Privacy & Data Protection Policy

Review Date: 4 February 2026

Controller: Strong + Bendy Reformer Ltd

Address: Strong and Bendy Reformer LTD, 5B Prince Edward Rd, London E9 5LX

Contact (Data Protection): hello@strongandbendy.co.uk

1. Introduction

We collect and process personal data to deliver studio services, bookings and payments and to comply with legal obligations.

This policy explains what personal data we process, how we use it, how long we retain it, and your rights.

2. Lawful Basis & Principles

We process personal data lawfully, fairly and transparently, and only for specified purposes.

We minimise data to what is necessary, keep it accurate, secure and not longer than needed.

3. What Personal Data We Collect

Via Mindbody (our booking/payment processor):

• Name, email, phone, address, payment card info (encrypted with only last 4 digits visible to us).

• Waivers and consent forms provided through Mindbody.

• Account status and attendance history.

(Mindbody’s own privacy terms apply).

Via ClassPass:

• Client name only; we do not receive email, phone or card details.

Website / Cookies:

We may use analytics tools such as Google Analytics and may implement cookie tracking in future via Squarespace.

4. How We Use Personal Data

We use personal data to:

• Provide class bookings, memberships and payments.

• Send transactional emails and service updates.

• Send marketing communications only where you have opted in (via Mindbody).

• Comply with legal obligations.

We do not market to persons under 18.

5. Data Sharing & Processors

Mindbody processes and stores client personal data on our behalf; they are our processor and have their own global privacy practices under applicable law, including data retention and security measures.

ClassPass holds client data separately; we receive only names.

We do not share personal data with unauthorised third parties.

6. Data Retention

We retain personal data for as long as needed for the purposes collected, including:

• Active client service delivery.

• Legal, accounting, tax or regulatory requirements.

Mindbody inactivates accounts after periods of non-use and retains data in accordance with their retention criteria (based on service use and applicable law).

Inactive accounts may be reactivated manually if clients return.

7. Your Rights

You have the right to:

• Request access to your personal data.

• Request correction of inaccurate data.

• Request erasure where lawful.

• Restrict or object to processing.

• Request data portability where applicable.

• Withdraw consent at any time (for marketing).

To make requests, contact Studio Manager Julia Nielsen at hello@strongandbendy.co.uk.

We will respond within required statutory timescales.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or damage.

9. Cookies & Tracking

Our website may use cookies and analytics tools.

Where required by UK law, we will obtain consent for cookies and provide controls to opt in or out.

10. Complaints to Authority

If you believe your data rights have been infringed, you can lodge a complaint with the UK Information Commissioner’s

Office (ICO).

11. Policy Review

This policy is reviewed whenever there is a significant change to our processing activities. Policies will be updated whenever significant business changes, new risks, or legal changes occur.

Review Date: 4 February 2026

Signed: Rhian Cowburn, Studio Owner

Last Review Date: 4th February 2026

Prepared and signed off by Studio Owner and Studio Manager