Privacy Policy
Privacy & Cookies Policy
KOA www.koa-edinburgh.co.uk
Effective Date: reviewed 15 January 2026
1. Introduction
KOA as a business created by Corinne Wilkie-Fessler, respects your privacy and is committed to protecting your personal data. This Privacy & Cookies Policy explains how we collect, use, store, and protect your information when you:
- Use our website: www.koa-edinburgh.co.uk
- Book or attend classes, workshops, engage in 1to1 sessions or events, including services where there is collaboration etc
- Communicate with us (e.g. by email, phone, forms, or social media etc)
KOA operates in Scotland and processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which apply across the UK. We also follow guidance from the Information Commissioner’s Office (ICO).
2. Who We Are
Business Name: KOA
Owner: Corinne Wilkie-Fessler
Location: Edinburgh, Scotland
Website: www.koa-edinburgh.co.uk
Email: hello@koa-edinburgh.co.uk
If you have any questions about this policy or your data, please contact Corinne Wilkie-Fessler, the creator or KOA.
If you’re unhappy with how we handle your data, you can contact Corinne directly via email or the ICO: https://ico.org.uk
3. What Personal Data We Collect
|
Category |
Examples |
How Collected |
|
Identity & Contact |
Name, email, phone number, address etc |
Contact forms, intake forms, bookings, emails, Eventbrite registrations, Mailchimp, newsletter sign-ups |
|
Health / Wellbeing Info |
Injuries, medical conditions, physical limitations (special category data) |
Health, intake, or disclaimer forms (collected with your consent) |
|
Service User Data |
Attendance, booking history, notes |
Class/workshop/event records, Eventbrite attendance reports |
|
Technical / Usage Data |
IP address, browser, device, referral source, usage stats |
Cookies, analytics, server logs |
|
Communications |
Emails, feedback, testimonials |
Direct communication, Eventbrite messages, Mailchimp campaigns (testimonials only shared with your consent), Newsletter |
|
Marketing Preferences |
Consent to receive updates or offers |
Newsletter sign-ups, opt-in boxes, Mailchimp preferences |
|
Transaction Data |
Payment confirmation, invoice info |
Through secure payment platforms, Eventbrite payments |
4. How We Collect Your Data
- Directly from you – via bookings, contact forms, emails, health forms, intake forms and more
- Automatically – when you browse the website (cookies, analytics)
- From third party services – booking tools, payment providers, analytics tools etc
5. Legal Bases for Processing
We process your personal data under the following lawful bases:
| Purpose | Legal Basis |
| Delivering classes and services, including the intake process for 1to1 clients | Contractual necessity |
| Responding to enquiries | Legitimate interest |
| Sending marketing emails/newsletter etc | Consent (you can withdraw anytime) |
| Collecting health/disclaimer data | Explicit consent (special category data) |
| Analytics and website improvements | Legitimate interest / Consent (via cookies) |
| Legal compliance and record keeping | Legal obligation |
We only collect special category (sensitive) data where it is essential (e.g. for physical safety) and always with your explicit consent.
6. How We Use Your Data
We use your data to:
- Provide and manage classes, workshops, and events (all KOA events including events KOA collaborates with as appropriate)
- Communicate with you about bookings or services
- Send you newsletters or promotions (if you consent)
- Collect and process attendance and health-related info
- Analyse website usage and improve our services
- Maintain internal and legal records
- Meet regulatory obligations (e.g. tax reporting)
- Corinne Wilkie-Fessler engages in clinical supervision as part of her professional development. Any cases discussed within supervision will be anonymised and confidential.
7. Sharing Your Data
We will never sell your data.
We may share it with:
- Service providers – hosting, email, analytics, booking systems
- Payment processors – like PayPal etc
- Professional advisors – such as accountants or legal representatives
- Authorities – if required by law (e.g. HMRC, ICO)
- Partner studios – when relevant for a class/event you attend (only necessary info)
All third parties are required to keep your data secure and only process it under our instruction.
8. International Transfers
Some of our service providers (like email and cloud platforms) may store data outside the UK.
9. Data Retention
We keep your data only as long as needed:
- Service/client data: Up to 8 years after your last session
- Health or disclaimer forms: Also retained for 8 years
- Emails and messages: As long as needed to manage communication
- Newsletter/marketing data: Until you unsubscribe
- Analytics/cookies data: Retained as anonymised data where possible
When data is no longer needed, we delete or securely anonymise it.
