Privacy Notice

Contact details

Email

What information we collect, use, and why

We collect or use the following information to provide and improve products and services for clients:

• Names and contact details
• Gender
• Transaction data (including details about payments to and from you and details of products and services you have purchased, including gift vouchers)
• Health information (such as medical records or health conditions)

We also collect or use the following special category information to provide and improve products and services for clients. This information is subject to additional protection due to its sensitive nature:

• Health information

We collect or use the following personal information for information updates or marketing purposes:

• Names and contact details
• Marketing preferences

We collect or use the following personal information to comply with legal requirements:

• Name
• Contact information
• Health and safety information

We collect or use the following personal information to protect client welfare:

• Names and contact information
• Health and wellbeing information

We also collect or use the following special category information to protect client welfare. This information is subject to additional protection due to its sensitive nature:

• Health information

We collect or use the following personal information for dealing with queries, complaints or claims:

• Names and contact details
• Purchase or service history
• Information relating to health and safety (including incident investigation details and reports and accident book records)
• Correspondence

We also collect or use the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:

• Health information

Gift voucher purchases and redemptions

When someone buys a gift voucher, we may collect and use:

• Purchaser name and contact details (including email address)
• Payment confirmation details needed to match the purchase to Monzo payment records (such as payment reference, amount and date)
• Gift voucher type, amount or experience, unique voucher reference, activation status, remaining balance, and expiry date
• Optional recipient name or message, if the purchaser chooses to provide them
• Redemption and booking details when the voucher is used
• Correspondence about the purchase, certificate, reissue or redemption

We use this information to process the purchase, confirm payment, activate and email the digital certificate to the purchaser, keep an accurate record of voucher balances, handle redemptions and reissues, and keep records needed for accounting, tax or legal purposes.

Gift purchaser and recipient details are not used for marketing unless the relevant person has given appropriate consent (for example by signing up to The Boog Portal newsletter or another marketing preference). Buying or receiving a gift voucher does not, by itself, subscribe anyone to marketing messages.

If a recipient later books a session, we may then collect the information we normally need for that booking, including any health or wellbeing information required for a safe session, under the same arrangements described elsewhere in this notice.

Website usage statistics

We use Vercel Web Analytics on this website to understand how public pages are used — for example which pages are visited and roughly where visits come from. We use this information to improve the website and visitor experience. We do not use Google Analytics.

Vercel provides the analytics service and hosts this website. According to Vercel, Web Analytics does not use cookies; page-view data is processed to produce aggregated statistics in our Vercel dashboard (such as page views, referrers, and general device, browser, or location categories). Vercel describes visitor counting using a short-lived hash derived from the request, rather than a lasting browser cookie that identifies you across days or websites.

Technical details associated with a page view (for example the page URL, referrer, approximate location derived from the request, and device or browser category) may be processed by Vercel in order to produce those statistics. We do not use analytics to build marketing profiles of individual visitors, and we configure the site so that private admin pages, API routes, Journal editing and preview screens, and invite-only client form pages are not sent to Web Analytics. Sensitive query parameters (such as unsubscribe tokens) are removed before an analytics event is sent.

We rely on our legitimate interests in understanding and improving how the public website is used. This does not replace the separate consents we ask for when you book, complete a health form, or join the newsletter. If you have questions about website analytics, contact us using the details at the top of this notice. Further information about cookies and analytics is in our Cookie Policy.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:

• Your right of access: You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
• Your right to rectification: You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure: You have the right to ask us to delete your personal information. Read more about the right to erasure.
• Your right to restriction of processing: You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
• Your right to object to processing: You have the right to object to the processing of your personal data. Read more about the right to object to processing.
• Your right to data portability: You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
• Your right to withdraw consent: When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:

• Consent: we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract: we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for information updates or marketing purposes are:

• Consent: we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Our lawful bases for collecting or using personal information to comply with legal requirements:

• Legal obligation: we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for collecting or using personal information to protect client welfare are:

• Consent: we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

• Legitimate interests:we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • To respond to queries, manage and resolve complaints, and establish, exercise or defend legal claims where necessary.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where we get personal information from

• Directly from you
• From a gift voucher purchaser, where they provide recipient name or message details for a gift certificate

How long we keep information

We keep personal information only for as long as necessary for the purposes for which it was collected. Enquiry and client information is reviewed regularly and deleted when it is no longer needed. Records required for tax, accounting or legal purposes are kept for the period required by law. Health and wellbeing information is kept only for as long as necessary to provide services safely and appropriately, and is then securely deleted.

Gift voucher purchase, activation, balance and redemption records are kept while the voucher is valid and for as long afterwards as needed for accounting, tax, complaints or legal record-keeping requirements, then securely deleted or anonymised when no longer required.

Who we share information with

Data processors

• Vercel
  This data processor does the following activities for us: Hosts this website and provides Vercel Web Analytics so we can view aggregated statistics about how public pages of the site are used.
• Supabase
  This data processor provides secure database storage for information submitted through The Boog Portal, including enquiries, bookings and gift voucher records.
• Resend
  This data processor delivers transactional emails from The Boog Portal, including gift certificates and Welcome Pack emails. These emails may contain the recipient's email address and information necessary to deliver the requested service.
• Brevo
  This data processor manages newsletter subscriptions, marketing consent and preferences, and sends newsletter-related emails. Where customers choose to receive marketing updates through our booking forms, their email address and consent are also processed through Brevo.

Others we share personal information with

• Organisations we’re legally obliged to share personal information with

International Data Transfers

Some personal information is processed outside the United Kingdom.

Vercel processes website requests, including gift voucher purchases, in the United States.

Our main database is provided by Supabase and is located in Germany. Supabase may also process support and log information outside that database region.

Resend stores the content of emails it sends for us, including gift certificates and Welcome Pack emails, in the United States.

Brevo primarily hosts newsletter and marketing contact information in the European Economic Area. Gift voucher orders are not sent to Brevo.

Where personal information is stored in the European Economic Area, including Germany, that transfer is covered by the UK adequacy regulations.

Where personal information is transferred outside the United Kingdom to a country without UK adequacy regulations, we assess the applicable data protection requirements and the safeguards provided by the organisations we use. These may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another recognised lawful transfer mechanism, as applicable.

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: hello@theboogportal.com

If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO.