Legal

Privacy Policy.

Who we are

EvolveThrive Ltd (trading as Gurinder Sandhu Coaching) operates this website and is the data controller for any personal data collected through it. This policy explains what data we collect, why we collect it, and what your rights are.

Legal name: EvolveThrive Ltd
Companies House number: 9593149
Registered address: C/O Price & Accountants Ltd, WeWork, 1 Fore Street Avenue, London, EC2Y 9DT
Contact email: gurinder@gurindersandhu.coach
Website: gurindersandhu.com

What data we collect

Contact form submissions

When you use the contact form on this website, we collect:

Your name
Your email address
Your phone number, if you choose to provide it
Any other information you choose to include in your message

The form is processed by Web3Forms, which receives your submission and delivers it to us by email. It is protected from automated abuse by hCaptcha, a service operated by Intuition Machines, Inc., which presents an "I am human" check and processes your IP address and browser behaviour in order to distinguish people from automated bots. The form also carries a hidden field that only automated software fills in.

Booking and paying for a consultation

Appointments are booked through Acuity Scheduling, a service provided by Squarespace, which is embedded on this website. The details you enter when booking, which include your name, email address, phone number and anything you add in the notes, are submitted to Acuity and stored on their systems so that your appointment can be arranged and managed. The scheduler is only loaded when you ask for it (see Cookies below).

The initial consultation is paid for at the time of booking. The payment is taken by Square, which handles the card details directly; your card number is entered into Square's own payment fields rather than being collected by this website. Square processes that payment information in order to take the payment and to prevent fraud, under its own privacy notice. We receive confirmation of the payment and the booking it relates to, which we keep as part of our financial records (see How long we keep your data below).

Client questionnaires

Before working together, you will be asked to complete two questionnaires hosted by Wufoo, a service provided by SurveyMonkey and embedded on this website. Your answers are submitted to Wufoo and stored on their systems.

The Injury History Questionnaire collects your name, date of birth, email address, phone number and profession, and asks about your main pain or movement problem, any diagnosed medical conditions, injuries and trauma to your upper body, lower body and spine, any surgery you have had, what makes your symptoms better or worse, and how they affect your daily life.
The Physical Activity Readiness Questionnaire (PAR-Q) collects your name, date of birth, email address, phone number and home address, the name, relationship, phone number and email address of an emergency contact, any diagnosed medical conditions, any medication you take and its dosage, and answers about cardiac symptoms including whether a medical professional has cleared you to exercise.

Clients on a programme are also asked to complete a short weekly review form, also hosted by Wufoo. It collects your name, email address and the date, and asks you to reflect on how the week went and what you want to focus on next.

These forms are protected against automated abuse by Google reCAPTCHA Enterprise, which is built into Wufoo and processes your IP address and browser behaviour to distinguish people from automated bots. Like the other embeds, a questionnaire is only loaded when you ask for it.

Mailing list sign-ups

We do not currently operate a mailing list. When we launch one, we will update this policy before collecting any sign-up data and will ask for your explicit consent at that point.

Analytics data

When you browse this website and consent to analytics cookies, Google Analytics 4 (GA4) collects:

Pages visited and time spent on each page
Referring website or search term
Browser type, device type, and approximate location (country or city level)
Anonymised IP address (IP addresses are truncated before storage)

GA4 only fires after you have given consent through the cookie banner.

Health data

If you enquire about or book coaching services, we may ask you to share health or fitness information (for example, injuries, medical conditions, or fitness goals) so that we can tailor your programme safely. This is special-category data under UK GDPR and is handled under stricter rules. See the Special category data section below for details.

Why we collect it and our lawful basis

Under UK GDPR, we must have a lawful basis (a legal justification) for processing your personal data. The table below sets out each purpose and the basis we rely on.

Purpose	Lawful basis
Responding to your contact-form enquiry	Legitimate interests (responding to a request you initiated)
Providing coaching or personal training services you have booked	Performance of a contract
Keeping financial and contractual records	Legal obligation (UK statutory record-keeping requirements)
Running Google Analytics 4 to understand how the site is used	Legitimate interests, subject to your consent via the cookie banner
Processing health or fitness information to design a safe programme	Explicit consent (special-category data)
hCaptcha and reCAPTCHA spam and bot prevention	Legitimate interests (protecting the security of our systems)

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded that our interests do not override yours. You can object to processing based on legitimate interests at any time (see Your rights below).

Who we share your data with

We do not sell your personal data. We share it only with the service providers (data processors) listed below, and only to the extent necessary for each service to function.

Web3Forms: receives the contents of your contact-form submission in order to deliver it to us.
Intuition Machines, Inc. (hCaptcha): receives your IP address and browser signals from the contact form, in order to confirm you are not an automated bot.
Acuity Scheduling (Squarespace Inc.): receives the booking details you enter into the scheduler, in order to arrange and manage your appointment.
Square (Squareup Europe Ltd): receives and processes your card details when you pay for a consultation, in order to take the payment and prevent fraud.
Wufoo (SurveyMonkey Inc.): receives your questionnaire answers, including the health information described above, and stores them so that we can review them before and during your programme.
Google LLC (Google Analytics 4): receives anonymised analytics data about how visitors use this website, after you have given consent. Google also operates reCAPTCHA, which runs on the Wufoo questionnaires and processes IP address and browser signals to detect automated traffic.
Accountants and professional advisers: may see invoice or contract records where required for tax, audit, or legal purposes.

We do not currently use any social-media tracking pixels.

