Last updated: 13 August 2026

1. Who we are

This Privacy Policy explains how [Baltic Sweat Limited], trading as Attis Bathing Club ("Attis", "we", "us" or "our"), collects, uses, stores and shares personal information when you visit www.attisbathingclub.uk, make a booking or purchase, use our facilities or services, create an account, contact us, attend an event, or otherwise interact with us (together, the “Services”).

For the purposes of UK data protection law, Attis is the controller of the personal information described in this Privacy Policy, except where another organisation is separately identified as a controller.

Registered address: [116 Duke street, Liverpool, L15JW]

Privacy contact email: [hello@attisbathingclub.uk]

Company number: [16394635]

2. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Services, our data practices, the technologies we use, or legal and regulatory requirements. When we make changes, we will post the revised policy on our website and update the “Last updated” date above.

3. Personal information we collect

The personal information we collect depends on how you interact with Attis. We only aim to collect information that is relevant to operating our Services, providing a safe customer experience and running our business.

Information you provide directly

• Contact details, such as your name, postal address, email address and telephone number.

• Booking and membership information, such as sessions booked, membership or package details, attendance information and account details.

• Payment and transaction information, such as billing details, payment confirmation and records of purchases. Full card details may be processed directly by our payment provider rather than stored by Attis.

• Account information, such as your login details and preferences where you create an online account.

• Customer service information, including information you provide when contacting us with a question, complaint, feedback or other request.

• Marketing preferences, including whether you have chosen to receive email, SMS or other marketing communications from us.

Health and safety information

Because Attis provides sauna, cold-water immersion and other wellness services, we may ask you to provide information relevant to your safe participation. Depending on our procedures, this may include health declarations, contraindications, pregnancy information, injuries, medical conditions, accessibility requirements or other information you choose to disclose.

Health information is treated as special category personal data under UK data protection law. Where we collect it, we will only do so where we have an appropriate lawful basis and an applicable condition for processing special category data, and we will limit access to people who need it for legitimate operational or safety purposes.

Please do not provide more medical or health information than is reasonably required for the purpose for which we request it.

CCTV and venue information

If CCTV is used at Attis premises, we may collect images of visitors, members, staff and others entering or using monitored areas. CCTV will be used only for stated purposes such as safety, security, crime prevention and the protection of people and property. Appropriate signage should be displayed where CCTV operates.

Photography and event content

From time to time, Attis may arrange photography or filming at the venue or at events. Where identifiable customers or guests may be photographed or filmed for promotional use, we will provide appropriate notice and, where required, obtain consent or provide a reasonable way to opt out.

Information collected automatically

When you use our website or digital Services, we may automatically collect certain usage information through cookies and similar technologies. This may include device information, browser information, IP address, network information, pages viewed, interactions with the website and other technical or usage data.

Information from third parties

We may receive personal information from service providers and other third parties that help us operate our Services. Depending on the systems Attis uses, these may include:

• website and e-commerce providers, including Shopify where applicable;

• booking, membership and customer-management platforms;

• payment processors;

• email, SMS and customer communications providers;

• analytics and advertising providers;

• IT, hosting, cloud-storage and security providers; and

• professional advisers and other service providers acting on our behalf.

4. How we use your personal information

• Providing the Services, including creating and managing accounts, memberships and bookings, processing payments, administering purchases and communicating with you about your transactions or visits.

• Customer safety and venue operations, including managing health and safety requirements, responding to incidents and supporting safe participation in our services.

• Customer support, including responding to enquiries, requests, feedback and complaints.

• Security and fraud prevention, including protecting our systems, premises, customers and business from fraudulent, unlawful or malicious activity.

• Business administration, including record keeping, accounting, legal compliance, dispute resolution and enforcing our terms and policies.

• Improving our Services, including understanding how customers use our website, facilities and services and improving the customer experience.

• Marketing and advertising, where permitted, including sending promotional communications and measuring or improving the effectiveness of our marketing.

5. Our lawful bases for processing

Under UK data protection law, we must have a lawful basis for processing personal information. The basis we rely on will depend on the purpose and circumstances. We may rely on:

• Contract: where processing is necessary to provide a booking, membership, product or other service you have requested.

• Legitimate interests: where processing is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and interests. Examples may include customer service, service improvement, fraud prevention and business administration.

