Privacy Policy

After your second attended class, we may send you at most one marketing email inviting you to review our studio on Google. We process your email address, language and attendance records on the basis of our legitimate interest under Art. 6(1)(f) GDPR in collecting feedback and helping people find the studio; electronic marketing also remains subject to applicable statutory requirements. You may object at any time free of charge using the single-use unsubscribe link in the email without signing in, or by contacting us. Unsubscribing stops all marketing emails, but not operational messages about bookings, payments, passes or questionnaires. We retain the unsubscribe and sent-request records to honour your choice and prevent repeat requests. Reviewing is voluntary and does not affect our services.

The controller of your personal data is:

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on Personal Data Protection, as amended.

For any question about the processing of personal data or to exercise your rights, contact us at info@noonstudio.sk or in writing at our registered office.

The operator has not appointed a Data Protection Officer (DPO), as it is not required to do so by law.

• Identification and contact data: first and last name, email, phone number, language of communication.
• Booking data: the class booked, date and time, instructor, booking status, waitlist, attendance or no-show, and any note you write to us.
• Payment metadata: amount, currency, payment status, order and transaction identifiers. We do not receive or store the full card number, the CVV/CVC code or other sensitive card authentication data — you enter these directly on the payment gateway page.
• Contact form and opening-interest data: name, email, phone, selected interest and message.
• Job applicant data: name, contact details, experience, specialisations, CV and other data you voluntarily provide.
• Technical and security data: IP address, browser and device type, date and time of access, error and security logs.
• Cookies and analytics identifiers: only to the extent of your consent settings.
• Client questionnaire and informed consent data: first and last name, date of birth, phone number, email, previous Pilates experience and training goals. You complete the questionnaire electronically when making your first online booking; you complete it on paper at the studio if you do not book online or if the client is under 18 years of age.
• Emergency contact: the name and phone number of the person we should contact if a medical incident occurs during a class. You provide this data to us — we therefore ask you to inform the person concerned that you have shared their contact details.
• Health data: circumstances that may affect the safety of exercise — for example spinal or joint problems, a recent injury or surgery, cardiovascular or respiratory conditions, dizziness, pregnancy or the postpartum period, or the use of medication affecting movement. You provide them either in the client questionnaire or by telling the instructor directly. This is a special category of personal data — we process it solely on the basis of your explicit consent under Art. 9(2)(a) GDPR and only to the extent necessary for the safe delivery of the class. Providing it is voluntary, you may withdraw your consent at any time, and it is not a condition of attending a class.

• Booking and provision of the service, processing payment for the booking, operational customer communication (confirmations, changes, cancellations), management of bookings and the waitlist — performance of a contract and pre-contractual steps, Art. 6(1)(b) GDPR.
• Accounting, tax and other legal obligations, including consumer obligations and handling of complaints — compliance with a legal obligation, Art. 6(1)(c) GDPR.
• Security of the website and booking system, prevention of misuse and fraud, records and defence of legal claims — legitimate interest, Art. 6(1)(f) GDPR.
• Sending opening news, news about new class dates, newsletters and marketing communication, and non-essential analytics or marketing cookies — consent, Art. 6(1)(a) GDPR.
• Recruitment and selection — pre-contractual steps under Art. 6(1)(b) GDPR, or legitimate interest in filling the position under Art. 6(1)(f) GDPR; keeping a CV for future opportunities only on the basis of consent, Art. 6(1)(a) GDPR.
• Health information provided for the safe delivery of a class — explicit consent, Art. 9(2)(a) GDPR.
• Safe delivery and adaptation of the class based on the client questionnaire — performance of a contract and pre-contractual steps, Art. 6(1)(b) GDPR; the health section of the questionnaire solely on the basis of explicit consent under Art. 9(2)(a) GDPR.
• Contacting a close person in the event of a medical incident during a class, and keeping the signed declaration to demonstrate that the duty to inform was fulfilled and to defend legal claims — protection of vital interests under Art. 6(1)(d) GDPR, or legitimate interest under Art. 6(1)(f) GDPR, as applicable.
• Keeping client records linked to your email address, checking the validity of the questionnaire with each booking and notifying you before it expires — performance of a contract, Art. 6(1)(b) GDPR, and legitimate interest in safe operation, Art. 6(1)(f) GDPR.

Providing the data required for a booking is a contractual requirement — without it we cannot create the booking or provide the service. Consent is always voluntary and can be withdrawn at any time.

We share personal data only to the extent necessary. Recipients may include the following categories:

• NOON STUDIO instructors to the extent necessary for the safe delivery of your class,
• emergency medical services and summoned medical personnel if a medical incident occurs during a class,
• hosting, database and technical operation providers for the website and booking system,
• email service provider (sending confirmations and notifications),
• accounting, tax and legal advisors to the necessary extent,
• payment service providers and participants in the payment ecosystem (ČSOB, GP webpay / Global Payments Europe, card schemes and the customer's bank) to the extent needed to process the payment and any payment claims,
• analytics provider — only if you have given consent,
• public authorities where we are required by law to provide data.