Cookies

We use cookies on this website. A cookie is a small text file stored on your device. The table below explains the categories we use.

Strictly necessary cookies

These cookies are required for the website to function and cannot be switched off. They do not track you for marketing purposes and do not require your consent.

cc_cookie, which remembers whether you have accepted or declined optional cookies so the banner does not reappear on every visit.
A record in your browser's local storage of whether you have chosen to load the booking scheduler or a questionnaire form, so you are not asked again each time.
Cookies set by hCaptcha on the contact page, and by Google reCAPTCHA inside the questionnaire forms, for security. These are what allow the checks to tell a person from an automated bot, so the forms cannot work without them.

The "I am human" check on the contact form loads as soon as you open that page, rather than waiting for you to ask for it, because the form cannot accept a message without it.

Analytics cookies

These cookies are set by Google Analytics 4 and are only activated after you give consent through the cookie banner. They help us understand how visitors find and use the site so we can improve it. No personally identifiable information is stored in these cookies. They are named _ga and _ga_<id>.

Cookies set by embedded services

The booking scheduler and the questionnaire forms are provided by other companies, and each sets its own cookies when it loads. Neither is loaded automatically. Until you choose to load one, no request is made to that provider and none of their cookies are set.

Acuity Scheduling sets a session cookie (PHPSESSID) when the booking scheduler is loaded.
Wufoo sets a cookie (ep201) when a questionnaire is loaded, and Google reCAPTCHA, which runs inside those forms, sets its own cookies for security.
The contact page also embeds a Google Map showing the UNTIL Soho location, which is likewise only loaded if you ask for it. Google may set cookies when it loads.

Marketing cookies

We do not currently use any marketing or advertising cookies.

Managing your cookie choices

You can change or withdraw your consent at any time using the on this website. You can also delete cookies through your browser settings; instructions vary by browser but are usually found under "Privacy" or "History" settings.

How long we keep your data

Data type	Retention period
Contact-form enquiries and related correspondence	24 months from the date of your enquiry
Health and fitness information collected for programme design	24 months from the end of our coaching relationship, or until you withdraw consent (whichever is sooner)
Invoice and contract records	6 years from the end of the relevant financial year (UK statutory minimum)
Analytics data (GA4)	14 months within GA4 (Google's default retention setting); we review aggregated reports for up to 24 months

After the relevant retention period, data is securely deleted or anonymised.

Your rights

Under UK GDPR, you have the following rights in relation to your personal data. You can exercise any of them by emailing gurinder@gurindersandhu.coach. We will respond within one calendar month.

Access: you can request a copy of the personal data we hold about you. This is called a data subject access request (DSAR).
Rectification: you can ask us to correct inaccurate or incomplete data.
Erasure: you can ask us to delete your data in certain circumstances (for example, if we no longer need it or if you withdraw consent).
Restriction: you can ask us to pause processing your data while a dispute is resolved.
Portability: where processing is based on your consent or a contract and is carried out by automated means, you can ask us to provide your data in a structured, machine-readable format.
Objection: you can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.
Withdrawal of consent: where we rely on your consent (for example, for analytics cookies or for processing health data), you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing that took place before you withdrew.
Complaint to the ICO: if you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

ICO contact details:

Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would always prefer the opportunity to address your concern directly before you contact the ICO, so please reach out to us first if you are comfortable doing so.

International transfers

Some of our service providers transfer personal data outside the UK.

Google LLC is based in the United States. Data processed by Google Analytics 4 and Google reCAPTCHA is transferred to the US under Standard Contractual Clauses (SCCs) approved by the relevant authorities, which provide contractual safeguards for your data.
SurveyMonkey (Wufoo) contracts with customers outside the United States through SurveyMonkey Europe UC, and relies on Standard Contractual Clauses together with the UK Addendum for transfers to the United States.
Squarespace (Acuity Scheduling) contracts through Squarespace Ireland Limited. Squarespace, Inc. is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and additionally relies on Standard Contractual Clauses with the UK International Data Transfer Addendum.
Intuition Machines, Inc. (hCaptcha) is based in the United States. It is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and relies on Standard Contractual Clauses within its data processing agreement.
Square contracts with UK businesses through Squareup Europe Ltd, and relies on the UK Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement, for transfers to the United States.

We do not knowingly transfer your data to any other country outside the UK or European Economic Area.

How to contact us about your data

For any questions about this policy, to make a data subject access request, or to exercise any of your rights, please contact:

EvolveThrive Ltd (trading as Gurinder Sandhu Coaching)
Email: gurinder@gurindersandhu.coach
Registered address: C/O Price & Accountants Ltd, WeWork, 1 Fore Street Avenue, London, EC2Y 9DT

This service is not directed at children

Our coaching services are intended for adults only. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has submitted data to us, please contact us and we will delete it promptly.

Special category data

Health and fitness information (for example, details of injuries, medical conditions, or physical limitations) is classified as special-category data under UK GDPR and receives a higher level of protection.

We collect this information only when it is necessary to design a safe and effective coaching programme for you. Before we collect any health data, we will ask for your explicit consent and explain clearly what we will use it for. You can withdraw that consent at any time by emailing gurinder@gurindersandhu.coach.

We store health data securely, limit access to it strictly to Gurinder Sandhu, and delete it in line with the retention periods set out above.

Updates to this policy

We review this policy periodically and will update it when our practices change or when required by law. If we make material changes, we will post the updated policy on this page. We encourage you to check back occasionally.

Last updated: 30/08/2026