This policy explains what personal information Root & Reach Pilates (“we”, “us”) collects about you, why we collect it, how long we keep it, and the control you have over it. It is written to reflect exactly how our booking system works.
The data controller is Alison Bates, trading as Root & Reach Pilates, a sole trader based at Tomhaggard, Co. Wexford, Ireland. Our contact address for any privacy question is hello@rootandreach.ie.
1. The short version
- We collect what we need to take a booking, keep you safe in class, and keep proper accounts.
- We ask for health information, and we treat it as the sensitive data it is.
- We do not sell your data, and we never share it for anyone else’s marketing.
- Our website analytics uses no cookies and cannot identify you.
- You can download everything we hold, or delete your account, from your own dashboard.
2. What we collect
Account and contact details
- Your name and email address.
- Your phone number, if you give us one or if the studio books you in by phone or message.
- How you sign in: Google, or a one-time code sent to your email. We do not use passwords and we do not store any.
- Whether you have opted in to marketing email. This is separate from the emails we must send you about your bookings.
Health information
Before your first class we ask you to complete a short health screening (a PAR-Q) and accept a liability waiver. This covers things like heart conditions, injuries, recent surgery and pregnancy, plus anything you choose to tell us in your own words.
This is special-category data under Article 9 of the GDPR. We collect it only with your explicit consent, we use it for one purpose: so your instructor can look after you safely. We never use it for marketing or share it with anyone outside the studio. When you complete the form we also record the date, time and IP address, because a waiver has to be evidenced to be worth anything.
If the studio books you in directly and you complete a paper health form, we record only that a signed form exists and who confirmed it. Your health answers stay on the paper copy and are not entered into the system.
Booking and payment records
- Classes you book, attend, cancel or miss, and where you are on a waitlist.
- Classes remaining on your pack, and the history of how that balance changed.
- Payments, refunds, and (if the studio takes payment in person) that a cash or card payment was received, or that a class was given free.
- We never see or store your card details. Card payments are handled entirely by Stripe. If you choose to save a card for automatic renewal, it is stored by Stripe, not by us.
Technical information
- Your IP address when you sign in or submit a health form, as a security and fraud measure.
- Standard server logs.
3. Why we use it, and our legal basis
| What for | Legal basis |
|---|---|
| Taking and managing your bookings, packs and programmes | Performance of a contract |
| Emails about your bookings: confirmations, reminders, cancellations, receipts | Performance of a contract |
| Signing you in (one-time codes) | Performance of a contract |
| Health screening and liability waiver | Explicit consent (Article 9(2)(a)) |
| Keeping accounting and tax records | Legal obligation |
| Marketing email | Consent: opt-in, withdrawable at any time |
| Security, fraud prevention, and keeping the service working | Legitimate interests |
| Anonymous website statistics | Legitimate interests (no cookies, no identification) |
Transactional emails are not marketing. You cannot unsubscribe from a booking confirmation, because it is part of the service you asked for, but you can unsubscribe from marketing at any time without affecting it.
4. Website analytics, no cookies, no banner
We use DataFast in its cookieless mode to understand how many people visit the site and which pages they use. It sets no cookies, stores nothing on your device, and does not build a profile of you or follow you to other websites. Because it cannot identify you, we are not required to ask for cookie consent, which is why you will not see a cookie banner.
We deliberately chose this over more detailed tracking. Knowing roughly where our visitors come from is genuinely useful to a small studio; knowing who you are individually is not.
The analytics script does not run on the admin area, and payment pages are hosted by Stripe, so it never runs there either.
5. Who else is involved
We use a small number of service providers. Each one only processes data on our instructions.
| Provider | What they do | Where |
|---|---|---|
| Stripe | Card payments and saved cards | EU / USA |
| Resend | Sends our emails, including sign-in codes | EU / USA |
| Hetzner | Hosts the application and database | Germany |
| Cloudflare | Network security and encrypted off-site backups | EU / USA |
| Sign in with Google, if you choose it | EU / USA |
Where a provider processes data outside the EEA, that transfer is covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.
We do not sell your personal data, and we do not share it with anyone for their own marketing.
6. How long we keep it
| Information | Kept for |
|---|---|
| Your account and booking history | While your account is open, then deleted or anonymised on request |
| Financial and payment records | 6 years, as required by Irish tax law, retained in anonymised form after account deletion |
| Health form and signed waiver | Retained while you attend and for a period afterwards for insurance purposes (exact period to be confirmed with our insurer) |
| Marketing consent record | Until you withdraw it, plus a record of the withdrawal |
| Sign-in codes | Minutes; expired codes are deleted automatically every day |
| Encrypted backups | Up to 100 days, then permanently deleted |
One honest note about backups. We keep encrypted off-site backups so the studio could recover from a disaster. When you delete your account we remove your data from the live system immediately, but it may remain inside those encrypted backups until they age out, up to 100 days. Backups are not used for any day-to-day purpose and are only ever opened to restore the system after a failure.
7. Your rights
Under the GDPR you have the following rights, and we have built most of them into your account.
- Access and portability: download everything we hold about you, including your health form, as a file from your dashboard.
- Erasure: delete your account from your dashboard. We remove your personal details and health information, and anonymise the financial records we are legally required to keep, so they can no longer be linked to you.
- Rectification: correct your details in your account, or ask us.
- Withdraw consent: turn off marketing at any time in your account. You can also withdraw consent for us to hold your health information, though we will then be unable to let you attend classes, because we cannot do so safely without it.
- Restriction and objection: ask us to pause or stop a particular use of your data.
- Complain: you can contact us first, but you are also entitled to complain directly to the Irish Data Protection Commission at dataprotection.ie.
We will respond to any request within one month.
8. Keeping it safe
- All traffic to the site is encrypted.
- There are no passwords to steal, we sign you in with a one-time code that expires in minutes.
- Access to the admin system is restricted to studio staff accounts.
- Backups are encrypted before they leave our server, and are protected against deletion or tampering.
- Health information is stored separately from booking data and is only visible to the studio.
9. Children
Our classes and this website are intended for adults. We do not knowingly collect data about anyone under 16. If a young person attends a class, the booking and the health form must be completed by their parent or guardian.
10. Changes to this policy
If we change how we handle your data we will update this page and change the date at the top. If the change is significant, we will tell you by email.
11. Contact
Any question, request or complaint: hello@rootandreach.ie.