Privacy Policy

Pilates Studios UK ("we", "us", "our") is committed to protecting and respecting your privacy. This policy explains what personal data we collect, how we use it, your rights under UK GDPR, and how to exercise them.

1. Who we are

Pilates Studios UK is an independent UK pilates studio directory. For the purposes of UK GDPR, we are the data controller for both the enquiries visitors send us and the business information we publish about studios.

• · Controller: [LEGAL ENTITY OR FULL NAME]
• · Address: [REGISTERED OR CORRESPONDENCE ADDRESS]
• · Email: [PRIVACY CONTACT EMAIL]
• · ICO registration: [ICO REGISTRATION NUMBER, OR REMOVE THIS LINE IF NOT REGISTERED]

You can also reach us through our contact form, which has a dedicated option for studio owners who want their listing corrected or removed.

2. Information we publish about studios

This section is for studio owners, instructors and the people named in Google reviews. It explains data we hold that did not come from you — what UK GDPR Article 14 requires us to tell you.

Where it comes from

Studio listings are compiled from the Google Places API — the same public business information that appears on Google Maps. We do not contact studios before listing them, and we do not take content from studio websites.

What we hold

• · Business name, address, postcode and approximate coordinates
• · Business phone number and website address
• · Opening hours, where Google publishes them
• · Google rating and review count
• · Photographs published on the business's Google listing
• · Extracts from Google reviews, including the reviewer's display name as it appears publicly on Google
• · Service categories, which we infer from the listing and from review text — these are our inference, not a statement by the studio

Why we publish it, and on what basis

Our lawful basis is legitimate interests (Article 6(1)(f)): operating a directory that helps people find local pilates classes, using business information that is already public. We have weighed this against the interests of the businesses listed. The information is commercial rather than private, it is already published by Google, listing is free and carries no obligation, and any studio can have its entry corrected or removed on request. Where a listing names an individual — a sole trader operating under their own name, or a review author — that balance is finer, which is why the objection route below is unconditional.

Your right to object — no reason needed

Under Article 21 you can object to your listing at any time and we will remove it. You do not need to give a reason and we will not ask you to justify the request. You can also ask us to correct anything that is wrong (Article 16), or ask for a copy of what we hold about you (Article 15). Use the contact form and choose the studio-listing option, and we will respond within one calendar month — in practice, far sooner.

If you are named as a review author and would rather not be, tell us and we will remove your name from the extract or drop the extract entirely.

3. What data we collect from you

When you submit our recommendation form

• · Name and phone number (required)
• · Email address (optional)
• · Location (city/area)
• · Your pilates goal and budget range
• · Free-text notes you provide
• · Page URL where the form was submitted
• · IP address and timestamp

Automatic data when you use our site

• · Cookies (see our Cookie Policy)
• · Browser type, device type, screen resolution
• · Pages visited, time on page, scroll depth
• · Referrer URL (which site sent you to us)
• · Approximate location (country/city level via IP)

4. Lawful basis for processing

We process personal data under the following UK GDPR lawful bases:

• · Consent (Article 6(1)(a)) — when you submit our recommendation form, you consent to us using your contact details to respond to you
• · Explicit consent (Article 9(2)(a)) — for any health-related information in your enquiry, as described above
• · Legitimate interests (Article 6(1)(f)) — for publishing studio business information, for analytics, and for security monitoring
• · Legal obligation (Article 6(1)(c)) — when we must comply with UK law (e.g. responding to ICO enquiries)

5. How we use your data

• · To match you with relevant UK pilates studios based on your stated preferences
• · To send you those studio recommendations via phone or email
• · To improve our directory based on which studios users prefer
• · To detect and prevent fraud, spam, or misuse of our service
• · To comply with legal obligations

We will never sell your personal data to third parties.

6. Who receives your data

We do not pass your enquiry to studios. When you use the recommendation form, your enquiry comes to us and we reply to you directly. No studio receives your details unless you ask us to put you in touch with one.

We use the following service providers, who process data on our behalf:

• · Vercel — website hosting and delivery. Handles every request to the site, including form submissions in transit and IP addresses. United States and global edge network.
• · Resend — sends us the email containing your enquiry. Receives everything you typed into the form, plus your IP address. United States.
• · Google (Gmail) — the mailbox those enquiry emails are delivered to and stored in.
• · Google Maps — each studio page embeds a Google map. Loading a studio page sends your IP address, browser details and the page address to Google. This happens on page load.
• · Google Places — the source of studio listings and studio photographs.

Depending on what is switched on, the site may also load Google Analytics 4, Google Tag Manager, Microsoft Clarity (which records how visitors move through pages) and the Meta pixel (which shares site activity with Meta for advertising measurement). Which of these are active is set out in our Cookie Policy.

We do not sell personal data, and we do not pass enquiry details to advertisers.

7. International data transfers

Most of the providers above are based in the United States. Where personal data is transferred outside the UK we rely on the UK extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise on the International Data Transfer Addendum to the EU Standard Contractual Clauses.

8. How long we keep your data

We would rather describe this accurately than quote a schedule we do not operate:

• · Your enquiry is delivered to our email inbox and stays there until we delete it. There is no automatic deletion, so if you want yours removed, ask us and we will delete it.
• · Studio listings are kept for as long as the studio is listed. Remove a listing and the record is deleted outright, not archived.
• · Hosting and analytics logs are kept for as long as each provider retains them under its own policy — for Google Analytics this defaults to 26 months.
• · Cookies — see our Cookie Policy.

9. Your rights under UK GDPR

You have the following rights regarding your personal data:

• · Right to be informed — what we collect and why (this policy)
• · Right of access — request a copy of your data
• · Right to rectification — correct inaccurate data
• · Right to erasure ("right to be forgotten") — request deletion
• · Right to restrict processing — limit how we use your data
• · Right to data portability — receive your data in a structured format
• · Right to object — to processing based on legitimate interests
• · Rights related to automated decision-making — we don't make automated decisions with legal effect on you

To exercise any of these rights, submit your request via our contact form. We will respond within one calendar month, free of charge.

10. Right to complain

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• · Website: ico.org.uk
• · Helpline: 0303 123 1113
• · Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We'd appreciate the opportunity to address your concerns first — please contact us before lodging a formal complaint.

11. Security

The site is served over HTTPS, hosting is provided by Vercel, and enquiry emails are transmitted over encrypted connections. Access to the enquiry mailbox is protected by a password and two-factor authentication. This is a small operation rather than a large company with a security team, so we would rather be plain about that than imply more. No method of internet transmission is completely secure.

12. Children's data

Our service is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has submitted data to us, contact us immediately and we will delete it.

13. Changes to this policy

We review this policy regularly and may update it. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated via a notice on our home page.

14. Contact us

For any privacy-related questions or to exercise your UK GDPR rights, please use our contact form.