Privacy
Policy

1. Who We Are

This website, hertsswimcoach.uk, is operated under the trading name Herts Swim Coach. References to "we", "us", or "our" in this policy mean Herts Swim Coach.

For any privacy-related enquiries, please contact us via the form at hertsswimcoach.uk/contact.

2. What Personal Data We Collect

We only collect personal data that you choose to provide by submitting an enquiry form on this website, that you give us when booking a clinic, camp or session, or that we capture as part of delivering a coaching service you have booked. This includes:

• Your name
• Your email address
• A phone number (optional for enquiries, required for bookings)
• Details about your coaching requirements or swimming background
• Video footage of swimmers recorded during video analysis sessions (see section 4)
• Booking details for a clinic, camp or session — including the swimmer's name and age, club, personal best times, what they want from the session, and any medical or health information you tell us about (see section 5)
• Whether you want marketing emails from us, the wording you agreed to and when. If you have said yes, we also keep your swimmer's age band (for example 12–14) and club, so we only email you about sessions that suit them (see section 3)

We do not store card or payment details. Card payments are handled entirely by Stripe and never reach our systems — we only ever see a reference, the amount and whether it succeeded.

Where you give us medical or health information for a clinic or camp booking, that is special category data under UK GDPR and is handled as set out in section 5. Apart from that, and video analysis footage, we do not collect special category data. We do not collect data about children without the prior consent of a parent or guardian.

3. How and Why We Use Your Data

Enquiries. If you send us an enquiry, we use what you tell us to reply to it. Our legal basis is legitimate interests under Article 6(1)(f) of UK GDPR: our interest in replying to people who have contacted us through the website.

Marketing emails. We send occasional emails about our camps, clinics and drop-in sessions. We send them to people who have asked about or booked our coaching: through a form or the chat on this website, a Facebook or Instagram form, or a booking where the marketing box was left ticked. We only email you about similar coaching sessions, and you can stop them at any time.

Each email is about one thing, such as a camp or a clinic date, and we send no more than four emails about any one event. Every email has an unsubscribe link: one click stops all marketing email straight away. You can also email [email protected]. When you unsubscribe we keep a note of your email address and the date, so that you are never added back by mistake.

We use your swimmer's age band and club only to choose which emails are relevant to you. We never use a date of birth or any medical information for marketing, and we never sell your details or share them for anyone else's marketing.

Our legal basis is your consent under Article 6(1)(a) of UK GDPR or, for existing customers, the “soft opt-in” in regulation 22 of the Privacy and Electronic Communications Regulations together with legitimate interests under Article 6(1)(f).

4. Video Analysis Footage

As part of our video analysis service we record footage of swimmers — above and below the water — using action cameras (such as a GoPro). This footage is personal data, and we handle it as follows:

• Why we film — footage is recorded solely to analyse stroke technique and provide coaching feedback. Filming only takes place as part of a session you (or, for swimmers under 18, a parent or guardian) have booked and agreed to.
• Children — swimmers under 18 are only filmed with the prior consent of a parent or guardian, and footage of under-18s is shared with the parent or guardian, not directly with the child.
• How we store it — footage is transferred from the camera to secure, password-protected storage promptly after the session, and deleted from the camera's memory card once transferred. Footage is reviewed and annotated in professional video analysis software on password-protected devices. It is never uploaded to any publicly accessible location.
• Who we share it with — an edited copy of your footage and analysis is shared privately with you (or the parent or guardian who booked) via a secure, private link or transfer. We do not share footage with anyone else.
• How long we keep it — we retain footage for up to 12 months from the session date so we can compare technique across sessions, after which it is permanently deleted. You can ask us to delete your footage at any time and we will do so.

Our legal basis for recording and processing analysis footage is performance of a contract under Article 6(1)(b) of UK GDPR — the filming is a necessary part of the video analysis service you have booked.

Social media: occasionally we may wish to use short clips from a session on our social channels (such as Instagram) to showcase our coaching. We only ever do this with your separate, explicit, written consent — for under-18s, the consent of a parent or guardian — obtained before anything is posted. Consent is entirely optional, is never a condition of receiving coaching, and can be withdrawn at any time, in which case we will remove the clip. We do not include surnames or other identifying details of swimmers under 18 in any post.

