Privacy Policy

Contact details you provide - parent/guardian name, email and phone - when you ask for a free trial lesson, join the weekday waiting list or get in touch.

Your child's first name and age when you ask for a free trial lesson, so we know which child is coming and can pitch their session at the right level. We ask for a first name only - not a surname, and never contact details for your child.

Your child's full name, on one form only: our photo & media consent form asks for it, because a consent record has to say which child it covers. The "Photo & media consent" section below explains exactly what we do with it.

Whether your child has coded before, and anything you choose to tell us in the "anything we should know" box - such as an additional need or an access requirement - so we can plan their session properly.

How you heard about us, if you tell us - it helps us understand which of our efforts reach families. Answering is optional.

Anything you choose to tell us in a message field.

If you apply for a job with us: your name and contact details, the role you're applying for, a link to your CV or portfolio if you give one, and what you tell us about yourself.

If you enquire on behalf of an organisation about a workshop - a school, community group or charity: your organisation's name and type, your name, your role if you give it, your email and phone, and the age range and rough size of the group. These are business contact details. That form asks nothing about any individual young person - no name, no age, no details.

If you accept analytics cookies, information about how you use the website - such as pages visited and how you found us - to help us improve it (see Cookies, analytics & advertising).

If you accept advertising cookies, the Meta pixel records that your browser visited our site and which pages, so Meta can measure whether our adverts work (see Cookies, analytics & advertising).

The basic technical information every website receives - such as your IP address, your browser and the page you asked for - which our hosting provider records in short-lived server logs so the site keeps running securely.

When you submit a form, our server also passes the IP address the submission came from to HubSpot along with what you typed, so the record of your enquiry shows roughly where it was sent from - a town or city, never a street address or who you are. We use this to keep our enquiry records accurate; it is not used for advertising.

When you ask for a free trial lesson, the exact consent statement you agreed to - its wording and version - is stored as part of your record. The "Who handles your data" section below explains HubSpot's role.

One form is treated differently: when you submit our photo & media consent form, our server also records the IP address the form came from and the browser information your device sent, and keeps them with the consent record itself rather than only in those short-lived logs. The "Photo & media consent" section below explains why and how long for.

To respond to your enquiry, arrange your child's free trial lesson, manage your booking for our weekend classes, and hold your place on the weekday waiting list.

To send confirmations or follow-up updates through HubSpot where those notifications are configured.

To email you news and booking updates for the classes you asked about. The tick box on our forms covers this and has to be ticked to send the form, so if you would rather only hear back about your specific enquiry, say so in the message field or email info@hikora.co.uk and we will mark your record.

The footer newsletter is the one form without a tick box: subscribing is itself the opt-in, stated in plain words beside the field, and you can unsubscribe at any time - every email will carry an unsubscribe link, or you can simply email info@hikora.co.uk.

Where you complete our photo & media consent form, to record whether we may use your child's image and how - see the next section.

To consider your application if you apply to work with us.

To improve our courses, website and services.

Our photo & media consent form is the one place on this site where we ask for your child's FULL name (our trial lesson form asks for a first name only). We collect your child's full name, your own name and email address, and - if you give them - your phone number and your child's age, along with which uses you are happy with: keeping images internally, using them on our website and in printed materials, and/or posting them on social media.

Our server then adds a few details of the submission itself, which you don't type: a reference number for the record, the date and time it arrived, the IP address it was sent from, and the browser information your device sent (its "user agent"). These are kept with the consent record, not only in our host's short-lived server logs, for one reason: UK GDPR requires us to be able to demonstrate that a consent was actually given, and those details are what let us show that this consent was submitted, when and from where. They are used for nothing else - not for analytics and not for marketing. (Separately, like every form on this site, the submission also carries its IP address to HubSpot so the record shows roughly where it was sent from - see "Information we collect" above.)

The record also keeps the exact wording you agreed to: the declaration you ticked, and each of the three uses with your answer to it - including the ones you did not tick. That wording is stored word for word, with a version reference, so if we ever change the form we can still show precisely what was on your screen when you decided.

We are also straight with you about what that evidence is worth: it shows that a submission arrived, not who typed it. So we treat it as supporting evidence rather than proof of identity, and if there is ever any doubt about a consent we will check with you directly instead of relying on the record alone.

We ask for the name for a single reason: a media-consent record has to identify the child it applies to, so we can check what a parent has agreed before a photo is taken, kept or published. A consent recorded against the wrong child, or against no child at all, would be no protection at all.

Our lawful basis for using your child's image is your consent, which you are free to withhold and free to withdraw. Our lawful basis for holding the consent record itself - including your child's name - is our legitimate interest in keeping an accurate, checkable record of what you decided, so that we can honour it and show what was agreed.

The record is stored in HubSpot, the system we use to manage enquiries, alongside our other enquiry records. Your child's name is not added to a marketing list, is not used to advertise anything to you or your child, and is never published next to their photo - our Safeguarding policy commits us to never publishing a child's full name with their image.

To change or withdraw consent, email info@hikora.co.uk. We will update the record and stop using the images from that point onwards.

We use a small number of trusted providers ("processors") that handle data on our instructions: HubSpot receives everything you submit through our forms - storing your contact details, the consent you agreed to on the trial lesson form, and the photo & media consent record described above, so we can reply, arrange trial lessons and send any updates you have opted into (including the IP address each submission was sent from - see "Information we collect" above); Vercel hosts our website, so its servers handle every page request and its runtime logs record the technical details of them; and - only if you accept analytics cookies - Google (Google Analytics) and Microsoft (Clarity) help us understand how the site is used so we can improve it.

One provider stands apart from that list: if you accept advertising cookies, Meta (Facebook and Instagram's parent company) receives the visit and signup signals described in "Cookies, analytics & advertising" below. Meta is not a processor acting only on our instructions - it uses that data for its own advertising purposes too, under its own privacy policy. That is why advertising cookies have their own consent, separate from analytics, and stay off unless you turn them on.

Some of these providers process data outside the UK; where they do, that transfer is covered by appropriate safeguards (such as the UK's International Data Transfer Agreement or equivalent).

We never sell your data, and we only share it where it's needed to provide our service or where the law requires it.

Our classes are for young people aged 7-18. Our parent-facing forms are intended for a parent or guardian, who provides consent and submits enquiries on their child's behalf; our workshop enquiry form is for organisations and asks nothing about any child. When you ask for a free trial lesson we collect your child's first name and age, and whether they have coded before - enough to know who is coming and where to start them, and no more. We do not ask for your child's surname, address, school, or any contact details for them.

Our photo & media consent form asks for your child's full name, because a consent record has to identify exactly which child it covers. That is the only place we ask for a full name, it is never used for marketing, and the "Photo & media consent" section above sets out the purpose and lawful basis in full. Beyond that we collect only the minimum we need, we keep it only as long as we need it - your child's first name is deleted from our enquiry records once they are enrolled, see "How long we keep it" - and we follow the principles of the ICO's Age Appropriate Design Code (the "Children's Code").

Nothing about your child goes to any analytics or advertising tool. Your child's first name, age and experience - which our trial lesson form asks for - are sent to our own systems and HubSpot only, never to Meta, Google or Microsoft.

Trial lesson and enquiry details: we keep these for as long as we need them to respond and keep you informed - and, if you don't go on to book with us, for no more than 24 months, after which we securely delete or anonymise them. If you become a customer, we keep booking records for as long as the law requires (for example for tax purposes). You can ask us to delete your details sooner at any time.

If you tell us about your child's health, a disability or an additional need - in the "anything we should know" box, or in conversation - that is special category data under UK data protection law, and we treat it accordingly. We use it for one purpose only: to plan your child's session and support them properly. Our condition for processing it is your explicit consent, given when you choose to tell us, and you can withdraw it or ask us to delete it at any time by emailing info@hikora.co.uk. We never use it for marketing, and we never share it outside Hikora except where a safeguarding duty requires it.

