Last updated: 9 September 2026
Who we are
Sola Movement Studio is a small-group movement studio at 31 Goldsmith Road, Leyton, London E10 5EZ, operated as a sole trader business trading as "Sola Movement Studio". We are the data controller for the personal data described in this policy.
If you have any questions about this policy or your data, contact us at info@solaspace.co.uk.
What we collect
We only collect what we need to run the studio:
- Bookings and memberships. When you book a class or buy a membership or pass, we collect your name, email address, and — if you give them — your phone number and date of birth, along with your booking history and credit balance. Payments are processed by Stripe: the card form belongs to them, so we never see or store your card details. We also record whether a booking was made on a phone or a computer — just that, not a description of your device.
- Enquiries. If you email or WhatsApp us, we keep your message and contact details so we can reply.
- Meta lead forms. If you fill in one of our forms on Facebook or Instagram (for example to claim an intro offer), Meta shares the details you submit — typically your name, email and phone number — with us.
- Newsletter. If you sign up to our mailing list, we store your name and email address with our email provider, MailerLite.
- Website analytics. We use Google Tag Manager, Google Analytics and the Meta Pixel to understand how people find and use our website. If you accept cookies, these collect device and usage information such as pages viewed, approximate location and how you reached us. We also keep our own record of which ad or link first brought you here, described under Cookies below.
- Health information you choose to share. If you tell us about an injury or condition so we can coach you safely, we treat that information with extra care and only use it for that purpose.
- Photographs and video. Occasionally we take photographs or short video in class for our website and social media. We ask first, you can decline at the time or afterwards, and we will take anything down on request.
- CCTV. The studio premises are covered by CCTV for the safety and security of everyone who trains here.
Why we use it
Under UK data protection law we need a lawful basis for everything we do with your data:
- To provide what you've booked — managing classes, memberships and passes (performance of a contract).
- To reply to you — answering enquiries and messages (legitimate interests).
- To keep you safe — coaching around injuries you've told us about (consent), and CCTV for security (legitimate interests).
- To send you news and offers — only if you've opted in, and you can unsubscribe at any time (consent).
- To show what the studio is like — photographs and video from classes, on our website and social media (consent, which you can withdraw at any time).
- To improve the website and our advertising — analytics and measuring whether our ads work (legitimate interests / consent for cookies).
We never sell your data.
Who we share it with
We use a small number of trusted services to run the studio. Each only receives what it needs:
- Supabase — your account, bookings and credit balance, held on servers in London
- Punchpass — our previous booking system. It no longer takes bookings for us, but it still holds the booking and membership records created before we moved. We'll remove this entry once that data has been deleted.
- Stripe — card payments and memberships
- Resend — booking confirmations and other emails about your account
- MailerLite — our email newsletter
- Google — website analytics (Google Tag Manager and Google Analytics)
- Meta — lead forms and advertising measurement on Facebook and Instagram
- Netlify — website hosting
Your account and booking records are held in London. Some of the other providers above are based outside the UK (mainly in the United States); where that happens, transfers are protected by safeguards recognised under UK law, such as the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses.
Cookies
No measurement cookie is set until you have answered the cookie banner. Decline, and the site works exactly the same.
- sola_consent. Your answer to the banner, whichever way you answered, so we don't ask you again. It lasts six months.
- sola_attribution. Only if you accept. It records how you first found us: the ad or link you arrived from, the page you landed on, when, and the Google Analytics id for your browser if one has been set. We use it to work out which of our ads bring people to the studio, and nothing else. It lasts 90 days from that first visit, and is removed the moment you decline.
- Google Analytics and the Meta Pixel. Only if you accept. These set their own cookies, through Google Tag Manager, to measure how the site is used and whether our advertising works.
You can change your answer at any time. You can also block or delete cookies in your browser settings.
How long we keep it
- Booking and membership records — while you're an active customer, and for up to 6 years afterwards where needed for tax and accounting.
- Enquiries — up to 2 years after our last contact.
- Newsletter details — until you unsubscribe.
- CCTV footage — typically deleted within 30 days, unless needed for a specific incident.
- Records still held by Punchpass from before the move — deleted when we close that account.
Your rights
You have the right to ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
To exercise any of these rights, email info@solaspace.co.uk — we'll respond within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to sort it out with you first.
Deleting your data
To have your data deleted, email info@solaspace.co.uk with the subject 'Data deletion', and tell us the name and email address you booked under so we can find you. We'll respond within one month.
We delete your account, your booking and attendance history, and your contact details wherever we hold them for marketing, including your entry on our newsletter list. Data we've shared with Meta for advertising is deleted too — you can also control that yourself in your Facebook or Instagram settings.
Two things we can't delete. We have to keep a record of payments for 6 years because HMRC requires it: the amount, the date, and enough to tie it to you. And if you were involved in an accident or incident at the studio, we keep that record for as long as we're required to, in case a claim is ever made.
Changes to this policy
We'll update this page if anything changes about how we handle your data, and update the date at the top when we do.