Yoga with Jenny

Legal

Privacy notice

Who we are

Yoga with Jenny provides small group yoga classes in Oakwood, North Leeds, in person at Oakwood Church Hall and online via Microsoft Teams, trading as Yoga with Jenny G. You can reach us at info@jennygyoga.co.uk.

This notice explains what personal data we collect when you book a class or hold a membership, why we collect it, how long we keep it, who we share it with, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

Data we collect and why

Booking a class

When you book a class we ask for your name and email address. We use these to confirm your booking and (for Wednesday classes, which also run on Microsoft Teams) to email you a “Join class” link once you’ve paid, which becomes active 15 minutes before the class starts (you can also join from Jenny’s Ubindi page). The link goes by email to you only; it is never published on the website.

Lawful basis: performance of a contract, under Article 6(1)(b) UK GDPR. We need this information to deliver the service you have booked.

Membership payments

Monthly memberships are collected by Direct Debit through GoCardless, a UK regulated payment institution. GoCardless takes your payment details directly; we never see or store your bank account number or sort code. GoCardless is the data controller for the payment information it holds. Its privacy policy is available at gocardless.com/legal/privacy.

Lawful basis: performance of a contract, under Article 6(1)(b) UK GDPR.

Health information

Before you join a class, Jenny may ask whether you have any injuries, health conditions, or other factors that affect how you move, so she can offer the right options for your body. Any information you share is used only to teach you safely, is seen only by Jenny, and is never shared with anyone else or included in routine correspondence.

Health information is special category data under UK GDPR (Article 9). Any health information shared with Jenny verbally in the meantime is held in confidence and used solely for teaching.

Cookies, tracking and JavaScript

This website sets no cookies and runs no analytics, advertising, or tracking scripts of any kind. There is no JavaScript on any page of this site. Your visit leaves no trace on our end beyond what your own browser or network logs locally.

Who we share your data with

We do not sell or rent personal data. We share it only with the service providers we need to run classes and memberships:

  • GoCardless Ltd: processes Direct Debit payments for memberships. Your payment details go directly to GoCardless; we do not hold them.
  • Krystal Web Hosting: this website and the info@jennygyoga.co.uk mailbox are hosted on Krystal’s servers in the UK. Email you send to us is received and stored on their infrastructure.
  • Microsoft Teams: Wednesday classes run a live Microsoft Teams session. You do not need a Microsoft account to join; you can join from your web browser as a guest. We share the class join link with you by email; we do not pass your personal data to Microsoft on your behalf. Your use of Microsoft Teams is governed by Microsoft’s own terms and privacy policy.

GoCardless acts as an independent data controller for the payment data it holds. Krystal acts as a data processor, holding hosting data on our behalf under a contractual obligation to process it only as directed.

How long we keep your data

Booking records and email correspondence
Kept while you are an active student and for a reasonable period after your last class. Records that form part of our financial accounts are kept for seven years from the end of the relevant tax year, as required by HMRC.
Membership records
Kept for the duration of your membership and for seven years afterwards for financial record keeping purposes.

When data is no longer needed and the retention period has passed, we delete or irreversibly anonymise it.

Your rights

Under UK GDPR you have the following rights over the personal data we hold about you. To exercise any of them, contact us at info@jennygyoga.co.uk. We will respond within one calendar month (or inform you if we need up to two further months for complex requests).

  • Right of access: ask for a copy of the personal data we hold about you (a ‘subject access request’). This is provided free of charge.
  • Right to rectification: ask us to correct data that is inaccurate or to complete data that is incomplete.
  • Right to erasure: ask us to delete your data where we no longer have a lawful reason to hold it. Note that some data must be retained for the legal periods set out above and cannot be erased early.
  • Right to restrict processing: ask us to pause how we use your data while a concern about accuracy or lawfulness is resolved.
  • Right to data portability: where processing is automated and based on contract or consent, ask us to provide your data in a portable format. Most data we hold is in email or manual records, so this right has limited practical scope here.
  • Right to object: where we rely on legitimate interests as a lawful basis, you can object to that processing. We do not currently rely on legitimate interests for the processing described above, but this right may become relevant as our services develop.
  • Rights related to automated decision making: we do not make automated decisions about you. This right is not currently relevant to our processing.

If you are unhappy with how we have handled your data and we have not resolved your concern, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection: ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.

Changes to this notice

We will update this page if we make material changes to how we handle personal data.