Privacy Policy

1. Who we are

Oca London Limited ("Oca", "we", "us") is the data controller for the personal data described in this policy. We are a wellness studio offering yoga, movement, breathwork, sound, cacao ceremonies, circles and events.

  • Company: Oca London Limited, registered in England and Wales, company number 16422189

  • Address: Decima Studios, 17–19 Decima Street, London SE1 4QR

  • Contact for privacy questions: gabi@ocalondon.com

This policy explains what personal data we collect when you visit our website, book or attend a class, become a member, join our mailing list or contact us, and how we look after it. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data we collect

We want you to know what information we collect, why we collect it and how we use it.

At Oca, we collect personal information so we can look after you well and give you a welcoming, personal experience, whether you're joining a class, a ceremony or a circle. It also lets us tell you about your bookings, changes to our schedule or services, anything important for your health and safety in the studio, and news, events and offers from Oca. We collect this information when you:

  • Visit our website or follow us on social media

  • Create an account, book a class, workshop or event, or buy a membership

  • Sign our waiver or fill in a health and intake form

  • Attend a class, ceremony, circle or event at the studio

  • Call, email or message us, or speak to us in person

  • Start a booking or purchase online, even if you don't finish it

  • Sign up to our newsletter

  • Leave feedback or take part in a survey or giveaway

The information we collect includes:

  • Identity and contact details: your name, email, phone number, date of birth and emergency contact.

  • Booking and membership details: the classes and events you book and attend, your membership type and your purchase history.

  • Payment details: billing details and transaction records. Card details are handled securely by our payment provider and are never stored by Oca.

  • Health and wellbeing information: any injuries, medical conditions, pregnancy or postpartum status you choose to share with us.

  • Communications: your messages, enquiries, feedback and complaints.

  • Phone calls: if you call us, our booking platform Momence may record your phone number, the date and length of the call, and any notes we add about your enquiry.

  • Unfinished checkouts: if you start booking or buying but don't finish, Momence saves the details you entered, such as your name, email and the class or membership you chose.

  • Marketing preferences: whether you're on our mailing list and any opt-outs.

  • Website and technical data: your IP address, browser and device type, the pages you visit, and cookies.

  • Photos and video: images taken at our classes and events, only with your consent (see section 5).

  • Social media: your username and messages when you interact with us on Instagram or other platforms.

Health information is a "special category" of data. We only collect it with your explicit consent, so our teachers can keep you safe in class. You can choose not to share it, but please tell your teacher about anything that could affect your practice.

If you give us an emergency contact, please check they're happy for you to share their name and phone number with us. We only use these details to contact them if something happens to you at the studio.

3. How we use your data

UK GDPR requires a lawful basis for each use of your data. These are ours.

  • Managing your account, bookings, memberships and payments: contract.

  • Sending booking confirmations, reminders, schedule changes and policy updates: contract.

  • Keeping you safe in class using the health information you share: your explicit consent.

  • Contacting your emergency contact if something happens at the studio: vital interests (protecting your health and safety).

  • Answering enquiries, refunds and complaints: contract and legitimate interests.

  • Sending our newsletter, offers and event news: legitimate interests, as an existing client. You can unsubscribe at any time.

  • Improving our classes, website and services: legitimate interests.

  • Preventing fraud and keeping our studio secure: legitimate interests.

  • Keeping accounting and tax records and meeting legal duties: legal obligation.

If you leave a checkout unfinished, we may send you one or two reminder emails or texts so you can complete your booking. We do this based on our legitimate interests, and you can opt out at any time using the link in the message or by contacting us. We use call records to respond to your enquiry and keep your account accurate (contract and legitimate interests).

We never sell your personal data, and we never let other businesses use it for their own marketing.

Our legitimate interests. Where we rely on legitimate interests, these are: running and improving our studio and classes, keeping in touch with our clients about classes and events similar to the ones they've booked, responding to calls and enquiries, and keeping our business and members safe from fraud. We balance these against your rights, and you can object at any time.

Do you have to give us your data? We need your name, contact details and payment details to take your booking or membership. Without them, we can't book you in. Health information and marketing preferences are your choice.

Automated decisions. We don't make decisions about you using automated decision-making or profiling.

4. Who we share your data with

We only share your data with trusted providers that help us run Oca, and only as much as they need.

  • Momence: our booking, membership and payments platform. It processes your account, bookings, payments, phone call records and unfinished checkouts for us, and sends booking and checkout reminders on our behalf.

  • Payment processors: card payments are handled securely by Momence's payment partner, Stripe. Oca never sees your full card details.

  • Teachers and facilitators: the teacher leading your class or event sees your name and any health information relevant to your practice.

  • Email and marketing tools: used to send our newsletter and news about classes and events. When you sign our waiver or attend any of our classes, you're automatically added to our mailing list. You can unsubscribe at any time.

  • Website hosting and analytics providers: to run and improve our website.

  • Professional advisers: such as our accountant, insurers or legal advisers, when needed.

  • Authorities: when the law requires it, for example HMRC or the police.

Some providers may store data outside the UK. When they do, we make sure appropriate safeguards are in place, such as UK-approved contract terms.

5. Cookies, photos and marketing

Cookies. Our website uses essential cookies so it works properly. With your permission, we also use analytics cookies to see how people use the site. You can accept or decline non-essential cookies in the cookie banner or in your browser settings.

Photos and video. We sometimes take photos or short videos at classes and events to share on our website and social media. We'll always tell you beforehand. If you'd rather not appear, just let us know and we'll keep you out of shot or remove the image.

Marketing. When you sign our waiver or attend any of our classes, we add you to our mailing list so you hear about our classes, events and offers. You can choose not to join when you sign up, and you can unsubscribe at any time. Every email has an unsubscribe link, or you can ask us to remove you at any time. We'll still send essential messages about your bookings and membership.

6. How long we keep it and how we protect it

We keep personal data only as long as we need it.

  • Account, booking and membership records: while your account is active, then up to 2 years after your last booking.

  • Health information: while your account is active. We delete it when you ask or when your account closes.

  • Financial and transaction records: 6 years, as required by UK tax law.

  • Newsletter subscription: until you unsubscribe.

  • Enquiries and complaints: up to 2 years after the matter is resolved.

We review the data we hold once a year and securely delete what we no longer need. We protect your data with password-protected systems, access limited to team members who need it, and secure, encrypted providers for bookings and payments.

7. Your rights and how to contact us

Under UK GDPR, you have the right to:

  • Ask for a copy of the personal data we hold about you

  • Ask us to correct anything that's wrong or incomplete

  • Ask us to delete your data

  • Ask us to limit how we use your data, or object to how we use it

  • Ask for your data in a format you can take to another provider

  • Withdraw your consent at any time, for example for marketing or health information

  • Object to us using your data for marketing at any time. We'll stop straight away.

To use any of these rights, email us at gabi@ocalondon.com. We'll reply within one month.

Children. Anyone under 18 needs a parent or guardian to book and agree to this policy on their behalf.

Complaints. If you're unhappy with how we've handled your data, please talk to us first by emailing gabi@ocalondon.com. We'll acknowledge your complaint within 30 days and keep you updated on what we're doing about it. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes to this policy. We may update this policy from time to time. The latest version will always be on our website, and we'll tell members about any important changes. This policy was last updated on 10 November 2026.