Privacy notice

Privacy notice

Last updated: 13 October 2026

Who we are

Aspire Parkour Academy is run by Aspire Parkour Academy Ltd (company number 12008679), 18 Whitewater, Orton Wistow, Peterborough PE2 6FB. We decide how your information is used, which makes us the “controller” under UK data protection law. We pay the data protection fee to the Information Commission, the UK’s data protection regulator.

If you have a question about your information, or want to use any of the rights below, contact Kieran Wylde, our data protection lead, at team@aspireparkour.com or write to the address above. You can do most things yourself in the app, under Account → Your data.

What this notice covers

This notice explains what we collect when you use the Aspire Parkour Academy app and website, why, who we share it with, how long we keep it, and your rights.

The app is used by parents and carers (and adult members booking for themselves) to manage their children, book classes, camps and wildcards, pay for memberships, message the office and receive incident reports. Children don’t log in — except Young Leaders, aged 13 to 17, who have their own login to help in classes (see “Young Leaders” below). People who work for us have their own notice: the staff privacy notice, at /legal/staff-privacy.

What we collect about you

• Your name, email address, phone number and postal address (we use the address for posting Store orders and to reach you).
• Your sign-in details. Our sign-in provider keeps them; we never see your password. If we offer signing in with Google or Apple and you use it, they tell us your email and name.
• Emergency contacts you give us (names, relationships and phone numbers). Please let them know you’ve shared their details with us.
• What you’ve paid for, when and how much — including a place you paid for another way (for example cash or Tax-Free Childcare), which the office records with its reference, and vouchers the office gives you. We never see or store card numbers — Stripe does.
• Store credits on your account — from a 1-to-1 or camp package, or given by the office: what each one is for (and whether it’s for one child only), when it runs out, the booking it was used on, and the office’s reason when it gives, extends or cancels one.
• The agreements you accept (our terms and the participation waiver), and that you’ve read this notice, with the date, time, internet address and browser used.
• Messages you send to the office in the app, including voice notes (with the words typed to go with them) and GIFs, and the notifications we send you.
• How you’d like us to contact you, if you tell us (for example text only, or please call), and whether you’ve asked us to send written messages only, not voice notes.
• Your choices: which notifications you want by email or on your phone, and whether you’d like to hear about camps, events and offers (off unless you switch it on). If you joined us from our old website, we’ve kept the date you said yes to news there.
• Concerns you raise with “Report a concern”, and how we followed them up.
• Questions you send from the contact form on our website: your name, email, phone number if you give it, your child’s age and venue if you give them, and your message.
• If you’re hurt at one of our classes or camps (or a brother, sister or other visitor is), what happened goes in our accident book: the person’s name and phone number, what happened, any injury and treatment, and whether they went to hospital. Families can’t see the accident book; the office can.
• Bring a friend: who sent you, and the friends you brought (each family sees only the other’s first name).
• If you invite another adult to share your children, their email address.

What we collect about each child

• Name, date of birth and, if they come to us, when they started.
• Health and support information you choose to give us: medical conditions, allergies, medication, additional or sensory needs, GP details, and whether a medical professional has advised against physical activity. This is “special category” information and we protect it more strictly (see below). We ask you once a year to check it’s still right.
• Your photo and video choice for them.
• Bookings, class places, waiting lists, attendance (including late arrival and early collection times), skills, grading results and wristbands, XP, badges, crystals (and the coach who gave each) and rewards, how you’ve chosen their prizes open, competition entries and results, make-up classes, and short notes (“shout-outs”) coaches send you.
• Things bought in the Store with their XP: what, when, how much XP, whether it’s been handed over, and — if the office gave the XP back — why.
• For a child with a critical health condition (for example an EpiPen or inhaler), whether they had their medicine with them at each class: the coach asks on the register.
• For a 1-to-1 with a child under 18, whether their parent or carer was there and stayed (the coach checks before it starts).
• Incident and accident reports written by our coaches (including whether your child went to hospital), your acknowledgement or typed signature on them, and any notes you add to them.
• The history of changes to their name and photo choice.

Young Leaders

Young Leaders are young people aged 13 to 17 who help coach in our classes. They have their own login, and their parent or carer agrees to them joining — in the app, or with the office — and we record that agreement: who they are to the young person, that they have parental responsibility, and whether the young person’s photo may be on Meet the team.

Young Leaders see the children in the classes they help with by first name, surname initial and age, with flags such as “medical” or “no photos” — never their health details, absence notes, or families’ phone numbers and emergency contacts: the lead coach has those. If a Young Leader writes an incident report, it goes to the lead coach first, who sends it to you under their own name.

