Privacy Notice

Last updated: September 2026

This Privacy Notice explains how Align & Bloom Pilates ("we", "us", "our") collects and uses personal information when you visit our website, contact us, create a booking account, buy a class or pass, complete a health form, or attend a class.

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Data Controller: Align & Bloom Pilates
Email: tempeste@alignandbloompilates.com
Website: https://www.alignandbloompilates.com

Please contact us using the details above if you have questions about this notice or how we use your information.

2. Information We Collect

When you use this website, we may collect the following personal data:

a) Contact & enquiry information

We collect your name, email address, telephone number and any information you include in an enquiry or message.

b) Account and booking information

When you use Acuity Scheduling, we may collect your name, contact details, account information, appointments, classes booked or attended, cancellations, no-shows, waitlist entries, passes, subscriptions, credits, discount codes, communications, and your acceptance of applicable terms and waivers.

c) Payment and transaction information

We collect transaction details such as the product or class purchased, amount, date, payment status, refund information and transaction reference. Payments are processed by Stripe. We do not normally receive or store your complete payment-card number. Your payment provider may process your information as an independent controller under its own privacy notice. We collect transaction details such as the product or class purchased, amount, date, payment status, refund information and transaction reference. Payments are processed by. We do not normally receive or store your complete payment-card number. Your payment provider may process your information as an independent controller under its own privacy notice.

d) Health and participation information

If you complete a Pilates Readiness Form or tell us about an injury, medical condition, pregnancy, postnatal status, surgery, medication, disability or access need, we collect the information needed to support safe participation and make appropriate class adjustments. Health information is special-category personal data and receives additional protection.

e) Attendance and incident information

We may record attendance, relevant communications, accidents, injuries, safeguarding concerns, complaints and steps taken in response.

f) Marketing preferences

We record whether you have asked to receive or stop receiving marketing emails or messages.

g) Website and device information

Squarespace, Acuity and any enabled analytics tools may collect IP address, browser and device information, approximate location, pages viewed, referral source, interactions and cookie identifiers. See our Cookie Policy.

3. How we obtain information

We receive information directly from you when you contact us, submit a form, book or pay, join a waitlist, attend a class or communicate with us. We also receive information from Squarespace, Acuity, Stripe, cookie and analytics services you permit, and, where appropriate, a parent, guardian, emergency contact or healthcare professional acting with your authority.

4. Why we use information and our lawful bases

a) Responding to enquiries

  • Information: Contact details and message.

  • UK GDPR basis: Legitimate interests in responding and operating the business; steps requested before a contract where relevant.

b) Accounts, bookings, passes and classes

  • Information: Contact, booking, attendance and transaction data.

  • UK GDPR basis: Contract; steps requested before entering a contract.

c) Payments, refunds and accounting

  • Information: Transaction and limited payment data.

  • UK GDPR basis: Contract; legal obligation; legitimate interests in financial administration.

d) Confirmations, reminders and service updates

  • Information: Contact and booking data.

  • UK GDPR basis: Contract and legitimate interests. These are service messages, not marketing.

e) Safe participation and adjustments

  • Information: Health, access and participation information.

  • UK GDPR basis: Contract or legitimate interests under Article 6; explicit consent under Article 9(2)(a) for health information, unless another lawful condition clearly applies.

f) Emergencies and incidents

  • Information: Health, emergency-contact and incident data.

  • UK GDPR basis: Vital interests, legal obligation, legitimate interests and, for special-category data, vital interests or legal claims where applicable.

g) Legal, insurance and dispute records

  • Information: Bookings, waivers, health and incident data.

  • UK GDPR basis: Legal obligation and legitimate interests; Article 9(2)(f) where health data is necessary for legal claims.

h) Optional marketing

  • Information: Contact details and preferences.

  • UK GDPR basis: Consent, or the limited “soft opt-in” where legally available. Every marketing message includes an opt-out.

i) Website security and improvement.

  • Information: Device, usage and technical data.

  • UK GDPR basis: Legitimate interests for essential security; consent for non-essential cookies or analytics where required.

5. Health information and explicit consent

We ask only for health information that is relevant to safe participation. Where we rely on explicit consent, the request will be separate, specific and affirmative. You may withdraw consent by emailing us. Withdrawal does not affect processing that was lawful before withdrawal, and we may retain limited records where needed for legal claims, insurance or another lawful obligation. If information is reasonably needed to assess safe participation and you choose not to provide it, we may be unable to offer the relevant class safely.

6. Marketing

Booking confirmations, reminders, cancellations, safety messages and account notices are service communications. We will send promotional emails or texts only where permitted by law. You can unsubscribe using the link in a marketing email or by contacting us. We may keep a minimal suppression record so that we do not contact you again by mistake.

7. Sharing information

We share information only where needed for the purposes described in this notice, including with:

  • Squarespace and Acuity Scheduling for website hosting, forms, scheduling, client accounts, emails and related services;

  • Stripe for payment processing, fraud prevention, refunds and disputes;

  • Squarespace for business and marketing communications;

  • instructors, authorised assistants and venues where they need limited information to deliver a class safely;

  • accountants, insurers, legal advisers and other professional advisers;

  • emergency services where necessary to protect life or health; and

  • regulators, courts, law-enforcement bodies or other parties where required by law or necessary to establish, exercise or defend legal rights.

We do not sell personal information. We do not share it with third parties for their independent marketing without permission.

8. International transfers

Some suppliers may store or access information outside the United Kingdom. Where UK data-protection law requires a safeguard, we use an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful mechanism. You may contact us for further information about the safeguards relevant to your information.

9. How long we keep information

a) Enquiries that do not become clients

  • Retention period: Up to 12 months after the last meaningful contact.

b) Client, booking, pass and transaction records

  • Retention period: Up to six years after the end of the client relationship or transaction, where needed for contracts, tax, accounting, insurance or legal claims.

c) Health-readiness and participation information

  • Retention period: Review annually; normally delete three years after the last class, unless insurance, safeguarding or legal-claims requirements justify longer retention.

d) Accident, incident or complaint records

  • Retention period: For the relevant statutory limitation period and any longer period reasonably required by an insurer or safeguarding obligation.

e) Marketing consent and suppression records

  • Retention period: For as long as marketing continues, plus a limited record of consent or objection where needed to demonstrate compliance.

f) Cookie information

  • Retention period: For the duration stated in the cookie controls or provider information, subject to periodic review.

We may delete information sooner when it is no longer needed or retain it longer when required by law, an active complaint, safeguarding concern or legal claim.

10. Security

We use reasonable technical and organisational safeguards appropriate to the sensitivity of the information. Access is limited to people who need it. No internet service is completely secure, and we cannot guarantee absolute security. Please do not send detailed health or payment-card information through ordinary email unless we specifically ask you to use an appropriate secure method.

11. Your Data Protection Rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to the use of your information; receive certain information in a portable format; withdraw consent; and complain to the Information Commissioner’s Office. These rights are not absolute and legal exceptions may apply. Contact tempeste@alignandbloompilates.com to exercise a right. We may need to verify your identity.

You can complain to the Information Commissioner’s Office at https://ico.org.uk. We would appreciate the opportunity to address your concern first.

12. Children

Our services and online booking are for people aged 18 or over

13. other websites and services

Our website may link to services we do not control. Their privacy notices apply when you use them. Acuity Scheduling is part of the Squarespace suite, but the embedded scheduler may set or access its own cookies and process booking information as described above.

14. changes to this notice

We may update this notice when our services, suppliers or legal obligations change. The current version and revision date will be published on our website. Where a change materially affects how we use existing information, we will take reasonable steps to bring it to your attention.