Customer Privacy Notice

Post: Serene & Strong Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Email: admin@sereneandstrong.co.uk

To provide and improve products and services for clients

• Names and contact details
• Addresses
• Gender
• Pronoun preferences
• Occupation
• Date of birth
• Payment details (including card or bank information for transfers and direct debits)
• Transaction data (including details about payments to and from you and details of products and services you have purchased)
• Usage data (including information about how you interact with and use our website, products and services)
• Health information (such as medical records or health conditions)
• Information relating to compliments or complaints
• Video recordings
• Audio recordings (eg calls)
• Records of meetings and decisions
• Account access information
• Website user information

We also collect or use the following special category information to provide and improve products and services for clients. This information is subject to additional protection due to its sensitive nature:

• Health information

Operation of client or customer accounts

• Names and contact details
• Purchase or service history
• Account information, including registration details
• Information used for security purposes
• Marketing preferences

We also collect or use the following special category information for the operation of client or customer accounts. This information is subject to additional protection due to its sensitive nature:

• Health information

Information updates or marketing purposes

• Names and contact details
• Addresses
• Profile information
• Marketing preferences
• Purchase or account history
• Website and app user journey information

We also collect or use the following special category information for information updates or marketing purposes. This information is subject to additional protection due to its sensitive nature:

• Health information

Comply with legal requirements

• Name
• Contact information
• Client account information
• Health and safety information
• Any other personal information required to comply with legal obligations
• Safeguarding information
• Records required for legal and contractual compliance, including but not limited to: consent records, communication logs, payment and transaction records, attendance records, and incident reports.

Protect client welfare

• Names and contact information
• Client account information
• Health and wellbeing information
• Emergency contact details
• Dietary and nutritional information, medical and health history
• Mental health and wellbeing information, personal goals and aspirations

We also collect or use the following special category information to protect client welfare. This information is subject to additional protection due to its sensitive nature:

• Health information

Recruitment purposes

• Contact details (eg name, address, telephone number or personal email address)
• Employment history (eg job application, employment references or secondary employment)
• Education history (eg qualifications)
• Right to work information

Dealing with queries, complaints or claims

• Names and contact details
• Payment details
• Account information
• Purchase or service history
• Witness statements and contact details
• Photographs
• Relevant information from previous investigations
• Customer or client accounts and records
• Financial transaction information
• Information relating to health and safety (including incident investigation details and reports and accident book records)
• Correspondence

We also collect or use the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:

• Health information

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

Which lawful basis we rely on may affect your data protection rights, which are set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website.

• Your right of access — You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
• Your right to rectification — You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
• Your right to erasure — You have the right to ask us to delete your personal information.
• Your right to restriction of processing — You have the right to ask us to limit how we can use your personal information.
• Your right to object to processing — You have the right to object to the processing of your personal data.
• Your right to data portability — You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
• Your right to withdraw consent — When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

If a request is manifestly unfounded or excessive, for example if it is repetitive, we may charge a reasonable fee or refuse to act on it. We will explain our reasoning if we do so.

Limitations on the right to erasure: We may need to refuse, restrict, or partially fulfil erasure requests where: (a) we are legally required to retain the data (e.g., tax, employment law); (b) the data is necessary for insurance purposes or to defend or pursue legal claims; (c) the data relates to an ongoing complaint or investigation; (d) retention is necessary to comply with our legal obligations; (e) any other lawful basis applies to the data. We will inform you of any restrictions and the reasons for them.

Our lawful bases for the collection and use of your data

Provide and improve products and services for clients

• Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests — we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • To improve service quality and client experience by analysing class attendance patterns, client feedback, and engagement data to identify areas for enhancement and better tailor our offerings.
  • We also collect health information to ensure services are delivered safely and tailored to individual client needs.

Operation of client or customer accounts

• Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests — we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • To safeguard the physical, mental and emotional wellbeing of children attending our school workshops. We collect health information and account details to ensure services are delivered safely, identify child needs, and maintain emergency contact information for urgent situations.
  • To safeguard the physical, mental and emotional wellbeing of adult customers attending our classes. We collect health information and account details to ensure services are delivered safely, identify health considerations, and maintain emergency contact information for urgent situations.
  • To manage customer bookings, process payments, and operate customer accounts efficiently.
  • To maintain records for insurance purposes and to defend or pursue legal claims.
  • To prevent fraud and misuse of our services.

