G.R.I.P. Circus Arts CIC

Want the plain-English version? Read the summary→

Customer Privacy Notice

This privacy notice tells you what to expect us to do with your personal information.

Contact details
What information we collect, use, and why
Lawful bases and data protection rights
Where we get personal information from
How long we keep information
Who we share information with
Sharing information outside the UK
How to complain

Contact details

What information we collect, use, and why

To provide services and goods, including delivery and third party referrals

We collect or use the following information to provide services and goods, including delivery and third party referrals:

Names and contact details
Emergency contact details
Photographs or video recordings
Service use history
Health information (including medical conditions, test results, allergies, medical requirements and medical history)
Information about lifestyle, interests or personal history
Payment details (including card or bank information for transfers and direct debits)
Website user information (including user journeys and cookie tracking)

We also collect or use the following special category information to provide services and goods, including delivery and third party referrals. This information is subject to additional protection due to its sensitive nature:

Health information

For service updates or marketing purposes

We collect or use the following personal information for service updates or marketing purposes:

Names and contact details
Marketing preferences
Recorded images, such as photos or videos
Records of consent, where appropriate

To comply with legal requirements

We collect or use the following personal information to comply with legal requirements:

Name
Contact information
Financial transaction information
Health and safety information
Safeguarding information

We also collect or use the following special category information to comply with legal requirements. This information is subject to additional protection due to its sensitive nature:

Health information

For dealing with queries, complaints or claims

We collect or use the following personal information for dealing with queries, complaints or claims:

Names and contact details
Account information
Purchase or service history
Customer or client accounts and records
Financial transaction information
Information relating to health and safety (including incident investigation details and reports and accident book records)
Correspondence

We also collect or use the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:

Health information

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

Your right of access — You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
Your right to rectification — You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure — You have the right to ask us to delete your personal information.
Your right to restriction of processing — You have the right to ask us to limit how we can use your personal information.
Your right to object to processing — You have the right to object to the processing of your personal data.
Your right to data portability — You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent — When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods, including delivery and third party referrals are:

Consent — we have permission from you after we gave you all the relevant information. This applies to health information you share with us, photographs and video recordings, and any other information you choose to provide voluntarily. You have the right to withdraw your consent at any time.
Contract — we have to collect or use the information so we can enter into or carry out a contract with you. When you book a session, we need your name, contact details, and payment information to deliver the service you’ve booked.
Legitimate interests — we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. Our legitimate interests are: ensuring the physical safety of participants during circus training sessions, including collecting emergency contact details and experience levels to manage risk appropriately; and collecting website usage data via our hosting infrastructure to maintain site security and performance.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

Consent — we have permission from you after we gave you all the relevant information. You have the right to withdraw your consent at any time by unsubscribing from our communications.

Our lawful bases for collecting or using personal information to comply with legal requirements are:

Legal obligation — we have to collect or use your information so we can comply with the law. This includes retaining financial records for HMRC, meeting our obligations as a Community Interest Company registered with Companies House, recording health and safety incidents, and fulfilling safeguarding duties.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

Contract — we have to collect or use the information so we can enter into or carry out a contract with you. Many queries and complaints relate to sessions you’ve booked and paid for.
Legitimate interests — we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. Our legitimate interests are: investigating and resolving booking disputes, service complaints, and insurance claims fairly; and maintaining accurate records to protect the rights of both the organisation and our customers.

Where we get personal information from

Directly from you
Family members or carers — for example, when a parent or guardian books a beginner class on behalf of an attendee under 18

Children’s data

Some of our beginner classes are open to attendees under 18. When a young person attends, their personal information is provided by a parent or guardian during the booking process. We process children’s data with the same protections as adult data and rely on the same lawful bases described above. We do not knowingly collect personal information directly from children without parental involvement.

How long we keep information

We only keep personal information for as long as we need it. The table below sets out how long we retain different types of information and why.

Data type	Retention period	Reason
Booking and attendee data (name, email, emergency contacts, experience level)	12 months after last booking	No longer needed for service delivery once the customer is inactive
Health information	12 months after last booking	Special category data — deleted promptly once no longer required for safe session delivery
Consent records (waiver, T&Cs, marketing, photo/video)	24 months after last activity	Evidence that consent was obtained, in case of dispute or regulatory enquiry
Financial and payment records	6 years from transaction date	HMRC requirement for Community Interest Companies
Accident and incident reports	3 years minimum; until the injured person turns 21 if they were under 18	Limitation Act 1980 — personal injury claims can be brought within 3 years (extended for minors)
Safeguarding records	As specified in our safeguarding policy	Retained in line with statutory guidance and our safeguarding obligations
Marketing preference data	Until unsubscribe, then deleted within 30 days	No longer needed once the person withdraws consent
Session leader / admin notes	12 months after last booking	Deleted alongside attendee data

When the retention period expires, personal information is securely deleted from our systems and from our data processors’ systems in line with their data retention policies.

Who we share information with

Data processors

BookWhen Ltd

They provide our online booking and scheduling platform. They store and process attendee names, email addresses, emergency contacts, health information, experience levels, booking history, consent records, and all other data collected through our booking forms. They also manage automated booking confirmations, reminders, and cancellation emails on our behalf.

Stripe Payments UK, Ltd

They process online card payments for session bookings on our behalf, as a sub-processor of BookWhen. They handle payment card details during checkout. We do not store card details directly.

Others we share personal information with

Emergency services
Organisations we need to share information with for safeguarding reasons
Organisations we’re legally obliged to share personal information with
Relevant regulatory authorities, including the Scottish Charity Regulator (OSCR) and the ICO
Publicly on our website, social media or other marketing and information media — only where you have given consent for photographs or video recordings to be used

Sharing information outside the UK

Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

Organisation: Google LLC Category: Cloud service provider, analytics, data backups, and hosting Country: United States Transfer mechanism: Addendum to the EU Standard Contractual Clauses (SCCs)

Organisation: Amazon Web Services, Inc. Category: Cloud service provider and data backups Country: EU Transfer mechanism: Addendum to the EU Standard Contractual Clauses (SCCs)

Organisation: Stripe, Inc. Category: Payment processing provider Country: United States Transfer mechanism: Addendum to the EU Standard Contractual Clauses (SCCs)

Organisation: ActiveCampaign LLC (Postmark) Category: Transactional email provider (booking confirmations, reminders, cancellations) Country: United States Transfer mechanism: Addendum to the EU Standard Contractual Clauses (SCCs)

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Last updated

20 March 2026