Privacy Policy — yhge.co.uk
Last updated: 5 November 2026
1. Who we are
This website (yhge.co.uk) is operated by YHGE Ltd, a company registered in Scotland with its registered office at 16 Ravelston House Park, Edinburgh, EH4 3LU (“YHGE”, “we”, “us”, “our”).
For the purposes of UK GDPR and the Data Protection Act 2018, YHGE Ltd is the data controller for personal data collected through this website.
Data protection contact: Data Protection Lead — privacy@yhge.co.uk ICO registration: YHGE Ltd is registered with the UK Information Commissioner’s Office as a data controller.
2. What this policy covers
This policy explains how we handle personal data collected through yhge.co.uk, and personal data about adult members and people who have signed up for a taster class, which we hold in our internal administration system (the “admin system”), used only by our instructors.
Personal data about children and their parents or guardians (including data in the parent portal application used by enrolled families) is covered by a separate Parent Portal Privacy Policy, available within the app.
3. What data we collect and why
3.1 Class sign-up form
When you sign up for a free taster class through the website, we collect:
- Name
- Email address
Purpose: to contact you about the class you signed up for and to follow up about enrolment. Lawful basis: Article 6(1)(b) UK GDPR — taking steps at your request prior to entering a contract. Retention: We keep this information for 24 months from your last interaction with us. If you enrol, your data moves into the school system and is governed by that policy. If you do not enrol, we delete the record after 24 months.
3.2 Contact form
When you send us a message through the contact form, we collect:
- Name
- Email address
- Any other information you choose to include in your message
Purpose: to respond to your enquiry. Lawful basis: Article 6(1)(f) UK GDPR — legitimate interests (responding to people who contact us). Retention: We keep contact form submissions for 24 months, unless they relate to an ongoing matter or become part of a customer record.
3.3 Website analytics (Google Analytics 4)
We use Google Analytics 4 to understand how visitors use our website. It collects:
- Pages visited and time spent on each page
- Approximate location (city/region, not precise)
- Device type, browser, and operating system
- How you arrived at our site (referrer)
Purpose: to improve the website. Lawful basis: Article 6(1)(a) UK GDPR — your consent, given through our cookie banner. You can withdraw consent at any time using the cookie preferences link on our site or by clearing your browser cookies. Retention in Google Analytics: 2 months (the shortest retention period available).
If you do not consent to analytics cookies, none of the above is collected.
3.4 Form spam protection (Google reCAPTCHA v3)
Our forms are protected by Google reCAPTCHA v3, which helps us prevent automated spam submissions. When you load a page containing a form, reCAPTCHA collects:
- Your IP address
- Browser and device information
- Mouse and touch interaction patterns on the page
This data is sent to Google and is used by Google in accordance with Google’s privacy policy (policies.google.com/privacy).
Lawful basis: Article 6(1)(f) UK GDPR — legitimate interests (preventing spam and abuse of our forms).
3.5 Security and login protection
We use security plugins (Sucuri Security, Really Simple Security, Limit Login Attempts Reloaded) on our WordPress installation. These tools may process visitor IP addresses to detect and block malicious activity.
Lawful basis: Article 6(1)(f) UK GDPR — legitimate interests (protecting our website and its users from attack).
3.6 Adult members and the admin system
When you sign up for a class and become a member, your data moves from the website into the admin
system. This is accessed only by YHGE instructors, who sign in individually. Adult members do not
currently have access to any app. We hold:
- Name (and Chinese name, if you give one), email address
- Date of birth
- Membership status, trial date, first and last class dates, and attendance
- Membership type, payment type, class balance, expiry dates and any concession
- Grading and rank history
- Insurance reference
- Direct debit and subscription references (we do not hold your bank details; these are held by
GoCardless) - Records of emails we send you (e.g. reminders, payment requests)
- Accident or incident reports, if you are involved in one in class (see below)
Purposes: to run classes and manage your membership, take payments, keep you safe and insured,
and keep financial records.
