Who controls your information
Ouroboros MMA Ltd, company number 14630849, is the controller for personal information used to operate the academy. The academy contact address is Unit 35 AEC House, Romsey Industrial Estate, Romsey, SO51 0HR. Privacy questions and rights requests can be sent using the academy email address.
Information we receive
The public website has no enquiry form and does not require a website account. If you call or email, we receive the contact details and information you choose to provide.
When you book a trial or class, ONYX may collect your name, email address, telephone number, date of birth, selected class and attendance information. Membership purchases may also require payment and billing information. Please only provide health information when it is relevant to safe participation and the approved booking process asks for it.
Our hosting and security providers may process IP address, device, request and fault information needed to deliver and protect the website. The embedded ONYX panel also connects to ONYX when it loads.
Why we use it
We use information to respond to enquiries, take steps before entering into a membership, provide booked classes and memberships, administer payments and attendance, keep participants safe, maintain business records, prevent misuse and meet legal, safeguarding and insurance duties.
Depending on the purpose, the lawful basis will be performance of a contract or steps requested before a contract, compliance with a legal obligation, legitimate interests in safely and effectively operating the academy, or vital interests in a genuine emergency. Where special-category health information is necessary, it is handled only where an additional lawful condition applies.
Services and recipients
Information may be processed by ONYX for bookings and membership administration, Stripe or another payment provider presented during purchase, website hosting and security providers, professional advisers and insurers, and public authorities where disclosure is required or necessary to protect someone. Each external service may also provide its own terms or privacy information during the relevant journey.
Retention and transfers
Records are kept only for as long as needed for the relevant enquiry, membership, payment, attendance, safeguarding, insurance, tax or legal purpose. The period depends on the type of record and any applicable limitation or statutory requirement. Records that are no longer needed should be securely deleted or anonymised.
Some technology providers may process information outside the UK. Where that happens, the provider is expected to use a lawful transfer mechanism and appropriate safeguards. You can ask us for more information about the providers used for your data.
Your rights
Depending on the processing, you may have rights to access, correct, erase, restrict or move your information and to object to certain uses. Where processing depends on consent, you may withdraw it without affecting earlier lawful processing. Rights are not absolute and each request must be assessed under the applicable law.
Contact the academy first so we can investigate. You may also complain to the UK Information Commissioner’s Office.
Children’s information
A parent or carer should complete bookings and provide necessary information for younger participants. Information about children is used only for booking, membership, communication, attendance, safety and safeguarding purposes connected with the academy.
Policy review
This notice should be reviewed whenever booking, payment, hosting or academy processes change. If a material change affects how existing information is used, appropriate notice will be provided.