Privacy Policy

• Trading name: FORME Reformer Pilates
• Legal entity: DSF Companies Limited
• Registered or principal address: 33 Twin Oaks Close BH18 8JE
• Studio address: 214C Lower Blandford Road, Broadstone, BH18 8DX
• Email: hello@formereformer.co.uk
• Company number: 16994214
• ICO registration number: 00014997714

For data-protection purposes, FORME is normally the data controller for the personal information described in this policy. This means that we decide why and how that information is used. The person responsible for privacy matters at FORME is:

• Name or role: Director
• Email: hello@formereformer.co.uk

Depending on how you interact with FORME, we may collect:

Identity and contact information

• Name
• Date of birth
• Postal address
• Email address
• Telephone number
• Emergency-contact details
• Account username or booking profile
• Parent or guardian details where relevant

Booking and membership information

• Classes and private sessions booked
• Attendance history
• Waiting-list activity
• Membership or class-pack details
• Cancellation and no-show history
• Communications relating to bookings
• Preferences and customer-service notes
• Promotional offers used

Payment and transaction information

• Payments made
• Refunds
• Failed-payment information
• Billing history
• The last digits or tokenised reference associated with a payment card

FORME does not ordinarily receive or retain complete payment-card details where payments are processed through a third-party payment provider.

Health and safety information

We may collect information concerning:

• Injuries
• Medical conditions
• Pregnancy
• Recent surgery
• Medication affecting participation
• Allergies
• Mobility limitations
• Emergency incidents
• Health declarations and exercise restrictions
• Adaptations discussed with instructors

Health information is special-category personal data and receives additional legal protection. Organisations processing it must identify both an Article 6 lawful basis and a separate Article 9 condition. (ICO)

Communications

• Emails, messages and enquiry forms
• Telephone notes
• Complaints and feedback
• Social-media messages
• Reviews
• Consent preferences

Website and technical information

Where applicable, we may collect:

• Internet Protocol address
• Browser and device type
• Approximate location
• Website pages viewed
• Referral source
• Cookie identifiers
• Booking activity
• Website performance and security information

Images and recordings

Where appropriate and with suitable permission, we may collect:

• Photographs
• Video recordings
• Client testimonials
• Social-media content

Clients will not be required to appear in promotional material as a condition of receiving studio services.

We may obtain information:

• Directly from you when you register, book, purchase or contact us
• Through our website and booking platform
• When you complete a health declaration or waiver
• From an instructor where relevant to safe participation
• From a parent, guardian or emergency contact
• Through payment providers
• Through cookies and similar technologies
• From social-media platforms where you contact or interact with us
• From publicly available sources, where appropriate
• From another person who purchases a gift or makes a booking on your behalf

Where information is obtained from someone other than you, we will provide privacy information where required and reasonably practicable.

We may use your information to:

• Create and administer your account
• Process bookings, memberships and class packs
• Deliver classes, private sessions and other services
• Take and reconcile payments
• Manage waiting lists and cancellations
• Communicate changes to bookings or timetables
• Assess whether participation may require modification
• Respond to emergencies
• Maintain health and safety
• Handle enquiries, complaints and feedback
• Keep accounting and tax records
• Prevent fraud and misuse
• Protect the studio, clients, instructors and equipment
• Improve our services
• Send marketing communications where permitted
• Manage competitions, events and promotions
• Publish approved photography or testimonials
• Establish, exercise or defend legal claims
• Meet legal, insurance and regulatory obligations

We will not use personal information for a materially unrelated purpose without considering whether further notice or consent is required.

Different purposes may rely on different lawful bases.

FORME collects only the health information reasonably needed to:

• Assess relevant safety considerations
• Help instructors adapt exercises
• Identify circumstances requiring medical clearance
• Respond appropriately to an incident or emergency
• Document accidents, injuries or complaints
• Meet insurance or legal requirements

Our likely Article 6 bases are:

• Performance of our contract with you
• Legitimate interests in operating a safe studio
• Vital interests in an emergency
• Legal obligation where applicable

Our Article 9 conditions may include:

• Your explicit consent
• Processing necessary to protect vital interests where you are physically or legally incapable of consenting
• Processing necessary to establish, exercise or defend legal claims

FORME should obtain explicit consent through a clear, separate health-declaration statement where that is the Article 9 condition relied upon. Consent must be specific, informed and capable of being withdrawn. Withdrawal does not make earlier lawful processing unlawful, although FORME may be unable to permit participation without essential safety information.

Health information will not be used for marketing or shared more widely than necessary.

We ask you to tell your nominated emergency contact that you have provided their information to FORME. We will normally use this information only where:

• You become ill or injured
• We have a serious welfare concern
• We are otherwise reasonably required to contact them in an emergency

We may send information about:

• Classes and timetable updates
• New services
• Memberships and offers
• Events and workshops
• Studio news

We will obtain consent where required by the Privacy and Electronic Communications Regulations. Marketing consent will be separate from acceptance of membership terms or a health waiver. Consent boxes should be unticked by default. You may unsubscribe at any time by:

• Using the unsubscribe link in an email
• Updating your account preferences
• Contacting us at hello@formereformer.co.uk

We may still send non-marketing messages necessary to administer bookings, payments, safety matters or your membership. The ICO states that marketing emails and texts to individuals normally require specific consent, although a limited existing-customer exception may apply where its conditions are met.

