Pure Defiance is operated by Brett Cooke, trading as Pure Defiance, and is the Data Controller responsible for the personal information described in this Privacy Policy.

As Data Controller, Pure Defiance determines how and why your personal information is processed.

We only collect personal information that is reasonably necessary for the purposes explained in this Privacy Policy.

Depending on your relationship with Pure Defiance, the information we collect may include:

• Identity and contact information: name, email address, telephone number, billing address, delivery address and date of birth where required.
• Account and transaction information: account details, order history, purchase history, booking information, invoices, refunds and payment confirmations.
• Coaching information: enquiries, goals, training history, progress information, check-ins and communications relating to coaching services.
• Health and screening information: PAR-Q responses, injuries, medical conditions, medication information, pregnancy information and other health details you choose or are required to provide before participating.
• Technical information: IP address, browser type, device information, operating system, approximate location derived from technical data and website security information.
• Website usage information: pages viewed, interactions, referral information and information collected through cookies or similar technologies.
• Marketing information: communication preferences, newsletter subscription status and responses to marketing communications.
• Customer-service information: enquiries, complaints, photographs supplied as evidence of damaged goods and other correspondence.

We collect most personal information directly from you when you interact with Pure Defiance.

We may also receive limited information from third parties involved in processing an order, payment, booking or website interaction.

• Placing an order through our website.
• Creating or managing a customer account.
• Contacting us by email, contact form, telephone or social media.
• Booking personal training, online coaching or Bootcamp.
• Completing health, lifestyle, coaching or PAR-Q questionnaires.
• Submitting check-ins, progress information or programme feedback.
• Subscribing to marketing communications.
• Entering a competition, promotion or trade application.
• Browsing our website while cookies or similar technologies are active.
• Using payment, booking or delivery services that provide us with confirmation or fulfilment information.

The lawful basis used depends on the purpose for which the information is processed.

Contract

We process information where it is necessary to take steps at your request before entering into a contract or to fulfil a contract with you. This includes processing orders, arranging delivery, managing bookings and providing coaching services.

Legal Obligation

We process information where necessary to comply with legal duties, including accounting, tax, consumer-protection, fraud-prevention, insurance and regulatory requirements.

Legitimate Interests

We may process information where it is necessary for our legitimate business interests and those interests are not overridden by your rights. This may include maintaining records, responding to enquiries, improving services, securing the website, preventing fraud and defending legal claims.

Consent

We rely on consent where required, including for certain marketing communications, optional cookies and some uses of health information. You may withdraw consent at any time, although withdrawal does not affect processing that was lawful before consent was withdrawn.

Information about your health is special category personal data under UK data-protection law.

We may need to process health information to assess whether coaching or exercise participation appears appropriate, adapt sessions, respond to disclosed risks and maintain appropriate safety and insurance records.

Where special category data is processed, Pure Defiance identifies both an Article 6 lawful basis and an applicable Article 9 condition. This will commonly include your explicit consent. In limited circumstances, another lawful condition may apply, such as establishing, exercising or defending legal claims or protecting vital interests where permitted by law.

Health information is only accessed by people who reasonably need it for the relevant purpose and is not used for unrelated marketing.

• Process, manage and fulfil orders.
• Arrange dispatch and delivery of products.
• Create and manage customer accounts.
• Provide personal training, online coaching and Bootcamp services.
• Complete health screening and adapt coaching where appropriate.
• Manage bookings, cancellations, attendance and customer communications.
• Respond to enquiries, complaints, returns and customer-support requests.
• Send order confirmations, booking messages and delivery updates.
• Issue invoices, receipts and approved refunds.
• Improve products, coaching services and website performance.
• Maintain website, payment and account security.
• Detect, investigate and prevent fraud, misuse or unauthorised activity.
• Maintain business, insurance, accounting and legal records.
• Comply with legal and regulatory obligations.

Payments made through the website are processed by payment providers that may include Stripe and PayPal.

Pure Defiance does not receive or store your complete debit or credit card number. We may receive limited information such as payment status, payment reference, card type, the last digits of a card and information needed to manage refunds or payment enquiries.

Payment providers process personal information under their own privacy notices and security arrangements. They may also carry out fraud-prevention, identity or risk checks where appropriate.

Marketing communications may include information about products, coaching services, Bootcamp, promotions and Pure Defiance news.

We may send electronic marketing where you have provided consent or where the customer soft opt-in under the Privacy and Electronic Communications Regulations applies.

Where we rely on the customer soft opt-in, your contact details must have been obtained during a sale or genuine negotiation for a sale, the marketing must relate to similar products or services, and you must have been given a clear opportunity to opt out when your details were collected and in every subsequent message.

You can unsubscribe at any time using the link included in a marketing email or by contacting Pure Defiance.

We may share limited personal information with carefully selected organisations that help us operate Pure Defiance or meet legal obligations.

• Payment providers, including Stripe and PayPal.
• Delivery companies, couriers, suppliers and fulfilment partners.
• Website hosting, maintenance and security providers.
• Email, communications and customer-support providers.
• Booking, scheduling and coaching platforms.
• Cloud-storage, document and business-administration providers.
• Analytics and cookie providers where permitted.
• Accountants, insurers, legal advisers and other professional advisers.
• Regulators, law-enforcement bodies, courts or public authorities where disclosure is legally required or justified.
• A purchaser, successor or adviser involved in a genuine sale, transfer or restructuring of the business, subject to appropriate confidentiality and data-protection safeguards.

Service providers acting on our instructions are expected to process information only for agreed purposes and protect it appropriately. Some organisations, including payment providers and couriers, may also act as independent Data Controllers for parts of their processing.

Where personal information is transferred outside the United Kingdom, we take reasonable steps to ensure that an appropriate legal transfer mechanism is in place.

Safeguards may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another lawful mechanism recognised under UK data-protection law.

Additional technical, contractual or organisational safeguards may also be used where appropriate.

Pure Defiance takes appropriate measures to protect personal information against accidental loss, misuse, unauthorised access, alteration, disclosure or destruction.

• Secure website hosting and account controls.
• SSL/TLS encrypted website connections.
• Secure payment processing through specialist providers.
• Restricted access to customer and coaching information.
• Passwords, access controls and authentication measures where appropriate.
• Software updates, monitoring and backups where appropriate.
• Supplier selection and contractual protections.
• Procedures for responding to security incidents and personal data breaches.

Retention periods depend on the type of information, why it was collected and any legal, accounting, insurance or dispute-resolution requirements.

Order, payment and accounting records are normally retained for the period required by applicable tax and business-record laws.

Coaching, booking and health-screening information is retained only for as long as reasonably needed to provide the service, manage safety, meet insurance or legal requirements and respond to possible claims.

Marketing information is retained until you unsubscribe, withdraw consent, object or the information is no longer needed, subject to keeping a limited suppression record so that your preference can be respected.

When information is no longer required, it is securely deleted, anonymised or placed beyond normal operational use where appropriate.

Depending on the circumstances and lawful basis involved, you may have the right to:

• Be informed about how your personal information is used.
• Request access to personal information held about you.
• Request correction of inaccurate or incomplete information.
• Request erasure of personal information where the legal conditions are met.
• Request restriction of processing in certain circumstances.
• Object to processing based on legitimate interests or to direct marketing.
• Request data portability where applicable.
• Withdraw consent where processing relies on consent.
• Ask for human intervention and challenge certain decisions made solely by automated means where applicable.
• Complain to the Information Commissioner's Office.

These rights are not absolute and exemptions may apply. We may need to verify your identity before responding.

We normally respond without undue delay and within one month, although the period may be extended where permitted for particularly complex or numerous requests.

Our website uses cookies and similar technologies to operate essential features, remember preferences, support checkout and account functions, improve security and understand website use.

Where consent is required, non-essential cookies are used only in accordance with your cookie choices.

Further information about the cookies used and how to manage your preferences is provided in our Cookies Policy.

Pure Defiance does not normally make decisions about customers solely by automated means where the decision produces legal effects or similarly significant effects.

Payment, account or security providers may use automated systems to assess fraud, identity or transaction risk. Their processing is governed by their own privacy information and may result in a payment being delayed, declined or subject to additional authentication.

Contact us if you believe an automated security or payment decision has affected an order and you would like us to review the available information.

The Pure Defiance online store is intended for customers aged 18 or over.

Coaching and Bootcamp services may be available from age 16, subject to the applicable service terms, health screening and any parental or guardian consent requirements.

We do not knowingly collect more information about children or young people than is reasonably necessary for the relevant service, safety requirement or legal obligation.

If a personal data breach occurs, we will investigate the incident and take reasonable steps to contain it, reduce harm and prevent recurrence.

Where a breach is likely to result in a risk to people's rights and freedoms, we will notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where a breach is likely to create a high risk to affected individuals, we will also inform those individuals without undue delay where required by law.

We may update this Privacy Policy to reflect changes in legislation, regulatory guidance, business practices, suppliers, products or services.

The latest version will be published on this page with the revised date displayed at the top.

Where a change materially affects how existing personal information is used, additional notice will be provided where reasonably required.

If you are unhappy with how Pure Defiance uses your personal information, please contact us first so that we can investigate and try to resolve the concern.

You also have the right to complain to the Information Commissioner's Office, the United Kingdom's independent data-protection regulator.

Contact Pure Defiance if you have a question about this Privacy Policy, want to exercise a data-protection right or are concerned about how your information has been handled.