Privacy policy.

Nova Core Wellness is a Pilates and movement studio in Liverpool, trading as a sole trader owned by Natalie Melia. We are the data controller for the personal information described in this policy, which means we decide what is collected and what happens to it.

Nova Core Wellness (Natalie Melia)
187–193 Picton Road
Liverpool
L15 4LG

We are registering with the Information Commissioner’s Office as a data controller. Placeholder (Registration number to be added once issued.)

If you have any question about this policy or about your information, email us at info@novacorewellness.co.uk.

We collect different information depending on how you use the site. We do not buy personal data from anyone else, and we never sell yours.

If you join the mailing list

We store your email address, your first name if you give it, the date and time you ticked the consent box, and which page you signed up from. We use this only to send you the class timetable when it is confirmed and occasional studio news.

We keep a record of when you consented because data protection law requires us to be able to show that you asked to hear from us.

If you create a member account

We store your name, email address and a securely hashed version of your password. When you complete the joining form we also store your date of birth, address, phone number and an emergency contact name and number. We use this to run your membership: to identify you, take bookings, manage your class credits, and reach you or your emergency contact if something happens in the studio.

Your health questionnaire

Before your first class we ask you to complete a health screening questionnaire and sign it. Information about your health is “special category” data and is treated with extra care. We use it solely so instructors can teach you safely and adapt movements where needed. It is visible to studio staff who need it for that purpose, and to nobody else.

If you pay us

Card payments are handled entirely by Stripe. We never see or store your full card number. We keep a record of what you paid, when, and the reference Stripe gives us, so we can manage your membership and meet our accounting obligations.

Cookies

We only set cookies that are strictly necessary for the site to work: one that keeps you signed in, and one that remembers staff previewing the site before launch. We do not use advertising or analytics cookies, so there is no cookie banner to click through.

Data protection law requires us to have a specific reason, called a lawful basis, for each use of your information.

• Consent for marketing. We only email you class updates and studio news because you ticked the box asking us to. You can withdraw that consent at any time and we will stop.
• Performance of a contract for member accounts. When you take out a membership or book a class, we need your details to provide what you have paid for.
• Explicit consent for health information. You give this when you sign the health questionnaire, and we rely on it only to keep you safe in class.
• Legal obligation for financial records, which we must keep for a set period for tax purposes.

We share your information only with the suppliers who help us run the studio, and only with what they need. Each of them acts on our instructions and is bound by contract to protect it.

• Stripe processes card payments and subscriptions.
• Resend sends our emails, including booking confirmations and mailing list messages.
• Neon hosts the database your information is stored in.
• Vercel hosts this website and the booking system.

Some of these suppliers operate outside the UK. Where information is transferred abroad, it is protected by the safeguards UK data protection law requires, such as the International Data Transfer Agreement or an approved adequacy decision.

We will also disclose information where the law requires it. That might mean a regulator, or a valid court order.

• Mailing list: until you unsubscribe. When you do, we keep a minimal record that you opted out, so we do not add you back by mistake.
• Member accounts: for as long as you are a member, and for two years after your membership ends in case you come back.
• Health questionnaires: for the duration of your membership and for a period afterwards, as our insurer requires.
• Payment records: six years from the end of the financial year they relate to, as UK tax law requires.

When a retention period ends we delete the information or anonymise it so it can no longer identify you.

Under UK GDPR you have the right to:

• ask what personal data we hold about you, and get a copy;
• have inaccurate information corrected;
• ask us to delete your information, where we have no continuing reason to keep it;
• ask us to restrict how we use it, or object to a use;
• receive the information you gave us in a portable format, or have it sent to someone else;
• withdraw consent at any time, where consent is what we rely on.

To exercise any of these, email info@novacorewellness.co.uk. We will respond within one month. There is no charge.

To come off the mailing list, click the unsubscribe link at the bottom of any email we send you. It takes effect immediately. You can also email us and we will do it for you. Unsubscribing from marketing does not affect your membership, and you will still receive booking confirmations for classes you have booked.

If you are unhappy with how we have handled your personal information, you can complain to us directly. Email info@novacorewellness.co.uk with the word “complaint” in the subject line, and tell us what happened and what you would like us to do about it. You do not need to use any particular form of words.

We will acknowledge your complaint in writing within 30 days of receiving it. We will then look into it and tell you the outcome, along with anything we are changing as a result. If we need more time to investigate, we will say so and keep you updated.

Complaining to us first is not a condition of anything. You can go straight to the Information Commissioner’s Office if you prefer, and you can complain to them at any point, including while we are still looking into it.

The Information Commissioner’s Office is the UK’s data protection regulator. You have the right to complain to them about how we have handled your personal information at any time, and doing so is free.

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

If we change how we use your information we will update this page and change the date at the top. If the change is significant we will tell you directly.