Privacy notice.

1. Who we are

New School BJJ Brixton is a Brazilian Jiu-Jitsu academy at 130 Brixton Hill, London SW2 1RS. It is run by Reiss Bailey BJJ Ltd, company number 13642905, whose registered address is C, 11 Bullen Street, London SW11 3ER ("we", "us", "our"). We are the controller of the personal information described in this notice.

This notice explains how we handle personal information about our members, trial members, parents and guardians, children who train with us, people who enquire or visit our website, and visitors to the gym. It should be read alongside our terms and conditions.

If you have any questions, or want to use any of your rights, contact us by email at Reiss@newschoolbjj.com, by phone on 07578 284838, through the messaging feature in your Gymdesk account, or by post to New School BJJ Brixton, 130 Brixton Hill, London SW2 1RS.

2. Information we collect

Depending on how you deal with us, we may collect:

• Identity and contact details: name, date of birth, email address, phone number and postal address.
• Emergency contact details: the name, relationship and phone number of the person you ask us to contact in an emergency. Please make sure they're happy for you to share their details with us.
• Health information: medical conditions, injuries, medication and any other health information you choose to give us (see section 4).
• Membership and training records: membership type, start and end dates, waiver and terms acceptance, bookings, attendance, belt and stripe grades, freezes, cancellations, and notes about incidents or accidents.
• Payment and transaction information: payments made and due, payment method type, the last four digits and expiry date of your card, and purchases such as kit. Full card details are collected and held by our payment provider, not by us.
• Communications: messages, emails, texts, WhatsApp messages and call notes when you contact us or we contact you, and your marketing preferences.
• Enquiry and sign-up information: details you give us when you start a trial, book a free kids class or send us an enquiry, together with how you found us (for example, an advert or a search).
• Images: photographs and video taken at classes, gradings, competitions and events, and CCTV images if we operate CCTV (see section 7).
• Technical and advertising information: IP address, device and browser type, pages visited, and which advert or campaign brought you to us, collected through cookies and similar technologies only in line with your cookie choice (see section 13).

Most of this information comes from you directly. Some comes from a parent or guardian (for children), from our booking and payment providers, or from advertising and analytics providers where you have agreed to cookies.

3. How we use your information, and our lawful bases

We only use personal information where the law allows us to. The table below explains what we do and why.

Where we rely on legitimate interests, we have balanced our interests against yours and you can object at any time (see section 12). We do not make decisions about you based solely on automated processing.

4. Health information

Information about your health is "special category" data and has extra protection. We ask for it so that coaches can adapt training, respond properly to injuries and keep everyone safe. We process it with your explicit consent, which you give when you complete the medical section of your student profile, and, in an emergency, to protect your vital interests or someone else's.

Only coaches and staff who need to know will see it. You can withdraw your consent at any time, but if we don't have the health information we need to keep you safe, we may not be able to let you train.

5. Children

Our kids classes are for children aged 4 to 12. We collect information about children from their parent or guardian, who signs up, completes the health questionnaire and gives any consents on the child's behalf. Parents and guardians can exercise their child's data rights for them. Our adult classes are open from age 14; for members aged 14 to 17, we also ask a parent or guardian to agree to the terms.

We only use images that focus on an identifiable child, such as a close-up or a named photo, with a parent or guardian's consent, which can be withdrawn at any time.

6. Marketing

We'd like to tell you about offers, events, seminars, gradings and news. We will only send marketing by email, text message or WhatsApp if you have agreed to it, or if you are a member or trial member and we are telling you about similar services of our own (the "soft opt-in" under the Privacy and Electronic Communications Regulations 2003). Every marketing message will tell you how to opt out, for example by clicking "unsubscribe" or replying STOP, and you can also tell us at any time. Opting out of marketing won't affect service messages about your membership or bookings.

If you accept cookies, we, Meta and Google may use information about your visit to our website (including whether you started a trial) to measure our adverts and show them to people likely to be interested. You can change your cookie choice at any time using "Cookie settings" at the bottom of every page.

7. Photos, video and CCTV

We sometimes take photos and video at classes, gradings, competitions and events and share them on our website and social media. If you'd rather not appear, tell a coach or message us and we'll avoid featuring you and, where reasonably practicable, remove existing posts showing you. The same applies to your child.

If we operate CCTV at the gym, it will be for safety, security and preventing crime, it will be clearly signed, and recordings will be kept for no longer than 30 days unless we need them to investigate an incident or a claim, or the police ask for them.

