Website Privacy Policy

Website Privacy Policy

This Website Privacy Policy applies to the website operated by Gracie Barra Bradley Stoke Ltd ('GBBS', 'we', 'us', 'our'). It explains what data we collect when you visit our website, how we use it, and your rights.
This policy is in addition to our general Privacy Notice and our Cookie Policy.

1. Data We Collect via the Website

1.1 Automatically Collected Data

When you visit our website, we may automatically collect:

• IP address
• Browser type and version
• Operating system
• Pages visited and time spent
• Referring URL (the page you came from)
• Date and time of visit

Server logs and technical data (IP address, browser type, pages visited, referrer) are collected under our legitimate interests (Article 6(1)(f) UK GDPR) in maintaining a secure and functional website. This data is retained for up to 180 days.
Website analytics data collected via Google Analytics 4 (GA4) cookies is processed only with your prior consent (Article 6(1)(a) UK GDPR; PECR Regulation 6). Analytics cookies are not set until consent is given via our cookie consent banner. You may withdraw consent at any time. Server log data and analytics data are separate processing activities with different lawful bases.

1.2 Enquiries and Contact Forms

If you submit a contact or enquiry form on our website, we collect:

• Your name
• Your email address
• Your telephone number
• Your message content
• Any other information you choose to provide

This data is used to respond to your enquiry. The lawful basis is Article 6(1)(b) UK GDPR (steps prior to entering a contract) or, where no contract is contemplated, Article 6(1)(f) UK GDPR (legitimate interests in managing communications).

Enquiry form data is retained for 12 months unless it leads to a membership, in which case our standard membership retention periods apply.

1.3 Membership Sign-Up Forms

If you sign up for membership via the website, the data collected and processed is as described in our Privacy Notice. We use secure (HTTPS-encrypted) web forms for all personal data submission.

1.4 Newsletter and Marketing Sign-Ups

If you subscribe to our newsletter or marketing communications, we collect your name and email address. We will only send marketing emails where you have given explicit consent (Article 6(1)(a) UK GDPR and PECR Regulation 22). You can unsubscribe at any time using the unsubscribe link in any email or by contacting privacy@gbbradleystoke.com.

2. Cookies

Our website uses cookies. Please see our separate Cookie Policy for full details of the cookies we use and how to manage your preferences.

3. Third-Party Services on Our Website

3.1 Payment Processing

Payment processing is handled by GoCardless and/or Stripe. These processors are PCI DSS-compliant and process payment data in accordance with their privacy policies and our Data Processing Agreements. GBBS does not receive or store full payment card details.

3.2 Google Analytics 4 (GA4)

Our website uses Google Analytics 4 (GA4), a web analytics service provided by Google LLC ('Google'). GA4 collects anonymised data about how visitors use our website — including pages visited, session duration, and general geographic location (country/region level only) — to help us understand website performance and improve user experience.

Lawful basis: Consent (Article 6(1)(a) UK GDPR; PECR Regulation 6). GA4 analytics cookies are not set until you have given your consent via our cookie consent banner. You may withdraw consent at any time via the 'Cookie Settings' link in our website footer, or by using the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.

IP anonymisation: GA4 anonymises IP addresses by default before any data is stored. GBBS does not receive or process full IP addresses via GA4.

Data retention: We have configured GA4 to retain analytics data for up to 14 months, after which it is automatically deleted from Google's servers.

Data transfer: Google LLC is headquartered in the United States. The transfer of analytics data to Google is covered by the UK-US Data Bridge adequacy decision (granted October 2023), under which Google LLC participates in the UK Extension to the EU-US Data Privacy Framework. A Data Processing Agreement is in place with Google in accordance with Google Analytics Terms of Service.

Google's privacy policy is available at: https://policies.google.com/privacy

3.3 Embedded Social Media Content

Our website may contain links to or embedded content from Facebook, Instagram, or other social media platforms. These platforms may collect data about you when you interact with embedded content. GBBS is not responsible for the data practices of these third-party platforms. Please consult each platform's privacy policy for details.

4. Your Rights

You have the same data subject rights in respect of data collected via our website as those described in our Privacy Notice. To exercise your rights, contact: privacy@gbbradleystoke.com.

5. Website Security

• All pages of our website use HTTPS (TLS encryption).
• We apply security patches and updates to our website platform.
• We do not store payment data on our own servers.

6. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies.

7. Children

Our website is not directed at children under the age of 13. We do not knowingly collect personal data from children via the website without parental consent. If you believe a child has submitted personal data to us without parental consent, please contact privacy@gbbradleystoke.com.

8. Changes to This Policy

We will publish any changes to this policy on our website. Significant changes will be highlighted. This policy was last updated on 2 April 2026.

9. Contact and Complaints

Email: privacy@gbbradleystoke.com

ICO: www.ico.org.uk | 0303 123 1113