Young Leaders talk to coaches and the office in the team’s chat, never to families or children. Under 18, they chat one-to-one only with the office, and the office can read every chat they’re in. There are no voice notes to or from them, and no notifications to them between 9pm and 7am (except safeguarding ones). A Young Leader can report any message to the office.

If a Young Leader is under 16, their parent or carer gets an email each Monday with that week’s shift times (the day, time and place, nothing else); for 16 and 17-year-olds, only if the office switches it on. Their parent or carer’s phone number and email come off the Young Leader’s record 30 days after their 18th birthday.

Young Leaders have their own privacy notice, with a short version written for them: /legal/staff-privacy.

Why we use it, and the law that allows it

• Your account, bookings, memberships and payments: to provide the classes and camps you sign up for. Lawful basis: contract.
• The Store — paying by card or with a child’s XP, and the credits a package puts on your account: to give you what you’ve bought, keep track of credits until they’re used or run out, and remind you before they do. Lawful basis: contract.
• Payment and accounting records: to meet tax and accounting law. Lawful basis: legal obligation.
• Children’s details, attendance, progress and incident reports: to run safe classes, keep registers, record progress and look after the children. Lawful basis: legitimate interests (running a safe activity club), and legal obligation where health and safety law requires records.
• Health and support information: so coaches can keep children safe and support them properly, and tell the emergency services if needed. Condition: your explicit consent, which you give with a separate tick on the health form. You can take it back at any time by messaging the office — we then delete the health details, but your child can’t take part until coaches know what they need to keep them safe. And vital interests in an emergency.
• Emergency contacts: to reach someone if we can’t reach you. Lawful basis: legitimate interests.
• Concerns and safeguarding reports: to keep children safe. Lawful basis: legitimate interests and, where needed, the safeguarding conditions of the Data Protection Act 2018.
• The accident book: health and safety law asks us to record accidents, and we may need it for a claim. Lawful basis: legal obligation and legitimate interests. Condition for the injury itself (health information): establishing, exercising or defending legal claims.
• Questions from our website’s contact form: to answer you. Lawful basis: legitimate interests.
• A Young Leader’s shift times to their parent or carer: so they can plan getting them there and back safely. Lawful basis: legitimate interests.
• Photos and video: only as you choose in the photo setting. Lawful basis: consent — change it any time on your child’s details page.
• Emails about camps, events and offers: only if you’ve said yes. Lawful basis: consent (switch it off any time under Account → Notifications, or with the link in any of those emails).
• Service messages (bookings, reminders the day before a camp day, 1-to-1, competition or first class, changes to classes and camps, cancellations, incident reports, payment problems): part of the service, not marketing. Lawful basis: contract and legitimate interests.
• Security and fraud prevention, including the record of who opened health information and our audit trail: to protect your information and our systems. Lawful basis: legitimate interests and legal obligation.

Decisions made automatically, and looking at attendance

We look at attendance to spot when a child may be struggling or about to leave, so the office can get in touch.

Some decisions are made automatically under our terms: a class place is released if a membership is unpaid for 7 days, and a waiting-list place passes on after 3 offers you didn’t take. If one of these affects you, ask us and a person will look at it.

We don’t sell your information, and we don’t show adverts.

How we protect health information

Health and support details are only visible to you, to our office, and to the coaches who run your child’s class around the time of that class. Coaches see a flag (for example “Critical” for an EpiPen or inhaler) on the register and must open the details deliberately; every opening is recorded, and you can see who opened them and when under Account → Your data.

For classes where the signal may drop, the coaches on the class keep a short offline card on their phone for children with a critical condition (their name, who to call and what to do). It deletes itself at midnight after the class, and when they sign out.

Office accounts sign in with a second step (a code from an app on their phone) as well as a password.

Safeguarding records

If you, a coach or anyone else raises a concern about a child, it’s kept as a safeguarding record, with each step taken and its outcome. Only our safeguarding lead and their deputies can read it (until a lead is named, the office), never anyone it names, and every time one of them opens it is recorded. We may share it with the local authority, the police or other safeguarding services when a child may be at risk — sometimes without telling you first, if telling you could put a child at risk. Your own download lists the concerns you raised, but not the office’s notes or other safeguarding records.

Other adults on your account

You can invite another adult (for example another parent) to share your children. They see everything about the children you share — their details, health, bookings and messages — but not your other children, your payments or your own details.

When the office signs in as you

To sort out a problem, the office can sign in to your account as you, for 30 minutes at most. They have to give a reason, which you see; you’re told when it happens, and every visit and what changed is listed under Account → Office access.

Who we share it with

We use trusted service providers who process information for us, under contracts that require them to protect it:

• Supabase — our database, sign-in and file storage, hosted in London.
• Vercel — hosts the app, in London.
• Stripe — takes card payments and runs memberships. Stripe sees your name and email, what you’re buying (for a camp, the day and your child’s first name) and your card details. Stripe is also a controller of some payment information in its own right: see stripe.com/gb/privacy.
• Resend — sends our emails (your email address, first name, and the notification’s words — never health details).
• Upstash — protects sign-in from attack, in London (it keeps internet addresses for a few minutes).
• Apple and Google (and Mozilla and Microsoft for web browsers) — deliver phone notifications if you allow them. They handle the words of each notification to deliver it, so we never put health details in notifications.
• Giphy — GIFs in Messages come from Giphy through our own server, so Giphy never sees your device or its internet address; it only gets the search words.
• Google and Apple — only if we offer signing in with them and you choose to.
• Anthropic — only if the office switches on Ask, a question tool for the office. People’s names are swapped for codes before anything leaves the app, and it never sees health details, contact details, addresses, messages or payment details.
• Your calendar app — if you add your children’s classes to your calendar, the private link shows their class times to anyone who has it. Keep it to yourself; you can reset it in the app.

Where a provider stores information outside the UK, we rely on the UK’s adequacy regulations (for example the UK–US data bridge) or approved contract clauses.

We also share information with the emergency services if a child needs urgent help, with our insurer if there’s a claim, and with others where the law requires it (for example safeguarding authorities or a court order).

When you joined us from our old system, we brought your details across from it (contact details, children, memberships and health forms). Once the import has been checked, the old system’s data and the import files are deleted.

How long we keep it

• Your account and your children’s details: while your account is open, then removed when you delete it. If nobody uses an account — no class, booking or sign-in — for 3 years, we tell you about a month before (in the app and by email) and then delete it. Signing in keeps it.
• Sign-ups never finished, with nothing in them: 90 days.
• Your child’s progress — XP, badges, crystals and prizes, skills and grading sign-offs: a year after their last membership (or grading membership) ends, or their last class if that’s later. We tell you a week before. Registers and bookings stay with the account.
• Health and support information, and the register’s checks that a child had their medicine: deleted when you delete your account; for a child who leaves us, 6 months later, or 6 years after an incident if they had one.
• Messages: while your account is open.
• Notifications: a year after they’re read, or after two years.
• Payment records: 6 years after the end of the tax year you paid in (tax law). After that, for a deleted account, we keep only the amounts and dates.
• Store credits, and things bought with a child’s XP: while your account is open. If you delete it, credits you haven’t used are cancelled; what was bought stays with the payment records, without your names.
• Signed agreements: 6 years after your account closes.
• Incident and accident reports, and the notes you add to them: until the child is 21, or for 3 years if they were an adult (the time for a legal claim); longer only while a claim or a safeguarding matter needs them. Then what happened (and your notes) is cleared, and only the kind of incident, the date and the venue remain. If you delete your account, a report is still kept for that time, with your notes on it.
• The accident book (adults hurt at our classes or camps): 3 years after the accident, or longer while a claim or our insurer needs it.
• Safeguarding records, and the record of who opened them: until the child’s 25th birthday; allegations about staff: 10 years, or until their normal retirement age if that’s longer.
• The record of who opened health information, our audit trail and the office’s visits to your account: 6 years.
• Your requests to us (for example to see or delete your data): 6 years after we answer.
• Questions from our website’s contact form: 12 months after we’ve dealt with them, and 24 months at most.
• The app’s own records of the reminders and alerts it has sent: 90 days.
• The app’s error log: 90 days.
• Ask’s question log (if Ask is switched on): 12 months.
• Member-import files: 30 days.
• Backups: erased information stays in our database provider’s backups until they expire, after 7 days.

Your rights

You have the right to:

• see the information we hold — download it yourself under Account → Your data → Download my data, or ask us (if you don’t have a login, or the download doesn’t cover what you need, we’ll answer within one month);
• correct it — most details can be edited in the app;
• delete it — use Account → Your data → Delete my account; we decide within one month and email you when it’s done. We keep only what the law or our insurers need (payment records, signed agreements, incident reports);
• take it elsewhere — the download is in a standard format (JSON);
• object to how we use it, or ask us to restrict it;
• withdraw consent at any time (photos, emails about camps, events and offers, health information);
• complain to us first at team@aspireparkour.com — we’ll acknowledge within 30 days — and to the Information Commission, the UK’s data protection regulator, at ico.org.uk or 0303 123 1113.

Young people aged about 13 and over can usually make these requests about their own information; we’ll consider what’s in their best interests if a parent asks on their behalf.

Cookies and storage

We only use what’s needed to make the app work, or to remember a choice you made — see our cookies and storage page (/legal/cookies). We don’t use advertising or tracking cookies.

Changes to this notice

If we change this notice, we’ll publish the new version and tell you in the app.