Privacy policy

Last updated: 18 September 2026

Who we are and how to contact us

First Swim Limited (company number 10460939), 92 Queens Road, Twickenham, TW1 4ET, is responsible for the personal information described in this notice. We run swimming lessons and related services at our Twickenham and Chiswick centres. Our website is intended for parents, carers and adult customers.

Mat Terry handles privacy requests. Contact info@firstswimlondon.co.uk, marked “Privacy request”, or write to the address above. You do not need to have an online account to exercise your rights.

Information we use and why

• Bookings, purchases and customer service: your name, contact details, billing details, account information, orders, correspondence and attendance records. We use these to administer our contract with you, take payment, deliver lessons, handle changes, absences, catch-ups, refunds and enquiries.
• Children’s information: names, dates of birth, swimming level and lesson/attendance information supplied by parents or carers. We use the information needed to organise suitable lessons, manage attendance and keep children safe. Our legitimate interests are running an appropriate and safe swimming service; we give particular weight to children’s rights and wellbeing. Please only provide information you are authorised to share.
• Declared medical information: relevant health or additional-support information that you choose to tell us so we can assess and support safe participation. Health information receives additional protection. Where we rely on explicit consent, this must be obtained separately from agreement to our terms, and you can withdraw it. We may also retain relevant information where necessary to establish, exercise or defend legal claims. Please share only what is relevant to the service.
• Payment information: Stripe and Revolut process payments. We receive transaction details needed for orders, refunds, reconciliation and fraud prevention; we do not store full card numbers or card security codes on our website. Processing is necessary for the purchase contract, our legitimate interest in preventing fraud and applicable accounting obligations.
• Recruitment: contact details, the role sought, availability, qualifications, experience and the CV you submit. We use these to consider your application and take steps towards a possible employment contract at your request. Please do not include unnecessary sensitive information about yourself or others. CV files are stored outside the public website folder and website downloads are restricted to authorised administrators.
• Promotional photographs: we use identifiable photographs for promotion with appropriate, separate consent, including permission from a parent or guardian where required. Booking lessons is not conditional on agreeing to promotional photography. You can withdraw consent for future use by contacting us.
• Live CCTV: we use live surveillance for safety and security, based on our legitimate interests in protecting visitors and staff. We do not record CCTV footage.
• Security and technical information: IP addresses, browser/device information, access logs and security events help us operate the site, investigate problems and protect accounts. Our lawful basis is our legitimate interest in maintaining a reliable, secure service.
• Marketing and measurement: Google Ads and Google Analytics are our intended advertising and analytics services. Optional website tracking requires your cookie choice before activation. Any consent-based marketing can be stopped using the unsubscribe option or by contacting us. Essential booking and service messages are separate from marketing.

Our use of ChatGPT and Claude is limited to creating marketing content without supplying customer personal information, children’s information or identifiable photographs.

Possible future customer matching for advertising

We do not currently upload customer lists for advertising matching as part of this website. We may introduce a service that uses adult customer identifiers, such as an email address, to match customers with an advertising platform, exclude existing customers from acquisition advertising or improve how advertising reaches potential new customers. Before doing so, we will explain the provider, purpose and choices, establish the required lawful basis and obtain separate consent before uploading customer identifiers. Cookie choices alone do not authorise a customer-list upload.

Children’s names, dates of birth, lesson details, medical information and recruitment records will not be included in advertising audience lists. Hashing an adult email address before matching does not make it anonymous. You can object to direct marketing and related profiling at any time by contacting us.

Cookies and optional services

We use essential cookies for account, basket and security features. Optional visit measurement and Google Maps require your choice. Google Ads and Analytics tags are not yet enabled on the new website; their integration must use the consent controls before activation. Read our Cookie policy for the current services and durations, and use Cookie settings at the bottom of any page to change your choice. Agreeing to a privacy notice is not blanket consent to optional tracking or marketing.

Who may receive information

Access is limited to people who need it for their work, including relevant customer-service staff, teachers and administrators. We use service providers for website hosting, technical support, security, communications and payment processing. They receive only information needed for their service, subject to appropriate arrangements. Payment providers may also have their own legal obligations and act as independent controllers. See Stripe’s privacy policy and Revolut’s privacy notice.

When optional Google services are used, Google receives information described in its privacy policy. We may share relevant information with professional advisers, insurers, regulators, emergency services or public authorities where necessary and lawful, or as part of a properly controlled business transfer. We do not sell customer personal information.

International processing

Some service providers may process information outside the UK. Where this is a restricted international transfer, an applicable UK adequacy decision or appropriate safeguards, such as approved contractual arrangements and the required assessment, must be in place. Simply using our website does not amount to consent to an otherwise unlawful transfer. Contact us for information about the safeguards relevant to your information.

How long information is kept

Our retention schedule is:

• Customer, booking and child records: up to six years after the last booking or the end of our customer relationship.
• Declared medical information: only while needed for the relevant purpose, up to six years after the last relevant lesson or incident.
• Unsuccessful applications and CVs: one month after the application is closed or the unsuccessful decision is made.
• Promotional photographs: up to six years from the date taken, subject to the agreed use and any withdrawal of consent.
• CCTV: no recordings are retained.

These are maximum ordinary retention periods, not a reason to keep information that is no longer needed. Specific legal obligations, an unresolved dispute, safeguarding matter or legal claim may require relevant records to be kept longer. Information retained for such a reason is restricted to that purpose. Recruitment information for successful applicants becomes part of the employment record and is covered by staff privacy information. Consent withdrawals and marketing objections may require a minimal record so we can respect your choice.

Deletion or anonymisation must include relevant working copies and systems. Backups may retain information until replaced under the backup cycle; any restored data must remain subject to the same restrictions and deletion requirements. Contact us for the retention criteria applicable to a particular record.

Your rights

Depending on the circumstances, you can ask to access, correct or erase your information, restrict its use, object to processing based on legitimate interests, and receive or transfer information where the portability right applies. You can object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Some rights have exceptions, including where records must be kept to meet legal obligations or handle legal claims.

We may need proportionate information to confirm your identity and, for a request involving a child, your authority to act. We normally respond within one month; if a lawful extension is needed, we will explain it. Your account shows some information, but is not the only way to make an access request.

If you are unhappy with our response, you can complain to the Information Commissioner’s Office (ICO). We would welcome the opportunity to address your concern first.

Security and changes

We use access controls and other appropriate technical and organisational measures to protect information. No system can guarantee absolute security. If a personal data breach occurs, we assess the risk and notify the ICO where required, without undue delay and where feasible within 72 hours of awareness. We notify affected people without undue delay where required because the risk to them is high.

We update this notice when our services or practices change and show the revision date above. Significant changes will be brought to your attention where appropriate.