Information updates or marketing purposes

• Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Legitimate interests — we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • To promote relevant services to clients and keep them informed about new classes, courses, and workshops. We send targeted marketing based on their interests and previous attendance so they learn about services that may benefit them, while enabling our business to reach interested clients. Clients can opt out at any time.

Comply with legal requirements

• Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Protect client welfare

• Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Legitimate interests — we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • To deliver safe, personalised services by understanding client health needs, conditions, and goals. This allows us to modify classes appropriately, seek to prevent injury, and provide relevant support — protecting their physical and mental wellbeing. For children in school workshops, this safeguarding is essential to their protection.

Recruitment purposes

• Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests — we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • To assess applicant suitability for cover teaching roles. We collect employment history and references to verify experience, reliability, and ability to deliver safe services. This is a standard hiring practice that benefits both our business and applicants through fair assessment of qualifications.

Dealing with queries, complaints or claims

• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests — we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • To fairly investigate and resolve client queries, complaints, and claims by understanding the issue, assessing responsibility, and making appropriate decisions. We collect relevant information (account history, health data, correspondence, witness statements) to ensure transparent, documented resolution.
• Vital interests — collecting or using the information is needed when someone's physical or mental health or wellbeing is at urgent or serious risk. All of your data protection rights may apply, except the right to object and the right to portability.

• Directly from you
• Suppliers and service providers
• Parents and guardians (providing children's data when enrolling children in school workshops)
• Schools (providing information when hosting our workshops)
• Emergency contacts identified by clients on booking forms
• Witnesses to incidents or complaints during investigations
• Other instructors, including cover teachers, who may report attendance, incidents, or welfare concerns arising during a class they have covered
• Previous employment (recruitment purposes only)

The table below sets out how long we retain different categories of personal information, and why.

Children's data — how the 21st-birthday rule works in practice

Backup copies

Other important caveats

• Litigation hold: if a claim, dispute, or investigation is raised or reasonably anticipated involving a specific record, that record is retained beyond its normal schedule until the matter is resolved.
• Early deletion requests: individuals may request earlier deletion under their right to erasure; however, this schedule overrides such requests where retention is required by law (e.g. the 7-year HMRC requirement for financial records).
• Processor retention: our data processors may have their own independent retention obligations. We instruct processors to align with our retention periods where possible, but their own obligations may still apply.
• "Deletion" means secure and irreversible removal, not archiving or hiding of data.
• This schedule is reviewed annually, or on any material change to our business practices.
• Staff and instructor personnel records are held under separate HR retention rules, not covered by this schedule.

For more information on how long we store your personal information, or the criteria we use to determine this, please contact us using the details provided above.

Data processors

This data processor does the following activities for us: Manages class bookings, stores client names/emails/booking details, processes payments

This data processor does the following activities for us: Processes payment card transactions for class bookings and course payments

This data processor does the following activities for us: Stores accounting records, invoices, financial data, client payment history

This data processor does the following activities for us: Provides website usage and traffic analytics to help us understand how visitors use our site

This data processor does the following activities for us: Manages our email newsletter, including subscriber lists, interest preferences, and email sends

This data processor does the following activities for us: Provides secure cloud storage and backup for business files and correspondence

This data processor does the following activities for us: Provides website hosting and content delivery network services

This data processor does the following activities for us: Collects and stores health enrollment form responses, including health history, medical conditions, and personal health information

Others we share personal information with

• Other financial or fraud investigation authorities
• Insurance companies, brokers or other intermediaries
• Professional or legal advisors
• Emergency services
• Organisations we're legally obliged to share personal information with
• Publicly on our website, social media or other marketing and information media
• Suppliers and service providers

Where necessary, our data processors will share personal information outside of the UK. When doing so, they comply with the UK GDPR, ensuring appropriate safeguards are in place. For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the details above.

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: admin@sereneandstrong.co.uk
Post: Serene & Strong Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Our full Data Protection Complaints Procedure is published on our Complaints Procedure page. We aim to respond to all data protection complaints within 30 days.

If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113  |  Website: ico.org.uk/make-a-complaint

Last updated: 11 July 2026