your data is securely deleted or anonymised.
7. WHO WE SHARE YOUR DATA WITH
We do not sell your personal data. We share it only with the following trusted third-party service providers, and only to the extent necessary to operate our business:
ACUITY SCHEDULING (Squarespace, Inc., USA)
Our online booking and scheduling platform. Your name, contact details, and appointment details are stored on Acuity's servers. Squarespace is certified under the EU-US Data Privacy Framework and provides appropriate safeguards for international data transfers.
Privacy policy: squarespace.com/privacy
STRIPE (Stripe, Inc., USA)
Our payment processor. Stripe processes your payment card details securely. We receive only a payment reference — we do not see or store your full card number. Stripe is certified under the EU-US Data Privacy Framework.
Privacy policy: stripe.com/gb/privacy
GOOGLE WORKSPACE (Google LLC, USA) — where applicable
If you contact us via a branded Pilates Peaks email address, your message will pass through Google's servers. Google is certified under the EU-US Data Privacy Framework.
Privacy policy: policies.google.com/privacy
SQUARESPACE (Squarespace, Inc., USA)
Our website is hosted on Squarespace, which processes your IP address and usage data as part of standard website hosting. Squarespace is certified under the EU-US Data Privacy Framework.
Privacy policy: squarespace.com/privacy
INTERNATIONAL DATA TRANSFERS
The third-party providers listed above are based in the United States. Transfers from the UK are governed by the UK's International Data Transfer Agreement (IDTA) or equivalent adequacy mechanism. Transfers from the EU/EEA (including France) are governed by the EU Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework where applicable. By using our website and services, you acknowledge these transfers and the safeguards in place.
We require all third parties to keep your personal data secure and to use it only for the purposes we specify.
8. COOKIES
Our website uses cookies — small text files stored on your device — to help it function and to understand how visitors use it.
ESSENTIAL COOKIES
Required for the website to work (e.g. session management). These cannot be disabled.
ANALYTICS COOKIES
We use Squarespace's built-in analytics to understand how visitors use our site (e.g. which pages are most visited). This data is aggregated and does not identify individuals.
BOOKING COOKIES
Acuity Scheduling may place cookies to support the booking process.
Under both UK and EU law (the UK PECR regulations and the EU ePrivacy Directive), we are required to obtain your consent before placing non-essential cookies. Our website will request your consent when you first visit.
You can also control cookies through your browser settings at any time. Disabling non-essential cookies will not affect your ability to browse the site or make a booking.
9. YOUR RIGHTS
Under both UK GDPR and EU GDPR, you have the following rights. To exercise any of them, please contact us at contactpilatespeaks@gmail.com. We will respond within one calendar month and will not charge a fee for reasonable requests.
RIGHT OF ACCESS — You can request a copy of the personal data we hold about you (a "Subject Access Request").
RIGHT TO RECTIFICATION — You can ask us to correct inaccurate or incomplete data.
RIGHT TO ERASURE ("RIGHT TO BE FORGOTTEN") — You can ask us to delete your personal data, subject to our legal obligations to retain certain records.
RIGHT TO RESTRICT PROCESSING — You can ask us to pause how we use your data while a dispute is being resolved.
RIGHT TO DATA PORTABILITY — You can ask us to provide your data in a structured, commonly used, machine-readable format.
RIGHT TO OBJECT — You can object to processing based on legitimate interests (including profiling) or to direct marketing. Where you object to direct marketing, we will stop immediately.
RIGHT TO WITHDRAW CONSENT — Where we rely on your consent (e.g. for health data or marketing), you can withdraw it at any time without affecting the lawfulness of prior processing.
RIGHT NOT TO BE SUBJECT TO AUTOMATED DECISIONS — We do not make automated decisions about you that produce legal or similarly significant effects.
EU residents also have the right to lodge a complaint directly with their local supervisory authority without first contacting us (see clause 10).
10. SUPERVISORY AUTHORITIES AND COMPLAINTS
We would always prefer to resolve any concern directly, so please contact us first at contactpilatespeaks@gmail.com.
If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection supervisory authority:
IF YOU ARE IN THE UK:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
IF YOU ARE IN FRANCE OR ANOTHER EU MEMBER STATE:
Commission Nationale de l'Informatique et des Libertés (CNIL) — France
Website: cnil.fr
Telephone: +33 1 53 73 22 22
EU residents may also contact the supervisory authority in their country of residence. A list of all EU supervisory authorities is available at: edpb.europa.eu
11. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The current version will always be available on our website with the "last updated" date at the top. Where changes are significant, we will notify you by email if we hold your contact details.
12. CONTACT
Pilates Peaks
Hannah Sharman trading as Pilates Peaks
Flat 2 Harbour Lights, Arwenack Street, Falmouth, Cornwall, TR11 3LH, United Kingdom
+44 7557 352761
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
NOTE: This Privacy Policy has been written to reflect compliance with both UK GDPR and EU GDPR (including French data protection law). As Pilates Peaks operates in France and processes personal data of EU residents, EU GDPR applies. Strictly speaking, EU GDPR requires organisations outside the EU that are subject to it to appoint an EU representative (Art. 27 EU GDPR) — however, this requirement does not apply where processing is "occasional" and does not involve large-scale processing of special category data. For a small seasonal business, Hannah is likely to fall within this exception, but we recommend seeking legal advice to confirm this as the business grows.
We also recommend having this policy reviewed by a solicitor or data protection specialist familiar with both UK and French/EU law before publishing.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━