This policy explains what personal information Formé by Liv collects when you use this website, book a class or get in touch, why we collect it, and your rights over it. We keep it to what we genuinely need to run your classes safely.
Who we are
Formé by Liv runs Reformer Pilates classes at Sculptd Pilates, 105 Provence Dr, Bournemouth BH11 9FE. We are the data controller for the information described here. For anything privacy-related, email hello@formebyliv.com.
What we collect
- Your details: name, email address and (optionally) mobile number, when you create an account, book or contact us.
- Your account: your email and a securely hashed password. We never see or store your password itself.
- Bookings: the classes you book, cancel or join a waitlist for, and your attendance.
- Payments: handled by Stripe. We receive confirmation that a payment was made and its amount; your card details go directly to Stripe and never reach us.
- Shop and memberships: what you buy, when, and your email address, so we can deliver your downloads and give members access to their library. Memberships are billed by Stripe; we see their status and renewal date, never your card.
- FORMÉ at Home: which classes you watch and how far you got, so you can pick up where you left off and track your progress.
- Health questionnaire: your answers about injuries, recent surgery, pregnancy and medical conditions, plus anything else you choose to tell us.
- Age confirmation: that you confirmed you are 16 or over, and when. We don’t ask for your date of birth.
- Messages: what you send through the contact form.
- Newsletter: if you subscribe, your email address and first name, when and how you joined, and whether each newsletter reached you. If delivery tracking is enabled, we may also see whether an email was opened or a link clicked.
- Security data: to stop automated attacks, we briefly record scrambled (hashed) versions of IP addresses and email addresses that attempt to sign in, sign up, book or send messages. These can’t be read back and are deleted within a day.
Your health information
Health information is a special category of personal data under UK GDPR, so we treat it with extra care. We only collect it with your explicit consent, given when you tick the consent box, and only use it so your instructor can adapt exercises and keep you safe in class. It is only visible to studio staff, never shared with anyone else, and never used for marketing.
You can review and update your answers at any time from your account. You can withdraw consent by emailing us. We’ll then delete your answers, though without them we may not be able to offer you a place in class safely.
Why we use it (and our lawful basis)
- To provide your classes and purchases (performance of a contract): managing your account, bookings, waitlist places, payments, downloads and memberships, and emails about them.
- To keep you safe (explicit consent): your health questionnaire.
- To send our newsletter: news, new classes, events and occasional offers from Formé by Liv. If you ask to join, we rely on your consent (confirmed by email). If you book a class or buy from us, we may send it as an existing customer (the “soft opt-in” under PECR, based on our legitimate interests) unless you tick “No studio news emails” at the time. It’s only ever about our own classes and offers, never third parties.
- To answer your enquiries (legitimate interests): replying to messages you send us.
- To protect the website (legitimate interests): preventing fraud, spam and unauthorised access.
- To meet legal obligations: keeping payment and booking records for tax and accounting.
We don’t sell your data. We only send newsletters to people who asked for them or who are customers and didn’t opt out, and every newsletter has a one-click unsubscribe link. You can also unsubscribe from your account page at any time. Unsubscribing doesn’t affect emails about classes you’ve booked.
Who we share it with
We use a small number of trusted providers to run this service. They only process your data on our instructions:
- Vercel: website hosting and secure file storage for downloads (our servers and files are in London).
- Neon: our database, hosted in London (UK).
- Stripe: payments and membership billing.
- Resend: sending booking emails and newsletters.
- Mux: streaming FORMÉ at Home classes, including anonymous playback quality data.
Some of these companies are based in the US. Where your data is handled outside the UK, it’s protected by recognised safeguards such as the UK–US Data Bridge or the ICO’s International Data Transfer Agreement.
How long we keep it
- Account and contact details: while your account is active, and deleted after 2 years with no bookings, or sooner if you ask.
- Shop and memberships: what you buy, when, and your email address, so we can deliver your downloads and give members access to their library. Memberships are billed by Stripe; we see their status and renewal date, never your card.
- Health questionnaire: while you’re attending classes, and deleted within 2 years of your last class or as soon as you withdraw consent.
- Booking, order and payment records: 6 years, as required for tax purposes.
- Contact form messages: up to 12 months.
- Newsletter: until you unsubscribe. We then keep only your email address on a do-not-email list so you’re never emailed again, unless you ask us to delete it entirely. Unconfirmed sign-ups are deleted after 30 days, and records of individual newsletters sent after 2 years.
- Security data: less than 24 hours.
Cookies and similar technologies
We only use what the site needs to work: a secure cookie that keeps you signed in, and your browser’s session storage to remember small preferences (such as not replaying the opening animation). We use no analytics, advertising or tracking cookies.
Our map of the studio is provided by Google Maps. When it loads, Google may set its own cookies and receive your IP address under Google’s privacy policy.
How we protect it
Everything is encrypted in transit (HTTPS) and your data is stored in an encrypted database. Passwords are stored only as salted hashes, sign-in attempts are rate-limited, sessions expire automatically, and the back office is restricted to authorised studio staff.
Your rights
Under UK data protection law you have the right to:
- access a copy of the personal data we hold about you
- have inaccurate data corrected
- have your data deleted
- restrict or object to how we use it
- receive your data in a portable format
- withdraw consent (for your health questionnaire or newsletter) at any time
To use any of these rights, email hello@formebyliv.com. We’ll respond within one month. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put things right first.
Age
Our classes and this website are for people aged 16 and over. We don’t knowingly collect data from anyone younger.
Changes to this policy
If we change how we use your data, we’ll update this page and the date at the top. For significant changes, we’ll let account holders know by email.