VEA StudiosReturn home

GDPR Policy

How VEA Studios meets its obligations as a data controller under UK GDPR.

Our approach to data protection

VEA Studios is committed to handling personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy sets out how we meet our obligations as a data controller, alongside our Privacy Policy, which explains what information we collect and why.

Data controller

VEA Studios, within Manor Park Sports Club, Albert Road North, Malvern, WR14 2TL, is the data controller for personal information processed through this website and our studio operations.

VEA Studios is registered with the Information Commissioner’s Office (ICO).

The data protection principles we follow

We process personal information:

  • Lawfully, fairly and transparently
  • For specified, explicit purposes only
  • To the minimum extent necessary
  • Accurately, and kept up to date
  • For no longer than necessary
  • Securely

Legal bases for processing

  • Consent — for marketing communications
  • Contract — to provide classes, memberships or passes you have booked
  • Legitimate interests — to respond to enquiries and run the studio responsibly

Your rights under UK GDPR

You have the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, and the right to object. We do not use automated decision-making or profiling. We will respond to any request within one month, as required by law.

Data security

We take reasonable technical and organisational measures to keep personal information secure and to limit access to those who need it to run the studio.

Data sharing and processors

Where we use third-party services to process personal information on our behalf — such as an email/marketing platform or class-booking platform — we require them to keep it secure and use it only for the purpose agreed.

International transfers

We do not transfer personal information outside the UK. If this changes in future, this policy will be updated to explain the safeguards in place.

Data breaches

In the unlikely event of a data breach that risks your rights and freedoms, we will notify the ICO within 72 hours as required, and notify you directly where the law requires it.

How to exercise your rights or raise a concern

Contact info@veareformer.com. If you remain unhappy with our response, you have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

Reviewing this policy

We review this policy periodically to reflect changes in our practices or the law.

Last updated: 28 July 2026