Privacy policy

This policy explains what personal data we collect about you, why, how long we keep it and what rights you have. It applies to the website floritbucharest.com, to the booking platform the website links to, and to the services provided in the studio.

1. The controller

FLORIT ARTS CAFE SRL Str. Placeholder 1, Bucharest, Romania [PLACEHOLDER: full address] Tax ID (CUI): [PLACEHOLDER] E-mail: [email protected] Phone: +40 700 000 000 [PLACEHOLDER]

For anything to do with your data, write to the address above with the subject line “Personal data”.

2. The principles we work by

we collect only the data we need for a specific purpose, which we explain here;
we do not sell your data and do not pass it to third parties for marketing;
where processing needs consent, we ask for it explicitly beforehand, and you can withdraw it at any time;
we take reasonable technical and organisational measures to protect the data, and require the same of the partners who process it on our behalf;
we respect your right to access, correct, delete or transfer your data.

3. What data we process, why and for how long

3.1 Account and bookings

When you create an account and book a class we process: your first and last name, e-mail address, phone number, date of birth [PLACEHOLDER: if Glofox requires it], booking and attendance history, and the products you have bought.

Basis: performance of the contract between us (Art. 6(1)(b) GDPR). Retention: for the life of the account, plus 3 years from the last activity, while claims could still be brought.

3.2 Payments and invoicing

For payment and invoicing we process: your name, billing address, tax identification details for companies, and the amount and date of payment. Card details are processed exclusively by the booking platform’s payment provider; they never reach us and we do not store them.

Basis: performance of the contract and our legal accounting obligations (Art. 6(1)(b) and (c) GDPR). Retention: accounting records for the period required by current tax legislation, at present 10 years from the end of the financial year.

3.3 Health information

Information about conditions, injuries, pregnancy or physical limitations that you tell us about before a class is special-category data. We use it solely to adapt your participation and for your safety. We do not record it on your account unless you expressly ask us to, so that you do not have to repeat it at every visit.

Basis: your explicit consent (Art. 9(2)(a) GDPR), which you give by telling us and can withdraw at any time. Retention: while you are an active member, or until you withdraw consent.

3.4 The contact form

When you write to us through the form on the website we process: your name, e-mail address, the subject and content of your message, and your IP address (as an anti-spam measure). The message is delivered to us by e-mail.

Basis: our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR). Retention: 12 months after the enquiry is resolved.

3.5 Booking and account communications

We send you, by e-mail or app notification, booking confirmations, class reminders, notices of schedule changes and information about your membership. These are service messages, not marketing.

Basis: performance of the contract (Art. 6(1)(b) GDPR).

[PLACEHOLDER: keep this section only if the client runs a newsletter.] We send you news and offers only if you have subscribed or ticked that option when creating your account. You can unsubscribe at any time from the link in every e-mail or by writing to us.

Basis: your consent (Art. 6(1)(a) GDPR). Retention: until you unsubscribe.

3.7 Photography and filming in the studio

Photographs or video in which you can be identified, taken in the studio for promotional use, are used only with your prior consent, as described in the Terms & conditions.

Basis: your consent (Art. 6(1)(a) GDPR). Retention: until you withdraw consent; the material is then removed from the channels we control.

3.8 Running and securing the website

Our hosting provider automatically records, for every request, the IP address, browser type, page requested and time, in technical logs used for security and troubleshooting.

Basis: our legitimate interest in keeping the website working and secure (Art. 6(1)(f) GDPR). Retention: technical logs are deleted automatically within 30 days.

3.9 Website usage statistics

[PLACEHOLDER: the website currently uses no analytics tool. Complete this section if one is added, and update the Cookie policy.]

We do not sell or rent your data. We share it only with:

our processors, the providers that process data on our behalf so that we can operate (section 5), under contracts that oblige them to protect the data and use it only on our instructions;
public authorities, where the law requires it or where necessary to defend a legal claim;
our accountant and professional advisers, to the extent necessary;
a prospective buyer of the business in the event of a sale, merger or reorganisation, in which case we will inform you.

5. Our processors

Service	Provider	What it processes	Where
Bookings, memberships, payments	Glofox (ABC Fitness Solutions)	account, bookings, payments	EU / USA [PLACEHOLDER: confirm]
Website hosting and protection	Cloudflare, Inc.	technical logs, IP address	EU / USA
Delivery of contact-form messages	Resend, Inc.	form content	USA
Newsletter	[PLACEHOLDER]	name, e-mail	[PLACEHOLDER]

Where a provider processes data outside the European Economic Area, the transfer is made under European Commission adequacy decisions (including the EU–US Data Privacy Framework) or the standard contractual clauses approved by the Commission. You can ask for a copy of the applicable safeguards by writing to us.

6. Cookies

The website uses a minimal number of cookies and similar technologies. Details are in the Cookie policy.

7. Security

Access to your data is limited to the people who need it to do their job. Administrative accounts on the platforms we use are protected by two-step authentication, and data sent through the website and the booking platform is encrypted in transit. If, despite these measures, a security incident affecting your data occurs, we will inform you as the law requires.

8. Your rights

Under the GDPR you have the right:

of access — to learn what data we hold about you and receive a copy;
to rectification — to correct inaccurate or incomplete data;
to erasure — to ask for your data to be deleted, when we no longer have a legal reason to keep it;
to restriction of processing — in certain situations, to ask us to stop using the data but keep it;
to portability — to receive the data you gave us in a structured, commonly used format and transfer it to another controller;
to object — to processing based on legitimate interest, and at any time to direct marketing;
to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal;
not to be subject to an automated decision with legal effects on you. We do not make such decisions.

To exercise your rights, write to [email protected]. We reply within one month; in complex cases this may be extended by two months, in which case we will tell you. To protect your data, we may ask you to confirm your identity before acting on a request.

9. Complaints

If you are unhappy with how we process your data, please write to us first. You always have the right, however, to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, Bucharest, dataprotection.ro, [email protected].

10. Minors

Florit’s services are for people aged 16 and over [PLACEHOLDER: align with the Terms]. We do not knowingly collect data from children under 16. If you become aware that a minor has given us data without a parent’s consent, write to us and we will delete it.

11. Third-party websites

The website links to the Glofox booking platform, Instagram and possibly other sites. This policy does not apply to those sites; we recommend reading their privacy policies.

12. Changes

We may update this policy. The current version, with the date of its last update, is published on this page. We will tell you about significant changes by e-mail or by a notice on the website.