KARVE – Privacy Policy

1.1 This privacy policy explains how Karve Limited (“KARVE”, “we”, “us”, “our”) collects, uses, stores and shares your personal data when you use our website at www.karve.club, our KARVE CLUB app, our SMS messaging programme, or attend any of our studios in the United Kingdom. Karve Limited (company number 11998308) is the data controller of your personal data.

1.2 We do not rent or sell your personal information, and we only share it with third parties as described in this policy.

1.3 We may update this privacy policy from time to time. If you are a registered KARVE user, we will inform you of any material changes by email. The latest version will always be posted on our website.

2.1 We may collect and process the following categories of personal data: Identity Data: first name, last name, username or similar identifier, and date of birth. Contact Data: email address, telephone number (including mobile number where you opt in to SMS messages) and postal address. Financial and Transaction Data: details of payments to and from you and details of memberships, class packs and other products you have purchased from us. Payment card details are collected and processed directly by our payment provider, Stripe – we do not store full card numbers. Health Data: information you provide in health declarations and information about injuries, pregnancy or medical conditions you disclose to us so that you can exercise safely, together with information about your exercise activities. This is a special category of personal data and is explained further in section 4. Technical Data: internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website or app. Profile Data: your username and password, bookings, preferences, feedback and survey responses. Usage Data: information about how you use our website, app, products and services, including class attendance. Marketing and Communications Data: your preferences in receiving marketing from us, your SMS opt-in status, and your communication preferences. Images: CCTV footage when you visit our studios, and photography or filming carried out for marketing purposes as described in our Terms and Conditions.

2.2 We also collect, use and share Aggregated Data such as statistical or demographic data. Aggregated Data may be derived from your personal data but does not directly or indirectly reveal your identity. If we combine Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data subject to this policy.

2.3 Apart from health data as described above, we do not collect any other special categories of personal data about you (such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, or trade union membership), nor any information about criminal convictions and offences.

2.4 Our Services are intended for adults aged 18 and over, and for 16-17 year olds only with parental or guardian consent as set out in our Terms and Conditions. We do not knowingly collect data relating to children under 16.

3.1 Under UK data protection law (the UK GDPR and the Data Protection Act 2018), we must have a lawful basis for using your personal data. We rely on the following: Performance of a contract: to register and manage your account, take payment, manage bookings, memberships and class packs, provide classes and services, and communicate with you about your account. Legitimate interests: to improve our website, app, services and products; to ensure the safety and security of our studios (including CCTV); to administer and protect our business; and to send you marketing about similar KARVE products and services where permitted by law, subject to your right to opt out at any time. Consent: where you opt in to receive SMS messages, where you agree to be identifiable in marketing photography or filming, and for any other purpose for which we specifically request your consent. You may withdraw consent at any time. Legal obligation: to comply with our legal and regulatory obligations, including tax and accounting requirements.

4.1 We collect health information (including health declarations, disclosed injuries or conditions, and exercise activity) only so that we can provide our services to you safely and perform our obligations under your contract with us. We process this special category data on the basis of your explicit consent, which you may withdraw at any time – although if you do, we may be unable to allow you to participate in classes where we cannot assess your safety.

5.1 Where you purchase services from us, we may send you marketing emails about similar KARVE products and services in reliance on the “soft opt-in” under the Privacy and Electronic Communications Regulations. You will be given a clear opportunity to opt out of marketing at the point of sign-up, and every marketing email will contain an unsubscribe link.

5.2 If you opt in to our SMS messaging programme, we may send you text messages including class and appointment reminders, booking confirmations and updates, account alerts, promotional offers, and customer support follow-ups. You can opt out at any time by replying STOP to any message, and get help by replying HELP. Message and data rates may apply. Your mobile number and SMS opt-in data will never be shared with third parties or affiliates for marketing or promotional purposes.

5.3 Opting out of marketing will not affect service communications, which we will continue to send you where necessary – for example booking confirmations, account and security updates, payment notifications, and changes to our Terms and Conditions or this privacy policy.

6.1 We may collect and store certain information about your interaction with the KARVE website and services through cookies and similar technologies, including IP addresses, browser type, device type, location, internet service provider (ISP), entry and exit pages, operating systems, and time/date stamps. We use this information to improve the quality of our services and products.

6.2 Where required by law, we will ask for your consent before placing non-essential cookies. You can also decline or manage cookies via your browser settings, though if you do, some features of the KARVE services may be limited.

7.1 We share personal data with trusted third-party service providers who process it on our behalf and under our instructions, including: our payment provider (Stripe); our booking and studio management platform; our email, SMS and marketing platforms; and our website and IT hosting providers. These providers are only permitted to use your data to provide services to us.

7.2 Where you consent to marketing cookies, we also share limited data (a hashed version of your email address, your IP address and device information) with Meta Platforms for advertising measurement. Meta uses this data in accordance with its own privacy policy. You can withdraw this consent at any time via Consent Preferences in the site footer.

7.3 We may also disclose your personal data where required by law, to professional advisers, or to enforce our Terms and Conditions.

7.4 In the event KARVE goes through a business transition, such as a merger or acquisition by or with another company, including a transfer of some or all of our assets, personal data we hold may be transferred as part of that transaction. We will notify you of any such change and of any choices you may have.

7.5 Your mobile number and SMS opt-in data are excluded from all of the above sharing for marketing or promotional purposes, as stated at the top of this policy.

7.6 Where any of our service providers process your data outside the UK, we ensure appropriate safeguards are in place as required by UK data protection law, such as the UK International Data Transfer Agreement or an adequacy decision.

8.1 We keep your personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting and reporting requirements. In general: account and membership data is kept for the duration of your relationship with us and for up to 6 years afterwards to meet legal obligations; health declarations are kept for as long as needed to manage your participation safely and to defend legal claims; CCTV footage is retained for a limited period (typically no more than 30 days) unless needed for an incident investigation; and marketing data is kept until you opt out.

9.1 We protect data in transit with SSL encryption and apply appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss or misuse. However, no system can be guaranteed completely secure, and we encourage you to maintain the security of your own account by choosing a strong, unique password for your registered KARVE account and keeping it confidential.

9.2 If you forget your account information, you can use the “forgot login” option on the login screen and a password reset link will be emailed to you.

10.1 Under UK data protection law, you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased in certain circumstances; restrict or object to our processing of your data (including the absolute right to object to direct marketing); receive a copy of your data in a portable format; and withdraw consent at any time where we rely on consent.

10.2 You can exercise any of these rights, or review and update the personal information you have provided, by contacting us at hello@karve.club or by logging into your KARVE account and updating your details in your account settings. We will respond to requests within one month.

10.3 You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk), although we would appreciate the chance to address your concerns first.

11.1 Any changes we make to this privacy policy in the future will be posted on this page and, where the changes are material, notified to you by email.

12.1 If you have any questions or concerns about this policy or any KARVE services, products or features, please contact us at hello@karve.club.