Privacy Policy

Version 1.0 | Effective date: 17 March 2026

Data Controller: Gracie Barra Holbrooks Ltd

a company registered in England and Wales, company number 13453244

Registered address: Unit B1, Endemere Rd, Coventry, CV6 5RH

Trading as: Gracie Barra Holbrooks

Data protection contact: Ramone Codrington

Email: info@graciebarraholbrookscoventry.co.uk

ICO registration number: [INSERT ICO REGISTRATION NUMBER]

1.1 This Privacy Policy explains what personal data we collect about you, why we collect it, how we use it, who we share it with, and how long we keep it. It also tells you about your rights under UK data protection law and how to use them.

1.2 This policy applies to everyone who interacts with us, including students, trial participants, parents and guardians of child students, website visitors, and anyone who contacts us with an enquiry.

1.3 We handle your personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.4 Please read this policy alongside our Terms and Conditions and Membership Terms, which are available on our policies page. If you have questions about how we handle your data, please contact us at info@graciebarraholbrookscoventry.co.uk

2.1 Gracie Barra Holbrooks Ltd, trading as Gracie Barra Holbrooks, is the data controller for the personal data described in this policy. As the data controller, we decide why and how your personal data is used.

2.2 We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator. Our registration number is shown in the contact box at the top of this policy. You can verify it on the ICO's public register at ico.org.uk.

2.3 We have nominated a data protection contact who oversees how we handle personal data and can answer any questions you have about this policy. You can reach them at info@graciebarraholbrookscoventry.co.uk

3.1 We collect and process the following categories of personal data:

Category

What this includes

Full name, date of birth, home address, email address, phone number

Medical conditions, injuries, disabilities, allergies, and any other health information relevant to safe training

Name, relationship, and contact details for a nominated emergency contact

Payment method type, billing address, and transaction history. We do not store full card or bank account numbers directly. These are handled by our payment processor

Membership type and start date, belt rank and grade history, attendance records, session bookings, and coaching notes relevant to your progress

Records of messages, emails, enquiries, and support requests sent to us, and your marketing preferences

IP address, browser type, pages visited, time spent on our website, and other data collected through cookies and analytics tools

Photographs and video footage taken at the academy for marketing and communications purposes

Images recorded by our CCTV system, where installed at our premises

3.2 Health and medical data is classed as special category data under UK GDPR and receives additional legal protection. We ask for it so that your coaches can look after you safely during training. For example, knowing about a severe allergy, a cardiac condition, asthma, or a learning difficulty helps us adapt how we coach and respond if something happens. Sharing health information with us is voluntary and is not a condition of membership. We will always tell you at the point of collection why we are asking for specific information.

3.3 We do not collect or retain any other special category data, such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data, or data about sexual orientation. If you share information of this kind with us, we will not record it or use it.

4.1 We collect personal data through the following means:

Online registration, membership, enquiry, and health declaration forms on our website

Trial class bookings made through our customer relationship management system (CRM)

Paper forms or signed documents completed during enrolment, where applicable

Communications you send to us by email, phone, or through our website

Our gym management software, through which students book sessions, track attendance, and manage their accounts

Cookies and analytics tools when you visit our website

Photography and video taken at the academy, where consent has been given

4.2 Where we ask you to provide personal data, we will always tell you why we are asking for it at the point of collection.

4.3 If you provide us with the personal data of a third party, such as an emergency contact or a child you are enrolling, you are responsible for ensuring you are entitled to share that data with us and, where possible, that the person is aware their details are being passed to us.

5.1 UK data protection law requires us to have a clear reason for every type of personal data we collect and use. The table below explains the reason that applies to each category of data.

Data category

Our reason for using it

Why this applies

To fulfil our contract with you; our legitimate business interest in running the academy

We need this to manage your membership and communicate with you. For trial and enquiry contacts, we have a legitimate interest in responding and following up

Your consent. In a genuine emergency, to protect your vital interests

Where you choose to share health information with us, you give your consent for us to hold and use it to keep you safe in training. In a genuine emergency we may also use health data to protect your life or someone else's, even without prior consent

To protect your vital interests; our legitimate business interest in student safety

Held so we can contact someone on your behalf if you are injured or taken ill

To fulfil our contract with you; our legal obligation to maintain financial records

Required to process payments and keep records as required by HMRC

To fulfil our contract with you; our legitimate business interest in delivering and improving the service

Used to deliver the membership you have paid for and to track and support your progress

Communications data: responding to enquiries and messages

Our legitimate business interest in communicating with students and prospective students

We have a genuine business reason to respond to and keep records of communications

Communications data: marketing updates to existing students

Our legitimate business interest in keeping existing students informed

We may send existing students relevant updates about our services by email or text without a separate marketing opt-in, provided those messages relate to similar services and we make it easy to unsubscribe. Students can opt out at any time

Communications data: marketing to new contacts or by post

We only send marketing to people who are not yet students, or any postal marketing, where prior consent has been given

Our legitimate business interest in running and improving our website (essential functions); your consent (non-essential cookies)

Non-essential cookies, including those used for advertising and analytics, are only placed with your prior consent via our CookieYes tool

Images and video

We only use identifiable photographs or footage for marketing purposes where you, or for a child their parent or guardian, have given written consent

Our legitimate business interest in the security of our premises and the safety of people in them

CCTV helps us keep the building secure and respond to incidents

5.2 Where we rely on your consent to use your data, you have the right to withdraw that consent at any time. Withdrawing consent does not affect anything we did lawfully before you withdrew it. To withdraw consent, please contact us at info@graciebarraholbrookscoventry.co.uk

6.1 We use your personal data for the following purposes:

Processing your membership application, managing your account, and delivering the training you have signed up for

Communicating with you about your membership, bookings, timetable changes, and academy news

Tracking your attendance, belt rank, and progress so your coaches can support you effectively

Processing your payments and maintaining accurate financial records

Using any health or medical information you have chosen to share with us to keep you safe during training and to help our coaches support you appropriately

Contacting your nominated emergency contact if you are injured or unwell and unable to contact them yourself

Responding to enquiries and supporting you with any questions or concerns you raise

Sending you information about our services, events, promotions, and updates where we have a lawful basis to do so

Monitoring and improving our website using analytics and behaviour data

Operating and maintaining the security and safety of our premises

6.2 We will not use your personal data for any purpose that is incompatible with the purposes listed above. If we ever want to use your data for a new purpose, we will contact you with details before doing so.

7.1 We share your personal data with certain third parties in order to operate our academy and deliver our services. Some act as data processors, meaning they handle data on our behalf and under our instructions only. Others act as independent data controllers and are separately responsible for their own compliance.

7.2 The table below lists the third parties we currently work with.

Third party

Purpose

Data shared

Customer relationship management, lead and enquiry tracking, trial bookings, and automated follow-up communications

Name, contact details, enquiry and booking information, communications history

Quill Forms

Name, contact details, health data, and any other information submitted through our online forms

Membership management, session booking, attendance tracking, and belt rank records

Name, contact details, membership data, attendance, belt rank, and training history

Zettle by PayPal (iZettle)

Name, billing address, payment method details, and transaction history

Cookie consent management: recording and managing your cookie preferences on our website

Your consent preferences and the date and version of consent given

Google Analytics

Anonymised data on pages visited and session behaviour. Only active where cookie consent has been given

Managing analytics and marketing tracking tools on our website

Technical website data. Marketing and analytics tags only fire where cookie consent has been given

Meta (Facebook and Instagram)

Paid advertising and ad performance tracking. Where we use the Meta Pixel on our website, we and Meta may share responsibility for data collected up to the point it is transmitted to Meta. Meta then processes that data under its own privacy policy

Technical website data via the Meta Pixel, only where cookie consent has been given

Website behaviour analytics including heatmaps and session recordings

Anonymised interaction data. Only active where cookie consent has been given

Google Workspace

Any personal data contained in emails and documents we create and store

7.3 Where a third party processes data on our behalf, they are contractually required to handle it securely, use it only as we instruct, and comply with UK GDPR. We do not sell your personal data to any third party.

