Privacy Policy

When you book a session, purchase a pass, or contact us, we may collect:

• Your name and email address
• Your phone number (if provided)
• Booking and payment history
• Any health information you voluntarily disclose for safety purposes
• Messages you send us via the contact form, email, or WhatsApp

We do not collect sensitive personal data beyond what you voluntarily provide for session safety.

We use your personal data to:

• Process and manage your bookings
• Send booking confirmations and event reminders
• Manage your Intro Pass or gift card credits
• Respond to your enquiries
• Ensure sessions are safe and appropriate for you
• Send occasional updates about upcoming events (only if you opt in)

We will never sell, rent, or share your personal data with third parties for marketing purposes.

Online payments are processed securely by Stripe. We do not store or have access to your full card details.

Stripe is PCI DSS Level 1 certified, the highest level of security certification in the payments industry. For more information, see Stripe's Privacy Policy.

We may contact you by email or WhatsApp for:

• Booking confirmations and reminders
• Changes or cancellations to events you are booked on
• Responses to your enquiries

Marketing messages (e.g. upcoming events, new services) are only sent if you have opted in. You can unsubscribe at any time by contacting us.

Your data is stored securely using Google Workspace and protected by access controls. Only authorised personnel can access customer records.

We retain your booking data for up to 6 years for accounting and legal purposes, in line with HMRC requirements.

Health information disclosed for session safety is kept only as long as necessary and is not shared with third parties.

This website uses essential cookies required for the site to function (e.g. session management). These do not track you for advertising.

We use Vercel Analytics for anonymous, aggregated usage statistics (page views, performance). This does not use cookies or collect personal data.

No third-party advertising or tracking cookies are used on this site.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate data
• Delete your data (subject to legal retention requirements)
• Object to processing of your data for marketing
• Withdraw consent for optional communications at any time

To exercise any of these rights, contact us at info@thesonicsanctuary.uk.