The role of each recipient differs — some act as processors under a contract pursuant to Art. 28 GDPR, while others (e.g. a bank or public authorities) act as independent controllers.

The client questionnaire is completed electronically when you make your first online booking and is stored in the database of our booking system within the European Economic Area. The health section of the questionnaire is stored separately from other data and is made available to staff only on request; we record every such view. Instructors see health notes only for participants in classes they lead themselves, and only in the period around the class date. If you complete the questionnaire on paper at the studio, we keep it in paper form on the studio premises.

We process data primarily within the European Union / EEA. If a transfer outside the EEA were to occur in a specific case (e.g. with a technical provider), it takes place only where the GDPR conditions are met — based on an adequacy decision, standard contractual clauses or another valid instrument, together with appropriate supplementary safeguards.

• Client questionnaire and informed consent (electronic and paper form): for the duration of the client relationship and then for 3 years from the last class attended, for the establishment and defence of legal claims. If you withdraw your consent to the processing of health data, we will destroy the health section of the questionnaire without undue delay. Once the retention period expires, we shred the questionnaire. Records of staff views of the health section are kept for a period corresponding to the retention period of the questionnaire itself. Single-use links for updating the questionnaire expire no later than 7 days after they are issued.
• Bookings, payment metadata and accounting documents: for the period required by applicable accounting and tax law, and for limitation/complaint periods for the establishment and defence of legal claims.
• Contact and enquiry messages: a maximum of 24 months after the last communication, unless longer retention is required for a legal reason.
• Marketing communication: until consent is withdrawn or the purpose ceases to exist.
• Job applicant data: for the duration of the selection procedure; a CV kept for future opportunities for a maximum of 12 months and only where you have consented.
• Security and technical logs: for a proportionate period necessary to ensure operational security.
• Cookies: according to the lifetime of each cookie and your consent settings.

Once the retention period expires, we delete or anonymise the data.

• You complete the questionnaire once and it is valid for 12 months. With each subsequent booking we only ask you to confirm that your health has not changed.
• Approximately 30 days before it expires, we will send you a reminder with a renewal link. This email contains no data about your health.
• We will never display the content of your questionnaire merely on the basis of an email address being entered. To view and update it, we will send a single-use link to your email; the link is valid for a limited time and can be used once.
• Each time you complete the questionnaire, a new version is created. We keep earlier versions so that it is clear what you declared at the time of a particular class.
• Consent to the processing of health data is voluntary and is not a condition of attending a class. If you do not give it, we do not store the health section at all. If you withdraw it, we will destroy the health section without undue delay — the questionnaire itself and its validity remain unaffected.

• the right of access to your data and to a copy of it,
• the right to rectification of inaccurate data and completion of incomplete data,
• the right to erasure (the “right to be forgotten”) in the cases set out in the GDPR,
• the right to restriction of processing,
• the right to data portability,
• the right to object to processing based on legitimate interest and to direct marketing,
• the right to withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal,
• the right to lodge a complaint with the supervisory authority.

You can exercise your rights at info@noonstudio.sk. We usually respond within one month; in justified cases the period may be extended in accordance with the GDPR.

If you believe that the processing of your data infringes your rights, you may file a motion to commence proceedings on personal data protection.

• Necessary cookies ensure the basic functioning of the website and the booking system; we use them to the extent permitted by law without consent.
• Analytics and marketing cookies are used only after your consent, in accordance with Act No. 452/2021 Coll. on Electronic Communications, as amended, and the GDPR.
• Analytics cookies include Google Analytics; marketing cookies include the Meta Pixel (Meta Platforms Ireland Ltd.), which measures the effectiveness of Facebook and Instagram ads. Both tools load only after the relevant consent is given; if consent is refused or withdrawn, their cookies are deleted.
• You can change or withdraw your consent at any time via the Cookie settings link in the page footer.

We do not carry out automated decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you. The booking system automatically evaluates technical rules only (e.g. class capacity, waitlist order or the cancellation window).

The website and the booking system are not intended for children. They may be used independently only by persons over 16 years of age; younger persons may use the service through their legal guardian.

A person under 18 may also attend a class. In that case the booking is made by their legal guardian, and the client questionnaire — including the informed consent and the consent to the processing of health data — is signed by the legal guardian. We process a minor's data only to the extent necessary for the safe provision of the service.

If we find that we have obtained a minor's data without the necessary legal basis, we delete it without undue delay.

We may update this document, for example when our services, technologies or the law change. The current version is always available on this page. Effective from 16 August 2026.

Related documents: Terms and Conditions · Payment Methods