Keeping your data safe

Privacy policy

Last updated: 24th Nov 2025

This website is operated by Sarah Baxter, trading as “The Happy Yogi.” The privacy of my users is extremely important to me, and I encourage all users to read this policy very carefully because it contains important information regarding:

who I am (the Data Controller);
how and why I collect, store, use and share your personal information;
your rights in relation to your personal information; and
how to contact me and supervisory authorities in the event that you have a complaint.

Who I Am

I, Sarah Baxter (trading as “The Happy Yogi”) (‘I’, ‘me’, ‘my’) collect, use, and am responsible for storing certain personal information about you (‘you’, ‘your’, ‘yours’).

The personal information I collect and use

Personal information is information which you can be identified from (and does not include any anonymised forms of information).

1. Types of personal information

I may process the following types of personal information in relation to you:

Contact details such as: name, email address, postal address, telephone number; and; Health/fitness details such as: details of injuries, relevant medical conditions, or experience levels provided for the purpose of safe participation in yoga classes (‘Special Category Data’).

How your personal information is collected

This section describes how the above types of personal information are collected by me. Your personal information will be collected as follows:

1. Personal information obtained from you directly

I will sometimes obtain information from you directly, including when you:

Place a booking (e.g., for a yoga class or workshop), subscribe to any newsletter, purchase a product, create a user profile, or contact me.

2. Personal information obtained by use of cookies or other automated means

I will sometimes obtain information via automated technology. This shall be by use of cookies and other similar technology. A cookie is a small text file which is placed onto your computer or electronic device when you access my website. Similar technologies include web beacons, action tags, local shared objects (‘flash cookies’) and single-pixel gifs. Such technologies can be used to track users’ actions and activities, and to store information about them. Usually this will be in order to monitor and obtain information regarding:

How many times a user visits the website, which pages a user visits, traffic and location data.

On the first occasion that you use my site I will ask whether you consent to my use of cookies and/or other similar processing technologies. If you do not consent, such technologies will not be used. Thereafter you can opt-out of using cookies at any time or you can set your browser not to accept cookies. However, some of my website features may not function as a result.

For further information on my use of cookies and other similar technologies, please see my policy document as described below.

3. Additional sources

I shall collect personal information in relation to you from the following sources:

Social media platforms such as Facebook, Whatsapp and Instagram.

4. Changes to the way in which I collect your personal information

In the event that I need to obtain personal information in relation to you from any other source than those described above, I shall notify you of this.

How I use your personal information

1. General purposes

Your personal information will generally be processed for the following purposes:

To enter into a contract for the sale of services (e.g., yoga classes) to you, to manage my business and website and provide marketing to you. The processing of health/fitness details is specifically to ensure the safety and suitability of the yoga instruction provided.

2. Monitoring

I may monitor communications, and in doing so I may obtain your personal information through this process. I will undertake monitoring in the following circumstances:

All emails will be monitored for quality assurance, training and compliance.

3. Use of your information for marketing purposes

I have described above that one of the general purposes for which your data shall be processed is for my marketing purposes.

I wish to make you aware that you have the right to object or to opt-out of any direct marketing by:

Unsubscribing using the link contained in marketing emails.

Lawful basis for processing of your personal information

I have described above the purposes for which I may process your personal information. These purposes will at all times be justified by UK data protection law.

1. General lawful bases

The lawful basis upon which I am able to process your personal data are:

(1) where I have your consent to use your data for a specific purpose;

(2) where it is necessary to enter into a legal contract with you or to perform obligations under a legal contract with you;

(3) where it is necessary to enable me to comply with a legal obligation;

(4) where it is necessary to ensure my own legitimate interests or the legitimate interests of a third party (provided that your own interests and rights do not override those interests). Wherever I rely upon this basis, details of the legitimate interests concerned shall be provided to you;

(5) where I need to protect your own vital interests (or the vital interests of another person); and/or

(6) where it is needed in the public interest (or where I am acting in my official functions), provided that the task or function has a clear basis in law.

In general, in order to meet the purposes I have described above, I will process your personal information where I have your express consent on each occasion that the data is processed.

2. Lawful bases specifically applicable to marketing

I will only ever use your personal information to send you marketing directly where I have your explicit consent (which will be obtained in a format separately to this privacy policy).

3. Lawful basis specifically applicable to Special Category Data

The health/fitness details you provide constitute ‘Special Category Data’ under UK data protection law. I will process this data only where:

(1) I have your explicit consent (usually obtained via a separate intake/waiver form); or

(2) It is necessary for medical diagnosis or the provision of health or social care or treatment (e.g., to adjust instruction for a medical condition/injury).

Sharing of your personal information

On any occasion where any of your personal information is shared with any third party, I shall only permit them to process such information for my required purposes, under my specific instruction, and not for their own purposes. I am required to enter into a formal legal agreement to enable such sharing to take place.

I do not anticipate that I will need to share your personal information with any third party. I will notify should this position change.

Necessity of information

Where information is requested from you and you do not provide this:

It may prevent you from using certain features of the website and/or receiving services (e.g. participation in classes if safety-critical information is withheld).

I will inform you at the point of collecting information from you, whether you are required to provide the information to me.

How long your personal information will be kept

Your personal information will only be kept for the period of time which is necessary for me to fulfil the above purposes.

I envisage that your personal information shall be retained by me as follows:

Until any contract for services has completed and up to 7 years after. This retention period is necessary to comply with insurance requirements for yoga instructors.

After the period described above, your information shall be properly deleted or anonymised.

Keeping your information secure

I will ensure the proper safety and security of your personal information and have measures in place to do so. I will also use technological and organisation measures to keep your information secure. These measures are as follows:

All data is stored on secure servers;
All website communication including any payment details are encrypted using SSL.
Any user account access is controlled by a unique username and password;

I have proper procedures in place to deal with any data security breach, which shall be reported and dealt with in accordance with data protection laws and regulations. You shall also be notified of any suspected data breach concerning your personal information.

Children

My website is not intended for children (anybody under the age of 18). I do not intend to collect data from children, unless explicit consent is obtained from a parent or legal guardian for participation in specific youth/family classes.

Your rights

Under the UK General Data Protection Regulation you have a number of important privacy rights free of charge. In summary, those include rights to:

(1) fair processing of information and transparency over how I use your use personal information;

(2) access to your personal information and to certain other supplementary information that this Privacy Statement is already designed to address;

(3) require me to correct any mistakes in your information which I hold;

(4) require the erasure of personal information concerning you in certain situations;

(5) receive the personal information concerning you which you have provided to me, in a structured, commonly used and machine-readable format and have the right to transmit this information to a third party in certain situations;

(6) object at any time to processing of personal information concerning you for direct marketing;

(7) object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you;

(8) object in certain other situations to my continued processing of your personal information, or ask me to suspend the processing procedure in order for you confirm its assurance or my reasoning for processing it;

(9) object to processing my your personal information where I am doing so in reliance upon a legitimate interest of my own or of a third party and where you wish to raise to an objection to this particular ground;

(10) otherwise restrict my processing of your personal information in certain circumstances;

(11) claim compensation for damages caused by my breach of any data protection laws; and/or

(12) in any circumstance where I rely upon your consent for processing personal information, you may withdraw this consent at any time.

For further information on each of those privacy rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on your rights under the General Data Protection Regulations.

If you would like to exercise any of these privacy rights please contact the Data Protection Officer: Sarah Baxter in the following manner:

Via the contact form on the website at thehappyyogi.net/contact or by email:

Complaints procedure

I hope that I can resolve any query or concern you raise about my use of your information.

The UK General Data Protection Regulation also gives you right to lodge a complaint with the supervisory authority. The supervisory authority in the United Kingdom is the Information Commissioner (ICO), who can be contacted at https://ico.org.uk/.

Changes to the privacy policy

I may change this privacy policy from time to time and will notify you of any changes by:

By updating the ‘last updated’ date displayed beneath the main heading of this policy page;

Contacting me

The Data Controller is Sarah Baxter.

Any requests or questions regarding the use of your personal information should be made to the above named person using the following method: