Privacy Policy

Last updated: 25 August 2026

MyCharleston Cumbria is committed to protecting your privacy and handling your personal information fairly, transparently and securely. This privacy policy explains what information we collect, why we use it, who we may share it with, how long we keep it and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are and how to contact us

MyCharleston Cumbria is operated by Angeline Keightley, who is the data controller for the personal information described in this policy.

• Email: angeline@mycharleston-cumbria.co.uk
• Telephone: 07968 689947

The information we collect

Depending on how you interact with us, we may collect:

• Your name, email address, telephone number and other contact details.
• Information you provide in enquiries, booking forms, emails, telephone calls or messages.
• Class, workshop, event and booking information.
• Billing and transaction information. Card details are processed securely by Stripe and we do not store your full payment-card details.
• Your marketing preferences and records of consent.
• Health and emergency-contact information supplied through a Physical Activity Readiness Questionnaire (PARQ).
• Technical information such as your IP address, browser type, device information, pages visited and cookie information.

How we collect information

We collect personal information when you:

• Use this website or submit an online form.
• Contact us by email, telephone, social media or another messaging service.
• Book or pay for a class, course, workshop, performance or other service.
• Complete a PARQ or provide information needed to participate safely.
• Join our mailing list or change your marketing preferences.

Why we use your information

We use personal information only where we have a lawful basis. These purposes and lawful bases include:

• Providing services and managing bookings: to respond to enquiries, process bookings and payments, deliver classes or events and communicate with you. We rely on taking steps at your request before entering into a contract and on the performance of a contract.
• Running and improving the business: to administer the website, maintain records, prevent fraud, understand how our services are used and improve the customer experience. We rely on our legitimate interests where those interests do not override your rights.
• Meeting legal obligations: to keep appropriate financial, tax, safeguarding and other records, and to respond to lawful requests.
• Marketing: to send news and information about classes, events and offers where you have consented or where another lawful permission applies. You can opt out at any time.

Health information and PARQ forms

Health information is special category data and receives additional protection. We use PARQ information only to assess readiness for physical activity, make reasonable safety adjustments and respond appropriately if medical attention is required during a class or session.

Our Article 6 lawful basis is the performance of our contract with you and/or our legitimate interest in delivering activities safely. Our Article 9 condition for processing health information is your explicit consent. You may withdraw that consent at any time, although doing so may affect our ability to provide a service safely.

Cookies and website information

Our website may use cookies and similar technologies to make the site work, remember preferences, understand website use and improve our services. Where consent is required, non-essential cookies will only be used with your consent. You can also manage or block cookies through your browser settings, although doing so may affect parts of the website.

Who we share information with

We do not sell your personal information. We may share only the information necessary with trusted service providers that help us operate, including:

• Stripe, which processes payments.
• Mailchimp, which manages our mailing list and marketing emails.
• Website hosting, form, security, analytics and IT service providers.
• Professional advisers, insurers, accountants, regulators, law-enforcement bodies or other organisations where disclosure is required or permitted by law.

Service providers may use personal information only to provide the contracted service and must protect it appropriately.

International transfers

Some service providers, including Mailchimp, may process personal information outside the United Kingdom, including in the United States. Where a restricted international transfer takes place, we require an appropriate safeguard permitted by UK data-protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses.

How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected, including legal, accounting and reporting requirements. Our usual retention periods are:

• Enquiry, customer and general administration records: normally up to three years after the last meaningful contact or the end of the service.
• Financial and tax records: for at least five years after the relevant 31 January Self Assessment submission deadline, or longer where legally required.
• PARQ and related health information: while you are an active class member and for one year after your membership or participation ends, unless a longer period is required for a legal claim or another legal obligation.
• Marketing information: until you unsubscribe, withdraw consent or we determine that the information is no longer needed. We may retain a minimal suppression record so that we can respect an opt-out request.
• Cookie and analytics information: according to the relevant cookie settings and service-provider retention periods.

How we protect your information

We use appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. Access is limited to people and service providers that need the information for a legitimate purpose.

Marketing communications

You can ask us to stop sending marketing communications at any time by using the unsubscribe link in an email or contacting angeline@mycharleston-cumbria.co.uk. Withdrawing consent does not affect processing that took place before consent was withdrawn.

Your data-protection rights

Depending on the circumstances, you may have the right to:

• Ask for a copy of the personal information we hold about you.
• Ask us to correct inaccurate or incomplete information.
• Ask us to erase your information.
• Ask us to restrict how we use your information.
• Object to processing based on legitimate interests or to direct marketing.
• Ask us to transfer information you provided to us in a portable format.
• Withdraw consent where we rely on consent.

These rights are not absolute and legal exemptions may apply. To exercise a right, contact angeline@mycharleston-cumbria.co.uk. We will normally respond within one month and will not usually charge a fee.

We do not use personal information to make solely automated decisions that produce legal or similarly significant effects.

Complaints

If you have a concern, please contact us first so that we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data-protection regulator.

Changes to this policy

We may update this privacy policy when our services, systems or legal obligations change. The latest version will always be published on this page with its revision date.

Contact

Questions or requests about this policy can be sent to angeline@mycharleston-cumbria.co.uk or made by telephone on 07968 689947.