What personal information London Handstand Academy collects, why, who it is shared with, how long it is kept, and the rights you have over it.
Last updated 31 August 2026
The data controller is Elliott Staley, trading as London Handstand Academy, a sole trader established in England. We decide what personal information is collected and what happens to it.
Contact. info@londonhandstandacademy.com
Correspondence address. [[ADDRESS TO BE ADDED]]
ICO registration. [[ICO REGISTRATION NUMBER TO BE ADDED]]
This policy is written to the UK GDPR and the Data Protection Act 2018.
| What | Where it comes from |
|---|---|
| Name and email address | You, when you sign up or apply |
| A password, stored only as a one-way hash | You. We never see or store the password itself |
| Your answers to the level quiz and the intake questions — goal, location, training history, availability | You |
| Training activity — sessions opened and completed, hold times, ratings, test results, written feedback | Recorded as you use the app |
| Messages between you and your coach | You and us |
| Video and photos you send for form checks | You |
| Injuries, pain, conditions, pregnancy and medication you tell us about | You, in the waiver and in messages |
| Payment records — what you bought, when, the outcome, and a Stripe customer reference | Stripe |
| Marketing preference | You, by ticking or not ticking the box |
We never see your card details. Payment is handled entirely by Stripe on their own pages. We hold a reference to your Stripe customer record, not a card number.
Two categories deserve to be called out plainly.
Details about injuries, pain, conditions, pregnancy or medication are special category data and get extra protection in law. We ask for them only because coaching you safely is impossible without them.
We rely on your explicit consent to hold this information, which you give when you complete the waiver and health declaration. You can withdraw that consent at any time by emailing us — though if you do, we may not be able to keep coaching you safely, and we will talk to you about that rather than simply stopping.
Video and photos of you training are personal information, and often show your home. They are used for one purpose: so your coach can watch your technique and give you feedback.
Being straight with you about one limitation. Your clips are stored at addresses that are long and effectively impossible to guess, but which are not yet individually access-controlled. Anyone who was given the exact address of a clip could open it. We are moving these to signed, expiring addresses. Until that is done, we mention it so you can judge for yourself what you are comfortable filming.
| Purpose | Lawful basis |
|---|---|
| Running your account and giving you what you paid for | Performance of a contract |
| Writing your programme and giving feedback on your footage | Performance of a contract |
| Holding health and injury information so we can coach you safely | Explicit consent (Article 9(2)(a)) |
| Taking payment and preventing fraud | Performance of a contract, and legal obligation |
| Service emails — password resets, receipts, a reply from your coach | Performance of a contract |
| Marketing emails about tips and workshop dates | Consent, which you can withdraw at any time |
| Keeping accounting records | Legal obligation |
| Understanding which drills people get stuck on, so the coaching improves | Legitimate interests — improving the service, balanced against your privacy |
| Using your footage or words publicly | Separate, specific, optional consent |
Where we rely on consent, saying no costs you nothing but the thing you said no to, and you can change your mind whenever you like.
We do not sell your information and we do not share it for anyone else's marketing. We use these providers to run the service, each of which processes data only on our instructions:
| Provider | What it handles |
|---|---|
| Netlify | Hosting the site, and the database holding accounts, messages, progress and photos |
| Cloudflare | Storing and delivering video, including your form checks |
| Stripe | Payments, subscriptions and card details |
| Resend | Sending service emails |
| Setmore | Session booking |
| Beehiiv | The newsletter, if you subscribed to it |
| Formspree | Enquiry and application forms on the site |
We may also share information with an accountant, or with a professional adviser, and we will disclose it if the law requires it. If the business is ever sold or transferred, your information may pass to the new owner under this same policy.
| What | How long |
|---|---|
| Account and training records | While your account is open, then 12 months, then deleted |
| Messages with your coach | The most recent 200 messages per client; older ones drop off automatically |
| Your form-check footage and photos | 12 months from upload, then deleted — or sooner if you ask |
| Health and injury information | While you are coached, then 12 months, then deleted |
| Payment and accounting records | 6 years, as UK tax law requires |
| Marketing consent and the record of it | Until you unsubscribe, then a minimal record that you did |
Worth knowing: deletion of footage is currently done by hand rather than automatically. We are building the automatic version. Until then, if you want a clip gone before the twelve months are up, email us and we will do it — that route works today.
Our providers operate globally, so your information may be processed outside the UK, including in the United States. Where that happens, transfers are covered by the safeguards UK law requires — an adequacy decision, or the International Data Transfer Agreement or Addendum. You can ask us for details of the safeguards that apply.
No system is perfectly secure. If a breach ever put your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.
You have the right to: see the information we hold about you; correct it; delete it; restrict or object to what we do with it; receive it in a portable format; and withdraw consent at any time. You will never be charged for exercising a right, and it will never affect the standard of coaching you get.
Email info@londonhandstandacademy.com and we will respond within one month. We may ask you to confirm who you are first, so that nobody else can get at your records.
The app stores a sign-in token and your progress in your own browser so you stay signed in and see your plan straight away. That is necessary for the app to work at all.
The main website uses a cookie banner, and anything beyond the strictly necessary is set only if you agree. You can change your mind from the "Cookie settings" link in the site footer.
The service is for people aged 16 and over. We do not knowingly collect information about anyone younger. A participant under 18 needs a parent or guardian to agree to the terms and the waiver on their behalf. If you believe we hold information about a child, tell us and we will delete it.
If we change this policy in a way that materially affects you, we will email you before it takes effect.
If you are unhappy with how we have handled your information, please tell us first — we would rather put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.