Privacy Policy & Terms

1. Introduction

Pro Studio Pilates (“we”, “us”, or “our”) is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR), the Dutch Implementation Act (UAVG), and any other applicable data protection legislation. This policy explains what data we collect, why, how long we keep it, and what rights you have.

2. Data We Collect

We collect the following categories of personal data:

• Identity data: full name, date of birth.
• Contact data: email address, phone number, postal address.
• Account data: hashed password (bcrypt), account creation date, membership role.
• Financial data: credit balance, payment transaction records, Mollie payment IDs. We do not store full card numbers, bank account details, or CVV codes.
• Usage data: class bookings, waitlist entries, cancellation history, messages exchanged with the studio.
• Technical data: encrypted session tokens (JWT). We do not use analytics cookies, tracking pixels, or advertising identifiers.
• Device data (mobile app only): push notification device token (Expo Push Token). We do not collect device model, OS version, or location data.

3. How We Use Your Data

We process your personal data for the following purposes:

• To create and manage your membership account.
• To process class bookings, cancellations, and credit transactions.
• To send booking confirmations, reminders, and payment receipts by email.
• To send push notifications about your bookings and studio announcements (only with your explicit permission).
• To respond to messages and enquiries you send us through the app or website.
• To comply with our legal and tax obligations under Dutch law.

Legal basis: Contract performance (Art. 6(1)(b) GDPR) for account and booking management; legitimate interest (Art. 6(1)(f) GDPR) for service improvement; and your explicit consent (Art. 6(1)(a) GDPR) for push notifications.

4. Data Retention

• Account data is retained for as long as your account is active.
• After account deletion, we retain financial transaction records for 7 years to comply with Dutch tax law (Belastingdienst requirements under the Algemene wet inzake rijksbelastingen).
• Message history and personal information are deleted within 30 days of account deletion.
• Push notification tokens are deleted immediately upon account deletion or app uninstallation.

5. Data Sharing

We do not sell, rent, or trade your personal data. We share data only with the following processors:

• Mollie B.V. (Amsterdam, NL) — payment processing. GDPR-compliant, EU-based.
• Mijndomein (NL) — transactional email delivery only.
• Hetzner Online GmbH (Gunzenhausen, DE) — server hosting. ISO 27001 certified, EU-based.
• Expo / Apple APNs / Google FCM — push notification delivery. Only your device token and notification text are shared.

No personal data is transferred outside the European Economic Area (EEA). Push notification tokens may be processed by Apple (for iOS) and Google (for Android) under their respective GDPR commitments.

6. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — request deletion of your data. You can do this directly via the “Delete Account” option in the mobile app or by contacting us.
• Right to restrict processing (Art. 18) — request that we limit how we use your data.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.
• Right to withdraw consent — you may withdraw consent for push notifications at any time via your device settings.
• Right to lodge a complaint — with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

To exercise any of these rights, contact us at info@prostudiopilates.nl.

7. Security

We implement industry-standard security measures including: bcrypt password hashing, HTTPS/TLS encryption for all data in transit, encrypted JWT session tokens, and secure server infrastructure hosted on Hetzner Cloud (ISO 27001 certified) within the European Union. Access to production systems is restricted to authorised personnel only.

8. Cookies

Our website uses a single HttpOnly session cookie (ps_session) for authentication purposes only. We do not use advertising cookies, analytics cookies, or any third-party tracking technologies. No cookie consent banner is required as this cookie is strictly necessary for the service to function (Art. 5(3) ePrivacy Directive / Dutch Telecommunications Act Art. 11.7a).

9. Children's Privacy

Our service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16 years of age. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

10. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated to you by email or through an in-app notification at least 30 days before they take effect. The “Last updated” date at the top of this page indicates when the policy was last revised.

1. Acceptance of Terms

By creating an account and using the Pro Studio Pilates website and mobile application (collectively, the “Service”), you agree to be bound by these Terms. If you do not agree, please do not use the Service.

2. Eligibility

You must be at least 16 years old to create an account. By registering, you confirm that you meet this age requirement and that the information you provide is accurate and complete.

3. Account Registration

You are responsible for maintaining the confidentiality of your login credentials and for all activity that occurs under your account. You agree to notify us immediately of any unauthorised use. We reserve the right to suspend or terminate accounts that violate these Terms.

4. Credits and Payments

• Credits are purchased through secure payments processed by Mollie B.V.
• Credits are non-refundable except where required by applicable Dutch consumer protection law (including the right of withdrawal under BW Article 6:230o, where applicable).
• Credits have an expiry date clearly displayed in the app. Expired credits are automatically forfeited.
• Subscription payments, where offered, are charged on a recurring monthly basis until cancelled by the user.
• Prices are displayed in euros (€) and include VAT where applicable.

5. Class Bookings and Cancellations

• Bookings are confirmed immediately upon credit deduction.
• Cancellation requests must be submitted through the app in accordance with the studio's current cancellation policy. Credits may not be refunded for late cancellations.
• The studio reserves the right to cancel or reschedule a class at any time. In such cases, credits will be fully refunded to the customer's account.
• Class availability is subject to capacity limits and shown in real time.

6. Account Deletion

• You may delete your account at any time via the mobile app (Profile → Delete Account) or by contacting us.
• Upon deletion, all personal data is removed except where retention is legally required (see Privacy Policy §4).
• Unused credits are forfeited upon account deletion and are non-refundable.

7. Prohibited Conduct

You agree not to:

• Provide false or misleading registration information.
• Attempt to access another user's account or personal data.
• Reverse-engineer, decompile, or tamper with the application.
• Use the Service for any unlawful purpose or in a way that could harm others.
• Automate interactions with the Service (bots, scrapers, etc.) without prior written consent.

8. Intellectual Property

All content, trademarks, logos, and design elements in the Service are owned by or licensed to Pro Studio Pilates. You may not copy, reproduce, distribute, or create derivative works without our prior written permission.

9. Limitation of Liability

To the fullest extent permitted by Dutch law, Pro Studio Pilates shall not be liable for any indirect, incidental, special, or consequential damages arising from your use of the Service. Our total aggregate liability to you for any claims arising from or related to the Service is limited to the total amount you have paid to us in the three (3) months immediately preceding the event giving rise to the claim.

10. Governing Law

These Terms are governed by and construed in accordance with the laws of the Netherlands. Any disputes arising from these Terms or the Service shall be submitted exclusively to the competent court in Eindhoven, the Netherlands, unless mandatory consumer protection law provides for a different jurisdiction.

11. Changes to These Terms

We may update these Terms from time to time. Continued use of the Service after notification of changes constitutes acceptance of the revised Terms. Material changes will be communicated by email or in-app notification at least 30 days in advance.