Privacy Policy

1. Who We Are

Matt Macaulay Strength & Performance Coaching (MMSPC) operates from Vortex Performance Academy, Cheshire, United Kingdom. Matt Macaulay is the data controller for this website (mmspc.co.uk) and the associated booking platform.

If you have any questions about how we handle your personal data, please contact us at: matt@mmspc.co.uk

2. What Data We Collect

We collect the following categories of personal data:

Account & Profile

• Full name and email address
• Password (stored as a secure hash. We never see it in plain text)
• Phone number (optional)
• Emergency contact details (optional)

Health Information

• Medical notes or relevant health information you choose to provide (optional). This is used solely to allow the instructor to adapt sessions safely for you. See Section 6 for more detail.

Booking & Activity

• Class bookings, cancellations, and attendance records
• Waitlist entries
• Class credits purchased and remaining

Payment

• Payments are processed by Stripe. We do not store your card details. We retain only a Stripe payment reference (payment intent ID) alongside your purchase record.

Technical Data

• IP address and basic browser/device information collected automatically by our hosting provider (Vercel) and database provider (Supabase) as part of normal service operation.
• Session authentication cookies (see Section 9).

3. How We Use Your Data

4. Third-Party Services

We share personal data with the following third parties only to the extent necessary to provide our service. Each acts as a data processor on our behalf.

• Supabase:database, authentication, and storage provider. Your account credentials, profile, bookings, and related data are stored on Supabase infrastructure.
• Stripe:payment processing. When you purchase a class package, you are directed to Stripe's secure payment flow. Stripe's own privacy policy governs how they handle your payment data.
• Vercel:website hosting. Vercel processes request data (including IP addresses) as part of serving this site.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. International Transfers

Some of our third-party providers (Supabase, Vercel, Stripe) may store or process data outside the UK or European Economic Area. Where this occurs, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or equivalent Standard Contractual Clauses to ensure your data is protected to the same standard as it would be in the UK.

6. Medical & Health Information

Health information is special category data under UK GDPR (Article 9). If you choose to add medical notes to your profile, you are giving explicit consent for Matt Macaulay to access this information solely to ensure sessions are adapted appropriately for your safety and wellbeing.

You are never required to provide medical notes. You may update or remove this information at any time from your account settings.

7. Children and Minors

Our booking platform requires account registration and payment via Stripe. We therefore require that all account holders are aged 18 or over. Parents and legal guardians may create accounts and book classes on behalf of children in their care. In doing so, the guardian confirms they have the authority to provide any personal data entered, including any health information relating to the child.

We do not knowingly collect personal data directly from children under 18.

8. Data Retention

• Account and profile data:retained for as long as your account is active. If you request account deletion, your data will be removed within 30 days, except where we are required to retain it by law.
• Booking and attendance records:retained for up to 3 years for administrative and legal purposes.
• Financial records:retained for 7 years in accordance with UK tax law.
• Medical notes:deleted immediately upon your request or on account deletion.

9. Cookies

This site uses a small number of cookies that are strictly necessary for the service to function:

• Authentication cookies:set by Supabase to maintain your login session. These expire when you log out or after a period of inactivity.

We do not use advertising cookies or third-party tracking cookies. Because we only use strictly necessary cookies, we are not required to obtain cookie consent, though you may block these cookies in your browser settings (this will prevent you from logging in).

10. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Access:request a copy of the personal data we hold about you.
• Rectification:ask us to correct inaccurate or incomplete data.
• Erasure:request deletion of your data (subject to legal retention requirements).
• Restriction:ask us to limit how we use your data in certain circumstances.
• Portability:receive your data in a structured, commonly used format.
• Objection:object to processing based on legitimate interests.
• Withdraw consent:where processing is based on consent (e.g. medical notes), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email matt@macsstrength.com. We will respond within one calendar month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

11. Changes to This Policy

We may update this policy from time to time. When we do, we will update the date at the top of this page. Material changes will be communicated by email to registered users. Continued use of the platform after any changes constitutes acceptance of the updated policy.

12. Contact

For any privacy-related queries, requests, or concerns: