Privacy Policy

Last updated: 4 September 2026

Section 1 — Who we are CR Spaces Ltd (“CR Spaces”, “we”, “us” or “our”) provides therapy-room hire, memberships and related services in Bethnal Green. We are the controller of the personal information described in this notice. Contact: carlo@crspacesltd.com Telephone: 07828 488 351 Registered office: 56 Rope Street, London, SE16 7TF This notice explains how we use personal information when you visit www.crspacesltd.com, enquire, apply to join, join our mailing list, create a member account, buy a membership or plan, book or hire a room, use a site group, or otherwise deal with us.

Section 2 — Information we collect Depending on how you use our services, we may collect: • your name, practice or business name, address, email and telephone number; • account, login, profile, membership, approval, preference, contact-label and category information used to manage members, current practitioners, enquiries and marketing contacts; • booking and contract details, including the Blue or Orange room, date, time, booking status and reference, hire history, access arrangements, agreements, deposits and cancellations; • professional information reasonably required from practitioners, such as professional memberships, profile links, qualifications or evidence of insurance; • payment, refund, invoice, direct-debit and other transaction records. Payment providers process card or bank details; we do not normally receive or retain full payment-card details; • enquiries, form submissions, viewing requests, emails, feedback and support messages; • marketing preferences and email-engagement information; • professional contact details obtained from public professional websites or directories where we carry out permitted business outreach; • posts or comments you choose to publish in member or community areas; and • technical and usage data, such as IP address, device and browser information, pages viewed, referring source, approximate location and cookie identifiers. Please do not enter or send client names, contact details, therapy notes, presenting issues, diagnoses, risk information or other clinical information through the CR Spaces website, Wix booking system or CR Spaces Blue and Orange calendars. A room booking should identify only the practitioner, room, date and time. Practitioners remain responsible for their own client records, confidentiality and privacy obligations. We do not need or intend to collect clients’ clinical information to provide room hire.

Section 3 — How and why we use information We use personal information to respond to enquiries and viewings; assess and approve practitioners; administer accounts, memberships, plans and bookings; manage and release room availability; compare the Blue and Orange room calendars with Wix availability; prevent double booking; process payments, paid invoices, deposits, refunds and cancellations; verify practitioner requirements; provide support and service messages; organise contacts using relevant labels; operate member features; maintain security; keep financial and legal records; improve our services; and send marketing where permitted. We do not use solely automated decision-making that produces legal or similarly significant effects. Our lawful bases under UK data-protection law are: • contract — to take steps at your request or perform our agreement; • legitimate interests — to run and improve our business, respond to enquiries, manage availability, maintain security, prevent misuse, keep appropriate records and conduct proportionate business outreach where permitted, provided those interests are not overridden by your rights; • legal obligation — where processing is required by law; and • consent — particularly for optional mailing-list marketing and non-essential cookies. You may withdraw consent at any time. Where information is needed for a contract, you may be unable to book or use the relevant service if you do not provide it.

Section 4 — Marketing If you join our mailing list, we may send CR Spaces news, availability and offers. Where legally permitted, we may also contact selected business or professional contacts using details published on professional websites or directories. We apply the UK GDPR and Privacy and Electronic Communications Regulations as relevant, identify CR Spaces in each message and provide a clear way to opt out. You can unsubscribe using the link in an email or by contacting us. You have an absolute right to object to direct marketing at any time. We may retain a minimal suppression record so that we continue to respect your choice. Unsubscribing does not stop necessary messages about an account, booking, payment or contract.

Section 5 — Cookies and website analytics Our Wix-hosted website uses cookies and similar technologies. Strictly necessary cookies support security, sign-in, bookings, payments and privacy choices. With your consent, optional cookies may be used for analytics, functionality or marketing. Use the website’s cookie banner or cookie settings to accept, reject or change choices for optional cookies. Browser controls can also block cookies, although this may affect site functions.

Section 6 — Who we share information with Where reasonably necessary, we may share information with: • Wix, which provides hosting, forms, member accounts, groups, bookings, pricing plans, invoicing, payments and email marketing; • Google Workspace and Google Calendar, used to manage the Blue and Orange room calendars and keep booking availability aligned. Calendar entries should contain only the practitioner’s identity, room, date, time and booking status or reference, not client information; • payment, banking, direct-debit and accounting providers; • email, IT, security and professional service providers acting for us; • accountants, insurers, legal advisers, building management or contractors; and • regulators, law-enforcement bodies, courts or other parties where required by law, needed to protect legal rights, or connected with a business reorganisation. Some providers are independent controllers for their own purposes and publish their own notices. We do not sell personal information.

Section 7 — International transfers Some providers may process information outside the UK. Where this happens, we require an appropriate legal safeguard, such as UK adequacy regulations, approved contractual protections or another lawful transfer mechanism.

Section 8 — How long we keep information We keep information only as long as reasonably necessary. Generally: • routine enquiries: up to two years after last contact; • booking, contract, invoice, payment and tax records: normally six years after the relevant relationship or accounting period; • account and membership information: while active and afterwards for up to six years where reasonably needed for contractual, accounting or dispute purposes, otherwise deleted sooner; • professional-verification records: while relevant to the hire relationship and for any necessary legal period; • marketing and publicly sourced professional contact records: until you unsubscribe, object or the information is no longer relevant, with a limited suppression record retained to respect opt-outs; and • public member or group content: until removed, the feature closes or the account is deleted, subject to legal and operational needs. We may keep information longer where a complaint, claim, investigation or legal obligation requires it.

Section 9 — Security We use reasonable organisational and technical measures to protect personal information. No website or electronic transmission is completely secure, so please avoid sending sensitive information that is not required.

Section 10 — Your rights Depending on the circumstances, you may ask to access, correct or erase your information; restrict or object to processing; receive certain information in a portable format; withdraw consent; or object to direct marketing. Your right to object to direct marketing applies at any time. These rights are not absolute and legal exemptions may apply. Email carlo@crspacesltd.com to exercise a right. We may verify your identity and will normally respond within one month.

Section 11 — Complaints Please contact us first so we can try to resolve any concern. You may also complain to the Information Commissioner’s Office (ICO), the UK regulator, at www.ico.org.uk.

Section 12 — Children Our services are intended for adult practitioners and organisations, not children. We do not knowingly ask children to create accounts or buy services.

Section 13 — Other websites Our website may link to third-party websites or practitioner profiles. We are not responsible for their privacy practices.

Section 14 — Changes to this notice We may update this notice when our services, providers or legal obligations change. The latest version will be posted here with a revised date.