Privacy Policy

MOGA ("we", "us", "our") is a private members club located at 4-6 South Mall, London, N9 0TN. We operate a martial arts, wellness and coworking facility, manage a founding membership programme known as Club 150, and run classes, courses and events — including programmes for young people aged 12 to 16. For the purposes of UK data protection law, MOGA is the data controller responsible for your personal information. If you have any questions about this Privacy Policy or how we handle your data, you can contact us at: info@moga.london

We collect the following categories of personal information: Identity & Contact Information First name, last name, email address, telephone number and gender — collected when you register your interest through our website, book a class or event, or become a member. Participant Information Where you book a place for a young person on one of our youth programmes, we collect their full name and date of birth, together with your name, contact details and relationship to them. Health Information Any medical conditions, injuries, allergies or medication you tell us about when booking a class or event. This is what UK data protection law calls special category data, and we treat it with additional care. It is used only to keep participants safe during training and is seen only by the coaching and management team. Emergency Contact Information The name and telephone number of an emergency contact. Where you give us someone else's details, please make sure they are happy for you to do so — we will only ever use them in an emergency. Booking & Payment Information Records of the classes and events you or a participant book, attendance, and confirmation of any deposit or payment. Card details are handled directly by our payment provider and are not stored by us. Photographs & Video Images and footage captured during classes, events and around our premises, which may include participants, members and visitors. See section 9 for how we use these. Interest & Preference Information Your responses to optional questions about what interests you most about MOGA and how you heard about us. Communication Records Records of any correspondence you send to us, including emails to info@moga.london. Technical & Usage Data When you visit our website, we may automatically collect technical data including your IP address, browser type and version, device type, pages visited, and time spent on pages. This is collected via standard web analytics tools. Marketing Preferences Whether you have opted in to receive marketing communications from us.

We use your personal information for the following purposes: To manage your registration of interest for Club 150 membership — this is necessary for the performance of a contract or steps taken at your request prior to entering a contract. To administer bookings for classes, courses and events — including confirming places, managing capacity, processing deposits and payments, and keeping attendance records. To keep participants safe during training — our coaches use the health information you provide to adapt sessions, respond appropriately to injuries or medical episodes, and decide whether a participant can safely take part in a particular activity. To contact an emergency contact where a participant becomes unwell or injured, or where we cannot reach the parent or guardian. To produce photographs and video of our classes, events and facilities for promotional purposes — see section 9. To send you updates about Club 150, membership availability, and MOGA news — only where you have given your explicit consent to receive such communications. To respond to your enquiries and provide customer support — based on our legitimate interest in providing a quality service. To improve our website and marketing by analysing how visitors use our site — based on our legitimate interest in understanding our audience. To comply with legal obligations we are subject to as a business operating in the United Kingdom, including health and safety and safeguarding duties. We will never use your personal information for purposes incompatible with those described above without first obtaining your consent.

Under UK GDPR, we rely on the following legal bases to process your personal information: Consent — where you have actively opted in to receive marketing communications. You may withdraw this consent at any time by contacting us at info@moga.london or using the unsubscribe link in any email we send you. Explicit Consent — for health information. When you tell us about a medical condition, injury or allergy as part of a booking, you are giving your explicit consent for us to hold and use that information to keep the participant safe. You may withdraw it at any time, although we may then be unable to allow participation. Contractual Necessity — where processing is necessary in connection with a membership agreement, a class or event booking, or pre-contractual steps you have requested. Legitimate Interests — where processing is necessary for our legitimate business interests, such as improving our services, responding to enquiries, promoting MOGA, and understanding how our website is used. We have assessed that these interests are not overridden by your rights and interests, and we apply additional care where the information relates to a young person. Vital Interests — where it is necessary to protect someone's life or health, for example contacting an emergency contact or sharing health information with paramedics. Legal Obligation — where we are required to process your data to comply with UK law, including health and safety and safeguarding obligations.

We do not sell, rent or trade your personal information to third parties for their own marketing purposes. We may share your information with carefully selected third-party service providers who assist us in operating our business, including: — Our booking and membership management platform, used to hold bookings, client records and attendance — Payment processors, used to take deposits and payments securely — Online form tools, used to collect booking enquiries and event registrations — Email and communication platforms used to send Club 150 updates and booking confirmations — Web analytics providers used to understand website usage — Cloud storage and database services used to store registration data securely All third-party service providers are contractually required to handle your data securely and in accordance with UK data protection law. They are permitted to process your data only for the purposes we specify. We may also share health or emergency contact information with medical professionals, emergency services or a participant's emergency contact where necessary to protect someone's health or safety. We may also disclose your information where required to do so by law, regulation, or legal process, including where we have a safeguarding concern about a young person, or to protect the rights, property or safety of MOGA, our members, or others.

Some of the service providers we use are based outside the United Kingdom, or store data on servers outside the UK. This includes certain booking, payment, email and cloud storage providers. Where your personal information is transferred outside the UK, we make sure appropriate safeguards are in place. This means we only transfer data to countries the UK Government has decided provide an adequate level of protection, or we put in place a contract based on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. If you would like more information about the safeguards we apply to a particular transfer, please contact us at info@moga.london.

