1. Information we collect
- Identity and contact details: name, address, date of birth, telephone number and email address.
- For juniors: parent/guardian name, telephone number and relationship to the child, plus authorised collection information where relevant.
- Emergency contact information.
- Health and safety information: medical conditions, injuries, medication, health screening/PAR-Q answers and relevant training restrictions.
- Membership and training information: membership type, attendance, bookings, grading records, coaching notes and participation history.
- Payment and transaction information. Full card/bank details may be handled by payment processors rather than stored directly by LionHeart.
- Communications, including email, membership-platform messages and WhatsApp conversations/groups where used.
- Photographs and video where media consent or another lawful basis applies.
- CCTV images and incident-related footage.
- Website and device information, including cookies and analytics where used.
2. Why we use information and our lawful bases
Purpose | Typical lawful basis |
|---|---|
Deliver membership, classes, bookings, billing and customer support | Contract; steps requested before contract |
Manage parents/guardians and junior participation | Contract with parent/guardian; legitimate interests in safe administration |
Health screening, injury management and safe coaching | Contract/legitimate interests plus an appropriate Article 9 condition for health data, including explicit consent where relied upon |
Safeguarding children and adults at risk | Legal obligations, legitimate interests, vital interests and applicable safeguarding/public-interest conditions; consent is not required where sharing is necessary to protect someone from harm |
Security, incident prevention and CCTV | Legitimate interests in safety, security and protection of people/property; legal obligations where relevant |
Grading, coaching records and service improvement | Contract and legitimate interests |
Promotional photos/videos of identifiable people | Consent |
Email/text/WhatsApp marketing | Consent or another lawful route permitted by PECR; LionHeart will honour opt-outs |
Website analytics/non-essential cookies | Consent where required by PECR |
Accounting, tax, legal claims and compliance | Legal obligation and legitimate interests |
3. Health information and other special-category data
Health information is particularly sensitive. LionHeart collects only information reasonably needed to make training safer, adapt coaching, respond to emergencies and manage participation. Where explicit consent is used for health information, it will be requested clearly and separately. Safeguarding information may be processed or shared without consent where necessary and lawful to protect a child or adult at risk.
4. Children's information
LionHeart applies extra care to children’s personal information. Junior membership contracts are normally made with a parent/guardian. Information is limited to what is reasonably needed for safe participation, membership administration, safeguarding and agreed media use. Privacy information should be explained in age-appropriate language where relevant, and the child’s views should be respected alongside parental responsibility.
5. Who we share information with
- Membership and booking providers, currently Glofox and during migration/operation Exercise.com.
- Payment processors such as Stripe and GoCardless.
- Professional advisers, accountants, insurers and IT/service providers where necessary.
- BMABA where required for insurance, governance, safeguarding, competitions or compliance.
- Coaches and authorised admin staff on a need-to-know basis.
- Statutory bodies such as Police, Children’s Social Care, Adult Social Care, Local Authority Designated Officer or DBS where required for safeguarding or law.
- Website, analytics, cloud, email and communications providers where used, subject to appropriate contractual/security measures.
6. International transfers
Some service providers may process information outside the UK. Where this occurs, LionHeart will use providers and transfer mechanisms intended to provide an appropriate level of protection under UK data-protection law.
7. CCTV
CCTV is used for safety, security, incident investigation and protection of people and property. Signage will identify CCTV use. Access is restricted. Footage is normally retained for no longer than 30 days unless an incident, safeguarding matter, insurance issue or legal requirement means a longer period is necessary.
8. Photography and video
Identifiable promotional photography/video is handled through separate consent. Declining consent does not affect membership. LionHeart will take reasonable steps to avoid using identifiable images of people who have not consented. Withdrawal stops new promotional use where reasonably practicable but may not enable LionHeart to retrieve material already printed, lawfully published, downloaded, shared or republished by third parties.
9. Marketing
Marketing consent is separate from membership. Members and parents can opt in to receive promotions by email, text or WhatsApp and can withdraw at any time using the unsubscribe method provided or by contacting LionHeart. Service messages about bookings, safety, payments or membership administration are not marketing.
10. WhatsApp and group communications
LionHeart may use WhatsApp for coaching/client communications and member or parent groups. Participants should understand that group members may be able to see names, profile images and telephone numbers. Sensitive health or safeguarding matters should not be discussed in open groups and should be moved to a private, appropriate channel.
11. Cookies and analytics
The website may use essential cookies and optional analytics/marketing technologies such as Google Analytics. Non-essential cookies will be managed through an appropriate consent mechanism where required. A separate cookie notice should identify the current technologies and retention periods.
12. Retention
LionHeart does not keep personal information longer than reasonably necessary. Typical periods are set out in Appendix B. Most former-member contract, payment and routine operational records are retained for up to 6 years. Safeguarding records follow longer BMABA safeguarding retention standards.
13. Your rights
- Ask for access to your personal information.
- Ask for inaccurate information to be corrected.
- Ask for deletion where the law gives you that right.
- Ask for processing to be restricted in certain circumstances.
- Object to certain processing, including direct marketing.
- Withdraw consent at any time where processing relies on consent.
- Request data portability where applicable.
- Complain to the Information Commissioner’s Office if you believe your data-protection rights have been breached.
14. Contact
Privacy enquiries: info@lionheartmuaythai.com | 07957 994138. Postal correspondence may be sent to the Academy or the registered office listed in this pack. Information Commissioner’s Office: ico.org.uk
15. Data Retention Schedule
Record | Typical retention |
|---|---|
Membership contract, account and routine communications | Up to 6 years after membership ends |
Payment/accounting/tax records | Normally 6 years or longer where tax/legal requirements require |
Health screening/PAR-Q and injury-related operational records | Up to 6 years after membership ends, unless incident/legal/insurance needs justify longer |
Grading/training history | Up to 6 years after membership ends, or longer where the member reasonably expects a lasting grading record |
Marketing consent/opt-out records | While marketing continues; suppression/opt-out record retained as needed to respect the opt-out |
Photo/video consent record | For as long as the relevant media is retained/used and a reasonable period afterwards |
CCTV | Normally up to 30 days, unless retained for incident/safeguarding/insurance/legal purposes |
Child safeguarding records | At least 7 years from last entry or until age 25, whichever is later; longer for serious/ongoing cases |
Adult safeguarding records | At least 7 years from last entry; longer for serious/ongoing cases |
Complaints | Normally up to 6 years after closure where needed for legal/business records |