Privacy Policy | SPAG Wellness and Digital Ltd

1. Introduction

This Privacy Policy explains how SPAG Wellness and Digital Ltd (“we”, “us”, “our”) collects, uses, stores, and protects your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our website or services, you confirm that you have read and understood this Privacy Policy. If you do not agree with this policy, please do not use our services.

2. Data We Collect

A. Identity Data

Full name
Date of birth (where age verification is required)

B. Contact Data

Email address
Phone number (where provided)
Billing and correspondence address

C. Payment Data

Transaction details and payment history (processed and stored securely via third-party payment providers; we do not store full card details)

D. Technical Data

IP address
Browser type and version
Device information
Usage analytics and session data

E. Health Information (Where Voluntarily Provided)

Medical disclosures relevant to safe fitness participation

Health data is treated as special category data under UK GDPR and processed only where you have given explicit consent or where it is necessary for the performance of your contract with us.

3. How We Use Your Data

We process personal data for the following purposes:

Providing and managing online classes and services
Processing payments and managing subscriptions
Sending essential service communications and updates
Improving website performance and user experience
Complying with our legal and regulatory obligations
Responding to enquiries and resolving complaints

Legal bases under UK GDPR:

Contractual necessity – processing required to deliver the service you have purchased
Legitimate interests – improving our services and ensuring platform security
Legal obligation – compliance with UK law and regulatory requirements
Consent – where you have given specific consent (e.g. marketing communications, health data)

4. Marketing Communications

We will only send you marketing communications where you have given explicit consent to receive them. You may withdraw your consent and opt out of marketing communications at any time by clicking the unsubscribe link in any email, or by contacting us at info@spagwellness.com.

5. Data Sharing

We may share your personal data with:

Payment processors (to process transactions securely)
IT hosting and infrastructure providers
Email service providers (for service communications)
Professional advisers including legal and accounting professionals (under strict confidentiality obligations)

We do not sell, rent, or trade your personal data to any third parties. Any third parties we share data with are contractually required to process it only for specified purposes and in accordance with UK GDPR.

6. International Data Transfers

As a digital business serving international clients, your data may be processed outside of the UK. Where this occurs, we ensure that adequate safeguards are in place, including Standard Contractual Clauses approved by the UK ICO and secure data transfer protocols, in compliance with UK GDPR requirements.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

Duration of your active account and subscription
Legal and regulatory compliance obligations (typically up to 7 years for financial records under UK tax law)
Resolution of any disputes or complaints

Health data is deleted promptly once it is no longer required for safe service delivery.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access – to obtain a copy of your personal data
Right to rectification – to correct inaccurate or incomplete data
Right to erasure – to request deletion of your data (subject to legal retention obligations)
Right to restrict processing
Right to object to processing based on legitimate interests
Right to data portability
Right to withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, please contact us in writing at info@spagwellness.com. We will respond within 30 days in accordance with UK GDPR.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or destruction, including:

Secure HTTPS/SSL encrypted website hosting
Encrypted payment processing systems
Strict access controls limiting data access to authorised personnel only
Regular security monitoring and review

10. Contact & Data Controller

Data Controller: SPAG Wellness and Digital Ltd

Email: info@spagwellness.com

Registered Office: 82 Hillary Street, Walsall, England, WS2 9BS