Our website may use:

• Essential cookies required for operation and security
• Booking or payment cookies
• Preference cookies
• Analytics cookies
• Advertising or social-media cookies

Non-essential cookies will not be placed before valid consent is obtained, where consent is legally required.

We may share information, where necessary, with:

• Booking and membership-platform providers
• Payment processors
• Website hosting and IT providers
• Email and communications providers
• Accountants and professional advisers
• Insurance providers
• Instructors and relevant studio personnel
• Contractors providing support services
• Marketing providers acting on our instructions
• Emergency services
• Healthcare professionals in an emergency
• Regulators, courts, law-enforcement bodies or public authorities
• A buyer or successor in connection with a genuine business sale or restructuring

We will not sell your personal information. Where a supplier processes information on our behalf, we will use appropriate contracts and take reasonable steps to ensure that it protects the information.

Services to identify before publishing:

• Booking system: Momence
• Payment processor: Stripe
• Website host: Lovable
• Email-marketing platform: Momence
• Accounting platform: Quickbooks
• Cloud storage provider: Google

Some FORME instructors may be self-employed contractors. Depending on the circumstances:

• They may process client information on FORME’s instructions as a processor or authorised user; or
• They may act as a separate controller for information they independently collect for their own services.

FORME will limit instructors’ access to information needed to teach safely and administer the relevant session. Instructors must not copy, retain or use FORME client information for their own marketing without a separate lawful basis and appropriate notice.

Some booking, payment, website, communications or cloud providers may store or access personal information outside the United Kingdom. Where this occurs, FORME will ensure that an appropriate legal transfer mechanism is used, such as:

• UK adequacy regulations
• The UK International Data Transfer Agreement
• The UK Addendum to approved standard contractual clauses
• Another legally permitted safeguard

You may contact us for further information about the safeguards applying to a particular provider.

FORME will keep information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, insurance or contractual requirements. A proposed retention schedule is:

FORME will take appropriate technical and organisational measures to protect personal information. Measures may include:

• Password-protected systems
• Multi-factor authentication
• Restricted staff and instructor access
• Device encryption
• Secure cloud storage
• Regular software updates
• Secure payment providers
• Confidentiality obligations
• Staff and contractor privacy training
• Secure deletion and disposal
• Data backups
• Incident-response procedures

No system can guarantee absolute security, but we will maintain safeguards proportionate to the sensitivity and volume of information processed.

A personal-data breach may include accidental loss, destruction, unauthorised disclosure, alteration or access. FORME will:

• Investigate suspected breaches promptly
• Take steps to reduce harm
• Record relevant incidents
• Notify the ICO where legally required
• Notify affected individuals where the breach creates a sufficiently high risk to their rights and freedoms

Clients should report suspected privacy or security issues to: hello@formereformer.co.uk

Depending on the circumstances, you may have the right to:

• Be informed about how your information is used
• Request access to your information
• Ask for inaccurate information to be corrected
• Ask for information to be deleted
• Ask us to restrict processing
• Object to certain processing
• Receive information in a portable format
• Withdraw consent
• Object to direct marketing
• Ask for human review of certain automated decisions
• Complain about our use of your information

Not every right applies in every circumstance. We may need to verify your identity before responding. Requests should be sent to: hello@formereformer.co.uk

We will normally respond within the legally required period.

FORME does not intend to make decisions about clients solely by automated means where those decisions have legal or similarly significant effects. Our booking platform may automatically:

• Deduct class credits
• Apply waiting-list rules
• Send reminders
• Restrict bookings following failed payment
• Apply cancellation settings

These are administrative functions governed by the applicable membership and booking terms. Contact us where you believe an automated action is incorrect.

FORME’s ordinary services are intended for adults unless a specific class or private session is offered to a younger person. Where a client is under 18, FORME may require:

• Parent or guardian details
• Parental consent
• An age-appropriate health declaration
• Suitable supervision
• Additional safeguarding arrangements

Children’s information will be processed only where necessary and with particular care.

CCTV may operate in selected entrance, reception or external areas for:

• Safety
• Security
• Crime prevention
• Protection of clients, staff and property
• Investigation of incidents

CCTV will not normally operate in toilets or private changing areas. Signs will identify areas under surveillance. Footage will normally be retained for no longer than 30 days unless needed for an incident, insurance matter or legal claim.

Where you communicate with FORME through Instagram, Facebook or another platform, both FORME and the relevant platform may process information. The platform will process information under its own privacy terms. We recommend reviewing those terms and privacy settings. We will not normally publish identifiable client content without permission.

Please raise privacy concerns with us first so that we have an opportunity to investigate. Contact:

• Data Protection Lead: Director
• Email: hello@formereformer.co.uk
• Postal address: 214C Lower Blandford Road BH18 8DX

We will:

1. Acknowledge your complaint promptly.
2. Investigate it objectively.
3. Keep you informed where additional time is needed.
4. Provide a clear outcome and information about escalation.

From 19 June 2026, organisations are subject to specific statutory requirements for handling data-protection complaints under the Data (Use and Access) Act 2025. (ICO) You also have the right to complain to the Information Commissioner’s Office. Details of how to complain are available through the ICO’s official website.

We may update this policy to reflect:

• Changes in law or regulatory guidance
• New booking or payment systems
• New services
• Changes in how we use information
• New suppliers

The current version will be displayed on our website. Material changes will be communicated where appropriate.