You can choose to have your client files deleted at any time.
10. Cookies and Tracking Technologies
Our website uses cookies and similar technologies to:
- Ensure the site works properly
- Improve performance and functionality
- Collect analytics about usage
- Enable embedded services (e.g. Instagram, video)
What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They help us improve your experience and understand how visitors use our website.
Types of Cookies We Use:
| Type | Purpose |
| Strictly Necessary | Required for core site functions (e.g. page navigation) |
| Performance/Analytics | To collect anonymous data on how the site is used |
| Functionality | To remember preferences or settings |
| Third-party / Embedded | Used by embedded tools (e.g. Google Maps, social media) |
Managing Cookies:
- When you first visit our website, you will be asked to accept or manage cookies.
- You can block or delete cookies via your browser settings at any time.
- Blocking some cookies may affect how the site functions.
For detailed guidance on cookies, visit: https://www.allaboutcookies.org/
11. Your Rights Under UK GDPR (Scotland)
You have the following rights:
- Access – know what data we hold about you
- Rectification – correct any inaccurate or incomplete data
- Erasure – request deletion of your data
- Restriction – limit how we process your data
- Objection – object to processing based on legitimate interest
- Data Portability – receive your data in a reusable format
- Withdraw Consent – at any time where consent is the lawful basis
- Complain – to the Information Commissioner’s Office (ICO) or KOA direct
To exercise your rights, contact us via hello@koa-edinburgh.co.uk
If you’re unsatisfied, you can contact the ICO at https://ico.org.uk or call 0303 123 1113.
12. Data Security
We take appropriate technical and organisational steps to protect your personal data. These include:
- SSL encryption (HTTPS) on our website
- Secure third-party booking and payment providers
- Access controls for data stored digitally
- Regular backups and data minimisation
- Staff awareness of confidentiality practices (in particular when collaborating with other services)
No system is 100% secure, but we take all reasonable steps to protect your data.
13. Children
Our service only works with adults over the age of 18.
14. Social media
When you interact with us on social media, some information may be recorded by the platform. Please refer to their privacy policies. We use social media to raise advertise our services, share updates, information etc. Testimonials will only be shared with your consent.
15. Video/Online Consultations
Video/online consultations may be carried out using third party software such as Zoom. Zoom is based in the USA and is part of the EU-US Data Privacy Framework. Sessions will not be recorded without the clear consent of all parties.
16. External Links
Our website may contain links to third-party websites or services (e.g. booking systems, social media, other service providers). We are not responsible for their privacy practices. Please read their policies before sharing data.
17. Non consentual sharing of data
Legally, personal data can be processed (including shared) if there is a lawful basis.
One key lawful basis relevant here is “vital interests” or “legal obligation.”
Vital Interests:
KOA, Corinne Wilkie-Fessler will share personal data if it is necessary to protect someone’s life or prevent serious harm to that person or others. For example, sharing data to prevent a suicide attempt or serious assault.
Balancing Interests:
Even when sharing is justified, only the minimum necessary information should be disclosed to those who need it. A risk assessment will be undertaken prior to any action being taken.
18. Changes to This Policy
We may update this Privacy & Cookies Policy from time to time. When we do, we will update the “Last Updated” date at the top. You should check this page occasionally for changes.
19. Mailchimp, Eventbrite and Newsletter
When you sign up for an offering with Cori from KOA, you will be asked to agree to all terms and conditions, as well as the privacy policy on the KOA website.
If you are signing up for an Eventbrite-managed or advertised event, your name and email address will be added to the attendee list so you can receive reminders and information emails related to the event.
With regards to signing up to ALL offerings, your name and email address will also be added to Mailchimp, a secure KOA account, to receive pre or post-session information and the KOA monthly newsletter.
All offerings include a disclaimer, which all participants must sign. If you do not agree with any of the above, please inform Cori from KOA.
20. Contact Us
If you have any questions or want to exercise your data rights:
KOA
Business owner: Corinne Wilkie-Fessler
Website: www.koa-edinburgh.co.uk
Email: hello@koa-edinburgh.co.uk