Privacy Policy

Last updated: 17 June 2026

This Privacy Policy explains how Drainingkneesflo ("we", "us", "our") collects, uses, stores, and protects your personal data when you visit drainingkneesflo.shop (the "Website") or contact us about bike rides and related services.

UK data protection after Brexit: Following the United Kingdom's departure from the European Union, Great Britain has its own standalone data protection framework. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) as retained and amended in UK law, the Data Protection Act 2018 (DPA 2018), and guidance issued by the Information Commissioner's Office (ICO). The EU GDPR no longer applies directly in the UK. If we transfer data to the European Economic Area or other countries, we do so using appropriate UK-approved safeguards.

1. Data Controller

The data controller responsible for your personal data is:

Drainingkneesflo
Company number: 08770057 (registered in England and Wales)
Retail Park, UNIT 1A & 1B, Manningham Ln, Bradford BD1 3AH, United Kingdom
Email: clients@drainingkneesflo.shop
Phone: +44 1274 015480

ICO registration: We are registered with the Information Commissioner's Office (ICO) as a data controller and have paid the annual data protection fee required under the Data Protection (Charges and Information) Regulations 2018. As we process personal data electronically — including contact enquiries, website usage data, and cookie-related information — ICO registration is mandatory for our organisation. You can verify our registration on the ICO register at ico.org.uk/ESDWebPages/Search using our company name or number 08770057.

We have not appointed a Data Protection Officer (DPO) as we are not required to do so under UK GDPR Article 37. For all data protection enquiries, please contact us using the details above.

Under the Electronic Commerce (EC Directive) Regulations 2002, we provide the above business identity information on this Website so you can contact us about our cycling services. For booking terms and refunds, see our Refunds & Cancellations policy.

2. Personal Data We Collect

We may collect, use, store, and transfer the following categories of personal data:

Identity data: first name and surname when you contact us.
Contact data: email address, telephone number, and postal address if you provide them.
Technical data: IP address, browser type and version, time zone, operating system, device identifiers, and pages visited.
Usage data: information about how you use the Website, including referral source, page views, and session duration.
Communication data: messages, enquiries, and correspondence you send to us, including group ride or beginner programme requests.
Consent data: records of cookie preferences and GDPR consent given via our contact form, including the date and time of consent.

We do not routinely collect special category data (such as health data) unless you voluntarily include it in a message. We ask that you avoid sharing sensitive personal data unless it is necessary for your enquiry.

We do not collect personal data from third-party sources except where technical data is automatically collected by our hosting or analytics providers when you use the Website.

3. How We Collect Personal Data

Direct interactions: when you complete our contact form, email us, telephone us, or visit our Bradford base.
Automated technologies: as you interact with the Website, including through cookies and server logs (see our Cookie Policy).
Third parties: our hosting provider may process technical logs; analytics providers only if you consent to analytics cookies.

4. Purposes and Lawful Bases for Processing

Under UK GDPR Article 6, we must have a lawful basis for processing your personal data. We use the following:

Purpose	Data Used	Lawful Basis
Responding to enquiries and contact form submissions	Identity, contact, communication data	Consent (Article 6(1)(a)) and legitimate interests in responding to requests (Article 6(1)(f))
Managing group ride reservations and beginner programme bookings	Identity, contact, communication data	Steps prior to contract and contract performance (Article 6(1)(b))
Operating, securing, and maintaining the Website	Technical, usage data	Legitimate interests in running a secure website (Article 6(1)(f))
Website analytics (only with consent)	Technical, usage data	Consent (Article 6(1)(a))
Marketing communications (only with consent)	Contact data	Consent (Article 6(1)(a)) — you may opt out at any time
Complying with legal and regulatory obligations	Any relevant data	Legal obligation (Article 6(1)(c))
Establishing, exercising, or defending legal claims	Any relevant data	Legitimate interests (Article 6(1)(f))

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms and concluded that processing is necessary and proportionate. You have the right to object to processing based on legitimate interests (see Section 9).

