Association of Reflexologists Privacy Policy
This notice was last reviewed: May 2026
Compliant with UK GDPR, DPA 2018, and Data (Use and Access) Act 2025
The UK GDPR (as retained and amended by the Data Protection Act 2018 and the Data (Use and Access) Act 2025) gives legal protection to your personal information. This notice tells you what personal information we hold about you, why we hold it, and what your rights are.
Organisation details
Registered Office: Association of Reflexologists, Victoria House, Victoria Street, Taunton, Somerset, TA1 3FA
Telephone: 01823 351010
Email: info@aor.org.uk
What information do we collect?
We collect personal data when you apply to join the Association, place an order for products or services, complete surveys, or provide feedback. This includes:
- Name and contact details
- Address(es)
- Records of any contact with you, including compliments or complaints
- Purchase or account history
- Qualification and CPD information, including copies of certificates
Website usage information is also collected using cookies to improve your experience on our site.
How and why we use your information
We record and securely store your information to provide the best possible membership and related services support. Our lawful basis for processing is Legitimate Interests under UK GDPR.
Our legitimate interests are:
- To provide professional and trustworthy membership services
- To ensure the AoR maintains the highest standards for reflexology training and practice
- To promote reflexology to the public and within the healthcare sector
- To manage administration, prevent fraud, maintain records, and communicate with you about your membership
We do not sell your personal data. We do not pass it to third parties without your prior consent, unless required by law or directly necessary to fulfil a service.
Some emails are necessary to keep members up to date with rules and membership information. You can unsubscribe from marketing emails at any time using the link at the bottom of each email, or by contacting us at info@aor.org.uk.
Who do we share your information with?
We use a small number of carefully selected third-party service providers (‘data processors’) to help us deliver our services. These include providers for email communications, print and mailing of our membership magazine, order fulfilment and payment processing. All processors are contractually required to handle your data securely, use it only for the services they provide to us, and comply with UK GDPR.
- A current list of our data processors is available on request by emailing DataController@aor.org.uk.
- Where any processor is based outside the UK, we ensure appropriate safeguards are in place (such as UK adequacy regulations or Standard Contractual Clauses) before transferring your data.
Payments
All payments are handled by third-party payment gateways. The AoR does not store or hold credit card or PayPal details at any time. We do securely retain transaction receipts (which contain no card payment details) in case of dispute. We recommend reading the privacy policies of any payment provider you use.
How long we keep your information
We retain your information for as long as necessary to fulfil the purposes described in this notice, or as required by law. Specific retention periods include:
- Complaint records: retained for 10 years from the date of closure of the complaint (or, where there are linked complaints, 10 years from the closure of the last complaint).
- General membership records: retained for a reasonable period after membership ends to enable us to respond to re-application requests or queries about past membership.
Where law enforcement agencies notify us of an active investigation or potential criminal prosecution, we will comply with all relevant legal requirements regarding data retention.
Your data protection rights
Under UK GDPR you have the following rights:
| Right | What it means |
|---|---|
| Right to be informed | To know how your information is held and used (this notice). |
| Right of access | To request a copy of the personal data we hold about you. |
| Right to rectification | To ask us to correct inaccurate or incomplete information. |
| Right to erasure | To request deletion of your data where no lawful basis for retention exists (the ‘right to be forgotten’). |
| Right to restrict processing | To request limits on how we use your personal information. |
| Right to data portability | In certain circumstances, to receive your data in a portable electronic format. |
| Right to object | To object to us using your information for certain purposes. |
| Rights re: automated decisions | Not to be subject to solely automated decisions that significantly affect you without human review. |
How to make a Data Protection complaint
Step 1 — Raise It With Us First
If you believe we have not handled your personal data in accordance with UK GDPR or the Data (Use and Access) Act 2025, please raise your concern with us first. We are obliged to receive, consider, and respond to your complaint.
Contact us by:
Email: DataController@aor.org.uk
Post: Chief Executive, Association of Reflexologists, Victoria House, Victoria Street, Taunton, TA1 3FA
We will acknowledge your complaint within 30 days and provide a written outcome in plain, accessible language without undue delay.
Step 2 — Escalate to the ICO
If you are dissatisfied with our response, you may escalate to the Information Commissioner’s Office (ICO), the UK’s independent data protection supervisory authority:
Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
You may contact the ICO at any time, but we encourage you to contact us first as many concerns can be resolved quickly and informally.
Changes to This Notice
We keep this privacy notice under regular review. Any updates will be published on our website. We reserve the right to modify this notice at any time.