Privacy and Cookie Notice
How Bank Pilates uses and protects personal information
Effective date 18 July 2026
1. Who we are
LUME Wellness Ltd, trading as Bank Pilates (company number 16902274), is the controller responsible for the personal information described in this notice. In this notice, “LUME”, “Bank Pilates”, “we”, “us” and “our” refer to LUME Wellness Ltd.
Our registered address is:
24 Picton HouseHussar Court
Westside View
Waterlooville
PO7 7SQ
Privacy enquiries and rights requests may be sent to info@bankpilates.com or to the registered address above.
2. Scope of this notice
This notice applies to customers, prospective customers, website and app users, Pilates participants, physiotherapy and massage booking customers, workshop and event attendees, retail customers and visitors to our studio. It does not cover staff, job applicants or contractors, who are covered by separate notices.
LUME arranges bookings and payments for physiotherapy and massage services. Each physiotherapist or massage practitioner operates as an independent practitioner and controller for the clinical or treatment records they create and retain in their own system. Their privacy notice will be provided at or before the first appointment. LUME does not receive those clinical or treatment notes unless a limited disclosure is necessary and lawful, for example to deal with a safety incident, complaint or legal claim.
3. Personal information we collect
- Identity and contact information, including name, date of birth, address, email address and telephone number.
- Account and profile information, including login details, membership status and communication preferences.
- Booking and service information, including classes, appointments, workshops and events booked, attendance, waitlists and cancellations.
- Transaction and accounting information, including purchases, amounts paid, refunds and invoice references. Mindbody processes full card details and card security codes; LUME does not receive or store them.
- Pilates participation and safety information, including relevant injuries, health conditions, pregnancy, medication and disabilities or accessibility needs that may affect safe participation.
- Emergency-contact information, limited to the contact’s name, relationship to the customer and telephone number.
- Communications, enquiries, feedback, complaints and incident information.
- Technical and usage information, including IP address, device and browser information, website activity and identifiers collected through cookies and similar technologies.
- CCTV images from outside areas, reception and studios. CCTV is video-only and does not record audio.
- Photographs or videos created for promotional purposes where the individual has separately consented.
- Information connected with in-studio retail purchases, workshops and events.
4. How we obtain personal information
We obtain personal information:
- directly from you when you contact us, create an account, complete a health declaration, book, pay, attend or communicate with us;
- through Mindbody when you use its app, booking, account, payment or communication services;
- from a parent or guardian where a 16- or 17-year-old attends with the required consent;
- from the person who provides emergency-contact information;
- automatically through our website, consented analytics or advertising technology and CCTV; and
- from instructors, practitioners, payment and accounting providers, professional advisers, insurers, regulators or authorities where this is necessary and lawful.
If you give us another person’s emergency-contact details, you must tell that person that you have done so and direct them to this notice.
5. Why we use personal information and our lawful bases
UK data-protection law requires us to have a lawful basis for each use of personal information. The bases that apply depend on the purpose.
| Purpose | Lawful basis |
|---|---|
| Accounts, bookings, memberships, payments, refunds and service delivery | Necessary to enter into or perform our contract with you |
| Service, booking and safety communications | Contract; and legitimate interests in operating safe and reliable services where the message is not required by contract |
| Pilates participation and safety information | Explicit consent; see section 6 for the additional condition applying to health information |
| Accounting, tax and statutory records | Legal obligation |
| Customer support, complaints and service improvement | Contract and our legitimate interests in administering, improving and protecting our business |
| Security, fraud prevention and protection of systems | Our legitimate interests in protecting customers, staff, premises, systems and the business; and legal obligation where applicable |
| CCTV for security, crime prevention and incident investigation | Our legitimate interests in protecting people, premises and property, subject to necessity and proportionality safeguards |
| Email and SMS marketing | Consent; or legitimate interests where the PECR customer soft opt-in lawfully applies |
| Website analytics | Consent for non-exempt storage or access technology; and legitimate interests in understanding and improving our website |
| Google and Meta advertising measurement or targeting | Consent for storage or access technology and associated processing |
| Promotional photographs and videos | Consent |
| Legal claims, insurance and regulatory matters | Legitimate interests in establishing, exercising or defending legal rights; and legal obligation where applicable |
| Business sale, restructuring or due diligence | Legitimate interests in managing corporate transactions, subject to confidentiality and data-minimisation safeguards |
Where we rely on legitimate interests, we assess whether the use is necessary and balance our interests against the individual’s rights and reasonable expectations. You may contact us for further information about that assessment.
