The Kettlebell Works
Privacy Policy

Website  Programme Purchases  Coaching App  Bookings

Version 1.0
Effective date  16 september 2026
Last reviewed  16 September 2026

This policy explains how The Kettlebell Works collects, uses, shares and protects personal information when people visit our website, complete a programme questionnaire, purchase a programme, book a service, use our branded coaching app, communicate with us or receive coaching support.

It also explains the choices and legal rights available under the UK General Data Protection Regulation, the Data Protection Act 2018 and related UK privacy law. It should be read with our Website Cookie Policy and our Terms and Conditions.

1  Who is responsible for personal information

The Kettlebell Works trading as "The Kettlebell Works Ltd", is the controller of the personal information described in this policy. This means that we decide why and how that information is used.

Business address  128, High Street, Crediton, Devon EX17 3LQ
Website  www.the kelltlebellworks.com
Privacy email  evmart@btinternet.com
Company number:  17387437

Our coaching technology is supplied through a third-party white-label application. The Kettlebell Works remains responsible for the coaching information that we control. The application provider may also control limited account, security or service information for its own stated purposes. Its privacy information will apply to that separate use.

2  Who this policy applies to

This policy applies to website visitors, prospective customers, customers, programme users, coaching clients, class or appointment attendees, parents or guardians, emergency contacts and people who communicate with us through email, telephone, forms, WhatsApp or social media.

It does not govern an external website or service that we do not control. If a person follows a link to, or creates an account directly with, an external provider, that provider's own privacy information may also apply.

3  Personal information we collect

Identity contact and account information

This may include a name, date of birth or age range, postal address, email address, telephone number, username, app account identifier, password-related security information, profile details, parent or guardian details and emergency contact details.

Purchase payment and booking information

This may include products or programmes purchased, order number, price, payment status, refunds, billing address, appointment or class details, attendance and related correspondence. Card details are normally collected directly by the payment provider. We do not intend to receive or store a complete payment-card number or security code.

Fitness programme and progress information

This may include training experience, goals, preferred activities, available equipment, programme level, exercise records, session completion, performance results, progress measurements, photographs or videos submitted for coaching, feedback and coach notes.

Health and safety information

Where relevant to safe programme selection or coaching, this may include injuries, pain, mobility limitations, medical conditions, medication relevant to exercise, pregnancy status, disability information, previous procedures, readiness-to-exercise answers and other health information voluntarily provided. Health information is special-category personal data and receives additional protection, as explained in section 7.

Technical usage and communications information

This may include IP address, device and browser information, app or website logs, cookie identifiers, consent choices, security events, pages viewed, referral source, marketing preferences, emails, support messages, call notes and interactions with our advertisements or social-media pages.

4  How we obtain personal information

We normally obtain information directly from the person concerned when they complete a form or questionnaire, make a purchase or booking, create an account, use a programme, record progress, contact us or choose to provide information to a coach.

We may also receive information from a parent or guardian, a payment provider, Squarespace or Acuity Scheduling, our coaching-app provider, an authorised coach or contractor, a referral partner, a social-media platform, or another person acting with the individual's authority. Technical information may be created automatically when our website or app is used.

5  How and why we use personal information

The table identifies our main purposes and the lawful bases we expect to use. The correct basis depends on the particular activity. We do not treat consent as the basis for every use of information and we do not use health information merely because it is useful.

Purpose

What we do

Lawful basis

Enquiries and programme selection

Answer questions, provide requested information and recommend a suitable programme.

Steps requested before a contract; legitimate interests in responding to enquiries and operating the service. Health information is addressed separately in section 7.

Purchases and programme delivery

Take and confirm orders, manage the 24-hour cooling-off process described in our Terms, send app access, provide programmes, support users and administer refunds.

Contract; legal obligation for tax, accounting and consumer-law records.

App and account administration

Create or link an account, authenticate users, provide programme content, record progress, troubleshoot and communicate about the service.

Contract; legitimate interests in reliable, secure service administration.

Bookings and attendance

Schedule appointments or classes, issue reminders, record attendance and manage changes or cancellations.

Contract; legitimate interests in diary and capacity management.

Tailored coaching and safety

Assess training needs, adapt exercise, monitor progress and identify safety concerns.

Contract or legitimate interests for ordinary fitness information; an Article 9 condition is also required for health information, as explained in section 7.

Payments fraud and security

Process payment status, prevent fraud, secure the website and app, investigate misuse and protect users and the business.

Contract; legal obligation; legitimate interests in security, fraud prevention and legal protection.

Customer service and complaints

Respond to queries, resolve complaints, keep an audit trail and establish, exercise or defend legal claims.

Contract; legal obligation; legitimate interests in service quality and legal protection.

Marketing

Send relevant news, offers or programme information and measure campaigns.

Consent where required; otherwise legitimate interests where electronic-marketing law permits. Every message will include an opt-out.

Improvement and analytics

Understand use of the website, app and services, correct faults and improve content and programmes.

Consent for non-essential cookies or similar technologies where required; otherwise legitimate interests or an applicable statutory exception.

