Legal

Privacy Policy

Information on the processing of your personal data according to Art. 13 GDPR.

1. Controller within the meaning of GDPR

The controller responsible for data processing on this website is:

Halime Aydin-Darbas
BSR Pilates
Pfützenstrasse 91, 64347 Griesheim
Email: info@bsrpilates.com
Phone / WhatsApp: +49 151 52100102

2. Data protection officer

Information under Art. 13 (1) lit. b GDPR: We are not legally required to appoint a data protection officer; for all data protection matters you can reach us at the contact details above.

3. Hosting, access data & server log files

This website is hosted via the infrastructure of Vercel Inc., 340 S Lemon Ave PMB 4133, Walnut, CA 91789, USA. Vercel acts as a processor for us pursuant to Art. 28 GDPR. When you visit the website, Vercel automatically collects information transmitted by your browser. This includes in particular:

  • IP address
  • Date and time of access
  • Page or file requested
  • Volume of data transferred
  • Referrer URL
  • Browser, operating system & language

The legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the stable, secure and uninterrupted operation of the website. Data transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR) and the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

Retention period: We use Vercel on the Hobby plan; server log files are stored there for 1 hour and then automatically deleted. This period may change if the plan is upgraded.

The fonts used on this website are served locally from our own server. No connection to Google servers is established when the fonts are loaded.

Vercel privacy policy: vercel.com/legal/privacy-policy

4. Cookies & storage on your device

Storing information on your device and accessing information already stored is only permitted if it is strictly necessary (§ 25 (2) no. 2 TDDDG) or if you have given prior consent (§ 25 (1) TDDDG). Without your consent we only set the following strictly necessary entries:

  • bsr-consent-v1 (localStorage) — stores your cookie decision with timestamp, language and the categories offered, so that we do not ask you again on every visit and your refusal is respected. No browser expiry date; the entry remains stored until you delete it via your browser settings or until we change the consent version. Legal basis: § 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) lit. c GDPR (obligation to demonstrate consent under Art. 7 (1) GDPR).
  • NEXT_LOCALE (cookie) — stores your language selection (German or English). Lifetime: 12 months, SameSite=Lax. Legal basis: § 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) lit. f GDPR.
  • bsr-intro-played (sessionStorage) — remembers that the short logo animation has already been shown on your first page view. Contains no personal content and is deleted automatically when you close the browser tab. Legal basis: § 25 (2) no. 2 TDDDG.

All further services — Google Analytics, the Meta Pixel, the Instagram feed and Google Maps — are only loaded after you have actively consented in the cookie banner. Before your consent, no script is loaded and no connection to their servers is established for these services. Once you have consented, these providers may set their own cookies and similar technologies, according to the providers including:

  • Google Analytics: _ga and _ga_<property ID>, lifetime according to Google up to 24 months.
  • Meta Pixel: _fbp, lifetime according to Meta up to 90 days.
  • Google Maps and the Instagram feed may set further cookies and local storage entries of the respective providers when loaded.

You can withdraw your consent at any time and with the same effort as you gave it: via the "Cookie settings" link in the footer of every page. Withdrawal applies to the future; the lawfulness of processing carried out until then remains unaffected. You can also delete cookies that have been set at any time in your browser settings.

5. Google Analytics 4

If you have consented, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and similar technologies to analyse the use of the website — for example which pages are viewed, how long visitors stay and which source they came from. The information generated is generally transferred to a Google server in the USA and stored there. The IP address is truncated before storage (IP anonymisation).

The purpose is statistical evaluation and improvement of our offering. The legal basis is exclusively your consent under Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR) and the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). Google processes the data as a processor on our behalf; the retention period for analytics data is 14 months. You can withdraw your consent at any time with effect for the future via the cookie settings in the footer. You can also install the Google Analytics browser opt-out add-on: tools.google.com/dlpage/gaoptout.

Further information: policies.google.com/privacy

6. Meta Pixel (Facebook Pixel)

If you have consented, this website uses the Meta Pixel of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Meta"). The Meta Pixel is not a purely statistical tool but a marketing instrument: it records your behaviour on this website (e.g. pages viewed) and transmits this information together with your IP address and device information to Meta. Meta can link this data to your user account, process it further for its own purposes and use it to show you advertising on Facebook and Instagram and to measure the success of our ads (reach measurement, audience building, retargeting). Servers of Meta Platforms Inc. in the USA are also contacted in this process.

