1. Who We Are
Session (“we”, “us”, or “our”) is operated by Wil Grace, a sole trader of 161 Cathedral Road, Cardiff CF11 9PL, United Kingdom, trading as Session at bookasession.org. We are the data controller for personal data collected through the Platform.
Contact: wil@bookasession.org
This policy explains what personal data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
Please note that individual Organisations using the Platform to offer sessions may also act as independent data controllers for their own End Users. You should also review the privacy notice of the Organisation whose sessions you are booking.
2. What Personal Data We Collect
Account and profile data
- Name and email address (required to create an account)
- Optional demographic information: date of birth, gender, ethnicity, work situation, housing situation, and location (collected only if you choose to share it in your community profile)
- Authentication data managed by Clerk (see Section 5)
Booking and transaction data
- Session bookings you make, including dates, times, and quantities
- Payment information (processed by Stripe — we do not store raw card details)
- Membership subscription status and billing history
- Cancellation and refund records
Usage and technical data
- IP address and browser/device information
- Pages visited and actions taken on the Platform
- Error logs and diagnostic information
Communications
- Emails we send you (booking confirmations, membership confirmations, session cancellation notices)
- Any correspondence you send us
3. Lawful Basis for Processing
We process your personal data on the following legal bases under the UK GDPR:
- Contract — to create and manage your account, process bookings and payments, and fulfil our obligations to you
- Legitimate interests — to operate, maintain, and improve the Platform; to detect and prevent fraud; to send transactional communications; and to ensure Platform security
- Legal obligation — to comply with applicable laws (e.g. accounting, tax, and anti-money-laundering requirements)
- Consent — for optional demographic data you share in your community profile; you may withdraw consent at any time by updating or deleting that information in your account settings
4. How We Use Your Data
- Creating and managing your account
- Processing session bookings and payments
- Sending booking confirmations, receipts, and notifications
- Managing membership subscriptions and billing
- Providing customer support
- Ensuring the security and integrity of the Platform
- Complying with legal and regulatory obligations
- Analysing usage to improve Platform features and performance (using aggregated or anonymised data where possible)
We do not sell your personal data to third parties and we do not use it for advertising purposes.
5. Third-Party Processors
We use the following third-party sub-processors to help us deliver the Platform. Each is bound by appropriate data processing agreements:
- Clerk (Clerk Inc., USA) — authentication and user identity management. Data is processed in the US under standard contractual clauses.
- Supabase (Supabase Inc., USA) — database, storage and back-end infrastructure. Data is stored in the AWS eu-west-1 region, Republic of Ireland.
- Stripe (Stripe Payments Europe, Ltd., Ireland) — payment processing and subscription billing. Stripe is PCI-DSS compliant. Review Stripe’s Privacy Policy.
- Resend (Resend Inc., USA) — transactional email delivery.
- Vercel (Vercel Inc., USA) — application hosting and content delivery. Primary compute runs in Dublin, Republic of Ireland.
- Amazon Web Services (Amazon Web Services, Inc.) — marketing email delivery, in the eu-west-2 region, London.
- bunny.net (BunnyWay d.o.o., Slovenia) — image and asset content delivery, served from London, United Kingdom.
- Featurebase (CORDNET OÜ, Estonia) — in-app support chat and product feedback. Processes the identity of Organisation administrators only, not End Users.
- Google (Google Ireland Ltd. / Google LLC) — address autocomplete during account setup. Processes the address an administrator types, not End User data.
A current list is also maintained at Annex 3 of our Data Processing Agreement, where Organisations acting as controllers will find each sub-processor’s location and the transfer mechanism applied.
6. Data Retention
We retain your personal data for as long as your account is active or as needed to provide the Platform. If you close your account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it for longer by law (for example, financial records are retained for 7 years in line with UK tax law).
Booking and payment records may be retained for up to 7 years for accounting and legal compliance purposes. After this period they are securely deleted.
7. Your Rights
Under the UK GDPR you have the following rights in relation to your personal data:
- Right of access — to request a copy of the personal data we hold about you
- Right to rectification — to ask us to correct inaccurate or incomplete data
- Right to erasure — to request deletion of your personal data (subject to our legal retention obligations)
- Right to restriction — to ask us to restrict processing of your data in certain circumstances
- Right to data portability — to receive your data in a structured, machine-readable format
- Right to object — to object to processing based on legitimate interests
- Right to withdraw consent — where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at wil@bookasession.org. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
8. Cookies
The Platform uses essential cookies to maintain your session and authentication state. These cookies are strictly necessary and cannot be disabled without breaking Platform functionality.
We do not use advertising or tracking cookies. If we introduce non-essential cookies in future, we will update this policy and request your consent.
9. International Data Transfers
Some of our third-party processors are based outside the UK/EEA (primarily the United States). Where we transfer personal data internationally, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or standard contractual clauses approved by the ICO.
10. Children’s Privacy
The Platform is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
Individual Organisations may set their own age restrictions for specific sessions. Please check the Organisation’s booking terms.
11. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will give you at least 30 days’ notice by email or by displaying a prominent notice on the Platform. The “Last updated” date at the top of this page indicates when the policy was last revised.
12. Contact Us
For any questions, requests, or complaints relating to this Privacy Policy or our data processing practices, please contact: