Privacy and Data Protection Policy
Effective date: 6 August 2026
Next review date: 6 August 2027
1. Who we are
Rosetta Wellbeing provides menopause education, wellbeing workshops, gentle yoga, breathwork, relaxation practices, online programmes, one-to-one support and workplace wellbeing services.
Rosetta Wellbeing is operated by Jacqueline Fenton-Collins, who is the data controller responsible for deciding how and why personal information is used.
Contact Details
Rosetta Wellbeing
Email: hello@rosettawellbeing.co.uk
Website: www.rosettawellbeing.co.uk
2. Scope of this policy
This policy explains how Rosetta Wellbeing collects, uses, stores, shares and protects personal information when you:
-
Visit our website.
-
Contact us by email, telephone, social media or an online form.
-
Book or attend a workshop, course, yoga session or consultation.
-
Subscribe to our newsletter or marketing communications.
-
Participate in an online service or community.
-
Provide feedback, a testimonial, photograph, audio recording or video.
-
Are referred to us by an employer, community organisation, social-prescribing service or partner organisation.
3. Personal information we may collect
Depending on how you interact with us, we may collect:
Identity and contact information
-
Your name.
-
Email address.
-
Telephone number.
-
Postal address, where required.
-
Emergency-contact information, where appropriate.
Booking and service information
-
Services, workshops or courses you have booked.
-
Attendance and participation records.
-
Communication preferences.
-
Enquiries, correspondence and feedback.
-
Referral information.
-
Accessibility requirements or reasonable-adjustment requests.
Health and wellbeing information
You may choose to provide information about your health, menopause experience, injuries, mobility, medication, pregnancy, accessibility needs or other circumstances relevant to participating safely in our services.
We will only request information that is reasonably necessary for delivering the service safely and appropriately.
Health information is treated as special-category personal data and receives additional protection.
Payment and transaction information
When you make an online payment, it is normally processed securely by a third-party payment provider. Rosetta Wellbeing may receive transaction details, such as:
-
The amount paid.
-
Payment status.
-
Transaction date.
-
Booking or invoice reference.
We do not normally receive or store your complete payment-card details.
Website and technical information
When you use our website, we may collect:
-
IP address.
-
Browser and device information.
-
Website activity.
-
Pages viewed.
-
Cookie preferences.
-
Approximate location information derived from your device or IP address.
-
Photographs, recordings and testimonials
We may collect photographs, audio recordings, videos, written testimonials or case-study information only where appropriate permission has been obtained.
4. How we collect information
We may collect personal information:
-
Directly from you.
-
Through the Rosetta Wellbeing website and Wix forms.
-
Through bookings, payments and subscriptions.
-
By email, telephone, video call or social media.
-
During workshops, consultations and wellbeing sessions.
-
Through feedback and testimonial forms.
-
From employers, community partners or referral organisations, where you know about the referral or another lawful basis applies.
-
Automatically through cookies and similar website technologies.
5. Why we use personal information
We may use personal information to:
-
Respond to enquiries.
-
Manage registrations, bookings and payments.
-
Deliver workshops, courses, yoga sessions and consultations.
-
Provide joining instructions, reminders and service updates.
-
Make reasonable adjustments and support safe participation.
-
Maintain service, attendance and transaction records.
-
Provide customer support.
-
Manage complaints, safeguarding concerns, accidents or incidents.
-
Send newsletters and marketing communications where permitted.
-
Improve our services and understand how our website is used.
-
Protect our website, accounts and business systems.
-
Meet legal, regulatory, insurance, tax and accounting obligations.
-
Establish, exercise or defend legal claims.
6. Our lawful bases
Contract
We use information where it is necessary to take steps at your request, process a booking or deliver a service you have purchased or requested.
Consent
We rely on consent for activities including:
-
Optional email marketing where consent is required.
-
Non-essential cookies.
-
Certain photographs, recordings, testimonials and case studies.
-
The processing of voluntarily provided health information where explicit consent is the appropriate condition.
You may withdraw your consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
Legitimate interests
We may use information for legitimate business purposes, including:
-
Responding to enquiries.
-
Maintaining appropriate customer and service records.
-
Improving services.
-
Protecting our systems.
-
Managing our relationship with professional and community contacts.
-
Communicating with existing customers about similar services where legally permitted.
We will only rely on legitimate interests where our interests are not overridden by your rights and interests.
Legal obligation
We may use information where necessary to comply with tax, accounting, insurance, regulatory or other legal requirements.
Vital interests
In a genuine emergency, we may use or disclose information where necessary to protect someone’s life or physical safety.
Processing needed to deliver a purchased service may rely on contract, while health information also requires an appropriate special-category condition. Rosetta Wellbeing will normally use explicit consent for voluntarily provided participant health information.
7. Health and special-category information
Health and wellbeing information will only be collected where reasonably necessary, for example to:
-
Understand whether an activity may need adapting.
-
Support reasonable adjustments.
-
Help participants take part safely.
-
Respond to an accident, incident or safeguarding concern.
-
Providing health information is generally voluntary. However, withholding information that is important for safe participation may affect whether or how we can provide a service.
We will not use health information for unrelated marketing or advertising.
8. Marketing communications
We may send information about Rosetta Wellbeing workshops, programmes, courses and resources where:
-
You have asked to receive it.
-
You have provided valid consent.
-
The communication is otherwise permitted under applicable direct-marketing rules.
-
Where legally permitted, we may contact existing customers about our own similar services, provided they were offered an opportunity to opt out when their details were collected and in every subsequent message.
You may unsubscribe at any time by:
-
Selecting the unsubscribe link in an email.
-
Emailing hello@rosettawellbeing.co.uk.
-
Contacting us through the website.
Rosetta Wellbeing will not sell or rent personal information to other organisations for their marketing.
9. Who we may share information with
We may share limited personal information with trusted providers that help operate Rosetta Wellbeing, including:
-
Wix, for website hosting, forms, customer management, bookings and associated services.
-
Payment-processing providers.
-
Email and communication providers.
-
Zoom or another video-conferencing provider.
-
Website analytics and technical-support providers.
-
Accountants, insurers, legal advisers and other professional advisers.
-
Venues or delivery partners, where necessary for an activity.
-
Referral or commissioning organisations where this has been agreed or is otherwise lawful.
-
Public authorities, safeguarding bodies, emergency services or regulators where legally required or necessary to protect someone.
These organisations will only receive information reasonably necessary for their role.
10. International transfers
Some technology and service providers may process or store personal information outside the United Kingdom.
Where information is transferred internationally, we will take reasonable steps to ensure an appropriate lawful transfer mechanism is used. This may include:
-
A country covered by UK adequacy regulations.
-
A recognised UK international data-transfer agreement or addendum.
-
Other safeguards permitted under UK data-protection law.
We will review the privacy and data-processing terms of relevant providers.
11. How we protect information
Rosetta Wellbeing takes reasonable organisational and technical measures to protect personal information, including:
-
Password-protected accounts.
-
Appropriate access controls.
-
Multi-factor authentication where available.
-
Restricting access to people who need the information.
-
Secure website and cloud-service providers.
-
Keeping devices and software updated.
-
Secure storage and disposal of paper records.
-
Confidentiality requirements for contractors and service providers.
-
Reviewing account access when working arrangements change.
Although no internet or storage system can be guaranteed to be completely secure, we will take appropriate steps to prevent unauthorised access, loss, misuse or disclosure.
12. Data breaches
Rosetta Wellbeing will maintain a procedure for identifying, recording, investigating and responding to personal-data breaches.
Where a breach is likely to create a risk to people’s rights and freedoms, it will be reported to the Information Commissioner’s Office without undue delay and, where required, within 72 hours of becoming aware of it.
Where a breach is likely to create a high risk to an affected person, we will also inform that person without undue delay where required.
13. How long we keep information
We will not keep personal information for longer than reasonably necessary.
