Privacy Policy

Last updated: August 2026

Muddy MTB is committed to protecting your privacy and handling your personal information responsibly.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and your rights under UK data protection law.

1. Who we are

Muddy MTB provides mountain biking coaching, activities and related services for children and young people.

For the purposes of UK data protection law, Muddy MTB Ltd is the data controller for the personal information described in this policy.

If you have any questions about this policy or how we use your personal information, you can contact us using the contact details provided on our website.

2. What information we collect

We may collect personal information about parents, guardians, children and other customers when you:

  • book or enquire about a Muddy MTB session;

  • complete a registration, consent or medical information form;

  • contact us by email, telephone, social media or through our website;

  • sign up to receive communications from us;

  • attend one of our sessions or events; or

  • interact with our website or online booking services.

This may include:

  • parent or guardian name and contact details;

  • a child's name, age and date of birth;

  • emergency contact information;

  • booking and attendance information;

  • relevant medical, allergy, accessibility or additional-needs information that you choose to provide to help us deliver activities safely;

  • cycling experience, ability or other information relevant to participation;

  • photographs or video where appropriate permission has been obtained;

  • records of communications with us; and

  • technical information about use of our website, such as device, browser and cookie information.

3. How we use your information

We use personal information where necessary to:

  • process and manage bookings;

  • communicate with parents and guardians about sessions;

  • ensure participants are placed in appropriate activities;

  • deliver our coaching and activities safely;

  • respond appropriately to medical needs, emergencies or safeguarding concerns;

  • maintain appropriate attendance and operational records;

  • process payments, refunds and credits;

  • respond to enquiries and customer-service requests;

  • improve our activities and services;

  • comply with our legal, insurance, safeguarding and regulatory obligations;

  • protect the safety and legitimate interests of participants, staff and Muddy MTB; and

  • send marketing communications where we have an appropriate lawful basis to do so.

4. Information about children

Because many of our activities are for children, we may need to collect information about children from their parent or guardian.

We only ask for information that is reasonably necessary to organise and safely deliver our activities.

Information relating to children is treated with particular care. Where medical, health, accessibility or additional-needs information is provided, we only use it where necessary and appropriate for the safe and effective delivery of our activities and in accordance with applicable data protection law.

Parents and guardians should only provide information that is relevant to their child's participation.

5. Our lawful bases for using personal information

Under UK GDPR, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on:

  • Contract – where processing is necessary to provide a service or booking you have requested.

  • Legal obligation – where we are required to keep or use information to comply with the law.

  • Legitimate interests – where processing is reasonably necessary to operate and improve Muddy MTB, provided those interests do not override your rights and interests.

  • Consent – where you have specifically agreed to a particular use of your information, such as certain marketing communications or the use of photographs.

  • Vital interests – in exceptional circumstances where information needs to be used to protect someone's life or safety.

Where we process special-category information, such as health or medical information, we will also ensure that an appropriate additional legal condition applies.

6. Bookings and payments

We may use third-party service providers to manage bookings and payments.

When you make a booking, some of your information may therefore be processed by our booking and payment providers. These organisations may process information in accordance with their own privacy policies as well as providing services to Muddy MTB.

Muddy MTB does not normally receive or store your complete payment-card details when payment is handled by an external payment provider.

7. Marketing communications

We may contact you with information about Muddy MTB sessions, activities, events or other relevant services where you have consented to receive these communications or where we are otherwise permitted to do so by law.

You can unsubscribe from marketing communications at any time by using the unsubscribe option in the communication or by contacting us.

We will still send essential service messages relating to bookings you have made, even if you have opted out of marketing.

8. Photographs and video

We may occasionally take photographs or video during Muddy MTB activities for purposes such as promoting our activities on our website, social media or other marketing materials.

Where required, we will obtain appropriate permission before using identifiable images of children for these purposes.

You can withdraw consent for future use by contacting us. Withdrawal of consent will not affect uses that were lawful before consent was withdrawn, and we may not always be able to remove material that has already been legitimately published or distributed.

9. Sharing your information

We do not sell your personal information.

We may share information where necessary with trusted organisations that help us operate Muddy MTB, such as:

  • booking and payment providers;

  • website and technology providers;

  • email and communications services;

  • professional advisers and insurers; and

  • authorities, emergency services or safeguarding organisations where disclosure is necessary or legally required.

We only share information where there is an appropriate reason to do so.

10. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, safeguarding, insurance, accounting and tax requirements.

Different types of information may therefore be retained for different periods.

When information is no longer required, we will delete it or securely anonymise it where appropriate.

11. Keeping your information secure

We take reasonable organisational and technical measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

Access to personal information is limited to people who reasonably need it to perform their role.

No internet-based system can be guaranteed to be completely secure, but we take appropriate steps to reduce the risks associated with handling personal information.

12. Cookies and our website

Our website may use cookies and similar technologies to enable website functionality, understand how visitors use the site and, where applicable, support analytics or marketing.

Where required by law, non-essential cookies will only be used after you have provided consent.

You can manage your cookie preferences through the cookie controls available on our website.

13. Your data protection rights

Depending on the circumstances, UK data protection law gives you rights including the right to:

  • ask for a copy of the personal information we hold about you;

  • ask us to correct inaccurate or incomplete information;

  • ask us to delete your personal information in certain circumstances;

  • ask us to restrict how your information is used;

  • object to certain uses of your information;

  • receive certain information in a portable format; and

  • withdraw consent where our processing is based on consent.

These rights are not absolute and may not apply in every circumstance.

To exercise any of these rights, please contact us.

14. Complaints

If you have concerns about how we use your personal information, please contact us first so that we can try to resolve the issue.

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example if our services, suppliers or legal obligations change.

The latest version will be published on our website and the date at the top of this policy will be updated accordingly.

16. Contact us

If you have questions about this Privacy Policy, would like to exercise your data protection rights, or have concerns about how your information is being used, please email: hello@muddymtb.com