Where processing is based on consent, you may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you within the meaning of UK GDPR Article 22.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Specific retention periods:

Contact form and email enquiries: up to 24 months from the date of last communication, unless an ongoing booking or dispute requires longer retention.
Group ride and programme booking records: up to 6 years after the event for contractual, insurance, and legal purposes.
Cookie consent records: up to 12 months from the date consent was given or updated.
Server and security logs: up to 90 days, unless required for incident investigation.
Analytics data (if consented): up to 26 months, in line with standard analytics provider settings.
Legal and regulatory records: as required by applicable UK law, which may exceed the periods above.

When retention periods expire, we securely delete or irreversibly anonymise personal data.

7. Data Sharing and Recipients

We do not sell, rent, or trade your personal data. We may share data with the following categories of recipients, who act as data processors or independent controllers as applicable:

Website hosting and IT infrastructure providers — to host the Website and maintain security (UK or EEA-based where possible).
Email and communication service providers — to deliver and manage correspondence.
Analytics providers (e.g., Google Analytics) — only if you consent to analytics cookies.
Embedded service providers (e.g., Google Maps on our contact page) — may process technical data when you interact with embedded content.
Professional advisers — lawyers, accountants, or insurers where reasonably necessary.
Law enforcement and regulatory authorities — where required by law, court order, or to protect our legal rights.

All processors are bound by written contracts (Data Processing Agreements) requiring them to protect your data in accordance with UK GDPR and to process data only on our documented instructions.

8. International Data Transfers

Some service providers may process data outside the United Kingdom. Where personal data is transferred internationally, we ensure a level of protection equivalent to UK standards through one or more of the following mechanisms:

Transfers to countries with a UK adequacy regulation under Article 45 UK GDPR.
UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses.
Binding Corporate Rules or other approved transfer mechanisms where applicable.

You may request further information about transfer safeguards by contacting us at clients@drainingkneesflo.shop.

9. Your Rights Under UK GDPR

Under the UK GDPR and DPA 2018, you have the following rights in relation to your personal data:

Right of access (Article 15): request a copy of the personal data we hold about you (Subject Access Request).
Right to rectification (Article 16): request correction of inaccurate or incomplete data.
Right to erasure (Article 17): request deletion of your data where there is no compelling reason for continued processing.
Right to restrict processing (Article 18): request that we suspend processing in certain circumstances.
Right to data portability (Article 20): receive your data in a structured, machine-readable format where processing is based on consent or contract and is automated.
Right to object (Article 21): object to processing based on legitimate interests or for direct marketing purposes.
Rights related to automated decision-making (Article 22): not to be subject to solely automated decisions with significant effects (not applicable to our current processing).
Right to withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at clients@drainingkneesflo.shop or write to our postal address above. We will respond within one month of receiving your request. This period may be extended by a further two months for complex or multiple requests, in which case we will notify you within the first month.

We may need to verify your identity before processing a request. There is no fee for exercising your rights unless a request is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse the request as permitted by law.

If you are dissatisfied with our response, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
Website: ico.org.uk
Helpline: 0303 123 1113

10. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including:

HTTPS/TLS encryption for data transmitted via the Website.
Access controls limiting staff access to personal data on a need-to-know basis.
Secure storage of electronic records and regular review of security practices.
Staff awareness of data protection responsibilities.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours where required and inform affected individuals without undue delay where there is a high risk to them, in accordance with UK GDPR Articles 33 and 34.

No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Marketing Communications

We will only send you marketing communications about bike rides, events, or related services where you have given explicit consent or where permitted by law. You may opt out of marketing at any time by clicking an unsubscribe link (where provided), contacting us directly, or emailing clients@drainingkneesflo.shop. Opting out of marketing does not affect service-related communications about bookings you have made.

12. Children's Privacy

Our Website is not directed at children under 13. We do not knowingly collect personal data from children under 13 without appropriate parental consent as required under the DPA 2018. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will delete that information promptly.

Group rides involving participants under 18 may require parental or guardian consent and supervision. Please contact us before booking for participants under 18.

13. Links to Other Websites

Our Website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing personal data.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. The "Last updated" date at the top indicates when this policy was last revised. Where changes are material, we will provide a prominent notice on the Website or contact you directly where appropriate. We encourage you to review this page periodically.

15. Contact Us

For any questions about this Privacy Policy or our data practices, contact:

Back to Home