Draft — needs your details filling in. Health answers count as special category data under UK GDPR, so this one matters. Register with the ICO before you take bookings, fill in the bracketed fields, and delete this box.

What we do with your details.

Last updated 2026. Short version: we use your details to run your booking and nothing else, and we never sell them.

Who's responsible

[Company name], registered in England and Wales, company number [number], at [registered address], trading as Back of the Box. We are the data controller for the information described here. ICO registration number [number]. Contact backoftheboxwellness@gmail.com about anything on this page.

What we collect

Your contact details — name, email, mobile — when you book or join the founding list.
Your booking history — sessions booked, dates, how many people.
Health screening answers — the yes/no questions at booking. This is special category data and we treat it accordingly: it's used only to keep you safe, seen by as few people as possible, and never used for marketing.
Payment records — what you paid and when. We never see or store your card number; that goes straight to our payment provider.

Why we're allowed to

Contact and booking details: to perform our contract with you. Health answers: for reasons of your vital interests and our health and safety obligations, with your explicit consent given at booking. Marketing emails: your consent, which you can withdraw at any time with one click. Records we keep for accounts and insurance: our legitimate interest in running a business properly and our legal obligations.

Who else sees it

Only the suppliers who make the service work: our payment provider, our booking and email systems, and our accountant. Each is bound to handle your data only on our instructions. We do not sell your data, and we don't pass it to anyone else for their own marketing.

CCTV

CCTV covers the entrance and communal areas for safety and security. There are no cameras in the sauna, plunge area, showers or changing space. Footage is kept for [30] days and then deleted automatically, and is only reviewed after an incident.

How long we keep things

Booking and health records: [2] years after your last visit, for insurance and safety reasons. Accounting records: 6 years, as HMRC requires. Marketing list: until you unsubscribe. Founding-list details: deleted if you ask, or if we haven't heard from you within [12] months of opening.

Your rights

You can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, object to how we're using it, or withdraw consent. Email backoftheboxwellness@gmail.com and we'll respond within one month. If you're not happy with how we've handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies

This site uses no advertising or tracking cookies. The booking pages store your in-progress booking in your own browser so you don't lose it if you refresh — that stays on your device and never reaches us.