JUST ACTIVE — MASTER PRIVACY POLICY

1. WHAT DATA WE COLLECT & HOW WE GET IT

A. Data You Provide to Us Directly (Seekers & Claimed Providers): When you register an account, book an activity, or claim a Provider profile, we collect:

• Identity Data: First name, last name, date of birth.
• Contact Data: Email address, telephone number.
• Special Category Data (Dependents & Medical Notes): If a Seeker books on behalf of a child or dependent, we collect the dependent's name, age, emergency contact details, and strictly voluntary medical notes or required adaptations.
• Profile Data: Passwords (encrypted), Provider business descriptions, and self-declared safeguarding credentials.

B. Data We Collect from Public Sources (The Discovery Directory): To build our centralized community directory, we aggregate publicly available business contact information from websites, public directories, and public social media pages. If you operate as a sole trader or individual coach, this includes:

• Your business name (which may be your personal name).
• Your publicly listed business contact details (email address and phone number).
• Links to your public professional profiles.

C. Financial & Transactional Data: All payments are processed securely via our third-party payment gateway, Stripe Connect Express. Just Active Ltd does not collect, store, or process your raw credit card numbers or bank account details. We only retain transactional metadata (e.g., booking IDs, amount paid, payment status) necessary to confirm your booking and issue refunds.

2. HOW AND WHY WE USE YOUR DATA (LAWFUL BASIS)

Under UK GDPR, we must establish a valid lawful basis for processing your data:

• Contractual Necessity: We process your Identity, Contact, and Transactional Data to fulfill the core contract—facilitating your booking, securing your spot on a roster, and delivering your payment to the Provider.
• Explicit Consent (Special Category Data): By entering medical notes or required adaptations for yourself or a dependent during checkout, you grant us explicit consent to process this health data and securely transfer it to the specific Provider you have booked with to ensure safety and safeguarding.
• Legitimate Interest (The Directory): We process publicly available business data to populate our discovery directory. Our legitimate interest is to provide a comprehensive, centralized resource for the public. We have conducted a Legitimate Interest Assessment (LIA) and concluded that aggregating already-public business contact information does not disproportionately infringe on your privacy rights, provided strict opt-out safeguards are maintained.

3. DATA SHARING & THIRD-PARTY SUB-PROCESSORS

We do not sell your personal data. We only share your data with trusted third parties necessary to operate the Platform:

• Activity Providers: When a Seeker books a session, we transfer the attendee's name, emergency contact, and any self-disclosed medical notes to the Provider. Upon receipt, the Provider becomes an independent Data Controller of that information and is legally bound to process it securely.
• Payment Processors (Stripe): Financial data is transmitted directly to Stripe to facilitate multi-party payouts and maintain our exemption from the FCA payments regulatory perimeter.
• AI & Text Enhancement Providers: If a Provider utilizes the "Enhance with AI" feature, the text submitted is processed by a secure, third-party Large Language Model (LLM). Providers must not input Personally Identifiable Information (PII) into the AI enhancement tool.
• Cloud Infrastructure: Your data is stored securely on servers located within the UK/EEA, utilizing enterprise-grade encryption at rest and in transit.

4. DATA RETENTION & THE SUPPRESSION LIST

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

• Dependent & Medical Data: Maintained only while your account is active to facilitate recurring bookings.
• The Suppression List (For Scraped Providers): If an unverified Provider exercises their right to object to our public directory, we utilize a "soft delete" mechanism. Their public listing is removed upon administrative verification, but their email is securely retained on an internal backend Suppression List. This ensures Just Active Ltd never accidentally re-scrapes their public data and re-adds them against their wishes in the future.

5. YOUR LEGAL RIGHTS

Under UK data protection law, you possess absolute rights regarding your personal data:

• The Right to Access: You may request a copy of the data we hold about you.
• The Right to Erasure / Right to Object (The Frictionless Opt-Out): If you are a sole trader, you have the right to object to our processing of your public data. You can request removal at any time by clicking the "Report Data / Request Removal" link on your directory profile. We will process this request within five (5) business days.
• The Right to Withdraw Consent: Seekers may withdraw consent for the processing of dependent medical data by deleting the dependent profile from their authenticated dashboard.
• The Right to Rectification: You can ask us to correct inaccurate or incomplete data.

To exercise any of these rights, please email our Data Protection Officer at: compliance@justactive.co.uk.

6. COMPLAINTS

If you have concerns about our data processing, please contact us first so we can resolve the issue. You retain the right to lodge a formal complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk