Privacy policy
We care about your privacy. Below we explain what personal data we process, why, and what rights you have, in line with the GDPR (EU Regulation 2016/679).
1. Data controller
The controller of your personal data is Lumi Pilates® (“Lumi Pilates”, “we”). For any matters concerning personal data, you can contact us:
- email: studio@lumipilates.pl
- phone: 788 361 094
- in person at our studios in Marki, Wołomin and Radzymin
2. What data we process and why
- Contacting us (email, phone, social media messages): name, email address, phone number and message content, to answer your question or prepare an offer (Art. 6(1)(b) and (f) GDPR).
- Class bookings, passes and vouchers: data needed to book and settle services, to perform the contract (Art. 6(1)(b) GDPR) and meet tax and accounting obligations (Art. 6(1)(c) GDPR).
- Health information (e.g. pregnancy, injuries) that you provide to us, solely to adapt classes safely, based on your explicit consent (Art. 9(2)(a) GDPR). You may withdraw consent at any time.
- Recruitment and franchise: data from submitted applications, to run recruitment or partnership discussions (Art. 6(1)(b) and (f) GDPR).
- Website statistics: anonymous usage data (Google Analytics), only with your consent (Art. 6(1)(a) GDPR).
3. Fitssey booking system
Class bookings, pass purchases and the Lumi Club app run on the Fitssey system. When you create a Fitssey account, you provide your data directly to that system, which processes it on our behalf. Details are also available in Fitssey’s privacy policy.
4. Cookies and analytics
The website itself does not need cookies to work. With your consent, we use Google Analytics 4 to understand how visitors use the site, e.g. which pages are read most. Without consent, the Google Analytics script is not loaded at all.
We store your choice in your browser (localStorage) so we don’t ask on every visit. You can change your consent at any time by clicking “Cookie settings” in the footer.
The studio pages show an embedded Google map. While it is displayed, Google may set its own cookies under its privacy policy. The class schedule on the “Schedule & prices” page is provided by Fitssey.
5. Recipients of data
Your data may only be shared with providers that help us run our business: our booking system (Fitssey), email and Google services (Google Workspace, Google Analytics), website hosting and our accounting office. We never sell your data.
Some providers (e.g. Google) may process data outside the European Economic Area. This is based on standard contractual clauses approved by the European Commission or other mechanisms provided for in the GDPR.
6. How long we keep data
- correspondence, until the matter is resolved, then for up to 12 months;
- service-related data, for as long as you use our services, and accounting documents for the period required by law (usually 5 years);
- job applications, until recruitment ends, unless you agree to a longer period;
- analytics data, according to Google Analytics settings (up to 14 months).
7. Your rights
You have the right to:
- access your data and receive a copy,
- rectify and complete your data,
- erasure (“the right to be forgotten”),
- restriction of processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time (without affecting earlier processing),
- lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or your local data protection authority.
To exercise your rights, email studio@lumipilates.pl.
8. Social media
We run profiles on Instagram, Facebook and TikTok. Links on this site lead to those services. Once you click, their privacy policies apply.
9. Changes to this policy
We may update this policy, e.g. when our services or the law change. The current version is always available on this page.