Lawful basis:
- Article 6(1)(b) UK GDPR – performance of our membership contract with you
- Article 6(1)(c) – legal obligation (accounting and tax records, health and safety reporting)
- Article 6(1)(f) – legitimate interests (insurance, safety, and contacting you about your classes)
- Article 9(2)(b)/(f) where accident reports include health information, and explicit consent
(Article 9(2)(a)) for any medical information you choose to give us.
Retention:
- These periods are applied automatically by a scheduled monthly process. “Leaving” means the date your membership is marked as ended.
- Active members: while you are a member.
- Former members: 7 years after you leave, then anonymised.
- People who sign up for a taster but never attend: 24 months from sign-up (see 3.1), then anonymised.
- Accident and incident reports for adults: 7 years from the date of the incident, then deleted.
- Payment, invoice and order records: 6 years from the end of the financial year they relate to (our financial year ends on 31 March).
- Medical information you give us: deleted within 6 months of you leaving.
4. Cookies
We use the following categories of cookies:
- Strictly necessary cookies: required for the site to function, including session and security cookies. No consent needed.
- Analytics cookies (Google Analytics): set only if you consent via our cookie banner.
We do not use advertising or tracking cookies. We do not sell or share data with advertisers.
You can change your cookie preferences at any time using the cookie settings link on the site.
5. Who we share data with
We share personal data with the following third parties:
| Recipient | Purpose | Role | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting our WordPress server | Processor | UK / EU |
| Google (Analytics 4) | Website analytics | Independent controller | EU / USA |
| Google (reCAPTCHA v3) | Form spam protection | Independent controller | EU / USA |
| SendGrid (Twilio Inc.) | Sending emails from the website (replies, confirmations and member emails) | Processor | USA |
| Sucuri Inc. | Website security monitoring | Processor | USA |
| CookieYes | Recording your cookie consent choices | Processor | EU |
| Amazon Web Services (AWS) | Hosting the admin system, database and sign-in (in addition to the WordPress server above) | Processor | UK (London) |
| GoCardless | Direct debit mandates, subscriptions and payment collection | Independent controller | UK / EU |
| FreeAgent | Invoicing and accounting records | Processor | UK |
| MailerLite | Club news and email communications | Processor | EU |
International transfers: Where personal data is transferred outside the UK (in particular to the USA), the transfer is protected by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision, as relevant to each provider.
We do not sell your data. We do not share it with advertisers.
6. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Rectification of inaccurate data
- Erasure in certain circumstances
- Restriction of processing in certain circumstances
- Object to processing based on legitimate interests
- Data portability for data you provided to us
- Withdraw consent at any time where we rely on consent
To exercise any of these rights, email privacy@yhge.co.uk. We will respond within one calendar month.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office:
- ico.org.uk
- 0303 123 1113
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
7. Security
We use technical and organisational measures appropriate to the risk, including:
- Encryption in transit (HTTPS / TLS)
- Two-factor authentication on administrator accounts
- Automatic updates for WordPress, plugins, and the underlying server
- Login protection and security monitoring
- Access controls limiting who can see personal data
- Admin system access is restricted to named instructors, each with their own sign-in
- Data held in UK-based (London) AWS infrastructure
- Payment card and bank details are never held by us – only by our payment provider
No system is perfectly secure, and we cannot guarantee absolute security.
8. Children
This website is intended for parents and adults interested in our classes. We do not knowingly collect personal data about children through this website. Children’s data is only collected through enrolment and the parent portal, where it is provided by a parent or guardian, and is covered by the
Parent Portal Privacy Policy.
9. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top will reflect the most recent change. Material changes will be communicated on the website.
10. Contact
YHGE Ltd Registered office: 16 Ravelston House Park, Edinburgh, EH4 3LU Trading address: 471 Gorgie Road, Edinburgh, EH11 3AD Data protection contact: privacy@yhge.co.uk