Legal

Privacy Policy

Last updated: 9 September 2026

Introduction

Welcome to the Wenbrook Privacy Policy. Wenbrook is a product of Cinolla Software Limited, a company registered in England & Wales. Cinolla Software Limited respects your privacy and is committed to protecting your personal data. This policy explains how we look after personal data when you visit this website (https://wenbrook.uk), use the Wenbrook club management service, book through a club’s booking pages, or use the Wenbrook Admin or Wenbrook Family mobile apps. It also tells you about your privacy rights and how the law protects you.

Cinolla Software Limited (“we”, “us” or “our”) is the data controller with responsibility for your personal data. Our address is 26 Caledon Road, Lower Parkstone, Poole, Dorset, BH14 9NN.

We have appointed a Data Protection Officer (DPO). If you have any questions about this policy, including any requests to exercise your legal rights, please contact the DPO:

Data Protection Officer: Rob Brasington
Email address: dataofficer@cinolla.com
Telephone number: 01202 937620

Clubs and Wenbrook: who is responsible for what

Wenbrook is used by clubs to manage their classes, members and payments. For the account you hold with us — a club’s staff account, or a parent’s Wenbrook Family account — we act as data controller. For the information a club records about its own members and customers, the club is the data controller and we process that data on the club’s behalf and instructions. If you have a question about how a particular club uses your information, contact the club in the first instance; we will always help where we can.

The data we collect about you

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you depending on who you are and how you use Wenbrook, grouped as follows:

Identity Data: your name, and — for the children you register with a club — their name and date of birth.

Contact Data: address, email address and telephone numbers, including the emergency contacts and authorised pickup persons you choose to record for your children.

Health Data: medical and dietary notes about a child, where a parent or club chooses to record them so the club can run its classes safely. This is a special category of personal data. We process it only with your explicit consent, given when you (or your club, on your instruction) enter it, and only so the club can care for the child. You can update or remove these notes at any time, and withdrawing them does not affect your ability to use the service.

Financial Data: records of fees due and paid, and — for clubs receiving payouts — bank account details. Card payments are processed by Stripe; your full card details never touch our systems.

Content Data: information you or your club enter into the service, such as bookings, registers, attendance, notes, consent preferences, and images a club uploads (for example its logo or activity photos).

Technical Data: internet protocol (IP) address, login data, browser or device type and version, time zone setting, operating system, and aggregated statistical data about how the service is used.

Other than the Health Data described above, we do not collect special categories of personal data about you (such as details about race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, or genetic and biometric data), and we do not collect information about criminal convictions and offences.

Children

Wenbrook’s websites and apps are for adults — club staff and parents or guardians. We do not offer accounts to children. Information about children (their name, date of birth, and the details described above) is provided to us by their parent or guardian, or by the club they attend, so that the club can run its classes.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a service you have with us, but we will notify you if this is the case at the time.

How is your personal data collected?

Direct interactions. You give us Identity, Contact, Health and Content Data by filling in forms in the service or the apps, registering with a club, making a booking, or corresponding with us.

From your club. A club you belong to may record information about you and your children in Wenbrook so it can manage its classes.

Automated technologies. As you use the website, the service or the apps, we automatically collect Technical Data using cookies, server logs and similar technologies. The Wenbrook mobile apps contain no third-party analytics or advertising technology.

Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences, and protect the service (for example, our sign-up page uses Cloudflare Turnstile to distinguish people from bots; it assesses the request in real time and retains nothing about you). You can control cookies through your browser settings, though some features may not work correctly without them.

How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you — registering your account, providing the service, managing bookings, and processing payments, fees and charges.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests — administering, protecting and improving our business, the service and this website, including troubleshooting, security, support and hosting; keeping our records updated; and collecting and recovering money owed to us.
• Where we need to comply with a legal or regulatory obligation.
• With your explicit consent, for the Health Data described above.

Generally we do not otherwise rely on consent as a legal basis for processing your personal data, except in relation to sending direct marketing communications. You have the right to withdraw consent at any time by following the instructions in the message or by contacting us at dataofficer@cinolla.com. We do not sell your personal data.

Disclosures of your personal data

We share personal data with the parties set out below:

• Your club. The information you and your children’s records hold is visible to the club you registered with, so it can run its classes.
• External service providers acting as processors. Stripe processes card payments and payouts; Amazon Web Services hosts the service, manages sign-in and delivers our emails; Expo delivers push notifications to your phone, which means it receives your device's notification token and the wording of each notification — that can include a name or an amount, because that is what makes a notification useful; and Sentry receives diagnostic reports when something goes wrong in the software, which can incidentally include personal data that appeared in the error. Such third parties are subject to contractual terms which uphold the processing standards set out in current data protection law, and may only process your data for specified purposes and in accordance with our instructions.
• Our professional advisers, including solicitors, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services, subject to duties of professional confidentiality.
• Regulators and public authorities who require reporting of processing activities in certain circumstances.
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets, with any disclosure made in accordance with current data protection law.

International transfers

Wenbrook’s data is hosted in the United Kingdom (Amazon Web Services’ London region). Some of our service providers, such as Stripe, Expo and Sentry, may process data outside the UK or EEA; where they do, we ensure a similar degree of protection through safeguards recognised by UK data protection law, such as adequacy regulations or standard contractual clauses.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know, and they are subject to a duty of confidentiality. We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.

How long will you use my personal data for?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting or reporting requirements. We typically retain personal data for the periods set out below:

• Customer and supplier information where a contract is entered into — seven years from the date of termination of the contract.
• Customer and supplier information where a contract is not entered into — three years from the last communication between the parties concerning that matter.

You can delete your account yourself at any time: parents from within the Wenbrook Family app (Account → Delete account) or as described at wenbrook.uk/delete-account, and clubs from their settings. Deletion anonymises your personal data; clubs keep anonymised attendance and payment records they are required to hold. In some circumstances we may anonymise personal data so that it can no longer be associated with you, in which case we may use that information indefinitely without further notice to you.

Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data:

• Request access to your personal data (a “data subject access request”), to receive a copy of the personal data we hold about you.
• Request correction of the personal data that we hold about you, to have incomplete or inaccurate data corrected.
• Request erasure of your personal data where there is no good reason for us continuing to process it.
• Object to processing of your personal data where we are relying on a legitimate interest and something about your particular situation makes you want to object.
• Request restriction of processing of your personal data while a concern is resolved.
• Request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format.
• Withdraw consent at any time where we are relying on consent to process your personal data — including the Health Data described above.

Please email dataofficer@cinolla.com if you wish to exercise any of these rights. You will not have to pay a fee, though we may charge a reasonable fee or refuse the request if it is clearly unfounded, repetitive or excessive. We may need to request specific information from you to confirm your identity — a security measure to ensure personal data is not disclosed to a person who has no right to receive it.

Complaints

You have the right to make a complaint to the Information Commissioner’s Office (ICO, www.ico.org.uk) if you have concerns about our data processing activities. We would, however, appreciate the chance to address your concerns before you approach the ICO — please contact us in the first instance at dataofficer@cinolla.com or by post to Cinolla Software Limited, 26 Caledon Road, Lower Parkstone, Poole, Dorset, BH14 9NN.

Changes to this policy

We may update this policy from time to time; the date at the top shows when it last changed. It is important that the personal data we hold about you is accurate and current, so please keep us informed if your personal data changes during your relationship with us.