Reviews images and case studies

Publish a review, testimonial, photograph, video or identifiable transformation story.

Consent. Separate permission will be requested and may be withdrawn for future use.

Business and legal administration

Maintain accounts, meet regulatory duties, respond to lawful requests, manage insurance and support a sale or reorganisation of the business.

Legal obligation; legitimate interests in running and protecting the business.

6  When information is required

Some information is required to enter into or perform a contract, verify payment, create app access, provide a purchased programme or comply with the law. We will identify required fields where practical. If required information is not provided, we may be unable to complete a purchase, provide access, deliver tailored coaching or safely recommend a programme.

Providing optional health, progress, marketing or profile information is voluntary. However, withholding information about a relevant injury or condition may mean that we cannot provide personalised exercise guidance safely. A generic programme may be offered where appropriate, but this will depend on the circumstances.

7  Health and other special category information

Information about physical or mental health, disability and some related matters is special-category personal data. Before using it, we require both a lawful basis under Article 6 of the UK GDPR and an additional condition under Article 9.

For health information voluntarily supplied for programme matching, exercise screening, tailored coaching or progress support, we normally rely on performance of the coaching contract or steps requested before that contract under Article 6, together with the individual's explicit consent under Article 9(2)(a). We request this consent separately from general terms wherever required.

A person may withdraw explicit consent at any time. Withdrawal will not make earlier lawful use unlawful, but it may prevent us from continuing tailored coaching or retaining health-based app functions. We will explain any practical consequence before stopping the relevant service.

In a genuine emergency, we may use necessary information to protect life or physical safety under the vital-interests provisions, including Article 9(2)(c) where the person is physically or legally incapable of giving consent. Where necessary for a legal claim, we may rely on Article 9(2)(f). We do not rely on these conditions for routine coaching convenience.

We do not ask customers to upload medical records unless this is specifically necessary and agreed. Our programmes and coaches do not replace medical diagnosis or treatment.

8  Programme finder and automated recommendations

Our online questionnaire may use answers such as age group, experience, goals, exercise preferences, available equipment and safety responses to calculate a programme level, match percentage or suggested package. The purpose is to narrow the available programmes and provide a practical recommendation.

This matching is not intended to make a solely automated decision that has a legal or similarly significant effect. A user may disregard the recommendation, ask for a human review or contact us before purchasing. Safety answers may direct a user to obtain appropriate professional advice rather than complete a purchase.

We will not use questionnaire answers to infer unrelated sensitive characteristics, set discriminatory prices or target children with behavioural advertising.

9  Service providers and other recipients

We disclose personal information only where necessary for the purposes described in this policy. Depending on the services enabled at the relevant time, recipients may include:

·       Squarespace, including Acuity Scheduling where used, for website hosting, forms, commerce, bookings, security and related functions;

·       PT Distinction or the current white-label coaching-app provider for app accounts, programme delivery, communications, progress tracking and technical support;

·       Revolut Merchant Services for checkout, payment processing, fraud screening and refunds;

·       email, cloud-storage, document, customer-support and communications providers, including WhatsApp where a customer chooses that channel;

·       analytics, advertising and social-media providers such as Meta, but only to the extent enabled and permitted by the user's choices and applicable law;

·       coaches, professional advisers, accountants, insurers, IT and security providers, and vetted contractors who need the information for their work;

·       regulators, courts, law-enforcement bodies, public authorities or emergency services where disclosure is required or permitted by law; and

·       a genuine prospective purchaser, investor or successor if the business is sold, reorganised or transferred, subject to appropriate confidentiality and data-protection safeguards.

Providers acting on our instructions must use information only for the contracted service, keep it secure and assist us with data-protection obligations. Some providers may act as separate controllers for particular activities, such as processing a card transaction, operating a social-media account or meeting their own legal duties. Their privacy notices explain those uses.

We do not sell personal information. We do not permit a coaching-app or website provider to use identifiable health information for its own advertising.

10  International transfers

Some providers may store or access information outside the United Kingdom. Before making a restricted transfer, we will use an available UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another lawful transfer mechanism. We will also complete any required transfer risk assessment and apply supplementary measures where needed.

A person may contact us for information about the relevant safeguard. The exact transfer arrangements depend on the provider and configuration in use and must be checked against current supplier contracts.

11  How long we keep information

We keep personal information only for as long as reasonably necessary for the stated purpose, legal or accounting duties, insurance requirements, complaint handling and legal claims. The periods below are the intended operational periods and should be confirmed against our insurer's and service providers' requirements before publication.

Information

Intended retention period

Unsuccessful enquiry

Up to 12 months after the last meaningful contact, unless the person asks us to delete it sooner and no overriding reason applies.

Orders contracts and refunds

Six years after the end of the customer relationship or transaction, unless a longer period is required for an active dispute or legal duty.

Tax and accounting records

Normally six years after the end of the relevant financial year, or longer where HMRC or another law requires.

App account programme and progress records

While the service is active, then normally up to 24 months after the last activity, subject to contract, safety and legal-record requirements.

Health screening coaching and incident records

Normally six years after the final service. For a person under 18, normally until at least their 21st birthday. A documented insurer requirement or legal claim may justify longer retention.