The legal basis is exclusively your consent under Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. The pixel is only loaded after you have actively agreed in the cookie banner; without your agreement no transmission to Meta takes place. Legitimate interest is not an admissible legal basis for this tool. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR) and the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). We have no influence on the retention period of the data stored at Meta; it is governed by Meta policies. You can withdraw your consent at any time via the cookie settings in the footer.

Meta privacy policy: facebook.com/privacy/policy

7. Joint controllership with Meta (Art. 26 GDPR)

We are jointly responsible with Meta Platforms Ireland Ltd. for the collection of your data by the Meta Pixel and by embedded Instagram content and for its transmission to Meta (Art. 26 GDPR). We have concluded the corresponding joint controller arrangement with Meta ("Controller Addendum" or "Page Insights Controller Addendum").

The allocation is as follows: we are responsible for informing you about the processing and for obtaining your consent before the pixel or an Instagram embed is loaded. Meta alone is responsible for the subsequent processing of your data in its own systems — in particular linking it to your Meta account, profiling and delivering advertising. You can exercise your data subject rights (Art. 15 to 22 GDPR) both against us and directly against Meta; only Meta can provide information about the data stored at Meta. We forward such requests to Meta.

Essential content of the arrangement: facebook.com/legal/controller_addendum

8. Instagram feed on the home page (Behold)

On the home page we show our current Instagram posts. Technically this feed is not delivered directly by Instagram but via the service Behold. If you agree to it being loaded, a script is loaded from w.behold.so and your IP address as well as browser and device information are transmitted to Behold (servers at feeds.behold.so). The images displayed are then loaded from servers of Behold and of Meta (cdninstagram.com), which also transmits your IP address to these providers.

Provider of the feed service: Nonesuch Studios Inc. (doing business as "Behold"), based in the USA. The transfer of your data to the USA (and in part to Canada) is based on the EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR).

The feed is loaded only after your consent via the cookie banner (category "Third-party content"). Until then you only see a placeholder at this position and no connection to Behold or Meta takes place. Legal basis: Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. As the content originates from Instagram, the joint controllership with Meta described above also applies. You can withdraw your consent at any time via the cookie settings in the footer.

Privacy information: behold.so/privacy · privacycenter.instagram.com/policy

9. Google Maps

On the contact page we embed a Google Maps map to show our studio location. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the map loads, data (incl. IP address, browser and device information, location data if applicable) is transmitted to Google, and Google may set cookies.

The map is loaded only after your consent via the cookie banner (category "Third-party content"); until then you only see a placeholder. Legal basis: Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR) and the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). You can also find our address in text form without consent on the contact page and in the imprint.

Google privacy policy: policies.google.com/privacy

10. Display of Google reviews

On the home page we display reviews from our Google business profile. We retrieve these server-side via the Google Places API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and reproduce them on our website. What is published is the display name chosen by the author on Google, the star rating, the review text, the relative publication date and a link to the public Google profile of the person.

The retrieval is carried out by our server, not by your browser: simply viewing the reviews does not transmit any of your data to Google. The legal basis for reproducing the reviews is Art. 6 (1) lit. f GDPR; our legitimate interest lies in presenting publicly available customer feedback about our studio. The retrieved data is cached on our side for 24 hours and then retrieved again. If you have written a review and do not agree with it being reproduced on this website, an informal message to us is sufficient — we will then remove it from this website (right to object under Art. 21 (1) GDPR). You can delete the review itself at any time directly in your Google account.

11. Contact form & email

Via our contact form we collect exclusively: your name, your email address, the subject you select (general enquiry, class information, prices & packages, personal training or other) and the text of your message. We do not ask for any further details — in particular not for a telephone number. In addition, the form contains a field invisible to you for spam protection which only automated programs fill in; it does not collect any personal data about you.

