Privacy Policy
Last updated: May 2026
We collect the minimum personal data needed to run HOTBOX Social, keep it only as long as we have to, and do not sell it.
We keep it simple
We will never sell your data. We will never share it with anyone who does not need it to help us run HOTBOX Social. We collect the minimum we need, keep it only as long as we have to, and protect it properly.
This policy explains exactly what we collect, why, and what you can do about it.
Who we are
HOTBOX Social is a wellness venue based in Bristol, offering Finnish-style sauna, ice plunge, cafe, and community wellness experiences.
We are the data controller for the personal information described in this policy. That means we decide why and how your data is used.
Contact us about data: support@hotboxsocial.co.uk. Website: hotboxsocial.co.uk.
We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What we collect and why
When you book a session or become a member
We need certain information to take your booking, process your membership, and manage your account.
| What we collect | Why we need it |
|---|---|
| Name and contact details (email, phone) | To confirm your booking and send you account updates |
| Date of birth | To verify you are 18 or over |
| Membership tier and credit balance | To manage your account and process sessions |
| Payment information | To take payment, processed securely by our payment provider; we never store your full card details |
| Booking and visit history | To manage your credits, resolve disputes, and improve our services |
| Emergency contact name and number | To contact someone on your behalf in the event of an emergency at our venue |
Legal basis: Performance of a contract. We need this information to fulfil your booking or membership agreement.
For your safety in the sauna and ice plunge
Before using our facilities, we may ask you to complete a health declaration. This helps us ensure that sauna and cold-water immersion are safe for you.
Health information we may collect:
- Cardiovascular or heart conditions
- Pregnancy status
- Respiratory conditions
- Any other conditions relevant to high-temperature or cold-immersion activities
This is special category data under UK GDPR. We collect it only with your explicit consent, use it only to keep you safe during your visit, and delete it within one month of your session.
You are not obliged to disclose health information, but we may not be able to allow you to use certain facilities if we cannot confirm it is safe to do so.
Legal basis: Explicit consent and vital interests (your safety).
When you visit our venue
Our venue may be monitored by CCTV for the safety and security of customers and staff. Footage is retained for a maximum of 30 days unless required in connection with an incident or investigation.
CCTV does not cover changing areas, shower areas, or any space where you have a reasonable expectation of privacy. No cameras infringe on private areas of the venue, such as changing rooms.
HOTBOX Social reserves the right for its employees and contractors to review footage as required. By entering onto our sites you consent to your image being recorded and reviewed and waive any and all claims in relation to same. Recorded CCTV footage will be stored securely and retained in compliance with applicable laws.
The processing of CCTV will be handled in accordance with the Data Protection Regulations, the CCTV Code of Practice, and the Human Rights Act 1998.
The purpose of the use of CCTV systems and the collection and processing of CCTV images is for the prevention or detection of crime or disorder, apprehension and prosecution of offenders, health and safety, protection of public health, protection of our property and assets, and to ensure compliance with our policies and procedures.
HOTBOX Social's processing of CCTV is necessary for the legitimate interest in monitoring the venue as part of security measures and to be able to exercise or defend a civil claim.
Prior to any camera installation HOTBOX Social will ensure that the installation complies with this policy and that the use of any camera is justified, necessary, and proportionate. HOTBOX Social will regularly assess whether the use of any camera and the CCTV system as a whole continues to be justified, necessary, and proportionate.
The recordings are reviewed by random checks, specific suspicions, or other irregularities. All images are digitally recorded and stored securely within the system's hard drives. Images are stored for 30 days, after which they are deleted, unless longer storage is allowed under legislation.
All access to and disclosure of recorded CCTV images is restricted and carefully controlled. Access to and disclosure of CCTV is permitted only if it supports the purpose for which such images have been collected. Disclosure of CCTV to third parties, for example a police enquiry or request from a lawyer, needs to be supported by a DPA or written authority from the registered person on the images.
Legal basis: Legitimate interests (security and safety of the venue and its visitors).
When you contact us
If you email or message us, we keep a record of your correspondence so we can respond effectively and resolve any issues. We may also use this to improve the service we provide.
Legal basis: Legitimate interests (providing good customer service).
When you sign up for marketing
If you opt in, we will send you:
- Emails about upcoming events, new sessions, and exclusive member offers
- Occasional news about HOTBOX Social and what is going on in the community
We will always ask for your permission before sending marketing. You can withdraw that permission at any time. It will not affect your membership or bookings.
How to unsubscribe:
- Click the unsubscribe link in any marketing email
- Email us at support@hotboxsocial.co.uk
- Update your preferences through your account
Legal basis: Consent.
When you use our website
We collect technical data automatically when you visit our website, including your IP address, browser type, device type, and pages visited. This helps us keep the site running and understand how it is being used.
We also use cookies. See the Cookie Policy for more information.
Legal basis: Legitimate interests (improving our website and digital experience).
When you use our referral programme
If you refer a friend, we use your name and contact details to log the referral and apply any credits owed. Your friend's details are used only to set up their account and apply their introductory discount.
Legal basis: Legitimate interests (administering the referral programme).
Who we share your data with
We do not sell, rent, or trade your data. We share it only with the trusted third-party providers who help us operate HOTBOX Social.
| Provider type | What they do |
|---|---|
| Payment processors | Securely process card payments |
| Booking and membership platform | Manage session reservations, credits, and member accounts |
| Email marketing provider | Send newsletters and event communications to opted-in members |
| Website hosting and analytics | Keep our website running and measure its performance |
| Accounting software | Help us meet our financial and tax obligations |
All third-party processors are bound by UK GDPR and data processing agreements. They may only use your data as directed by us.
We may also disclose your data if required by law, for example in response to a court order, police request, or HMRC enquiry.
How long we keep your data
We keep your data only for as long as necessary. Here is our standard schedule:
| Data | Retention period |
|---|---|
| Booking and session records | 2 years from date of visit |
| Membership account data | Duration of membership + 2 years |
| Financial and payment records | 7 years (HMRC requirement) |
| Health and safety declarations | 1 month following your session |
| Emergency contact information | Duration of membership |
| CCTV footage | Up to 30 days (unless required for an incident) |
| Marketing consent records | Until consent is withdrawn + 3 years |
| Website analytics data | 13 months |
| Customer correspondence | 3 years from last contact |
When data is no longer needed, it is securely deleted or anonymised.
Your rights
Under UK GDPR, you have the following rights. You can exercise any of them by emailing support@hotboxsocial.co.uk. We will respond within one calendar month.
| Your right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Ask us to correct inaccurate or incomplete data |
| Erasure | Ask us to delete your data where there is no longer a lawful reason to hold it |
| Restriction | Ask us to pause processing your data in certain circumstances |
| Portability | Request your data in a structured, machine-readable format |
| Object | Object to processing based on legitimate interests or for direct marketing |
| Withdraw consent | Withdraw any consent you have given, including for health data or marketing, at any time |
We may need to verify your identity before fulfilling a request. We will not charge a fee for standard requests.
Cookies
Our website uses cookies to help it work, to understand how it is used, and, if you agree, to support marketing.
| Type | What it does |
|---|---|
| Strictly necessary | Required for the site to function, such as session management and booking forms. Cannot be turned off. |
| Analytics | Helps us understand how visitors navigate the site, such as Google Analytics. Only used with your consent. |
| Marketing | Used to show relevant ads and measure their effectiveness. Only used with your consent. |
You can manage cookie preferences via the banner on our website or through your browser settings. Refusing optional cookies will not stop you from booking or using your account.
Security
We take appropriate steps to protect your data:
- HTTPS encryption across our website
- Encrypted payment processing via certified third-party providers
- Access controls limiting who can view personal data internally
- Regular review of our data handling practices
No online transmission is 100% secure. If you have concerns about a specific security issue, contact us at support@hotboxsocial.co.uk.
Data breaches
If a breach occurs that is likely to affect your rights or freedoms, we will:
- Notify the Information Commissioner's Office (ICO) within 72 hours
- Notify affected individuals promptly where the risk is high
- Keep an internal record of all breaches and our response
Children
Our venue is for people aged 18 and over. We do not knowingly collect personal data from anyone under 16.
If you believe a child has provided us with their personal data, please contact us at support@hotboxsocial.co.uk and we will delete it promptly.
International transfers
We aim to store and process all data within the UK and EEA. Where third-party providers transfer data outside these areas, we require them to put adequate safeguards in place, such as the ICO's International Data Transfer Agreement (IDTA) or UK-approved Standard Contractual Clauses.
Changes to this policy
We may update this policy from time to time. Any changes will appear on this page with a revised "Last updated" date. If changes are significant, we will let you know by email if you have an account or via a notice on our website.
Make a complaint
If you are unhappy with how we have handled your data, please get in touch first. We would like the chance to put it right.
Email: support@hotboxsocial.co.uk
If you are still not satisfied, you have the right to complain to the UK's data protection authority:
Information Commissioner's Office (ICO). Website: www.ico.org.uk. Telephone: 0303 123 1113. Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.