6. Health information and safe participation
Information about health, injury, pregnancy, medication, disability or accessibility can be special-category personal information. For Pilates participation, we rely on your explicit consent under Article 9(2)(a) of the UK GDPR in addition to the Article 6 basis identified above. We request only information relevant to safe participation, not a complete medical or medication history.
A health declaration and explicit consent are required before participating in a class because instructors need relevant information to deliver services safely. If you do not provide the required information, or withdraw consent while it remains necessary, we may be unable to allow you to participate. Withdrawing consent does not affect processing that was lawful before withdrawal.
Access is limited to authorised staff and instructors who need the information to deliver classes safely, manage an incident or meet legal obligations. Health information is not used for advertising.
7. Young people
A person under 18 may not create a Bank Pilates account. A person aged 16 or 17 may attend an eligible class only with parental or guardian consent. Both the young person and their parent or guardian must complete the relevant participation and health-data consent process. We provide the young person with an age-appropriate explanation of how their information will be used.
8. Marketing
We send marketing only by email or SMS. You may separately choose whether to receive email marketing and SMS marketing through unticked opt-in choices. You may withdraw either choice at any time through Mindbody communication preferences, the unsubscribe or opt-out method in the message, or by contacting us.
Where permitted by the Privacy and Electronic Communications Regulations, we may use the customer “soft opt-in” to send marketing about our own similar services. We do this only where we obtained the contact details during a sale or negotiation for a sale, offered a simple opt-out when collecting the details and include a simple opt-out in every message.
We retain limited suppression information after an opt-out so that we can respect the request. We do not currently upload customer email addresses or telephone numbers to Google or Meta to create advertising audiences. We will update this notice before beginning that practice.
9. Cookies and similar technologies
Our Squarespace website uses cookies and similar technologies, such as tags, pixels and local storage. Some are necessary for security, navigation, accessibility, forms, consent preferences and other requested website functions. Other technologies are optional.
| Category | Purpose and provider | Control |
|---|---|---|
| Strictly necessary | Squarespace and consent-management functions needed to operate, secure and remember choices on the website | Used without consent only where a legal exception applies |
| Analytics | Google Analytics, used to understand website use and improve performance | Off by default; activated only after the required consent |
| Advertising | Google Ads and Meta advertising technology, used for advertising measurement and, where enabled, retargeting | Off by default; activated only after the required consent |
When you first visit, our cookie controls provide comparable options to accept or reject optional technologies. Optional analytics and advertising tools do not operate before the required choice. You can make category-level choices and change or withdraw them later through the “Cookie settings” link on the website.
The cookie settings panel forms part of this notice and displays the current cookie or technology name, provider, purpose and duration. Browser controls can also delete or block cookies, but doing so may affect website functions. We review the cookie inventory when the website or its integrations change.
10. CCTV
We use video-only CCTV outside the premises, in reception and in studios for security, crime prevention and incident investigation. We do not use CCTV in changing or treatment areas and do not record audio. Signs identify monitored areas and provide contact information.
Access is restricted to authorised people. Footage is normally deleted after 30 days. A relevant clip may be retained for longer where necessary for an incident, complaint, insurance claim, law-enforcement request or legal proceeding. It is then deleted when no longer required. We do not use CCTV for routine performance monitoring or promotional purposes.
