Privacy

Who I am

Unfrozen is a trading name of Hashtag HQ Ltd, a company registered in England and Wales, company number 12976144. The company is the data controller for any personal information you give me, which means it decides what happens to that information and is responsible for looking after it. In practice, that is me, Richard Porter.

You can reach me at richard@unfrozen.co.uk about anything on this page.

What I collect, and why

I only ask for what I need to run a session safely and to get you into it.

When you book

• Your name and email address, so that I can send your confirmation and tell you if anything changes
• Your phone number, if you choose to give one, in case I need to reach you on the day
• Your answers to the health and waiver questions

My lawful basis is performing our contract, because I cannot deliver a session I have sold you without this, together with my legitimate interest in running sessions safely.

When you pay

Card payments are handled by Stripe. I never see or store your card number. Stripe confirms that the payment succeeded and gives me the last four digits so that I can match it to your booking.

When you message me

Whatever you put in the message, and your email address so that I can reply. My lawful basis is my legitimate interest in answering people who get in touch.

When you visit this website

My host records standard technical information, such as the pages requested and the browser used, as part of running the server securely. My lawful basis is my legitimate interest in keeping this site available and secure.

If you agree to it, I also use Google Analytics to count visits and see which pages people read. That is entirely your choice. Nothing is loaded and no analytics cookie is set unless you say yes, and the site works exactly the same either way. My lawful basis for analytics is your consent.

Health information

Health information is special category data under UK GDPR, which means it gets extra protection. I collect it only through the health and waiver questions you complete before a session. My lawful basis is your explicit consent, which you give when you complete and sign that form.

I use it for one thing: deciding whether a session is safe for you, and knowing how to look after you in the room. It does not affect what I send you, and it is never combined with marketing information.

You can withdraw your consent at any time by emailing me, although I may then not be able to offer you a place.

When you come to a session

Session forms. When you take part in a session, I ask for your contact details, an emergency contact, and information about your health. Hashtag HQ Ltd, trading as Unfrozen, is responsible for this information.

Why I use it. I use your health information, with your explicit consent, to check that the session is safe for you and to look after you during it. I use your contact details to run the session and send you a copy of your form. If you have paid for a session, or ticked the box to hear from me, I also use your name and email address to tell you about future sessions and events. You can opt out on the form, or unsubscribe from any email at any time. Your health information is never used for marketing.

How long I keep it. I keep session forms for seven years, as my professional insurance requires, and then delete them. If you withdraw your consent, I will stop using your information for future sessions, but I may need to keep the record of past sessions in case of a legal claim.

Who sees it. Only me. I share it only with emergency services if you need urgent help, with my insurer if there is a claim, or where the law requires it.

How it is stored. Forms are stored on my website's secure server, are never emailed to me, and can only be opened with my password-protected login.

Your rights. You can ask to see, correct or delete your information by contacting me. If you are unhappy with how I handle it, you can complain to the Information Commissioner's Office at ico.org.uk.

Marketing

Booking a session online does not sign you up to anything. When you come to a session, the form you fill in asks about emails. If you paid for the session, I may email you about future sessions and events unless you tick the box to say you would rather not. If the session was free, I only email you if you tick the box asking me to.

Every email has an unsubscribe link. One click, no questions, and it takes effect straight away.

You can also ask to hear when new dates go live, using the email box at the top of each page. That takes your email address and a tick to say yes, nothing else. I then send you one email asking you to confirm, and you are only added once you click the link in it. I keep your address until you unsubscribe, and I use it only to tell you about Unfrozen sessions and events.

How long I keep things

• Booking and health records — seven years after your last session, because my insurer requires me to keep them
• Payment records — six years, because HMRC requires it
• Marketing list — until you unsubscribe, or after two years with no engagement
• Messages you send me — up to two years, then deleted

Who else sees it

Nobody, other than the services I need in order to run the business:

• Stripe — card payments
• SMTP2GO — sending your confirmation and, if you have opted in, session emails
• Zoho — sending emails about sessions and events to people who have asked for them, or who came to a paid session and did not opt out, from servers in the EU
• Amazon Web Services — hosting this website and its database, on servers in London
• Automattic — profile images through Gravatar
• Google — if you have agreed to analytics, Google Analytics receives information about your visit. The typefaces this site uses are stored on my own server, so loading a page sends nothing to Google Fonts

I do not sell your information, and I do not share it with anyone for their own marketing.

The one exception is safeguarding. If I believed you or someone else was at serious risk of harm, I might have to pass information to the emergency services or another appropriate body. That is rare, and I would tell you I was doing it wherever it was safe to do so.

Where your information goes

This website and its database sit on servers in London. Some of the services above are based outside the UK, mainly in the United States. Where your information goes outside the UK, it is protected by the safeguards UK law recognises: either the country has been judged to offer equivalent protection, or the transfer is covered by the International Data Transfer Agreement.

Keeping it safe

The site runs over an encrypted connection. Access to booking and health records is limited to me, and health information is kept apart from marketing information. If there were ever a breach that put your rights at risk, I would tell you and the Information Commissioner's Office.

Decisions made about you

Nothing here makes automated decisions about you, and I do not profile you. Whether a session is suitable is decided by me, reading your form.

Under 18s

Sessions are for adults. I do not knowingly collect information about anyone under 18. If you believe a child has given me their information, email me and I will delete it.

Cookies

This site sets only the cookies it needs in order to work: remembering what is in your basket and where you are in the booking process, and a cookie set by Stripe that helps it spot fraud during payment. These do not require your consent.

If you agree to it, Google Analytics sets two cookies so that it can count you as one visitor rather than several. You are asked before either one is set, nothing loads until you say yes, and saying no costs you nothing on this site.

If you agree to it, we may also set a Meta (Facebook) advertising cookie, used for things like showing you relevant ads on Facebook and Instagram. You are asked before it is set, and saying no costs you nothing on this site. A full, current list of the cookies this site uses is on the cookie policy page.

You are asked before anything optional is set, and you can pick and choose rather than accepting everything. You can change your mind whenever you like using the Cookie choices tab at the edge of the screen.

Your rights

Under UK GDPR you can ask me to:

• Tell you what I hold about you, and give you a copy
• Correct anything that is wrong
• Delete it, where I am not required to keep it
• Stop using it for a particular purpose, or restrict what I do with it
• Send it to you or to someone else in a portable format

You can also object to anything I do on the basis of legitimate interests, and where I relied on your consent you can withdraw it at any time. Withdrawing consent does not undo anything that was done before you withdrew it.

Email me and I will respond within one month. There is no charge.

Changes to this page

If I change how I handle your information, I will update this page and change the date at the top. If the change is a significant one, I will tell the people on my list.

If you are unhappy

Tell me first and I will try to put it right. If you are still not satisfied you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.