The path your message takes: the form is transmitted to our own server and sent from there as an email via the delivery service Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) to our mailbox info@bsrpilates.com. Our email mailbox is operated by Hostinger International Ltd., Lithuania (EU). Both providers therefore receive the full content of your enquiry and act as processors for us pursuant to Art. 28 GDPR.

Third-country reference: Resend is established in the USA; the transfer is based on the EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR). Your message is stored in our mailbox at Hostinger within the EU; no third-country transfer is required for this. Data processing agreements under Art. 28 GDPR are in place with both providers.

The purpose is exclusively to process and answer your enquiry. The legal basis is Art. 6 (1) lit. b GDPR insofar as your enquiry is aimed at concluding or performing a contract (e.g. a class enquiry), otherwise Art. 6 (1) lit. f GDPR (legitimate interest in answering enquiries). Providing the data is neither legally nor contractually required; without your name, email address and message, however, we cannot answer your enquiry.

If you write to us directly by email instead, we process the data you provide for the same purposes and on the same legal bases. For the retention period see section 18.

12. Health-related information (Art. 9 GDPR)

Among other things, we offer Reformer Pilates for pregnant women and postnatal recovery. Information about a pregnancy, injuries, complaints or medical restrictions constitutes health data and therefore special categories of personal data under Art. 9 (1) GDPR, which are subject to particular protection.

We expressly do not ask for such information in the contact form. Please do not write health data into the free message field. We do not need it in order to answer a request about an appointment or about prices. If you would like to discuss health-related points, please only tell us that you would like to talk about it — we will clarify the details in person at the studio or by telephone.

If you nevertheless provide us with health data on your own initiative, we process it exclusively in order to answer your enquiry and to make your participation in a class safe for you. The legal basis is then Art. 9 (2) lit. a GDPR (explicit consent, given by the voluntary disclosure for this purpose) in conjunction with Art. 6 (1) lit. a and lit. b GDPR. This information is viewed only by the studio owner, is not passed on to third parties and is deleted as soon as the reason for it no longer applies. You can withdraw your consent at any time and request erasure; a message to info@bsrpilates.com is sufficient.

Health-related information that you provide in the course of a booking to our booking system or in the class itself is processed by us on the same basis. It is not used for advertising and is not transmitted to Meta or Google.

13. Communication via WhatsApp

WhatsApp is not a mere link for us but a regular communication channel: on every page you will find a button at the bottom right that lets you write to us directly at +49 151 52100102. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, a company of the Meta group.

The button is a simple link — a connection to WhatsApp is only established once you click it. If you write to us, we process your mobile number, your WhatsApp profile name, any profile picture and the content and times of your messages in order to answer your enquiry. The legal basis is Art. 6 (1) lit. b GDPR (pre-contractual measures and performance of a contract) or Art. 6 (1) lit. f GDPR (legitimate interest in answering your enquiry). Message content is end-to-end encrypted; metadata (incl. phone numbers, timestamps, device data), however, is processed by WhatsApp on its own responsibility and transferred to Meta Platforms Inc. in the USA. We have no influence on this processing.

Please do not send us any health data via WhatsApp (see section 12). If you prefer not to use this channel, you can reach us equally well by email or via the contact form. We delete chat histories as soon as the reason for them no longer applies; for retention periods see section 18.

For the studio number we use the WhatsApp Business app provided by WhatsApp Ireland Limited. No additional cloud or API provider is used in between.

WhatsApp privacy policy: whatsapp.com/legal/privacy-policy-eea

14. Class booking via bsport

Classes, trial sessions, packages and academy places are not booked on this website. The booking buttons on our pages are external links: they open the booking platform bsport (bsport SAS, 11 rue Saint-Florentin, 75008 Paris, France) in a new tab. No booking widget and no bsport script is embedded on this website — as long as you do not click one of these links, no data is transmitted to bsport.