5. Clinic and Camp Booking Data

When you book a clinic, camp or session through this website we ask for information about the swimmer so the session can be planned and run safely. This is more than we collect anywhere else on the site, so it is worth setting out plainly.

• What we ask for — the swimmer's name and age, their club or squad, their 50m and 100m personal best times, what they most want out of the day, and anything medical we should know about (conditions, allergies, additional needs). We also take your own name, email and mobile as the person making the booking.
• Why we ask — ages, times and goals are used to group swimmers into lanes and plan the coaching. The medical information exists for one reason only: so the coach on poolside can act appropriately if something goes wrong. Your mobile is the contact on the day.
• Who sees it — the coach delivering the session, and where a second coach or assistant is working the session, them too. It is not shared with the venue, other parents, or anyone else.
• Where it is stored — in a private database hosted by Cloudflare (Cloudflare D1) in the UK and EU, accessible only to us behind password authentication.
• How long we keep it — medical and health information is automatically deleted 30 days after the session. The booking record itself (names, dates, amounts) is kept for six years, as we are required to do for tax purposes.
• Photography consent — the photo and video consent box at checkout is entirely optional, makes no difference to the coaching provided, and can be withdrawn at any time by emailing us.

Our legal basis for processing booking data is performance of a contract under Article 6(1)(b) of UK GDPR. For the health information specifically, our additional condition under Article 9 is your explicit consent (Article 9(2)(a)) — you choose whether to tell us, and the field can be left blank. Where a swimmer is under 18, that consent is given by the parent or guardian making the booking. Payment records are kept under legal obligation (Article 6(1)(c)).

6. The Site Assistant (Chat)

Some pages carry a chat assistant that answers questions about coaching, clinics, prices and booking. It is automated software, not Brian, and it will tell you so if you ask.

What it collects. Whatever you choose to type into it, plus the page you were on and a random session identifier. It never asks for card details and is not able to take a payment. If you ask it to pass something to Brian, it also sends him what you have typed along with the email address you give it. If you ask to join a waiting list, it also asks whether you would like emails about future camps and clinics, and only adds you to our marketing emails if you say yes.

Where your messages go. Messages are sent to Anthropic, who provide the language model behind the assistant, and are processed on our instructions to generate a reply. Conversations are stored on Cloudflare's infrastructure so that we can review what people ask and improve the answers.

How long it is kept. Conversations are deleted 30 days after they take place. A copy is also held in your own browser for 24 hours so the conversation survives moving between pages — you can remove that at any time with the "Clear" button in the chat header, which also deletes the conversation from our side.

If you mention a child. Parents often mention a swimmer's age, club or a health condition. That text is handled exactly as above and deleted on the same 30-day schedule. The assistant is instructed not to give any medical opinion and to pass health matters to Brian instead. Please do not use the chat to give us medical details — the booking form has a dedicated section for that, covered in section 5, which is held more carefully and seen only by Brian.

If you would rather not use it, don't — everything the assistant can tell you is on the site, and the contact form reaches Brian directly.

7. How Long We Keep Your Data

We retain enquiry submissions for up to 12 months from the date they were submitted, or until you ask us to delete them — whichever comes first. Data no longer required is permanently deleted.

Booking data is kept as set out in section 5: health information for 30 days after the session, the booking and payment record for six years.

Marketing contacts are kept for as long as you stay subscribed. Once a year we remove anyone who has not booked or signed up again in the past three years. Unsubscribe records are kept for as long as we send marketing email, so that we can honour them.

