Privacy Policy

1. Data controller

This privacy policy describes how SIEL SARL (hereinafter “the Studio”, “we”) collects, uses and protects the personal data of its clients and visitors (hereinafter “you”), in the course of its activities and through the use of its website and booking platform.

The data controller is:

All processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and the Luxembourg law of 1 August 2018 on the protection of individuals with regard to the processing of personal data.

2. Data we collect

We only collect the data necessary for our activities:

• Identification data: surname, first name, date of birth, postal address, email address, telephone number.
• Account data: login credentials, password (encrypted), preferences.
• Booking data: classes booked, attendance history, cancellations, no-shows, waitlist registrations.
• Payment data: the plan purchased and transaction history. Banking details (card, IBAN) are processed directly by our payment provider and are not stored by the Studio.
• Health data: information you provide voluntarily (injuries, pregnancy, contra-indications, medical certificate submitted in support of a medical suspension). See Article 4.
• Image: photographs or videos taken for communication purposes, with your agreement or subject to your right to object.
• Browsing data: IP address, technical and connection data, cookies (see Article 8).

3. Purposes and legal bases

We process your data for the following purposes:

• Management of client accounts, bookings and the contractual relationship — basis: performance of the contract.
• Processing of payments, invoicing and bookkeeping — basis: performance of the contract and compliance with legal obligations.
• Management of cancellations, no-shows and any penalties — basis: performance of the contract and legitimate interest (proper running of the Studio).
• Ensuring the safety of individuals and adapting classes to your physical condition — basis: consent and/or legitimate interest (see Article 4).
• Marketing communications and information about our offers — basis: consent, which may be withdrawn at any time.
• Prevention of fraud and unpaid amounts, and handling of disputes — basis: legitimate interest.
• Production of communication materials (photos, videos) — basis: consent and/or right to object.

4. Health data (sensitive data)

Certain information you provide (injuries, pregnancy, contra-indications, medical certificates) constitutes sensitive data within the meaning of Article 9 GDPR and is subject to enhanced protection:

• It is processed only on the basis of your explicit consent, for the sole purpose of ensuring your safety and adapting your practice, or handling a medical suspension request.
• Providing it is optional; however, the absence of such information may prevent us from ensuring the safety of your practice or granting certain requests.
• Access to this data is strictly limited to authorised persons (relevant instructors, administrative staff).
• Medical certificates are kept only for as long as necessary to process the request, then deleted.
• You may withdraw your consent at any time.

5. Recipients and processors

Your data is neither sold nor rented. It may be shared with:

• our booking and payment platform (Bsport);
• our payment service providers;
• where applicable, our technical providers (hosting, emailing tools) and advisers (accountant, lawyer);
• administrative or judicial authorities where required by law.

These providers act as processors and are bound by confidentiality and security commitments compliant with the GDPR.

6. Transfers outside the European Union

Your data is in principle hosted and processed within the European Union. Should a transfer to a third country occur (for example via a technical provider), it would be framed by appropriate safeguards (adequacy decision or the European Commission’s standard contractual clauses).

7. Retention periods

We keep your data for no longer than is necessary for the purposes pursued:

• Account and booking data: for the duration of the contractual relationship, then three (3) years after your last activity.
• Accounting and invoicing data: ten (10) years, in accordance with Luxembourg legal obligations.
• Health data: for as long as necessary for the purpose (safety, medical suspension), then deleted or anonymised.
• Marketing data: until you withdraw your consent, and at most three (3) years after the last contact.
• Cookies: for the durations indicated in Article 8.

8. Cookies

The Studio’s website may use cookies:

• cookies strictly necessary for the site to function, which do not require consent;
• audience-measurement and, where applicable, personalisation cookies, subject to your prior consent.

You can set or refuse cookies at any time via the dedicated banner or your browser settings.

9. Security

The Studio implements appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure (restricted access, passwords, secure providers). In the event of a data breach likely to result in a high risk to your rights, you will be informed in accordance with the applicable regulation.

10. Your rights

In accordance with the GDPR, you have the following rights:

• right of access to your data;
• right to rectification;
• right to erasure (“right to be forgotten”);
• right to restriction of processing;
• right to object, in particular to marketing;
• right to data portability;
• right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise these rights, contact us at contact@sielstudio.lu, enclosing proof of identity where necessary. We respond within one (1) month.

11. Complaints

If you consider that the processing of your data does not comply with the regulation, you have the right to lodge a complaint with the Luxembourg supervisory authority:

12. Minors

Access to the Studio’s services is reserved for persons meeting the age conditions set out in the Terms & Conditions. Data relating to an authorised minor is processed only with the consent of their legal representative.

13. Changes

The Studio may amend this policy to reflect legal developments or changes in its practices. The applicable version is the one in force on the date you consult it. In the event of a substantial change, you will be informed by appropriate means.

14. Contact

For any question regarding this policy or the processing of your personal data: SIEL SARL — 4 rue Leonardo da Vinci, L-2681 Luxembourg — contact@sielstudio.lu.