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected. Registration of Interest Data — we will retain your registration data for the duration of our Club 150 founding membership programme and for a period of up to 2 years thereafter, unless you request deletion sooner. Booking & Attendance Records — retained for up to 3 years after the booking, so that we can respond to any question, complaint or claim arising from a session. Health Information — retained for as long as the participant trains with us and for a period afterwards in line with our insurance and legal obligations. Where a participant attends a one-off class or event and does not return, we delete their health information once any period for raising a related concern has passed. Emergency Contact Information — deleted at the same time as the related booking or membership record. Photographs & Video — content published in promotional material may be retained indefinitely, as it may remain in circulation across our website, social media and printed materials. Unpublished footage is reviewed periodically and deleted when no longer needed. Marketing Data — if you have consented to receive marketing communications, we will retain your contact details until you withdraw consent or we cease operating. Technical & Analytics Data — typically retained in anonymised or aggregated form for up to 26 months. When your data is no longer required, we will securely delete or anonymise it.

Under UK GDPR, you have the following rights in relation to your personal information: Right of Access — you have the right to request a copy of the personal information we hold about you. Right to Rectification — you have the right to ask us to correct any inaccurate or incomplete information we hold about you. Right to Erasure — in certain circumstances, you have the right to request that we delete your personal information. Right to Restrict Processing — in certain circumstances, you have the right to ask us to restrict how we use your data. Right to Data Portability — where processing is based on consent or contract, you have the right to receive your data in a structured, machine-readable format. Right to Object — you have the right to object to processing based on legitimate interests, including our use of photographs and video, and to processing for direct marketing purposes. Right to Withdraw Consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Where a young person is involved, a parent or guardian may exercise these rights on their behalf, and a young person may also exercise them for themselves where they are able to understand what is being asked. We do not make decisions about you based solely on automated processing. To exercise any of these rights, please contact us at info@moga.london. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data appropriately.

Photography and filming take place at MOGA during classes, events and around our premises. We use the resulting content to show what training with us is like, across our website, social media, advertising and other promotional material. We rely on legitimate interests as our lawful basis for this. Showing our coaching, facilities and community is central to how we explain MOGA to people considering training with us, and we have assessed that this does not override the rights and interests of those who appear. We have documented that assessment internally and review it periodically. We tell you before you book. Where a class or event will be filmed, this is set out clearly in the booking information so that you know what to expect beforehand. You can ask us not to use content featuring you or your child. Email info@moga.london at any time — before a session or afterwards — and we will make sure they do not appear in our promotional material. Nothing about taking part in the session itself changes as a result, and we record the request so that our coaching team and anyone filming are aware of it. Where you object after content has been published, we will remove it from every channel we control. We may not be able to recall printed material already distributed, and we cannot retrieve content that has been shared onwards by other people. We take particular care with young people. We do not publish surnames, and we do not tag or name anyone under 18 on social media. We never publish health information, dates of birth or contact details alongside images. If a young person indicates on the day that they would rather not be filmed, we respect that regardless of what has been agreed beforehand. Members, visitors and guests using our facilities may also appear in photography and video taken around the club. Please speak to a member of the team if you would prefer not to. Photographs taken by members, parents or visitors for their own personal use are not covered by this policy or by data protection law. We do ask that you respect others and avoid posting images of other people's children on social media.

Our website may use cookies and similar tracking technologies to improve your browsing experience and to analyse how our site is used. Essential Cookies — necessary for the website to function correctly. These cannot be disabled. Analytics Cookies — used to understand how visitors interact with our website. These are only placed with your consent. You can control cookie preferences through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of our website. We do not use cookies for targeted advertising or share cookie data with advertising networks.

We take the security of your personal information seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, destruction or damage. These measures include encrypted data storage, secure access controls, and regular reviews of our data handling practices. Health information relating to participants is restricted to the coaching and management team who need it to run sessions safely. While we take all reasonable steps to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to addressing any breaches promptly and in accordance with our legal obligations. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

Our website may contain links to third-party websites, including our social media profiles, our booking platform and our payment provider. This Privacy Policy applies only to our website and services. We are not responsible for the privacy practices or content of any third-party sites. We encourage you to review the privacy policies of any external sites you visit.

We run classes and programmes for young people aged 12 to 16. We do not knowingly collect personal information from anyone under 12. Where a young person takes part in one of our programmes, we ask that a parent or legal guardian completes the booking, provides the information we need, and gives any permissions on the young person's behalf. We do not accept bookings for under-18s made without a parent or guardian. Our primary contact for anything relating to a participant under 18 — including confirmations, reminders and marketing — is their parent or guardian. We do not send marketing communications directly to under-18s. We collect only the information we need to run sessions safely: who is attending, their age, anything about their health that affects training, and how to reach an adult responsible for them. If you are a parent or guardian and want to know what information we hold about your child, ask us to correct or delete it, or object to how we are using it, contact us at info@moga.london. If you believe we hold information about a young person that we should not, please contact us and we will look into it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the effective date at the top of this page. We encourage you to review this policy periodically. Your continued use of our website or services after any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns or requests regarding this Privacy Policy or the way we handle your personal data, please contact us: MOGA 4-6 South Mall London N9 0TN Email: info@moga.london We aim to respond to all enquiries within 5 working days. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO): Website: ico.org.uk Helpline: 0303 123 1113