8. Third-Party Services

This website uses the following third-party services, each of which may process data independently under their own privacy policies:

• Tally.so — our enquiry form provider. Form submissions are processed and stored by Tally. See tally.so/privacy for details.
• Google Analytics 4 — only if you accept cookies. We use Google Analytics to understand how visitors use the site and, through Google Ads, which ads lead to enquiries and bookings. IP addresses are anonymised and the data is not used to identify you personally. See Google's Privacy Policy.
• Microsoft Clarity — only if you accept cookies. A product-analytics tool that captures anonymised usage data, including aggregated heatmaps and anonymised session replays of how visitors interact with our pages, to help us improve the site. See Microsoft's Privacy Statement.
• Meta pixel (Facebook and Instagram) — only if you accept cookies. Tells us when a visit, enquiry or booking came from one of our Facebook or Instagram ads, so we know which ads are worth paying for. When you pay for a camp or clinic place, our booking server also sends Meta a hashed (unreadable) version of your email address and the amount paid, so that the sale is counted once even if the pixel did not load. See Meta's Privacy Policy.
• Meta lead forms — if you fill in one of our Facebook or Instagram lead forms, Meta passes us your name, phone number, email address (if you gave one) and your answers, such as the swimmer's age, their club and the days you want. We use these to contact you about that camp or clinic, and we may also send you occasional emails about our other camps, clinics and drop-in sessions (see section 3). Every one has an unsubscribe link. We keep these details for up to 12 months after your last contact with us. You can ask us to delete your details at any time by emailing [email protected].
• Google Ads — only if you accept cookies. We advertise on Google Search. The Google Ads tag tells us when an enquiry came from one of our ads, so we can measure which ads are worth running. See Google's Privacy Policy.
• Google Maps — embedded on our location page. Google may collect usage data. See Google's Privacy Policy.
• Cloudflare — our hosting and performance provider, and the host of the private database holding clinic and camp bookings (Cloudflare D1). Cloudflare may log request metadata for security and performance purposes. See Cloudflare's Privacy Policy.
• Anthropic — provides the language model behind the site assistant. Messages you type into the chat are sent to Anthropic to generate a reply, and are processed on our instructions. See Anthropic's Privacy Policy.
• Stripe — our payment provider. Card details are entered directly into Stripe's secure form and never pass through our systems. Stripe processes your name, email and payment details to take the payment and issue any refund. See Stripe's Privacy Policy.
• SMTP2GO — the service that sends our booking confirmations, reminders and replies (marketing emails go through Brevo, below). It processes your name and email address in order to deliver those emails. See SMTP2GO's Privacy Policy.
• Brevo — the service we use to send marketing emails, if you have agreed to them. It stores your email address, first name, your swimmer's age band and club, the kinds of session you are interested in and whether you have booked with us, and records whether each email was opened and which links were clicked, which we use to avoid sending reminders you do not need. Brevo (formerly Sendinblue) is a French company and stores data in the EU. See Brevo's Privacy Policy.

We are not responsible for the privacy practices of these third-party services.

9. Cookies, Analytics & Advertising

Nothing that tracks you loads unless you say yes. On your first visit a banner asks whether we can use cookies for Google Analytics, Google Ads, Meta (Facebook and Instagram) and Microsoft Clarity. Accept and Reject are given equal weight. If you reject, or simply ignore the banner, none of these tools load and the site works exactly the same.

If you accept, Google Analytics and Microsoft Clarity help us understand how visitors use the site so we can improve it (Clarity also records aggregated heatmaps and anonymised session replays), and the Google Ads and Meta tags tell us when an enquiry or booking came from one of our ads, so we can tell which ads are worth paying for. These set cookies and similar identifiers. We do not sell your data, and we do not use it to make automated decisions about you.

We may also count visits with Cloudflare Web Analytics, which sets no cookies, does not follow you across other sites and collects no personal data, so it does not need your consent.

You can change your mind at any time: change your cookie choice, or block and delete cookies in your browser. You can also control the ads you see through Google's My Ad Center. Embedded services such as Tally (our forms), Google Maps and Stripe (payments) may set their own cookies when you use them.

10. Your Rights

Under UK GDPR, you have the following rights in relation to the personal data we hold about you:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Restriction — ask us to limit how we process your data
• Objection — object to processing based on legitimate interests
• Portability — request your data in a commonly used, machine-readable format

To exercise any of these rights, please contact us via hertsswimcoach.uk/contact. We will respond within one calendar month.

11. Right to Complain

If you believe we have mishandled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK's data protection regulator — at ico.org.uk.

We would always appreciate the opportunity to address your concerns directly before any complaint is filed.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect when changes were last made. Continued use of the website following any update constitutes your acceptance of the revised policy.