YOUR DATA, PROTECTED

Privacy Policy

This page explains what personal information we collect when you book a class, visit the studio, or get in touch, and how we keep it safe, in line with GDPR.

Last updated: August 7th, 2026

1. Who We Are

Laura Ceppelli Pilates ("we," "us," "our") is a reformer Pilates studio located at Via Laietana 54, 2º-205, Barcelona, 08003, Spain. We are the data controller responsible for your personal data collected through our website, booking system, and communications channels (email and WhatsApp).

Contact:

[If you have a separate legal entity name/NIF for the studio, add it here — it's typically required for a compliant Spanish privacy policy: "[Legal Name], with NIF [XXXXXXXXX]".]

2. What Personal Data We Collect

Depending on how you interact with us, we may collect:

  • Identification data: full name, email address, phone number/WhatsApp contact

  • Booking and account data: class reservations, attendance history, package or membership details

  • Health-related data (special category data): information you voluntarily share about injuries, physical conditions, or limitations relevant to your Pilates practice, when provided during intake forms, consultations, or class communication

  • Payment data: processed by our third-party payment provider (see Section 5) — we do not store full card details ourselves

  • Communications: messages sent via email, WhatsApp, contact forms, or in person

  • Technical data: IP address, browser type, and usage data collected via cookies when you visit our website (see Section 8)

3. Why We Process Your Data (Purposes & Legal Basis)

  • Managing class bookings and attendance — Performance of a contract (Art. 6.1.b)

  • Processing payments — Performance of a contract (Art. 6.1.b)

  • Responding to inquiries via email/WhatsApp — Legitimate interest / pre-contractual steps (Art. 6.1.b, f)

  • Adapting classes to your physical condition or injuries — Explicit consent (Art. 9.2.a) — required for health data

  • Sending newsletters or promotions — Consent (Art. 6.1.a) — only if you opt in

  • Complying with tax/accounting obligations — Legal obligation (Art. 6.1.c)

  • Improving our website and services — Legitimate interest (Art. 6.1.f)

Where we rely on your health information to tailor a class or session safely, we ask for your explicit consent separately (e.g., via an intake form) — this policy alone does not cover that consent.

4. Who We Share Your Data With

We do not sell your personal data. We may share it with:

  • Booking/scheduling software provider — Mindbody, to manage class reservations, attendance, and package/membership details

  • Payment processor — Stripe, to process transactions

  • Email/communication tools — LenzVu for marketing emails and communications

  • WhatsApp Business (Meta) — when you contact us via WhatsApp, subject to Meta's own privacy terms

  • Web hosting/analytics providers — Squarespace, Google Analytics and Meta.

  • Tax advisors, accountants, or authorities where legally required

Some of these providers, including Mindbody, are based in the United States and may process data outside the European Economic Area (EEA). Where this happens, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or an equivalent transfer mechanism recognized under GDPR).

5. How Long We Keep Your Data

  • Client/booking records: for the duration of your relationship with the studio, plus [insert period, commonly 5–6 years] to comply with Spanish tax and accounting obligations

  • Health-related notes: only as long as necessary for your safe participation in classes, and deleted when no longer relevant or upon your request

  • Marketing consent: until you unsubscribe or withdraw consent

  • Website/cookie data: as set out in our cookie policy (Section 8)

6. Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you

  • Rectify inaccurate or incomplete data

  • Erase your data ("right to be forgotten"), subject to legal retention requirements

  • Restrict or object to certain processing

  • Data portability for data you provided to us

  • Withdraw consent at any time, without affecting prior lawful processing

To exercise any of these rights, contact us at info@lauraceppelli.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse. Access to health-related and personal data is limited to staff who need it to deliver our services.

8. Cookies

Our website may use cookies and similar technologies to improve your browsing experience, remember preferences, and analyze site traffic. You can manage or disable cookies through your browser settings.

9. Children

Our services are not directed at children. We do not knowingly collect personal data from individuals under 16 without parental consent.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates the most recent revision.

11. Contact Us

If you have questions about this Privacy Policy or how we handle your data: