We keep it simple
We will never sell your data. We will never share it with anyone who doesn’t need it to help us run HotBox Social. We collect the minimum we need, keep it only as long as we have to, and protect it properly.
This policy explains exactly what we collect, why, and what you can do about it.
Who we are
HotBox Social is a wellness venue based in Bristol, offering Finnish-style sauna, ice plunge, café, and community wellness experiences.
We are the data controller for the personal information described in this policy. That means we decide why and how your data is used.
Contact us about data:Email: support@hotboxsocial.co.ukWebsite: hotboxsocial.co.ukWe process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What we collect and why
When you book a session or become a member
We need certain information to take your booking, process your membership, and manage your account:
| What we collect | Why we need it |
|---|---|
| Name and contact details (email, phone) | To confirm your booking and send you account updates |
| Date of birth | To verify you are 18 or over |
| Membership tier and credit balance | To manage your account and process sessions |
| Payment information | To take payment — processed securely by our payment provider; we never store your full card details |
| Booking and visit history | To manage your credits, resolve disputes, and improve our services |
| Emergency contact name and number | To contact someone on your behalf in the event of an emergency at our venue |
Legal basis: Performance of a contract — we need this information to fulfil your booking or membership agreement.
For your safety in the sauna and ice plunge
Before using our facilities, we may ask you to complete a health declaration. This helps us ensure that sauna and cold-water immersion are safe for you.
Health information we may collect:
- Cardiovascular or heart conditions
- Pregnancy status
- Respiratory conditions
- Any other conditions relevant to high-temperature or cold-immersion activities
This is special category data under UK GDPR. We collect it only with your explicit consent, use it only to keep you safe during your visit, and delete it within one month of your session.
You are not obliged to disclose health information, but we may not be able to allow you to use certain facilities if we cannot confirm it is safe to do so.
Legal basis: Explicit consent and vital interests (your safety).
When you visit our venue
Our venue may be monitored by CCTV for the safety and security of customers and staff. Footage is retained for a maximum of 30 days unless required in connection with an incident or investigation.
CCTV does not cover changing areas, shower areas, or any space where you have a reasonable expectation of privacy.
No cameras infringe on private areas of the venue, such as changing rooms.
HotBox Social reserves the right for its employees and contractors to review footage as required and by entering onto our sites you consent to your image being recorded and reviewed and waive any and all claims in relation to same. Recorded CCTV footage will be stored securely and retained in compliance with applicable laws.
The processing of CCTV will be handled in accordance with the Data Protection Regulations, The CCTV Code of Practice, and the Human Right Act 1998.
The purpose of the use of the CCTV Systems and the collection and processing of CCTV images is for the prevention or detection of crime or disorder, apprehension, and prosecution of offenders (including use of images as evidence in criminal proceedings), interest of public and employee Health and Safety, protection of public health and the protection of our property and assets and to ensure compliance with our policies and procedures.
PureGym's processing of CCTV is necessary for the legitimate interest in monitoring the venue as part of the implementation of security measures and to be able to exercise or defence of a civil claim.
Prior to any camera installation HotBox Social will ensure that the installation complies with this policy and that the use of any camera is justified, necessary and proportionate. HotBox Social will regularly assess whether the use of any camera and the CCTV System as a whole continues to be justified, necessary and proportionate.
The recordings are reviewed by random checks, specific suspicions, or other irregularities.
All images are digitally recorded and stored securely within the system's hard drives. Images are stored for 30 days, after which they are deleted, unless longer storage is allowed under legislation.
All access to and disclosure of recorded CCTV images is restricted and carefully controlled. Access to and disclosure of CCTV is permitted only if it supports the purpose for which such images have been collected. Disclosure of CCTV to third parties, for example, a police enquiry or request from a lawyer, needs to be supported by a DPA or written authority from the registered person on the images.
Legal basis: Legitimate interests (security and safety of the venue and its visitors).
When you contact us
If you email or message us, we keep a record of your correspondence so we can respond effectively and resolve any issues. We may also use this to improve the service we provide.
Legal basis: Legitimate interests (providing good customer service).
When you sign up for marketing
If you opt in, we’ll send you:
- Emails about upcoming events, new sessions, and exclusive member offers
- Occasional news about HotBox Social and what’s going on in the community
We will always ask for your permission before sending marketing. You can withdraw that permission at any time — it won’t affect your membership or bookings.
How to unsubscribe:
- Click the unsubscribe link in any marketing email
- Email us at support@hotboxsocial.co.uk
- Update your preferences through your account
Legal basis: Consent.
When you use our website
We collect technical data automatically when you visit our website, including your IP address, browser type, device type, and pages visited. This helps us keep the site running and understand how it’s being used.
We also use cookies — see the Cookies section below.
Legal basis: Legitimate interests (improving our website and digital experience).
When you use our referral programme
If you refer a friend, we use your name and contact details to log the referral and apply any credits owed. Your friend’s details are used only to set up their account and apply their introductory discount.
Legal basis: Legitimate interests (administering the referral programme).
How long we keep your data
We keep your data only for as long as necessary. Here’s our standard schedule:
| Data | Retention period |
|---|---|
| Booking and session records | 2 years from date of visit |
| Membership account data | Duration of membership + 2 years |
| Financial and payment records | 7 years (HMRC requirement) |
| Health and safety declarations | 1 month following your session |
| Emergency contact information | Duration of membership |
| CCTV footage | Up to 30 days (unless required for an incident) |
| Marketing consent records | Until consent is withdrawn + 3 years |
| Website analytics data | 13 months |
| Customer correspondence | 3 years from last contact |
When data is no longer needed, it is securely deleted or anonymised.
Your rights
Under UK GDPR, you have the following rights. You can exercise any of them by emailing support@hotboxsocial.co.uk — we will respond within one calendar month.
| Your right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Ask us to correct inaccurate or incomplete data |
| Erasure | Ask us to delete your data where there is no longer a lawful reason to hold it |
| Restriction | Ask us to pause processing your data in certain circumstances |
| Portability | Request your data in a structured, machine-readable format |
| Object | Object to processing based on legitimate interests or for direct marketing |
| Withdraw consent | Withdraw any consent you have given (including for health data or marketing) at any time |
We may need to verify your identity before fulfilling a request. We won’t charge a fee for standard requests.
Security
We take appropriate steps to protect your data:
- HTTPS encryption across our website
- Encrypted payment processing via certified third-party providers
- Access controls limiting who can view personal data internally
- Regular review of our data handling practices
No online transmission is 100% secure. If you have concerns about a specific security issue, contact us at support@hotboxsocial.co.uk.
Data breaches
If a breach occurs that is likely to affect your rights or freedoms, we will:
- Notify the Information Commissioner’s Office (ICO) within 72 hours
- Notify affected individuals promptly where the risk is high
- Keep an internal record of all breaches and our response
Children
Our venue is for people aged 18 and over. We do not knowingly collect personal data from anyone under 16.
If you believe a child has provided us with their personal data, please contact us at support@hotboxsocial.co.uk and we will delete it promptly.
International transfers
We aim to store and process all data within the UK and EEA. Where third-party providers transfer data outside these areas, we require them to put adequate safeguards in place — such as the ICO’s International Data Transfer Agreement (IDTA) or UK-approved Standard Contractual Clauses.
Changes to this policy
We may update this policy from time to time. Any changes will appear on this page with a revised “Last updated” date. If changes are significant, we’ll let you know by email (if you have an account) or via a notice on our website.
Make a complaint
If you’re unhappy with how we’ve handled your data, please get in touch first — we’d like the chance to put it right.
Email: support@hotboxsocial.co.uk
If you’re still not satisfied, you have the right to complain to the UK’s data protection authority:
Information Commissioner’s Office (ICO)Website: www.ico.org.ukTelephone: 0303 123 1113Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF