Legal
Privacy Policy
Last updated: 14 Oct 2026
Who we are
Studio 20 ("we", "us") operates the Studio 20 website and fitness centre at 20 High Street, Ilfracombe, Devon, EX34 9DA. We are the data controller for the personal data described here.
- Email: [email protected]
- Phone: 01271 862019
- Postal address: Studio 20, 20 High Street, Ilfracombe, Devon, EX34 9DA
What we collect, why, and our lawful basis
UK GDPR requires us to have a lawful basis for everything we do with your data. Here is ours, in full.
| What we collect | Why | Lawful basis |
|---|---|---|
| Name, email address, phone number (optional) and a securely hashed password | To create and run your member account and identify you at reception | Contract — we need it to provide the membership you asked for |
| Your member ID, membership type, start and expiry dates, payment records | To manage your membership, take payment and keep accurate financial records | Contract, and legal obligation for the accounting records |
| Anything you send us through the contact form, including your name, email and phone number | To answer your enquiry | Legitimate interests — replying to someone who has contacted us |
| IP address, browser information, sign-in times and failed sign-in attempts | To keep accounts secure, block brute-force attacks and prevent fraud | Legitimate interests — protecting our members and our systems |
| Health information you choose to tell us at your induction or in class (injuries, conditions, medication) | So staff can keep you safe and adapt exercises for you | Your explicit consent, which you can withdraw at any time. This is "special category" data and we treat it accordingly |
Providing your name, email and payment details is a requirement of taking out a membership — without them we cannot give you an account. Telling us about your health is always optional, though it helps us keep you safe.
We never see or store your card number. Card payments are processed entirely by Stripe on their own secure pages.
Marketing
We do not send marketing emails and we do not sell, rent or share your data with anyone for their own marketing. If we ever start a mailing list it will be strictly opt-in, with a separate unticked box, and every message will carry an unsubscribe link.
Who we share it with
- Stripe Payments Europe, Ltd. — card payments, subscriptions and fraud prevention. See Stripe's privacy policy.
- Our hosting and database providers — they store the data on our behalf under a written contract and cannot use it for their own purposes.
- Professional advisers and authorities — accountants, insurers, or anyone we are legally required to tell.
Sending data outside the UK
Stripe may process payment data outside the UK, including in the United States. Where that happens it is covered by the safeguards UK data protection law requires — an adequacy decision or the International Data Transfer Agreement. This website and its database are hosted in the United Kingdom.
How long we keep it
- Member accounts and membership history — while your account is open, then up to 2 years after your last membership expires, in case you come back or a dispute arises.
- Payment and accounting records — 6 years after the end of the relevant financial year, as UK tax law requires.
- Contact form messages — deleted within 12 months of your enquiry being dealt with.
- Security logs and sign-in records — 12 months.
- Health information — deleted when your membership ends, or sooner if you withdraw consent.
How we protect it
Passwords are hashed with Argon2id and are never stored or recoverable in readable form. Staff accounts require two-factor authentication. Traffic is encrypted with HTTPS, sessions are protected against hijacking and forgery, and access to member records is limited to staff who need it — with every change written to an audit log.
Automated decisions
We do not make any decision about you by automated means alone, and we do not profile you. Stripe runs automated fraud checks on card payments; if a payment is declined you can always pay at reception instead.
Children
Joining ages and any parent or guardian requirements vary by activity, so please ask reception before signing up a young person. Online accounts are intended for adults. If a young person joins, we collect the same information and ask a parent or guardian to complete it with them.
CCTV and the building
We operate CCTV cameras in and around the building to keep members, staff and property safe and to prevent and investigate crime. Footage is viewed only by authorised staff, is not published, and is kept only for as long as needed for those purposes before being overwritten. Signs in the building tell you where cameras are in use. If you want to see footage of yourself, or have a question about the cameras, contact us using the details above.
Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you;
- Rectify anything inaccurate or incomplete;
- Erase your data where we no longer need it;
- Restrict or object to how we use it, including anything based on our legitimate interests;
- Portability — receive the data you gave us in a machine-readable format;
- Withdraw consent at any time, where our basis is consent (for example health information).
Email [email protected] and we will respond within one month, free of charge. You can also update most of your details yourself in your member account.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk
Cookies
We set strictly necessary cookies only — no advertising, analytics or tracking. Full details are in our Cookie Policy.
Changes to this policy
If we change how we use your data we will update this page and change the date at the top. If the change is significant we will tell members directly.