Your child's first name is the exception, and we keep it for the shortest time of anything here. We ask for it so we know which child is coming and can greet them properly. Once your child is enrolled and set up in the booking system we use to run our classes, their first name has done its job in our enquiry records, and we delete it from them - the enrolment record itself is separate, and is covered by the customer-records period above. If you don't go on to enrol, we delete their first name along with the rest of the enquiry, and you can ask us to remove it at any point before that.

Photo & media consent records: we keep these while we may still use the images they cover, so we can always show what you agreed to. That includes the submission details described above - the reference number, the time, the IP address and the browser information - which are part of the evidence of consent and so are kept for as long as the record is, not deleted on the host's log schedule. When you withdraw consent we stop using the images, and we delete the record, those details included, once we no longer need it to evidence what was previously agreed.

Job applications: we keep these while we are considering them and for a short period afterwards in case a similar role comes up. You can ask us to delete your application at any time.

Some things sit outside those periods, because they are not ours to hold or delete individually: our host's server logs, which are technical, short-lived and deleted automatically on the host's own schedule (we can't search them for one person or erase a single visit), and analytics data held by Google and Microsoft, which is kept under those tools' own retention settings and is not stored against your name. If you accepted advertising cookies, Meta also holds the advertising data described in "Cookies, analytics & advertising" under its own retention rules and privacy policy.

That limitation applies to the logs themselves, not to the details held in our own CRM. The IP address passed to HubSpot with each form submission (see "Information we collect") is part of that submission's record and follows its period - 24 months for trial lesson and enquiry details, as above. The IP address and browser information inside a photo & media consent record already follow the consent-record period above. The details in our own CRM we can find, so if you ask us to delete a record, they go with it.

Our cookie banner asks you about two kinds of optional cookies, and you decide about each one separately: you can say yes to both, no to both, or yes to one and no to the other. Neither is set until you say yes to it, and rejecting either or both never limits what you can do on the site - including asking for a free trial lesson.

Analytics cookies: with your consent, we use Google Analytics (GA4) and Microsoft Clarity to understand how visitors use the site - for example which pages are popular and how people found us - so we can improve it. If you accept, Microsoft Clarity also builds heatmaps and recordings of how pages are used - where visitors click and scroll. These two tools are not used for advertising and do not track you across other websites.

Advertising cookies: separately, and only with your consent, we use the Meta pixel - a small piece of code from Meta, the company behind Facebook and Instagram - so that when we advertise there, Meta can tell us whether those adverts actually led anyone to our site or to ask for a trial lesson. We will be plain about what this one is: it is an advertising tool, it sets a cookie that identifies your browser, and Meta can use it to recognise you on other websites and connect what it sees to your Meta account. That is exactly why it has its own consent, and why it stays off unless you switch it on.

Whatever you choose, what you type into our forms stays out of these tools. In particular, your child's first name and age - which our trial lesson form asks for - are never sent to Meta, Google or Microsoft. The most we ever tell Meta is that a visit or a trial lesson request happened; none of the details entered on the form are included. We have also switched off the pixel's "automatic" collection, which would otherwise let it gather extra details from the page for itself.

If you reject a category - or if you simply haven't answered the banner yet - the tools in that category are not loaded on the page at all. Not a limited or "consent" mode, not a cookieless ping: nothing is requested from them and nothing about your visit reaches them.

You can change your mind at any time using the "Cookie preferences" link in the footer, which clears your saved answer and brings the banner back. Aside from these optional cookies, the site uses only what it needs to work - and your cookie choice itself is remembered in your own browser's storage, not sent to anyone.

Under UK data protection law you have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict how we use it, to withdraw consent at any time, and to ask for a copy of your data in a portable format. Where the request concerns your child's information, you can make it on their behalf.

To make any of these requests - or to withdraw consent, including photo consent - just email info@hikora.co.uk. We'll respond within one month and won't charge you. If you're unhappy with how we've handled your data, you can also complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk - you do not need to come to us first, though we would like the chance to put it right.

Hikora is the data controller for the information described here. You can reach us at info@hikora.co.uk or 07455 098033, or write to us at Mowmacre Sports Ground, Thurcaston Road, Leicester, LE4 2RG.

Questions about this policy, or want to make a data request? Email us and we'll be happy to help.