Reconnection to Wellness – Privacy Policy
Last updated: 15 October 2025
This Privacy Policy explains how Reconnection to Wellness (“we”, “us”, “our”) collects, uses, shares, and protects your personal data when you visit our website, make an enquiry, book or attend our programmes, classes, or 1-to-1 sessions, and when you otherwise interact with us. We comply with UK GDPR, the Data Protection Act 2018, and PECR.
1) Identity and contact details of the data controller
Controller:Reconnection to Wellness
Registered/Trading name: Reconnection to Wellness CIC
Email: dawn@reconnection2wellness.org
Telephone: 07758 133519
2) Data Protection Officer (DPO)
We are not legally required to appoint a DPO. For any data protection queries, contact Privacy Lead at dawn@reconnection2wellness.org.
3) Purposes and legal bases for processing
We process personal data only when we have a lawful basis. Where we process health or other special category data, we will usually rely on your explicit consent (UK GDPR Art. 9(2)(a)), or in limited cases vital interests (Art. 9(2)(c)) for safeguarding.
Purpose
Personal data
Lawful basis (Art. 6)
Special category basis (Art. 9)
Typical retention
Responding to enquiries and customer support
Name, contact details, enquiry content
Legitimate interests (to run our services and respond to you)
n/a
12 months after last contact
Booking, scheduling, delivery of classes/sessions/programmes
Name, contact details, booking details, attendance records
Contract (to provide the service)
Explicit consent (health info you share to tailor sessions)
7 years from last session (insurance recordkeeping)
Health screening, PAR-Q, risk assessment, accessibility needs
Health information you provide (e.g., injuries, conditions, GP info if offered)
Contract/Legitimate interests (safe delivery) + your consent
Explicit consent
7 years from last session (or as insurer requires)
Payments and invoicing
Name, email, billing address, payment amount, transaction ID
Contract; Legal obligation (tax)
n/a
6–7 years for HMRC
Marketing by email/SMS
Name, email/phone, preferences
Consent (opt-in); or Legitimate interests for similar services to existing clients (soft opt-in under PECR)
n/a
Until you opt out or 24 months of inactivity
Safeguarding and incident reporting
Identity and incident details; may include health data
Vital interests; Legal obligation; Legitimate interests
Vital interests / legal claims
As necessary for safeguarding/legal claims
Service improvement, surveys, testimonials
Feedback, survey responses, quotes (with your consent for named quotes)
Legitimate interests; Consent (for named testimonials)
Consent if health data included
Up to 24 months (anonymised thereafter)
Website security & basic analytics
IP address, device/usage data that are strictly necessary for security/performance
Legitimate interests (site operation & security); consent for any non-essential cookies/analytics
n/a
Per cookie/tool lifecycle
Where we rely on consent, you can withdraw it at any time (see Section 9).
4) Categories of personal data we collect
5) Recipients (who we share data with)
We share data only when necessary, under appropriate contracts and safeguards:
A current list of key processors is available on request.
6) International transfers
Some providers may process data outside the UK/EEA. Where this occurs, we ensure appropriate safeguards such as:
7) Data retention
We keep personal data only as long as necessary for the purposes set out above, including to meet legal, accounting, insurance, or reporting requirements. Typical periods:
8) Your rights
Under UK GDPR you have the right to:
9) Right to withdraw consent
Where we rely on your consent (e.g., to process health data for tailoring sessions, to send marketing, or to use photos/testimonials), you may withdraw that consent at any time by contacting dawn@reconnection2wellness.org or using unsubscribe links in emails. This will not affect processing already carried out.
10) Right to complain to the ICO
You can complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we process your data. We’d appreciate the chance to address your concerns first.
ICO: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. ico.org.uk | Tel: 0303 123 1113.
11) Statutory/contractual requirement
Some data is necessary to enter into or perform our contract with you (e.g., contact details, booking information, and relevant health information needed to deliver sessions safely). If you do not provide this data, we may be unable to provide certain services. Optional data (e.g., for marketing) will be clearly indicated.
12) Automated decision-making and profiling
We do not carry out automated decision-making that produces legal or similarly significant effects. We may use limited segmentation for marketing preferences (e.g., by programme type) to send you more relevant information—this does not have legal/significant effects, and you can opt out at any time.
13) Children’s data
Our services are generally for adults (18+). Where we run activities for under-18s, we will obtain parent/guardian consent and implement appropriate safeguards.
14) How we protect your data
We use appropriate technical and organisational measures including access controls, encryption in transit, secure configurations, staff confidentiality, and retention/minimisation practices. We review vendors and put contracts in place with processors.
16) Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will be revised. Material changes will be communicated where appropriate.