• Legal obligation: where we need to process information to comply with a legal or regulatory requirement.

• Consent: where we ask for and receive your consent, for example for certain marketing, cookies or other processing where consent is required. You may withdraw consent at any time, although this does not affect processing already carried out lawfully.

Where we process special category data such as health information, we will also identify and rely on an additional condition permitted by applicable data protection law.

6. Marketing communications

We may send you marketing communications by email, SMS or other channels where we are permitted to do so. You can opt out at any time by using the unsubscribe link in an email, following the instructions in an SMS, adjusting available account preferences, or contacting us using the details in this policy.

We will not share mobile opt-in data or SMS consent information with third parties for their own marketing or promotional purposes. We may, however, use service providers to send communications on our behalf.

7. Cookies and similar technologies

We use cookies and similar technologies to operate and improve our website, remember preferences, understand how visitors use our Services and, where permitted, support analytics and advertising.

Some cookies are necessary for the website to function. Where UK law requires consent for non-essential cookies or similar technologies, we will request that consent through our cookie banner or consent-management tool before using them.

You can manage your cookie choices through the controls made available on our website and, in many cases, through your browser settings. Blocking some cookies may affect website functionality.

Where Shopify technology is used, information about Shopify cookies is available at https://www.shopify.com/legal/cookies.

8. How we share personal information

• service providers that support our website, bookings, memberships, payments, communications, analytics, IT, security, hosting, customer support or other business operations;

• professional advisers such as accountants, insurers, lawyers and consultants;

• business partners where this is necessary to provide a service you have requested or where you have otherwise been appropriately informed;

• our group companies or affiliates, where applicable; and

• law enforcement, regulators, courts or other parties where disclosure is required by law, necessary to establish or defend legal rights, protect people or property, investigate wrongdoing, or support a corporate transaction such as a sale, merger or restructuring.

We do not disclose personal information to third parties for purposes that are incompatible with those described in this policy unless we have another lawful basis for doing so.

9. International transfers

Some of our service providers may process personal information outside the United Kingdom. Where personal information is transferred internationally, we will take steps required by applicable data protection law to ensure that appropriate safeguards are in place.

10. Third-party websites and services

Our website or Services may contain links to websites, apps or online platforms operated by third parties. Those organisations have their own privacy practices and notices. Attis is not responsible for the privacy or security practices of third-party services that we do not control.

11. Children's data

Attis's Services are intended for customers who meet our applicable minimum age requirements of over 18 years old.

We do not knowingly collect children's personal information except where this is necessary, lawful and consistent with our actual service rules. If you believe a child has provided personal information to us in circumstances where they should not have done so, please contact us.

12. Security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. However, no system or method of transmission is completely secure, and we cannot guarantee absolute security.

13. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, maintain appropriate business and financial records, comply with legal obligations, resolve disputes and enforce our agreements.

Retention periods may vary according to the type of information and the reason we hold it. In setting retention periods, we consider legal and regulatory requirements, the nature and sensitivity of the information, risk, operational need and whether the purpose can be achieved in another way.

Before publication, Attis should confirm whether any specific retention periods should be stated for booking/account records, financial records, health or waiver information, CCTV footage and marketing records.

14. Your UK data protection rights

Subject to applicable law and any relevant exemptions, you may have the right to:

• request access to the personal information we hold about you;

• request correction of inaccurate or incomplete personal information;

• request deletion of your personal information in certain circumstances;

• request restriction of processing in certain circumstances;

• object to certain processing, including direct marketing and, in some circumstances, processing based on legitimate interests;

• receive certain personal information in a portable format and ask for it to be transferred to another organisation where the right to data portability applies; and

• withdraw consent at any time where we rely on consent.

You will not normally have to pay a fee to exercise your rights. We may need to verify your identity before responding to a request.

15. Complaints

If you have a concern about how we use your personal information, please contact us first so that we can try to resolve it.

You also have the right to complain to the UK Information Commissioner's Office (ICO). Information about how to contact the ICO is available at https://ico.org.uk.

16. Contact us

For questions about this Privacy Policy, our data practices or your privacy rights, please contact:

Company: [Baltic Sweat Limited] trading as Attis Bathing Club

Email: [hello@attisbathingclub.uk]

Address: [116 Duke Street, Liverpool, L15JW]

Company number: [16394635]