Our normal retention approach is:
-
General enquiries: up to 12 months after the final meaningful contact.
-
Booking and customer records: normally up to six years after the end of the relevant financial year, where needed for accounting, tax, contractual or legal purposes.
-
Financial records: for the period required by tax and accounting law.
-
Health and participant information: for the shortest necessary period, normally no more than three years after the last relevant service unless insurance, safeguarding or legal circumstances require longer retention.
-
Marketing records: until you unsubscribe or your information is no longer needed. We may retain minimal suppression information to ensure we respect an opt-out.
-
Testimonials, photographs and recordings: for the agreed use period or until valid consent is withdrawn, where consent is the basis.
-
Complaints, accidents and safeguarding records: according to the nature of the matter and applicable legal, safeguarding and insurance requirements.
-
Website and cookie information: according to the retention periods stated in our cookie settings or Cookie Policy.
Retention periods will be reviewed regularly. UK data-protection law does not prescribe one universal retention period, so organisations must establish and justify appropriate periods. Self-employed business records must generally be retained for at least five years after the relevant tax-return deadline.
14. Your data-protection rights
Depending on the circumstances and lawful basis used, you may have the right to:
-
Ask for access to your personal information.
-
Ask for inaccurate or incomplete information to be corrected.
-
Ask for information to be deleted.
-
Ask us to restrict how information is used.
-
Object to certain processing, including direct marketing.
-
Receive certain information in a portable format.
-
Withdraw consent where processing relies on consent.
-
Complain to the Information Commissioner’s Office.
These rights are not absolute and exemptions may apply.
Requests can be made verbally or in writing, although written requests may help us understand and record what is being requested.
Contact:
We may need to confirm your identity before releasing or changing information. We will normally respond without undue delay and within one month.
We will not normally charge for an information-rights request. A reasonable fee may only be considered where legally permitted, such as when a request is manifestly unfounded or excessive.
15. Your right to object
You have the right to object at any time to our use of your personal information for direct marketing.
When you object to direct marketing, we will stop using your information for that purpose.
You may also object to processing based on legitimate interests. We will consider your circumstances and stop processing unless we have compelling legitimate grounds to continue or the information is required for legal claims.
16. Cookies and website analytics
Our website may use cookies and similar technologies to:
-
Operate essential website functions.
-
Remember preferences.
-
Manage bookings and secure accounts.
-
Understand website use and performance.
-
Support analytics or marketing functions.
Strictly necessary cookies may be used without consent where they are required for the website to function.
17. Photographs, videos, audio and testimonials
Rosetta Wellbeing will not assume that attendance at a session gives permission to use someone’s image, voice, story or testimonial.
Where photographs, audio, video, testimonials or case studies are collected, we will explain:
-
What will be recorded.
-
Why it is being collected.
-
Where it may appear.
-
Whether a name will be used.
-
How long it may be used.
-
How consent can be withdrawn.
Where consent is withdrawn, we will stop future use and remove material under our control where reasonably possible. We may not be able to retrieve material that has already been lawfully printed, shared or downloaded by others.
Separate consent should be obtained where a testimonial or case study includes health or menopause information.
18. Children’s information
Rosetta Wellbeing’s services are primarily intended for adults.
We do not knowingly collect personal information from children through the website unless this is necessary for a specific service, appropriate safeguards are in place and parental or guardian involvement is obtained where required.
19. Automated decision-making
Rosetta Wellbeing does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects.
20. Complaints
Please contact us first if you have a concern about how your personal information has been handled:
Email: hello@rosettawellbeing.co.uk
We will acknowledge and investigate the concern and aim to provide a clear response.
You may also complain to the UK supervisory authority:
Information Commissioner’s Office
The ICO’s contact information and complaint service are available through its official website.
21. Changes to this policy
We may update this policy when our services, providers, practices or legal obligations change.
The latest version will be published on the Rosetta Wellbeing website with its effective date. Where a change materially affects how we use information, we will take reasonable steps to bring it to the attention of affected individuals.