Privacy Policy

Craft Your Body by Caroline Grey ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you visit craftyourbody.com or use our coaching services. It is designed to comply with the UK GDPR, the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the California Consumer Privacy Act (CCPA/CPRA), and other applicable US state privacy laws.

1. Data Controller

The data controller responsible for your personal data is Caroline Grey, trading as Craft Your Body. You can contact us at hello@craftyourbody.com.

2. Information We Collect

• Identity & contact data: name, email, phone number, postal address.
• Health & fitness data: information you share for coaching (e.g. goals, training history, lifestyle, measurements). This is treated as special-category data under UK/EU GDPR.
• Transaction data: payment confirmations (we do not store card details — payments are processed by third-party providers).
• Technical data: IP address, browser type, device information, pages viewed, referring URL.
• Marketing preferences: your consent choices for emails and communications.

3. How We Use Your Data & Legal Bases

• To deliver coaching services — performance of a contract.
• To process health information — your explicit consent (GDPR Art. 9).
• To send marketing emails — your consent, which you may withdraw at any time.
• To comply with legal obligations — tax, accounting, regulatory.
• To improve our website and services — our legitimate interests, balanced against your rights.

4. Sharing Your Data

We share data only with trusted processors who help us operate, including: email providers, scheduling tools (e.g. Calendly), payment processors, website hosting, and analytics providers. All processors are contractually bound to protect your data.

5. International Transfers

Some providers are based outside the UK/EEA (including the USA). Where this happens, we rely on appropriate safeguards such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or the EU-US/UK-US Data Privacy Framework.

6. Data Retention

We retain personal data only for as long as necessary for the purposes set out above, or as required by law (typically 6 years for financial records in the UK).

7. Your Rights

Depending on your location, you have rights to: access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent. UK/EU residents may complain to the ICO (ico.org.uk) or their local supervisory authority.

California residents (CCPA/CPRA): You have the right to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. We do not sell personal information. To exercise these rights, email us at hello@craftyourbody.com.

8. Security

We use appropriate technical and organisational measures to protect your data. No internet transmission is fully secure, so we cannot guarantee absolute security.

9. Children

Our services are not intended for anyone under 18, and we do not knowingly collect data from children.

10. Changes to This Policy

We may update this policy from time to time. The "Last updated" date above reflects the latest version.

11. Contact

Questions or requests: hello@craftyourbody.com.

← Back to home