Legal
Privacy Policy
Draft placeholder, written for an individual trader. To be reviewed by a lawyer and accountant before online payments go live.
Controller
The owner, trading as Re·Form Pilates Studio, Limassol, Cyprus. For any data request, message us on Instagram @re_form_es.
What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, phone | Account, bookings, reminders, contacting you about a class | Contract (art. 6(1)(b)) |
| Bookings, classes (credits), payments | Providing classes, payment records | Contract; legal obligation (art. 6(1)(c)) |
| Health note (optional) | Adapting exercises safely | Explicit consent (art. 9(2)(a)), withdrawable any time |
| Consent records | Proving consent | Legal obligation |
| Marketing preferences | News about schedules and events | Consent (art. 6(1)(a)), opt-in only |
| Security logs (hashed) | Preventing abuse of sign-in codes | Legitimate interest (art. 6(1)(f)) |
Who processes it for us
- Supabase (database & sign-in, EU region, Frankfurt)
- Vercel (hosting)
- Stripe (online payments, only once enabled; card data is handled only by Stripe)
- Resend (email delivery)
- Twilio (SMS, only if enabled)
Each is bound by a data processing agreement. Transfers outside the EEA rely on Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep it
- Account data: while your account is active, then deleted or anonymised after 24 months of inactivity.
- Health note: until you delete it or withdraw consent, and at most while your account is active.
- Payment records: 6 years (bookkeeping obligations; to be confirmed with an accountant).
- Message logs: 12 months.
Your rights
You can access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time. Most of this is self-service in your Account page (Download my data / Delete my account). You can also complain to the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).
Cookies
We only use essential cookies. See the Cookies policy.