8. Who we share your information with

We don't sell your personal information. We share it only where necessary, with:

• Gymdesk, our membership management system, which holds member profiles, waivers, bookings, attendance, billing and messages;
• Stripe, which processes card payments (including the £20 trial, paid through Stripe Checkout on this website) and stores card details securely;
• GoHighLevel, our customer relationship management (CRM) tool, which we use to manage trial sign-ups and enquiries and to send emails and text messages;
• Meta (Facebook, Instagram and WhatsApp), when you contact us through those services, and for advertising and the Meta Pixel if you accept cookies;
• Google, for email and office tools, the map on our contact page, YouTube videos and, if you accept cookies, Google Ads conversion measurement;
• Klarna and Clearpay, if you choose to pay for a package with them. They make their own decisions about your information, including credit checks, under their own privacy notices;
• our accountants, insurers, banks and professional advisers;
• emergency services and medical professionals, if you are injured or unwell;
• the police, HMRC, courts or regulators, where the law requires or allows it; and
• a buyer or successor, if our business is sold or restructured, under equivalent privacy protections.

Service providers that act on our behalf (processors) may only use your information on our instructions and must keep it secure under a written contract.

9. International transfers

Some of our providers, including Gymdesk, Stripe, GoHighLevel, Meta and Google, may store or access personal information outside the UK, including in the United States. Where they do, we make sure the transfer is protected by a lawful safeguard, such as UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Contact us if you would like more information.

10. How long we keep your information

We keep personal information only for as long as we need it for the purposes described in this notice:

• Membership, payment and transaction records: 6 years after your membership ends, to meet tax and accounting requirements and deal with any claims.
• Health information: while you are a member; it is then deleted, unless it forms part of an accident or incident record.
• Accident and incident records: 3 years from the date of the incident or, for a child, until they turn 21, as the law allows claims to be brought within those periods.
• Enquiries and leads who don't join: 2 years from our last contact with you.
• Marketing preferences: until you opt out, after which we keep a record of your opt-out so that we don't contact you again.
• Photos and video published online: until you ask us to remove them, where reasonably practicable.
• CCTV recordings, if we operate CCTV: up to 30 days, unless needed for an incident or claim.
• Advertising cookies and data: as set out in section 13 (up to 90 days for advertising cookies), and no longer than 26 months in the advertising platforms' reports.

When information is no longer needed, we delete it securely or anonymise it.

11. Keeping your information secure

We use reputable providers with strong security, limit access to people who need it, protect accounts with passwords and two-factor authentication where available, and train our team on handling personal information. If a data breach happens that is likely to put your rights at risk, we will tell you and the ICO where the law requires.

12. Your rights

Under UK data protection law you have the right to:

• access the personal information we hold about you and receive a copy;
• have inaccurate or incomplete information corrected;
• have your information erased in certain circumstances;
• restrict how we use your information in certain circumstances;
• object to our use of your information where we rely on legitimate interests, and to direct marketing at any time;
• data portability, meaning you can receive information you gave us in a commonly used electronic format or ask us to send it to someone else, where we rely on consent or contract; and
• withdraw consent at any time, where we rely on consent. This won't affect anything we did before you withdrew it.

To use any of these rights, contact us using the details in section 1. There is normally no charge. We may need to confirm your identity, and we'll respond within one month, or tell you within that month if we need longer because your request is complex.

13. Cookies and similar technologies

Cookies and similar technologies (such as your browser's local storage) store small pieces of information on your device. Under the Privacy and Electronic Communications Regulations 2003, we only use them without asking where they are strictly necessary. Everything else is off until you click Accept in our cookie banner. If you click Reject, or ignore the banner, nothing optional loads.

You can change your mind at any time using the Cookie settings link at the bottom of every page. If you switch from Accept to Reject, we delete the analytics and advertising cookies we can reach and stop them loading again. We ask again after 12 months. You can also block or delete cookies in your browser settings.

We use an essential cookie to keep your checkout and receipt private and prevent repeat payment attempts. Optional advertising storage still requires your consent. This is what is stored or loaded:

We don't currently use Google Analytics or any other website analytics. If we start, we will add it to this table first and it will only run after you accept.

When you pay, you're taken to Stripe's secure checkout page, and when you create your member account or book classes, you use Gymdesk's website. Those sites use their own strictly necessary cookies (for example for security and fraud prevention) under their own cookie policies.

14. Complaints and changes to this notice

If you're unhappy with how we've handled your personal information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

We may update this notice from time to time. The latest version will always be on this page, and we will tell you about any significant changes by email or through Gymdesk.