7.4 Some of the third parties listed above may store or process your data outside the UK. Where this happens, we make sure that appropriate legal safeguards are in place to protect your data. You can ask for more information about these safeguards by contacting us at info@graciebarraholbrookscoventry.co.uk

7.5 We may also share your personal data with law enforcement agencies, courts, or other authorities where we are legally required to do so, or where we reasonably believe it is necessary to protect someone's safety.

8.1 Our website uses cookies. We use CookieYes to manage cookie consent, and non-essential cookies will only be placed on your device where you have given your prior consent through the cookie banner on our website. You can update your preferences at any time using the cookie settings link in our website footer.

8.2 Full details of the cookies we use, what they do, how long they last, and how to manage your preferences are set out in our Cookie Policy, which is available on our policies page.

9.1 We operate CCTV at our premises for the safety and security of everyone in our building and the protection of our property. Footage is held securely and retained for 60 days before being automatically overwritten, unless a specific recording needs to be kept in connection with an incident or legal matter.

9.2 Full details of how we operate our CCTV system, including camera locations and access controls, are set out in our CCTV Policy, which is available on our policies page.

10.1 We may take photographs and video footage at our academy for use in our marketing and communications. We will only use identifiable images of you for marketing purposes where you, or for a child their parent or guardian, have given written consent. You may withdraw that consent at any time by contacting us at info@graciebarraholbrookscoventry.co.uk

10.2 Full details of how we manage photography and video at the academy, including the consent process, are set out in our Media Consent Policy, which is available on our policies page.

11. Children's Data

11.1 Where a child under the age of 18 trains with us, we collect and process personal data about that child as part of the normal membership and safety processes described in this policy. For children, the parent or guardian acts as the contracting party and provides consent for photography and video where applicable.

11.2 Children's personal data is handled with additional care. Access is restricted to authorised staff and coaches who need it to deliver training safely.

11.3 Older children and teenagers may, depending on their level of understanding and maturity, be able to exercise certain data rights independently. If you are a parent or guardian with a question about your child's data, or a young person wishing to exercise your own rights, please contact us at info@graciebarraholbrookscoventry.co.uk

11.4 Our Safeguarding Policy sets out the wider responsibilities we have towards the welfare of children in our care and is available on our policies page.

12. How Long We Keep Your Data

12.1 We keep your personal data for only as long as we need it. The table below sets out our retention periods for each category of data.

Data category

Retention period

Reason

Membership and contact data

Duration of membership plus 6 years

To handle post-membership queries and meet legal obligations

Health and medical data (adults)

Duration of membership plus 6 years

In case of a delayed injury claim arising from training

Financial and billing records

7 years from the end of the relevant tax year

Required by HMRC

Children's data: identity, contact, health, and training records

Until the child reaches the age of 25, or 6 years after their last attendance, whichever is longer

To cover any injury claim that could be brought once the child reaches adulthood. Financial records for children follow the 7-year HMRC rule, which may run at the same time

Safeguarding records relating to a child

Until the child reaches the age of 25, or at least 7 years after their last attendance, whichever is longer

In line with statutory guidance on safeguarding record keeping

CCTV footage

60 days, unless retained for a specific incident

Routine security purposes only

Trial and enquiry data

24 months from the date of last interaction

To handle follow-up enquiries

Marketing consent records

While subscribed, plus 2 years after unsubscribing

To demonstrate that consent was validly given or withdrawn

Images and video

Until consent is withdrawn, or until we no longer have a use for the material, whichever is sooner

We will not retain or use images once consent has been withdrawn

Emails, enquiries, and support messages

3 years from the date of last communication

To handle any follow-up queries or disputes

Website analytics data

26 months

To monitor website performance over time

12.2 When your data is no longer needed, we will delete or anonymise it securely. Where immediate deletion is not possible, for example because data is held in backup systems, we will isolate it from further processing until deletion can be carried out.

13. Your Rights

13.1 Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

The right to be informed. You have the right to know what personal data we hold about you and how we use it. This policy fulfils that right.

The right of access. You have the right to ask for a copy of the personal data we hold about you. This is known as a Subject Access Request. See Section 14 for how to make one.

The right to rectification. If any data we hold about you is inaccurate or incomplete, you have the right to ask us to correct it.

The right to erasure. In certain circumstances, you have the right to ask us to delete your personal data. This right does not apply where we have a legal obligation to keep the data or where we need it to deal with a legal claim.

The right to restrict processing. In certain circumstances, you can ask us to pause using your data while a dispute is being resolved, without asking us to delete it entirely.

The right to data portability. Where we process your data by automated means on the basis of consent or contract, you have the right to receive it in a commonly used format and, where technically possible, to have it transferred directly to another organisation.

The right to object. You have the right to object to us using your data on the basis of our legitimate business interests. We will stop unless we can show a compelling reason that outweighs your rights. Where you object to us using your data for direct marketing, we will always stop with no exceptions. Contact us at info@graciebarraholbrookscoventry.co.uk to opt out.

The right to object to profiling. We use automated systems in our CRM to send follow-up messages based on your behaviour, for example if you enquired but did not book. This does not make any significant decisions about you automatically, but you have the right to object to it at any time by contacting us at info@graciebarraholbrookscoventry.co.uk

The right to withdraw consent. Where we rely on your consent to use your data, you can withdraw it at any time. This will not affect anything we did lawfully before you withdrew it.

The right to complain. You have the right to complain to the ICO if you believe we have not handled your personal data lawfully. Section 15 explains how to do this.

13.2 To exercise any of these rights, please contact us at info@graciebarraholbrookscoventry.co.uk We will respond within one month. In complex cases we may take up to three months, but we will let you know within the first month if that is the case.

13.3 We will not charge you for exercising your rights in most circumstances. If a request is clearly unfounded or excessive, we may charge a reasonable fee or decline to respond, and we will tell you if that applies.

14. How to Make a Subject Access Request

14.1 A Subject Access Request gives you the right to receive a copy of the personal data we hold about you, along with information about why we hold it, where we got it from, who it has been shared with, and how long we intend to keep it.

14.2 To make a Subject Access Request, please follow these steps:

Send your request by email to info@graciebarraholbrookscoventry.co.uk

Include your full name, the email address we hold for you, and your membership number or account reference if you know it.

Tell us what data you are looking for. If you want everything we hold, simply say so. If you are looking for data from a specific period or category, please describe it.

We may need to verify your identity before releasing any data and will let you know within a few days if we need anything from you.

We will provide your data within one month of receiving a valid request.

14.3 If you are making a request on behalf of a child, please confirm your relationship to the child and include their full name and date of birth. Where a child is of sufficient age and maturity to act independently, we may seek confirmation from them before releasing data to a parent or guardian.

15. Complaints and the ICO

15.1 If you have a concern about the way we handle your personal data, please contact us first at info@graciebarraholbrookscoventry.co.uk We will do our best to resolve your concern promptly and fairly.

15.2 If you are not satisfied with our response, or if you believe we have not handled your data lawfully, you have the right to complain to the ICO.

15.3 You can contact the ICO in the following ways:

Online: ico.org.uk/make-a-complaint

By phone: 0303 123 1113

By post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15.4 We would always prefer to hear from you directly before you contact the ICO, so please give us the opportunity to put things right first.

16. Changes to This Policy

16.1 We may update this Privacy Policy from time to time. When we do, we will update the version number and effective date at the top of this page.

16.2 If we make a significant change to how we use your personal data, we will let you know by email or by placing a notice on our website before the change takes effect.

16.3 We recommend reviewing this policy from time to time so you are always aware of how we handle your data.

This Privacy Policy was last updated on 17 March 2026 and is version 1.0.