As soon as you follow the link, the privacy information of bsport applies to the booking process. Data processed there includes in particular name, email address, telephone number, booked classes and payment data. We process booking data of our customers as controller for the performance of the contract under Art. 6 (1) lit. b GDPR; bsport acts as a processor for us pursuant to Art. 28 GDPR. Payment is handled by the payment service providers used by bsport; we never receive full card details. Commercial and tax retention periods apply to booking data (see section 18). [BESTÄTIGEN: Has a data processing agreement under Art. 28 GDPR been concluded and documented with bsport? Please check the server location and any sub-processors outside the EU.]

bsport privacy policy: bsport.io/privacy-policy

15. Links to social networks

On our website we link to our Instagram profile (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland). These are simple links without a social media plugin: data is only transmitted to the provider when you click the link. We have no influence on which data is collected there or how it is processed. Section 8 applies to the Instagram feed embedded on the home page, section 13 applies to WhatsApp.

Instagram privacy policy: privacycenter.instagram.com/policy

16. Are you obliged to provide data?

Information under Art. 13 (2) lit. e GDPR: you are not legally obliged to provide us with personal data. Using the website only requires the technically unavoidable processing of access data (section 3). For a contact enquiry we need your name, email address, subject and message — without this information we cannot reply to you. For a class booking, the contract and payment data requested there is necessary; without it no contract can be concluded. Consent to the statistics, marketing and third-party content categories is entirely voluntary in all three cases: if you refuse it, you can continue to use the website with all its content and functions. Refusing statistics or marketing puts you at no disadvantage whatsoever — these categories serve solely to measure reach and to evaluate our advertising. Only without consent to third-party content do the embedded map and the Instagram feed remain hidden, replaced by a placeholder with our address or a link.

17. No automated decision-making

Information under Art. 13 (2) lit. f GDPR: we do not take any decisions producing legal effects concerning you or similarly significantly affecting you based solely on automated processing, including profiling (Art. 22 GDPR). We do not use any AI-based evaluation of your data. If you have consented to the Meta Pixel, Meta may use the data collected there for its own profiling for advertising purposes (sections 6 and 7); this does not involve an automated decision within the meaning of Art. 22 GDPR.

18. Retention periods at a glance

We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention obligations exist (Art. 5 (1) lit. e GDPR):

  • Server log files: see section 3 — 1 hour (Vercel Hobby plan).
  • Contact enquiries (form and email): deletion as soon as the enquiry has been finally dealt with and no follow-up questions are to be expected, at the latest 6 months after the last contact. If the enquiry leads to a contract, the commercial and tax retention periods apply.
  • Delivery logs at the email service provider Resend: 30 days (Resend’s standard retention period).
  • WhatsApp chat histories: deletion as soon as the reason for them no longer applies, following the same periods as contact enquiries.
  • Health-related information (section 12): deletion immediately after the reason for it no longer applies, at the latest when participation in the class ends, and in no case longer than necessary for safe delivery of the class.
  • Contract, booking and invoice data: 6 years for commercial letters (§ 257 (4) HGB) and 10 years for accounting records and invoices (§ 147 (3) AO), calculated from the end of the respective calendar year.
  • Consent record (bsr-consent-v1): remains stored in your browser until you delete it or we change the consent version; see section 4.
  • Language cookie NEXT_LOCALE: 12 months. Intro flag bsr-intro-played: until the end of the browser session.
  • Google reviews: cached on our server for 24 hours; the review itself is stored by Google.
  • Data at Google, Meta and Behold after consent has been given: the retention period is governed by the policies of the respective providers; we have no influence on it. For Google Analytics, the retention period configured in our property applies (see section 5).

19. Your rights

You have the right at any time to:

  • Information about the data stored about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability in a commonly used format (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
  • Lodging a complaint with a supervisory authority (Art. 77 GDPR, see section 20)

An informal message to the following address, which we check regularly, is sufficient; we will respond within the statutory period of one month (Art. 12 (3) GDPR): info@bsrpilates.com

Note on the right to object under Art. 21 (1) GDPR: you may object to processing that we base on Art. 6 (1) lit. f GDPR on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests.

20. Right to lodge a complaint with the supervisory authority

Without prejudice to other remedies, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority about the processing of your personal data — in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority competent for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163, 65021 Wiesbaden
datenschutz.hessen.de

21. Status & changes

This privacy policy is dated 7 August 2026. Due to further development of the website or amended legal requirements, it may become necessary to revise it. The current version can always be found on this page.

WhatsAppPrivacy Policy – BSR Pilates