Privacy Policy

What does this policy cover?

This policy describes how JILO House, Trading as Hartbeeps Epsom, Ewell, Worcester Park, New Malden, Kingston and Surbiton will make use of your and your child's data when you book or attend a class or event with us or when you buy a product or service from us.

It also describes your data protection rights, including a right to object to some of the processing which JILO House carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you interact with us, and our website, attend one of our classes or book an event and when you purchase goods and services from us. This includes:

• your and your child's name

• your and your child's gender

• your child's age/date of birth

• any allergies you or your child may have,

• your marketing preferences, including any consents you have given

• any enquiries you submit to us

• any Hartbeeps' affiliates' sample products you requested to receive

• your home address, email address and phone number

• any disability information where you would like us to cater for your child's needs

• your child's photographs and videos during our classes for our training and promotional material or when you submit them for our competitions

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. These are outlined below:

• when you book a class or event we receive your payment details from our third party booking service provider

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• To fulfil a contract, or take steps linked to a contract: this is relevant where you make a purchase from us or enter a competition we run. This includes:

• communicating with you

• verifying your identity

• taking payments

• reserving a space for you in our classes when you book a class with us or attend your event or private parties

As required by Hartbeeps to conduct our business and pursue our legitimate interests, in particular:

• to provide products and services you have requested such as your private party requests, and respond to any comments or complaints you may send us

• if you provide a credit or debit card as payment, we also use third parties to check the validity of the sort code, account number and card number you submit in order to prevent fraud (see data sharing below)

Where you give us consent:

• we will send you direct marketing in relation to our relevant products and services, or other products and services provided by us, our affiliates and carefully selected partners

• we will process your or your child's allergy information, to provide you with an allergy free environment where we can and when you inform us

• on other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.

For purposes which are required by law:

• In response to requests by government or law enforcement authorities conducting an investigation.

Withdrawing consent or otherwise objecting to direct marketing

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes, such as those set out above. In some cases, we are able to send you direct marketing without your consent, where we rely on our legitimate interests. You have an absolute right to opt out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the unsubscribe link in the communication where this is an electronic message, or by contacting us using the details set out below.

Who will we share this data with, where and when?

• We may share your child's video and photographs to our franchisees through promotional material we supply to them. We will do this where you give us consent as the parent or the guardian of the child concerned. Please be aware that countries outside the European Economic Area may not have the same degree of protection for your or your child's personal data

• When you visit our Facebook page, Facebook Ireland will collect certain personal data from you and they will give us anonymous analytics data about you. This is called insight data and you can find more information about how Facebook processes it here . Facebook and Hartbeeps are joint controllers over the insight data. For any other processing we are separate controllers, please refer to Facebook's Data Policy to understand how they process your personal data. We process the insight data for our legitimate interests to understand how you interact with our Facebook page and its contents and to help us improve our services and contents. If you would like to exercise your data subject rights over this insight data please contact us or Facebook.

• Soundplay Music Limited when you book or attend one of our classes or events

• Our partner companies such as Ella’s Kitchen and Cheeky Wipes when you request a sample product from them

• Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws

• Personal data will also be shared with third party service providers, who will process it on behalf of for the purposes identified above. In particular, we use third party providers of booking and payment processing services

• In the event that the franchisee is sold or integrated with another business, your details will be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new franchisee.

What rights do I have?

You have the right to ask the Hartbeeps franchisee with whom you have a relationship with for a copy of your personal data held by each respective entity; to correct, delete or restrict (stop any active) processing of your personal data held by each respective entity; and to obtain the personal data you provide to either party for a contract or with your consent in a structured, machine readable format, and to ask either entity to share (port) the personal data they hold about you to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in the GDPR. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, you can get in touch with us using the details set out below.

For booking a class the provision of your card data is mandatory: if relevant data is not provided, then the franchisee will not be able to enrol you on a class or when you purchase a product from us we will need your payment information and address otherwise we will not be able to send you the product. All other provision of your information is optional. For example if you do not inform the Hartbeeps franchisee about your child's allergies or disabilities, they may not be able to ensure that the class you attend will be free from such allergens or special arrangements will be provided to meet your child's needs.

How do I get in touch with you?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch with:

• Laura Stevens, Laura.stevens@hartbeeps.com, JILO House, 117 Tudor Avenue, Worcester Park, KT4 8TU

Who is my data controller, and which affiliates might my data be shared with?

The data controllers for your information is the Hartbeeps franchisee with whom you have a relationship with. Similarly where you request receiving a sample product from one of our partners and when you make a payment to us using a payment processing gateway such as Stripe or Paypal, they will process your data as separate controllers to us. Please contact them separately to exercise your data subject rights for the personal data they hold on you.

How long will you retain my data?

• Where we process registration data, we do this for as long as you are an active attendee of our classes and for 2 years after this

• Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data indefinitely so that we can respect your request in future.

• Where we process personal data in connection with performing a contract or for a competition, we keep the data for 6 years from your last interaction with us.

How to complain

If you have unresolved concerns about the use of your personal information, you have the right to complain to the data protection authority where you live, work or where you believe a breach may have occurred.

In the UK you can complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address is:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF and their website address is https://www.ico.org.uk