Privacy Policy

1. Who we are

Zolsu is an online booking and form platform for organisers of yoga, wellness, workshops, classes, events and retreats. Our website is https://zolsu.com.

For privacy questions or data-protection requests, contact hello@zolsu.com.

2. When this policy applies

This policy applies when you:

• visit or use the Zolsu website;
• create or manage an organiser account;
• create or publish an event or booking page;
• book or join a waiting list for an event;
• submit information through a Zolsu Form;
• connect a Stripe account or make a payment;
• contact Zolsu for support or other enquiries;
• receive transactional or marketing communications from us.

This policy does not replace an organiser’s own privacy information. An organiser may have additional terms or privacy notices explaining how it uses participant information for its event.

3. Our role and the organiser’s role

Information Zolsu uses for its own purposes

Zolsu generally acts as a data controller for information used to operate accounts, provide the platform, manage subscriptions or fees, secure the service, communicate with users, comply with legal duties and improve the service.

Booking information and Zolsu Forms

The organiser generally acts as the data controller for participant booking information and form responses because the organiser decides what information is requested, why it is needed, who may access it and how long it should be retained.

Zolsu generally acts as a data processor when it hosts, stores and makes that information available to the organiser on the organiser’s instructions. Zolsu may separately act as a controller for limited purposes such as platform security, fraud prevention, legal compliance and handling requests concerning Zolsu’s own processing.

The legal role of each party depends on what each party actually does with personal information. Nothing in this policy changes responsibilities imposed by applicable data-protection law.

4. Information we collect

Information about organisers

We may collect:

• name and email address;
• business, trading or organisation name;
• profile image, logo, biography and public organiser information;
• Instagram handle, website, telephone number or other contact details;
• account login and authentication information;
• event information, including title, description, date, time, location, price, capacity and booking settings;
• Stripe connected-account status, payout status and payment-related identifiers;
• form questions, form settings and instructions created by the organiser;
• support messages, feedback and communications;
• technical, security and usage information linked to use of Zolsu.

Information about participants and customers

We may collect:

• first name and last name;
• email address;
• telephone number where requested or provided;
• event, session, ticket, price, booking and payment-plan details;
• booking status, payment status, refunds and related records;
• booking notes or messages provided to an organiser;
• waiting-list information;
• Stripe payment identifiers and transaction status;
• confirmation that required declarations or consent boxes were selected;
• the date and time of a booking, form submission or consent action;
• technical and security data associated with use of the service.

Information submitted through Zolsu Forms

Organisers may use Zolsu Forms to request information needed to administer or safely deliver an event. Depending on the organiser’s questions, this may include:

• health conditions, injuries, illnesses or medical history;
• medication information;
• pregnancy information;
• disability, accessibility or support requirements;
• allergies, dietary needs or food intolerances;
• mental-health or wellbeing information;
• fitness, mobility or participation information;
• emergency-contact details;
• other information relevant to event safety or participation.

Health, disability and some related information is special-category personal data and receives additional legal protection.

Organisers are responsible for ensuring their questions are necessary, proportionate, lawful, clear and relevant to the event. Organisers must not use Zolsu Forms to collect information they do not reasonably need.

Information about other people

If you provide information about another person, such as an emergency contact, you must have a lawful reason to provide it and should tell that person that their information has been supplied where appropriate.

Payment information

Card payments are handled by Stripe. Zolsu does not store full card numbers, card security codes or full payment-card credentials. We may receive and retain payment status, transaction references, Stripe customer or account identifiers, refund information and other records needed to operate the service.

Technical information

We may collect technical and security information such as:

• IP address;
• browser type, operating system and device information;
• pages viewed and actions performed;
• timestamps, logs, error reports and security events;
• cookie or session information necessary to operate and protect the service.

5. How we obtain information

We may obtain personal information:

• directly from you;
• from an organiser when it creates or manages an event;
• when a participant makes a booking or submits a form;
• from Stripe in connection with payments, connected accounts, refunds, disputes or fraud prevention;
• automatically through essential website, server and security technologies;
• from service providers that help us operate, secure and support Zolsu;
• from public sources where appropriate and lawful.

6. How we use personal information

We may use personal information to:

• create, maintain and authenticate organiser accounts;
• create and display organiser profiles, event pages and booking pages;
• process bookings, waiting-list entries and form submissions;
• record attendance-related and booking information;
• provide participant information and form responses to the relevant organiser;
• send booking confirmations, organiser notifications, form links, payment updates and service messages;
• connect organisers to Stripe and support payments and payouts;
• record payment, refund, dispute and booking status;
• provide organiser dashboards and booking-management tools;
• enable organisers to assess participant requirements and deliver events safely;
• record when a required declaration or consent box was selected;
• provide customer support and respond to enquiries;
• investigate errors, complaints, suspected fraud, misuse and security incidents;
• maintain, test, secure and improve the platform;
• enforce our terms and protect Zolsu, organisers, participants and third parties;
• meet legal, regulatory, accounting, tax and compliance requirements;
• establish, exercise or defend legal claims;
• send marketing communications where permitted by law.

7. Lawful bases

We rely on one or more lawful bases under UK data-protection law, depending on the information and purpose.

Contract

We may process information where necessary to enter into or perform a contract, including providing accounts, booking pages, booking services, payment-related features, organiser dashboards, forms and support.

Legitimate interests

We may process information where necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights. These interests may include:

• operating and improving Zolsu;
• protecting the platform and users from misuse, fraud and security threats;
• maintaining accurate service and transaction records;
• supporting organisers and participants;
• understanding and resolving technical problems;
• establishing, exercising or defending legal claims.

Legal obligation

We may process information where required to comply with legal, regulatory, tax, accounting, law-enforcement or court obligations.

Consent

We may rely on consent where required or appropriate, including for certain marketing activities or where a participant is asked to give explicit consent to the processing of special-category information. Consent may be withdrawn at any time, but withdrawal does not make earlier lawful processing unlawful.

Vital interests and other lawful grounds

In exceptional circumstances, information may be processed where necessary to protect someone’s life or physical safety, or under another lawful basis permitted by applicable law.

8. Health and other special-category information

An organiser collecting health or other special-category information must identify both:

• an appropriate lawful basis for processing personal data; and
• an additional condition permitting the processing of special-category data.

Depending on the circumstances, an organiser may rely on explicit consent or another condition available under data-protection law. The organiser is responsible for deciding and documenting the correct basis and condition.

Where consent is used, it must be freely given, specific, informed and unambiguous. Explicit consent must be given through a clear affirmative statement. A participant must be able to withdraw consent, although an organiser may be unable to provide an event or activity safely if essential information is not available.

Zolsu does not permit health or safety form information to be used for unrelated advertising, profiling or mailing-list activity merely because it was supplied through a booking or safety form.

9. Required declarations and checkboxes

Zolsu Forms may require a participant to select a checkbox before submitting a form. Zolsu may record the wording presented, whether it was selected, the relevant event or form, and the date and time of the action.

A checkbox record may provide evidence that a declaration or consent was given, but it does not remove an organiser’s legal duties, excuse negligence, guarantee participant safety or automatically make every question or use of information lawful.

10. Who receives personal information

We may disclose personal information to:

• the relevant organiser, so it can manage bookings, contact participants, view form responses and deliver its event;
• Stripe, for checkout, payment processing, connected-account onboarding, fraud prevention, refunds, disputes and payouts;
• Resend, for sending transactional and service emails;
• Supabase, for database, authentication or related infrastructure services used by Zolsu;
• Render, for application and website hosting;
• professional advisers, including lawyers, accountants, insurers and auditors where reasonably necessary;
• law-enforcement bodies, regulators, courts or public authorities where required by law or reasonably necessary to protect rights, safety or security;
• a buyer, investor, lender or successor organisation in connection with a proposed or completed business sale, financing, restructuring, merger or transfer, subject to appropriate confidentiality and data-protection safeguards.

Service providers may only use personal information for the services they provide to us or as otherwise permitted by law.

11. International transfers

Some service providers may process personal information outside the United Kingdom. Where personal information is transferred internationally, we use a lawful transfer mechanism where required, such as:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses;
• another permitted safeguard or legal exception.

You may contact hello@zolsu.com for further information about the safeguards used for relevant international transfers.

12. How long we retain information

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including providing the service, complying with law, resolving disputes, preventing fraud, enforcing agreements and maintaining appropriate records.

Retention depends on factors including:

• the type and sensitivity of the information;
• the purpose for which it was collected;
• the organiser’s instructions where Zolsu acts as a processor;
• whether an account, booking, dispute or legal claim remains active;
• tax, accounting, payment and legal record-keeping requirements;
• security and fraud-prevention needs;
• whether deletion is technically and legally possible.

Booking and payment records

Booking, payment, refund and dispute records may be retained for as long as needed for organiser records, support, accounting, tax, fraud prevention, chargebacks, disputes and legal compliance.

Form responses and health information

Form responses, particularly those containing health or other sensitive information, should not be retained longer than necessary. Where the organiser controls the information, the organiser is responsible for deciding and applying an appropriate retention period and deleting information it no longer needs.

Zolsu may retain form responses while needed to provide the service, comply with the organiser’s lawful instructions, protect the platform or users, resolve a dispute, or satisfy legal obligations. Zolsu may delete or restrict access to form responses where an account closes, an organiser requests deletion, a retention rule is applied, or the information is no longer required, subject to legal and technical limitations.

Backups

Deleted information may remain temporarily in secured backups until those backups are overwritten or expire. Backup copies are not used for ordinary business purposes and remain subject to appropriate safeguards.

13. Security

We use technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.

Measures may include:

• access controls and authentication;
• restricted access based on operational need;
• encrypted transmission where supported;
• secure hosting and database services;
• logging, monitoring and abuse prevention;
• software updates, testing and vulnerability management;
• confidentiality obligations for people with access;
• incident-response and recovery procedures.

No internet service can guarantee absolute security. Organisers must protect their login details, restrict access to participant information and promptly notify Zolsu of suspected unauthorised access.

14. Personal-data breaches

If we become aware of a personal-data breach, we will investigate and take appropriate steps. Where Zolsu acts as a processor, we will notify the relevant organiser without undue delay where required. Where Zolsu acts as a controller, we will notify the Information Commissioner’s Office and affected individuals where legally required.

15. Cookies and similar technologies

Zolsu may use cookies, local storage and similar technologies that are strictly necessary to provide, authenticate, secure and maintain the service.

If we introduce non-essential analytics, advertising or tracking technologies, we will provide any notice and consent controls required by law and update this policy or a separate cookie notice.

16. Transactional and marketing communications

Service communications

We may send emails needed to provide Zolsu, including login messages, booking confirmations, organiser notifications, payment updates, form links, security notices and support replies. These messages are not optional where they are necessary to provide or secure the service.

Marketing

We send electronic marketing only where permitted by law. Where consent is required, we will request it. Where the law permits marketing to existing customers without fresh consent, we will provide a clear opportunity to opt out.

You can unsubscribe from marketing at any time. Unsubscribing from marketing does not stop necessary service messages.

17. No sale of personal information

Zolsu does not sell personal information to advertisers. We do not permit advertisers to access private booking details or health and safety form responses.

18. Automated decision-making

Zolsu does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects on individuals.

We may use automated tools to support fraud prevention, security, spam detection or service reliability. Where applicable law provides rights concerning automated decision-making, we will respect those rights.

19. Children

Zolsu is not intended for children to create organiser accounts independently. Organisers are responsible for setting appropriate age restrictions for their events and for obtaining parental or guardian involvement where required.

Organisers must take particular care before requesting health, safeguarding or other sensitive information about a child. They must ensure that collection is necessary, lawful, age-appropriate and supported by any required parental or guardian authority.

20. Your data-protection rights

Depending on the circumstances and lawful basis, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of your information;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent;
• raise a concern with a data-protection authority;
• request human intervention where qualifying solely automated decision-making is used.

These rights are not absolute and may depend on the circumstances, lawful basis and applicable legal exemptions.

21. How to make a request

To exercise a right concerning Zolsu’s processing, email hello@zolsu.com. We may ask for information needed to confirm your identity and locate the relevant records.

For information controlled by an organiser, including the organiser’s use of a form response, you should normally contact that organiser first. If you contact Zolsu, we may forward the request to the organiser or assist the organiser where legally required.

22. Complaints

Please contact us first at hello@zolsu.com so we can try to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

23. Organiser responsibilities

Organisers using Zolsu must:

• provide accurate and appropriate privacy information to participants;
• collect only information that is necessary for a clear and lawful purpose;
• identify and document an appropriate lawful basis;
• identify and document an appropriate special-category condition where sensitive information is collected;
• avoid collecting excessive, irrelevant or intrusive information;
• use participant information only for disclosed and lawful purposes;
• restrict access to authorised people;
• keep information accurate where necessary;
• delete or anonymise information when it is no longer needed;
• respond appropriately to participants exercising data-protection rights;
• notify Zolsu promptly of suspected data loss, misuse or unauthorised access;
• not use health or safety information for unrelated marketing, profiling or mailing lists;
• comply with applicable data-protection, consumer, health and safety, equality and safeguarding laws.

24. Changes to this policy

We may update this policy to reflect changes to Zolsu, our service providers, legal requirements or how personal information is used. The latest version will be posted on this page with a revised “Last updated” date.

Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected users where required.

25. Contact

Privacy enquiries and data-rights requests:
hello@zolsu.com

Website:
https://zolsu.com