Customer service and complaints

Normally three years after closure, or six years where the matter relates to a contract, incident or potential claim.

Marketing records

Until consent is withdrawn or an objection is received. We may retain a minimal suppression record for as long as needed to respect the opt-out.

Testimonials and images

Until permission is withdrawn for future use or the agreed campaign ends, subject to material already lawfully printed or distributed.

Security and technical logs

Normally up to 12 months, unless a security investigation requires longer retention.

Cookies and similar identifiers

For the period stated in our Website Cookie Policy and live cookie register.

When retention ends, we delete, anonymise or securely archive the information. Backup copies may remain for a limited technical cycle and are protected from routine use until overwritten or securely deleted.

12  Marketing and communications

We may send service messages that are necessary to fulfil an order, administer an account, provide a booking reminder, deliver safety information or notify a user about an important change. These are not optional marketing merely because they are sent electronically.

We send promotional email, text or electronic messages only where the law permits. We may use consent or, for an existing customer, the statutory soft opt-in where its conditions are met and the marketing concerns our similar products or services. We do not assume that a purchase gives unlimited marketing permission.

The right to object to direct marketing is absolute. A person may unsubscribe using the link in a message or contact us at [PRIVACY EMAIL]. We will stop marketing without undue delay, although a minimal suppression record may be retained so that the preference continues to be honoured.

13  Cookies website analytics and advertising

Our website uses cookies and similar technologies for functions such as security, checkout, preferences, analytics, embedded content and, if enabled, advertising. Non-essential technologies are not activated until consent is obtained unless a specific statutory exception applies and all of its conditions are met.

The Website Cookie Policy at [INSERT COOKIE POLICY URL] explains the live technologies, providers, purposes, durations and controls. Cookie choices may be changed through [INSERT COOKIE SETTINGS LINK OR INSTRUCTION].

14  Children and teenagers

Our website may describe programmes suitable for teenagers, but the website, paid programmes and app are not directed to children under 13. A person under 13 must not create an account, submit a questionnaire or purchase a programme. A parent or guardian should contact us to discuss an appropriate service.

For customers aged 13 to 17, we require a parent or guardian to make or approve the purchase and to be involved where necessary for safety, payment and account administration. We minimise the information collected, use age-appropriate explanations, apply privacy-protective defaults and consider the child's best interests. We do not use a child's health information or image for marketing without appropriate, specific permission.

A child has their own data-protection rights. Depending on age and understanding, a request may be made by the child or by a person with parental responsibility acting appropriately on the child's behalf.

15  How we protect information

We use proportionate organisational and technical measures intended to protect personal information against accidental loss, unauthorised access, alteration, disclosure or destruction. Measures may include access controls, strong authentication, role-based permissions, secure devices, encryption in transit, supplier checks, backups, staff confidentiality, incident procedures and periodic review of accounts and permissions.

No online service can guarantee absolute security. Users must keep account credentials confidential, use a strong unique password and contact us promptly if they suspect unauthorised access. If a personal-data breach presents a legal reporting risk, we will notify the Information Commissioner's Office and affected individuals as required.

16  Data protection rights

Depending on the circumstances and lawful basis, a person may have the right to:

·       receive clear information about how their personal information is used;

·       request access to personal information and receive a copy;

·       ask for inaccurate or incomplete information to be corrected;

·       ask for information to be erased in certain circumstances;

·       ask us to restrict how information is used in certain circumstances;

·       receive information supplied to us in a structured, commonly used and machine-readable format, and ask for it to be transferred where the portability right applies;

·       object to processing based on legitimate interests or recognised legitimate interests, and object at any time to direct marketing;

·       withdraw consent at any time where processing relies on consent; and

·       ask for safeguards relating to a qualifying solely automated decision and challenge that decision where applicable.

These rights are not absolute. We may need to retain information where a legal obligation, overriding lawful reason, freedom-of-expression rule or legal claim applies. We will explain any refusal or limitation.

To make a request, contact [PRIVACY EMAIL]. We may ask for information reasonably necessary to confirm identity and locate the records. We do not normally charge a fee. We will respond within the period required by applicable law and will explain if a permitted extension is needed.

17  Complaints

Please contact us first at [PRIVACY EMAIL] if there is a concern about our use of personal information. We will make it easy to submit a complaint, acknowledge and investigate it, and respond as required by applicable law.

A person may also complain to the Information Commissioner's Office, the UK's data-protection regulator. Information and complaint forms are available at ico.org.uk/make-a-complaint. The ICO can also be contacted on 0303 123 1113. Using our complaints process does not remove the right to contact the ICO.

18  Changes to this policy

We may update this policy when our services, suppliers, technology or legal obligations change. The current version will be published on our website with its effective date. If a change would materially affect how existing customer information is used, we will provide an appropriate additional notice and obtain consent where required.

19  Contact us

Privacy questions, rights requests and complaints should be sent to:

The Kettlebell Works
The Kettlebell Works Ltd
128, High Street, Crediton, Devon EX17 3LQ

Email evmart@btinternet.com