Privacy Policy

Last updated: [DATE]

This Privacy Policy explains how rooted2u ("we", "us", "our") collects, uses, and protects your personal data when you visit this website (the "Site"), contact us, subscribe to our newsletter, or book a class with us. We are committed to handling your data in line with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988 to 2018.

1. Who we are

rooted2u, operated by [Business/Trading Name], registered address [Registered Address], is the data controller responsible for your personal data. If you have any questions about this policy or how we handle your data, contact us at [contact email] or via our contact page.

2. What data we collect

Depending on how you interact with the Site, we may collect:

• Contact form submissions — your name, email address, and the content of your message, when you use our contact form.
• Newsletter sign-up — your email address, when you subscribe to our newsletter.
• Booking information (where applicable) — your name, contact details, and class booking history, when you book a class through the Site.
• Technical data — basic information such as your IP address, browser type, and pages visited, collected automatically as part of running the Site.

We do not knowingly collect any special category data (such as health information) through the Site itself. If you disclose medical or health information to us directly (for example, before a class), we will only use it for your safety during that class and will not store it longer than necessary.

3. How we use your data

We use your personal data to:

• Respond to enquiries submitted through the contact form;
• Send newsletter updates to subscribers who have opted in;
• Manage and administer class bookings, where applicable;
• Maintain the security and proper functioning of the Site;
• Comply with our legal and regulatory obligations.

4. Our legal basis for processing

We rely on the following legal bases under the GDPR:

• Consent — for newsletter sign-ups, which you can withdraw at any time.
• Legitimate interests — for responding to contact form enquiries and keeping the Site secure.
• Contract — for processing bookings and providing the services you request.
• Legal obligation — where we are required to retain or disclose data by law.

5. Sharing your data

We do not sell your personal data. We may share it with trusted third parties who help us run the Site and our services, including:

• Our website hosting provider, for storing and serving the Site and its data;
• Our email/SMTP provider, for sending contact form notifications and, where applicable, newsletter emails;
• A newsletter platform (if and when we introduce one), for managing subscriber communications;
• A booking platform (if and when we introduce one), for managing class bookings;
• Cloudflare, Inc., whose Turnstile service checks that contact form and newsletter submissions come from a person rather than an automated bot. When you use those forms, your browser sends Cloudflare technical information (such as your IP address and browser characteristics) for this check only. See Cloudflare's Turnstile privacy addendum;
• Any third party where required to comply with a legal obligation.

Any third party we share data with is required to protect it in line with applicable data protection law.

6. Cookies

This Site may use a small number of essential cookies required for it to function correctly (for example, to support security features like CSRF protection). We do not currently use analytics or marketing cookies. If this changes, we will update this policy and, where required, ask for your consent.

7. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy, or as required by law. Contact form enquiries and newsletter subscriptions are retained until you ask us to delete them or until they are no longer needed, whichever is sooner.

8. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data;
• Object to or restrict how we use your data;
• Withdraw consent at any time, where we rely on consent (for example, by unsubscribing from our newsletter);
• Request a copy of your data in a portable format;
• Lodge a complaint with the Data Protection Commission (DPC), Ireland's data protection authority, at dataprotection.ie.

To exercise any of these rights, contact us at [contact email] or via our contact page.

9. Data security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal or regulatory reasons. The updated policy will be posted on this page with a revised "last updated" date.

11. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please get in touch or email us at [contact email].