11. Who we share personal information with
Where necessary and lawful, we share information with:
- Mindbody Online Inc. and its authorised subprocessors for accounts, bookings, payments, communications and business-management services;
- Squarespace and website-support providers;
- Google for consented analytics and advertising services;
- Meta for consented advertising services;
- Xero and relevant bookkeeping or accounting providers for necessary invoice, transaction, reconciliation, tax and financial-reporting information;
- employed and contracted instructors who need information to deliver classes safely;
- independent physiotherapists and massage practitioners for booking and payment administration and other limited information necessary to provide the appointment;
- CCTV, IT, security, communications and professional-service providers acting under appropriate terms;
- insurers, accountants, auditors, lawyers and other professional advisers;
- police, courts, regulators, tax authorities or other public bodies where disclosure is required or permitted by law; and
- prospective purchasers, investors or advisers involved in a business transaction, subject to appropriate confidentiality safeguards.
Service providers acting as our processors may use personal information only for the contracted services and under our instructions, except where the law requires otherwise. Some providers, including Mindbody, may also process limited information as independent controllers for purposes described in their own notices.
12. International transfers
Some providers, including Mindbody, Squarespace, Google, Meta and Xero, may process personal information outside the UK. Where a restricted transfer occurs, we use a lawful transfer mechanism, such as UK adequacy regulations (including an applicable UK extension to an adequacy framework), the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another safeguard permitted by UK law.
Mindbody states that it participates in the UK Extension to the EU–US Data Privacy Framework and provides contractual transfer mechanisms in its privacy terms. You may contact us for information about the safeguard relevant to a particular transfer, subject to necessary confidentiality protections.
13. How long we keep personal information
| Record | Normal retention period |
|---|---|
| Customer accounts, bookings and transaction history | While the account or membership is active and for 6 years afterwards |
| Invoices and accounting records | 6 years after the end of the relevant financial year, or longer if lawfully required |
| Unsuccessful enquiries | 12 months after the last substantive contact |
| Pilates health declarations | Reviewed regularly and deleted 12 months after the customer’s last class, unless a lawful reason requires a longer hold |
| Adult accident and injury reports | 6 years after the incident |
| Accident or injury reports involving a person under 18 | Until the person’s 21st birthday |
| Marketing consent and opt-out records | While marketing continues; limited suppression information is retained as needed to honour an opt-out |
| Website security logs | Up to 12 months, unless required longer to investigate a security incident |
| CCTV | Normally 30 days; relevant clips longer where needed for an incident, claim or legal purpose |
| Promotional photographs and videos | Reviewed at least every 2 years and kept only as long as needed for the agreed campaign or publication; new use stops following withdrawal of consent |
We may suspend routine deletion where information is needed for an active complaint, safeguarding matter, insurance claim, investigation or legal proceeding. At the end of the applicable period, information is deleted or anonymised. Independent physiotherapists and massage practitioners apply their own clinical or treatment-record retention policies.
14. Security
We use proportionate organisational and technical measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure or access. Measures include access controls, confidentiality requirements, appropriate supplier terms and secure payment processing through Mindbody. Access is limited according to role and business need.
No internet or storage system can be guaranteed completely secure. If we become aware of a personal-data breach, we assess it and notify affected people and the Information Commissioner where required by law.
15. Your rights
Depending on the circumstances, you may have the right to:
- ask for access to your personal information and related information;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information;
- ask us to restrict how information is used;
- receive certain information in a portable format or have it sent to another controller;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- withdraw consent at any time, without affecting processing already carried out lawfully; and
- receive safeguards in relation to solely automated decisions producing legal or similarly significant effects, where applicable.
These rights are not absolute and may not apply in every case. To exercise a right, contact info@bankpilates.com. You do not normally have to pay a fee. We may request proportionate information to verify identity and will respond within the period required by law, normally one month.
16. Complaints
Please contact us first if you have a concern so that we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection.
- Website: ico.org.uk/make-a-complaint/
- Telephone: 0303 123 1113
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
17. Changes to this notice
We keep this notice under review. We will post updates on our website and, where a change materially affects how we use personal information, provide an additional notice by an appropriate method. The effective date at the beginning shows when this version took effect.
18. Contact us
Email: info@bankpilates.com
Post: LUME Wellness Ltd, 24 Picton House, Hussar Court, Westside View, Waterlooville, PO7 7SQ