Privacy Statement
The Purpose of this privacy statement is to explain, in general terms, how Sweaty Mama Ltd (Sweaty Mama) processes your personal data from the moment it is collected to the point it is deleted or destroyed. It is written for anyone who is making an enquiry about one of Sweaty Mama’s services or making a booking for a course. Other ‘specific to customer’ privacy notices will be provided when needed.
The Role of Sweaty Mama in data protection terms is that of a data controller because we determine the purposes and the use of the personal data we collect. Once received it becomes the responsibility of the Sweaty Mama Privacy Officer (PO) to ensure that it is processed in accordance with the latest relevant UK legislation. You can contact the Sweaty Mama PO by email using privacyofficer@sweatymama.com or by writing to: The Privacy Officer, Sweaty Mama Ltd, Church Road, Shropham, Attleborough, NR17 1EJ
The personal data processed by Sweaty Mama will only be basic contact information such as names, addresses, telephone numbers and an email address to be able to respond to your query. If you are booking a course when you will be accompanied by a child, Sweaty Mama will need additional information about the child, sufficient to complete the booking. All participants in our courses are required to complete a Physical Activity Readiness Questionnaire (PARQ) which includes health information to ensure that we can support you to exercise safely. Sweaty Mama will also collect minimal financial details for the purposes of recognising payments for activities. If you are enquiring about opportunities as a franchisee we will collect information about your qualifications, work experience and lifestyle that are directly linked to such a business opportunity.
The way we collect or receive your personal data is directly from you when you make your initial enquiry either through the web page contact form, a direct call, by email, or social media enquiry or the result of a visit to one of our courses.
Sweaty Mama’s duty of confidentiality means that Sweaty Mama staff will treat your personal data in confidence. Sweaty Mama uses reasonable technical and organisational measures to ensure personal data is safe guarded. Access is strictly limited to those members of staff who need it.
As a wholly owned subsidiary of Premier Education Group (PPEG), Sweaty Mama sources support through the corporate services teams at PEG. These include HR, finance, marketing and IT personnel including consultants, advisors and contractors appointed to work with those departments, all of whom are considered members of staff in relation to this privacy statement.
Sweaty Mama expects the same duty of confidentiality of all third parties with whom we need to share your personal data for the purposes of fulfilling our contractual obligations to you. They are required to enter into a separate data processing agreement with us when they have the role of data processor unless the equivalent clauses are already included in our contract with them.
Sweaty Mama will process personal data using a lawful basis; such instances are described below:
When we have a legitimate interest to respond to your general enquiry regardless of how it reached us in the first instance
When we have a legitimate interest to use your contact details, as a former and/or current customer, to send you a newsletter with updates about our services
When we have a legitimate interest to record your images using CCTV equipment positioned around Sweaty Mama’s offices, should you have reason to visit
When we have your consent in the situation where you have not been a customer of ours before, in order to send you a newsletter with updates about our services
When we have your explicit consent when we need to process special category data such as medical/health related data needed to support activity applications
To fulfil our contractual obligations to you either as a customer for the purposes of delivering the service(s) you have asked of Sweaty Mama
To comply with our legal obligations
Sweaty Mama will never sell your personal data and will only disclose it when it’s absolutely necessary, to some or all of the following third parties:
HMRC for invoice related activities
The franchise(s) that run the activities
Sub-contractors appointed by Sweaty Mama, subject to a data processing agreement or equivalent commitment to confidentiality
Any payments made through our website will be handled by our appointed payment processing partner. We will not ask them to share any financial information with us and any personal data you provide to them will be under the terms of their own privacy policy.
Sweaty Mama will process your personal data at its UK premises and utilises Microsoft Azure cloud (UK) for back up services. This website is hosted at a UK based data centre. We use HubSpot purely for marketing purposes which is US based. HubSpot is a signatory to EU-US Data Privacy Framework which has been extended to the UK.
Sweaty Mama follows a retention schedule to determine the length of time it holds different types of personal data of the customer. The key points of the schedule are shown below:
If you make an enquiry about a service that you subsequently choose not to use, we will routinely delete any information we have collected about you after 12 months
If you are or have been a customer, we will retain the details of your order, including your contact details, for 12 months, unless you ask us to delete them. If we don’t have another over-riding legal basis for processing, we will fulfil your request
If we have your consent to hold your contact details, we will retain them until you notify us that you want to withdraw your consent
For financial records and invoices, which include your personal data, these will be retained for six years after the end of the current tax year of processing
Personal data collected about children is not retained beyond their fifth birthday unless separate consent has been granted by the parent for specific activities
By exception, documentation that includes your personal data may be retained by Sweaty Mama beyond the schedule, but only for a specific purpose and only when Sweaty Mama believes there is a legitimate interest or has a legal obligation to do so. None the above affects your rights stipulated under the UK GDPR (see below).
At the end of the retention schedule Sweaty Mama will either return, destroy or delete/ anonymise your personal data and any associated emails or relevant documentation. If it is technically impractical to do so, we will put it beyond operational use. It allows up to 3 months after the retention criteria has expired to do this.
The Sweaty Mama website uses cookies (and similar technologies) with your permission when this is needed and does not attempt to identify individuals who visit the website. For further details please read the Sweaty Mama cookie policy, a link to which can be found at the foot of the homepage.
The UK General Data Protection Regulation defines the rights that you have (although these do not apply in all situations). For convenience, these rights are shown below:
Right to be informed as to how your personal data is being processed by Sweaty Mama – this is done through this privacy policy and/or separate Sweaty Mama privacy notices when appropriate
Right to access your personal data held by Sweaty Mama which is done by making a ‘Data Subject Access Request’ (DSAR) to the Sweaty Mama privacy officer
Right to rectification of your personal data if you believe Sweaty Mama has collected it incorrectly or it needs to be updated
Right to erasure of your personal data for which Sweaty Mama no longer has an overriding lawful basis with which to process
Right to restrict processing under certain circumstances, during which time your personal data will be out of operational use until the related matter is resolved
Right to data portability in a machine-readable version of the personal data you have provided to us, but this only applies to data provided with your consent or under contract
Right to object to Sweaty Mama processing your personal data when it does not relate to a legal or contractual obligation
Rights related to automated decision making and profiling (however Sweaty Mama does not use these techniques in its decision making)
Right to withdraw your consent at any time to any service for which have previously sought and obtained your consent as the lawful basis for processing your personal data
Further details on data subjects’ rights can be found on the Information Commissioner’s Office (ICO) website: https://ico.org.uk
Exercising rights or making queries to Sweaty Mama can be done by contacting the Privacy Officer. We will need to confirm your identity before proceeding with any request, therefore it may be necessary to ask you to provide documentation to verify your identity. If you have any concerns about the way we are processing your personal data, please contact the Privacy Officer in the first instance. Alternatively, you may also contact the ICO directly using the details found on the ICO website.
In the event of a takeover or acquisition, the personal data Sweaty Mama holds will form part of the assets of the organisation to be taken over by the new company, but only used for the same or similar purpose. If this happens, we will notify you using the latest contact details held.
This privacy statement is subject to a routine review every 12 months or sooner if there are significant changes to UK legislation.