Privacy policy

Last updated: 20-Feb-26

OrangeYoga (‘orangeYoga Studio CIC’, 'we', 'us', 'our') is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what personal information we collect, how we use it, and your rights in relation to it.

We are registered as a data controller with the Information Commissioner's Office (ICO). Our ICO registration number is ZC097007. This policy is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy, please contact us at:

1. Who We Are

OrangeYoga is a not-for-profit yoga studio. Our classes are delivered by self-employed, professionally qualified yoga teachers. For the purposes of this policy, OrangeYoga is the data controller for all personal data processed in connection with studio bookings, membership, and communications.

We may update this policy from time to time. Any material changes will be communicated by posting an update on our website or by contacting you directly. We recommend you check this page periodically.

2. What Personal Data We Collect

We collect personal data in the following circumstances:

When you create an account or book a class

  • Your full name and email address.

  • Optionally phone number and postcode.

  • Optionally date of birth (to send you a birthday offer and verify age eligibility).

Your payment details are handled directly and securely by our payment provider, Stripe - we never see or store your card details.

When you attend a class

The teacher will know the names of their students but not have access to any of your personal details.

You are asked to inform the teacher verbally of any current injuries or medical conditions before each class. This information is used by the teacher in the moment to adapt their teaching. It is not recorded or stored by OrangeYoga.

When you use our website

  • Technical data such as IP address, browser type, and pages visited (via cookies - see Section 8 below)

3. How We Use Your Personal Data

We use your personal data for the following purposes:

To fulfil our contract with you

  • Processing bookings and managing your account

  • Taking payment and issuing refunds

  • Sending booking confirmations, cancellation notices, and class reminders

  • Managing membership renewals and cancellations

For legitimate interests

  • Sending you marketing emails about our classes, workshops, and events where you have previously purchased from us and have not opted out

  • Responding to queries and complaints

  • Analysing how our website is used in order to improve it

  • If our business is sold or transferred - to enable continuity of service

With your consent

  • Sending you marketing communications if you have not previously purchased from us but have opted in

  • Setting non-essential cookies (see Section 8)

We will never sell your personal data to third parties or share it for their marketing purposes.

4. Third-Party Data Processors

We use trusted third-party services to run our studio operations. These providers process your data only on our instructions and are bound by appropriate data protection agreements:

  • Stripe - secure payment processing

  • Zoom - delivery of live-streamed online classes (where applicable)

Some of our third-party providers may be based outside the UK. Where data is transferred internationally, we ensure adequate safeguards are in place in accordance with UK GDPR requirements.

5. How Long We Keep Your Data

We retain your personal data for as long as is necessary for the purposes set out in this policy and in line with our legal obligations. As a general rule:

  • Account and booking data is retained for 7 years from your last interaction with us, after which it is securely deleted.

  • Financial transaction records may be kept for up to 7 years for tax and accounting purposes.

6. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right of access - you may request a copy of the personal data we hold about you (a 'Subject Access Request'). We will respond within 30 days of verifying your identity.

  • Right to rectification - you may ask us to correct inaccurate or incomplete data.

  • Right to erasure - you may ask us to delete your data, subject to any legal obligations requiring us to retain it.

  • Right to restriction - you may ask us to restrict how we process your data in certain circumstances.

  • Right to portability - you may request your data in a portable, machine-readable format.

  • Right to object - you may object to processing based on legitimate interests, including direct marketing.

  • Rights relating to automated decision-making - we do not make automated decisions about you that produce legal or significant effects.

To exercise any of these rights, please contact us at studio@orangeyoga.co.uk. We will respond within one calendar month. There is no charge for making a request.

7. Marketing Communications

We may send you emails about classes, workshops, events, and promotions. You can opt out at any time by:

  • Clicking the 'unsubscribe' link at the bottom of any marketing email

  • Contacting us directly at studio@orangeyoga.co.uk

  • Updating your preferences in your online account

Opting out of marketing will not affect your ability to receive essential service communications such as booking confirmations.

8. Cookies

Our website uses cookies - small text files stored on your device - to help us provide you with a better experience. We use:

  • Essential cookies - necessary for the website and booking system to function. These cannot be disabled.

You can manage your cookie preferences at any time using the cookie consent banner on our website, or by adjusting your browser settings. Please note that disabling certain cookies may affect website functionality.

9. Security

We take the security of your data seriously and have put in place appropriate technical and organisational measures to protect it from unauthorised access, disclosure, alteration, or destruction. These include:

  • Encryption of data in transit (SSL/TLS)

  • Restricted access to personal data on a need-to-know basis

  • Use of reputable, security-certified third-party service providers

  • We will never ask you for your full password by email or phone

10. Children's Privacy

Our website and services are not intended for anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us immediately and we will take steps to remove it.

11. Complaints

If you are unhappy with how we have handled your personal data, we encourage you to contact us first at [your email] so we can resolve the matter directly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

  • Website: www.ico.org.uk/concerns

  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

OrangeYoga Studio CIC, Crescent Bakery, 70 St Georges Place, Cheltenham GL50 3PN - studio@orangeyoga.co.uk